How to limit function access to certain frontend?

Question

I've a function in my smartcontract, that pays out ETH to the sender. However it sgould be only callable from registered users on my website, regardless of their ETH-address.

I already tried to send a secret string as parameter, hash it and compare that to an array of hashes. But the problem is that an array of 1000 hashes is very expensive/impossible. So I wonder if there's a better way to do that? Would it maybe possible to generate unique secrets for each transaction, which all fit to ONE single "key" in the contract?

At the moment it's:

bytes32[] public hashedSubmitSecrets;


function requestMoney(string _submitSecret) {
   require (hashedSubmitSecrets[i] == keccak256(_submitSecret));
}


function addSubmitSecrets (bytes32[] _arrayOfHashedSecrets) onlyOwner {
      for (uint i = 0; i < _arrayOfHashedSecrets.length; i++) {
            hashedSubmitSecrets.push(_arrayOfHashedSecrets[i]);
        }
    }

Answer 1

This does not seem too hard to achieve off chain.

You, and only you know the function signature of the withdrawal method in the deployed contract. As such, assuming you do not 'verify' the contract on a blockchain explorer, only you can sign a transaction to call that function.

There is nothing more to it..

Only sign a transaction for a user if they meet your authentication requirements, and implement the necessary server security so no bad actors can determine the function signature.

Answer 2

There is no secrecy in Ethereum, hashing will not help you here. The only thing that comes to my mind here is

1. allow registered users to send HTTP requests to a nodejs server
2. this (and only this) server has access to a node with an unlocked account, whose address
3. corresponds to the address you give permission in your smart contract to do withdrawals.