I have the following scenario: Contract A is created. Contract MASTER will validate Contract A (may make a few changes to state variables of Contract A) and lock it from any further changes. Contract A will only be available for viewing purposes only.

Is this scenario possible. If yes, what would be the best way to execute this? Thanks.


You could do it with an onlyOwner modifier and careful management of the owner address.

First, deploy A and designate address Master as the owner. Consider that Master could be the deployer using a factory pattern. In this case, contract A's constructor would set owner = msg.sender.

Alternatively, A's constructor would require an arbitrary address to set the Master it should respect, function A(address masterContract) { owner = masterContract; }

With the initial permission set up:

modifier onlyOwner {
  require(msg.sender == owner);

Now you have a modifier for guarding the setter functions. They will refuse anyone but the owner.

When you want to "burn" the keys and ensure no further changes are possible (sure you want to do that?), this not undoable:

function throwAwayTheKey() onlyOwner returns(bool success) {
  owner = address(0);
  return true;

With the owner set to 0, it is no longer possible to execute the functions guarded by onlyOwner because no one can sign a transaction from address(0).

I would also emit an event for throwing the keys away. Omitted it for brevity.

Hope it helps.

  • Hi @RobHitchens. Awesome. The suggestion for the second part is great. The suggestion for part 1 will also work. A follow up question: How does Contract Master validate that the owner for Contract A is indeed set as the MasterContract. Is there a default function to find the owner of a contract?
    – userDSSR
    Oct 19 '17 at 18:34
  • No. There's nothing special about "owner". It's just a state variable in A, like address public owner; and A uses it to decide who to listen to and who to ignore (modifier onlyOwner). Master doesn't really need to confirm it's the owner (it could, by checking a.owner() is "me") because it isn't then A is going to throw on any protected method. Oct 19 '17 at 18:45
  • Thanks @RobHitchens for your quick reply. However, in my scenario it may create a problem. Contract Master and Contract A - are created by two different organizations. Contract Master has to take ownership of Contract A and approve, set state variables and lock it. But, potentially, Contract A creator may create a fake variable as "owner" or other modifiers to bypass. Could this be a potential enhancement request - on ownership identification?
    – userDSSR
    Oct 19 '17 at 18:58
  • Well, it depends on use-case, so maybe post more details as a new question. For example, if the contract is deployed from a template, then the template itself and the rules of governance etc., can themselves by part of the production process so no deceitful behavior is possible. Oct 19 '17 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.