0

I am looking into creating a DAPP that can be upgraded via new contracts, to do this I am looking at separating the storage out into a separate contract.

My only concern is security, it was put to me that the storage contract could allow for only certain external contract addresses to interact with them. If we take the following example:

contract Storage {

    address approvedAddress;

    function update(address _sendingAddress, __MORE_HERE__) public {
        if(_sendingAddress == approvedAddress){
          // Do Stuff
        }
    }
}

From my calling contract I call update and pass in the calling contracts address to _sendingAddress the address is then checked to see if it matches the approved address. If it does I can update the storage.

However what is stopping someone from calling the update function directly without going through the calling contract and guessing at the address?

1

Instead of using address _sendingAddress in parameter, what you can do is.

use msg.sender to determine the function caller and compare

msg.sender with approvedAddress

contract Storage {

    address approvedAddress;

    function update( __MORE_HERE__) public {
        if(msg.sender == approvedAddress){
          // Do Stuff
        }
    }
}
  • Would the msg.sender be the address of the calling contract and not the address of the "individual"? For example if my address is xxxx and i call a contract at address yyyy, if I run msg.sender it should show xxxxx. If that contract then calls the storage would msg.sender change to yyyy and not keep xxxx? – ORStudios Jan 10 '18 at 11:57
  • @ORStudios msg.sender will be the contract calling the contract. tx.origin will be the account that initiated the chain of contract calls. so in your above-described case msg.sender would be yyyy at the end – Ajay Jan 10 '18 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.