Treatment of constant contract functions in Solidity (privacy and access to msg.sender)

Question

I have a simple contract:

pragma solidity 0.4.8;

contract SimpleContractTest {
    event ReturnValue(address _from, uint256 _value);
    function SimpleContractTest()
    payable
    {

    }
    function myBalanceConstant() constant returns (uint256 amount)
    {
      return msg.sender.balance;
    }
    function contractBalanceConstant() constant returns (uint256 amount)
    {
      return this.balance;
    }
    function myBalancePublic() public returns (uint256 amount)
    {
      ReturnValue(msg.sender, msg.sender.balance);
      return msg.sender.balance;
    }
    function contractBalancePublic() public returns (uint256 amount)
    {
      ReturnValue(msg.sender, msg.sender.balance);
      return this.balance;
    }
}

The public functions work fine and return contract / calling account balances as expected. However the constant functions only work for the contract balance.

Specifically the function myBalanceConstant() always returns:

115792089237316195423570985008687907853269984665640564039455084007913129639935

Looking at the documentation on contracts at: http://solidity.readthedocs.io/en/develop/contracts.html#constant-state-variables it states that for constant state variables execution data (e.g. msg.gas) is not allowed to be used. However there doesn't seem to be any such information around the use of execution data for constant functions as in the example above.

Q1

Any ideas as to why the above doesn't work, and what the rules are governing constant functions (my example doesn't change state which seems to be the only stated rule) would be very much appreciated for my understanding!

Q2

On a related note, is it reasonable to rely on calls to constant functions not being exposed publicly (i.e. the arguments to the call and the return values)? This seems reasonable to me assuming the user is running a local node (as the constant function call will be just executed locally) although presumably if there isn't a local node (e.g. if using MetaMask) then the values will be exposed at least as far as the MetaMask nodes, even if not the full blockchain?

Thanks very much for any advice, hints etc. - I am just starting out as a Dapp developer!

Answer 1

The issue here is with the method with which you are calling the constant functions. You still need to pass in a transaction object with a from address if you want the call to have access to that value.

Essentially, when you call a constant function using .call, the call is simulated locally. If you don't provide a transaction object, default values (address 0, maximum gas, 0 value, etc,) are used,

It is reasonable to expect that no transaction will be broadcast to the blockchain, as long as you explicitly use .call, but since the RPC connection likely isn't encrypted you probably shouldn't be sending sensitive data over it anyways.