Say I have this smart contract that can be invoked only by a set of known users (a finite list of addresses).

The obvious method to implement this logic is simply by keeping track of these addresses in a List and validate the addresses whenever a function is invoked, though there are a few restrictions I need to consider:

  • I cannot expose these addresses on the contract. So no address_list can be stored on the contract.
  • I don't have a limit on the number of users I can whitelist. There could be a few million users whitelisted in this contract.

I cannot find a good solution for this problem which I think should be pretty common. I was thinking about doing a Token-based validation but not sure if this is doable in smart contracts. Any solution for this use-case?


2 Answers 2


Previous user's answer isn't really workable with a possible user list in the millions--you'd be spending billions of gas to add all the users, which is obviously too much. What you want is a Merkle tree, which can add any amount of users almost for free. This is a pretty good example and should provide exactly what you want.

  • You're right, probably Merkle tree is a good solution in case of millions users. But it's come along with the difficulty of implementation, while there's a small set of users, than it's worth to go with a simple way.
    – PySoL
    Commented Feb 22, 2022 at 14:34
  • Yeah it's much more difficult than a list of users for sure.
    – Meriadoc
    Commented Feb 22, 2022 at 20:11

Your two concerns can be resolved using a private field and a public set method.

contract MyToken is Ownable {
    mapping(address -> bool) whiteListUsers; // this is private
    modifier onlyWhiteListed() {
        require(whiteListUsers[msg.sender], "Only whitelist allowed");

    function addToWhiteList(address[] users) public onlyOwner {
        for (int i = 0; i < users.length; i++) {
            whiteListUsers[users[i]] = true;

    function doSomething() public onlyWhiteListed() {
         // your logic

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.