Sorry if this sounds like a beginner question but after reading through a lot of material I have some questions.

Firstly, if a contract has already been created can I call its functions if I know its ABI & address? I think contract(ABI).at(contractAddress) does this but I found the description rather ambiguous.

Secondly, if I am running web3 by direct library import without MetaMask or Mist when I initiate a function call who is the msg.sender? If MetaMask or Mist are running is the msg.sender the currently signed in wallet?

Finally, if I want to create a browser Dapp, how do I ensure some functions can only be invoked by the Dapp and no one else (Not even the owner)?

Thanks in advance!

1 Answer 1


1- if you know the address and the ABI you can call the contract's function as described in the official doc :

// creation of contract object
var MyContract = web3.eth.contract(abi);

// initiate contract for an address
var myContractInstance = MyContract.at('0x78e97bcc5b5dd9ed228fed7a4887c0d7287344a9');

var result = myContractInstance.myConstantMethod('myParam');
console.log(result) // '0x25434534534'

myContractInstance.myStateChangingMethod('someParam1', 23, {value: 200, gas: 2000}, function(err, result){ ... });

2-msg sender is the address of the message//call sender's address so if you use any ethereum's wallet, the account's address is sent with your message (like an ip).

3-for this use a modifier :

modifier isAllowed() {
   if (msg.sender != allowed_address) {

  • Thank you for solving my initial two questions. Regarding the third one, that also means I as the owner of the address would be able to log in and use the method as well, correct? Is there a way to ensure only the app can invoke the functions? If not, would investors still trust the integrity of the app if one address to be used with the Dapps would be able to make a significant function call? (won't be able to alter their balances negatively but only positively) Aug 19, 2017 at 16:49
  • you have to define the allowed address from which you can call the functions otherwise the call fails. normally we attribute such abilities to the person who has deployed the contract (a kind of admin) but to just perform some basic actions like stopping the contract (in case of security flaws). if you are talking about tokens contract i advise you to read about the ERC20 concept .
    – Badr Bellaj
    Aug 19, 2017 at 17:07
  • My token is already ERC 223 compliant, the problem is that the amount a specific user is allowed to withdraw from the 'bank' should be dictated by the Dapps only. If not there is no assurance that the owner cannot use it maliciously. Aug 19, 2017 at 17:25
  • sorry but i didn't get what is your need would you elaborate more?
    – Badr Bellaj
    Aug 19, 2017 at 17:59
  • Let's say you have a bank. You deposit money to it. This can be done via the contract itself. Then after you deposit the money, you use a Dapp which can alter how much money you have "deposited" (The deposit here refers to the amount returned by the ERC20 standard allowance(address, address) function, where the first address is the contract's address.). I want only the Dapp to be able to alter how much money you have deposited (Meaning only the Dapp and the contract can call the approve function of the contract). Aug 19, 2017 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.