I am making a DApp where users need to be registered in the Solidity smart contract to perform some actions, for example:

function publish (string memory _itemURI) userOnly public {
    // Publish item

Where the userOnly modifier is as follows

modifier userOnly {
    require(users[msg.sender] == true, "User only");

Registration is done with this function:

function register(address newUser) public {
    users[newUser] = true;
    emit Register(newUser);

The problem is: anyone could call the register function to register there own address, and then be able to call the userOnly functions. Is there a way the register function could only be called only at the end of our DApp sign-up process, like only after the user signs our terms of service with Metamask?

1 Answer 1


your dapp needs to control a wallet that registers users(hard). registration needs a "dappOnly" modifier or you need to add a comment on the source code that discloses the TOS(easier).

  • Alright, but if I wanted the dApp's address to call the register function, then I'd have to store the private key somewhere. Even if it's in the env vars of Fleek, it's still a security risk. So is there a way that the user calls the register function, but can only do so from the dApp? Mar 14, 2022 at 17:41
  • No not really, that's why I say it's safest to just put your TOS into the comments of your code. It shouldn't contribute to the contact's bytecode length at all. Legal contract inside a smart contract!
    – ctnava
    Mar 14, 2022 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.