1

The approach I'm currently using in my DApp is mapping Ethereum addresses to a solidity struct which contains all of that specific user's data. But since the address is publicly available can't someone just use that user's address and by manipulating their keystore file or some other way send messages to the contract with other user's Ethereum address? If yes, then what can be done to prevent this and what other login/authentication methods are there? If no then I guess I have some wrong ideas about how contracts are signed(?), so please direct me where I can find out more in depth information about this.

1 Answer 1

1

But since the address is publicly available can't someone just use that user's address and by manipulating their keystore file or some other way send messages to the contract with other user's Ethereum address?

Transactions sent to the blockchain don't explicity contain a sender address - the address is worked out from the transaction's signature.

The only way to sign the transaction is using the sender's private key. So even though the msg.sender address can be publicly determined, no one else can sign their transactions.

...and by manipulating their keystore file

If someone has access to msg.sender's account, then they have complete control. It's up to the user to ensure their account is secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.