Unlocked Account can obtain return values from a call function. Basically I assign eth.defaultAccount with some valid address, which only have access to the some state variables as you can see under getIndexReadFrom() as clusterContract[msg.sender].getIndexReadFrom().

[Q] Is it normal that even I didn't unlocked the account, I can use that account as msg.sender when I call a contract's function and reach that account's mapped information? Is there any lock mechanism that can I prevent this from happening, where only who can unlocks the account could reach the mapped information?

> eth.defaultAccount = "0x6af0204187a93710317542d383a1b547fa42e706"
> eth.defaultAccount
> myContract.getIndexReadFrom()
10 //Returns a valid information.

Example function:

   function getIndexReadFrom() constant returns ( uint ) {
    return clusterContract[msg.sender].getIndexReadFrom();

2 Answers 2


They're two separate issues.

Q1: Yes. Since your function is marked constant, there will be no gas cost and therefore no need for the user's account to be unlocked. They will use their own copy of the blockchain and their own computing resources to find their own results.

Q2: Yes. This isn't related to account unlocking. Contract access control is enforced by contracts. For example, the function can check if the msg.sender is a member of a list of address that are permitted to use the function. This is independent of unlocking accounts, as it doesn't rely on anything the user does/doesn't do to make the determination.

Below is a very contrived example in which the deployer is at first the only "authorized" user and only authorized users can permit/revoke access to functions by other users.

I should point out that the "free" getter for the authorized[] mapping is not protected. Read-only functions are generally left open since efforts to conceal data stored on the blockchain will not prevent determined adversaries from acquiring the information.

pragma solidity ^0.4.6;

contract ACL {

    mapping (address => bool) public authorized;

    modifier onlyIfAuthorized {
        if(!authorized[msg.sender]) throw;

    function ACL() {
        authorized[msg.sender] = true; // authorize the deployer

    function authorizeAddress(address newUser)
        returns(bool success)
        authorized[newUser] = true;
        return true;

    function revokeAccess(address removeUser)
        returns(bool success)
        authorized[removeUser] = false;


Hope it helps.

  • Sorry I didn't get how you combine authorizedUser and call function. So only authorised users could call the constant function? @Rob Hitchens
    – alper
    May 11, 2017 at 4:36
  • 1
    onlyIfAuthorized modifier attached to functions ensures they throw if the msg.sender isn't on the ACL. You can also protect a constant function this way, meaning you could remove public from the mapping and instead reveal that information through an onlyIfAuthorized function and that would make it much more challenging to get at the information. The warning is that even by doing so, the "sensitive" information is not safe from a determined adversary. For this reason, it's suggested to design on the basis that read-only functions are not protected. May 11, 2017 at 5:53

All information stored on the Blockchain is public. If you are only reading data (using constant functions or .call()) and not modifying the state of the Blockchain, you don't need to send/request any information from other nodes. You can just read the information from your local node, as it is already being synced with the rest of the network.

So answering your question: All the data stored in that mapping is stored in all nodes and anyone can access it. You cannot prevent them from reading it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.