User Whitelisting on Smart Contract

Question

Say I have this smart contract that can be invoked only by a set of known users (a finite list of addresses).

The obvious method to implement this logic is simply by keeping track of these addresses in a List and validate the addresses whenever a function is invoked, though there are a few restrictions I need to consider:

• I cannot expose these addresses on the contract. So no address_list can be stored on the contract.
• I don't have a limit on the number of users I can whitelist. There could be a few million users whitelisted in this contract.

I cannot find a good solution for this problem which I think should be pretty common. I was thinking about doing a Token-based validation but not sure if this is doable in smart contracts. Any solution for this use-case?

Answer 1

Previous user's answer isn't really workable with a possible user list in the millions--you'd be spending billions of gas to add all the users, which is obviously too much. What you want is a Merkle tree, which can add any amount of users almost for free. This is a pretty good example and should provide exactly what you want.

Answer 2

Your two concerns can be resolved using a private field and a public set method.

contract MyToken is Ownable {
    mapping(address -> bool) whiteListUsers; // this is private
    modifier onlyWhiteListed() {
        require(whiteListUsers[msg.sender], "Only whitelist allowed");
        _;
    }

    function addToWhiteList(address[] users) public onlyOwner {
        for (int i = 0; i < users.length; i++) {
            whiteListUsers[users[i]] = true;
        }
    }

    function doSomething() public onlyWhiteListed() {
         // your logic
    }
    
}