3

Say for example you have this simple contract:

contract Example {
   function sayHello() constant returns (string msg) {
      return "hello";
}

And I make a message call:

exampleContract.sayHello.call();

Since it's a constant (read only) message call, according to the docs, a from address is optional. Since a from is not required, does this mean anyone can call the function - no signature validation is performed?

|improve this question
4

You're correct, anyone can call the function and no signature validation is performed.

They are performed locally without broadcasting to any other nodes. These constant message calls also don't appear to be in the core protocol itself and not mentioned in the Yellow Paper. Happy to correct this part if needed and a further example is pyethereum doesn't implement eth_call.

|improve this answer
  • This seems to be something that at least should be emphasized more in the docs. For example, if the return value is actually something in contract state, the contract author could be unknowingly exposing information to unintended readers under the assumption that Ethereum is magically verifying the sender. – dbryson Feb 28 '16 at 5:48
  • 1
    Yes, it could be emphasized more. At a simpler level though, everything on the blockchain, which includes contract state, can be accessed by the public (some may take more effort, reverse engineering, parsing blockchain data/db files but it's all public) and exposed. – eth♦ Feb 28 '16 at 6:18
  • 2
    Note, it's not actually that hard to access contract state. eth.getStorage() can retrieve all storage variables, not just public ones. There is NO private data on the blockchain – Tjaden Hess♦ Feb 28 '16 at 7:20
  • There is no private data, but position indexes need to provided when using eth.getStorageAt and isn't straightforward when the indexes are scattered instead of next to each other. – eth♦ May 27 '16 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.