2

I was making a smart contract which involves people to buy tokens in exchange of ether they send. It works fine in testrpc as all accounts are unlocked, but how do I do it for actual accounts in main network using web3 in nodejs. What fields would be required to invoke these payable functionalities of smartcontract except the wallet address ofcourse? Any code snippets or examples? Any help would be appreciated. Thanks.

Improve this question

2 Answers 2

Reset to default
3

A few points to help you separate issues and clarify thinking.

A contract cannot do anything that a normal user can't do. For example, there's nothing you can program to make a contract spend someone else's money.

All action on the blockchain starts with an "Externally Owned Account" "signing" and transaction. Contracts can talk to each other, but they never do anything until someone sends a signed transaction, so those "messages" are in another category ("messages").

Signing is done by wallets using secret keys. Without the secret, signing is not possible. But anyone who acquires the secret (somehow) can sign on behalf of another address.

When you're using TestRPC, "the" user has 10 different addresses. They are his addresses, not strangers. He's got the secret keys. TestRPC simply makes it convenient to unlock the accounts and spend as you go. You would not be able to make up an 11th address and spend from it without the corresponding secret.

In the case of a website, there are two (general) solutions.

  1. The website can create the accounts and (safely!) keep the secret keys. That would be like opening the accounts "on behalf of" the users. Consider how Exchanges operate.
  2. The browser can rely on the users' local Ethereum or MetaMask so it is (in fact) the user and not the web server that signs transactions and sends them to the chain. Consider the Mist Wallet contract.

Hope it helps.

Improve this answer
6
  • thanks that explains a lot! I was wondering if it was the best way to use ethereum payment gateways for ether transfer to the contract and then making the contract "send" or "transfer" ether to the intended account account?? There wont be any signing required if the smart contract transfers ether right? If so what payment gateways do you suggest? Also if the front-end invokes the transaction of ether is meta mask the only way to verify transaction or other wallets might alsos be able to launch the web3 instance to verify or sign transaction??
    – Shubhabrata Mukherjee
    Jul 5, 2017 at 20:34
  • correction-there wont be any signing required if the contract transfers ether from within itself using transfer method??
    – Shubhabrata Mukherjee
    Jul 5, 2017 at 21:05
  • A common pattern is to make a payable function and then record the user address that sent funds. It's self-evident who has the funds on deposit or who paid. In the case of an exchange, then the exchange "signs" the transaction. You can see how some ICO warn against using exchange accounts to send funds, because only the sender will be allowed to withdraw. Maybe the UI for the exchange isn't capable ... so that can lead to issues.
    – Rob Hitchens
    Jul 5, 2017 at 23:29
  • The contract can't transfer within itself until someone sends it an instruction to do so. The beginning of the chain is always a signed transaction. A signed transaction can invoke a chain of contracts calling contracts. Each one can see the previous contract (who called me?) and use that as an authenticated user.
    – Rob Hitchens
    Jul 5, 2017 at 23:30
  • My requirement is for the transfer of ether from multiple accounts to smart contract and I'm building API for all smart contract management which can be integrated with a frontend separately. Now users won't give their private keys to sign the transactions, and if the payment is done from front integrated web3 then only the wallets which can start an instance on browser can sign them, these wallets are limited(corect me if I'm wrong).
    – Shubhabrata Mukherjee
    Jul 6, 2017 at 5:18
2

You need to sign the transactions on the browser. You can do this manually, or use a provider which does this automatically for you.

https://github.com/trufflesuite/truffle-hdwallet-provider

Improve this answer
2
  • Can you explain the signing process in a bit detail?? How will 'n' users connect to my application and make their account unlocked for my transactions?? how will they send ether?
    – Shubhabrata Mukherjee
    Jul 5, 2017 at 11:24
  • Your users would need to input the private key (or mnemonic) of the wal;let that they want to use into the application so that it can sign transactions for them. Alternatively they can use an extension such as MetaMask, this will inject a web3 instance in the page with a provider that does a similar thing.
    – Olmo Ziarko
    Jul 5, 2017 at 13:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.