Approving Addresses & Preventing Direct Access To Storage Contract

Question

I am looking into creating a DAPP that can be upgraded via new contracts, to do this I am looking at separating the storage out into a separate contract.

My only concern is security, it was put to me that the storage contract could allow for only certain external contract addresses to interact with them. If we take the following example:

contract Storage {

    address approvedAddress;

    function update(address _sendingAddress, __MORE_HERE__) public {
        if(_sendingAddress == approvedAddress){
          // Do Stuff
        }
    }
}

From my calling contract I call update and pass in the calling contracts address to _sendingAddress the address is then checked to see if it matches the approved address. If it does I can update the storage.

However what is stopping someone from calling the update function directly without going through the calling contract and guessing at the address?

Answer 1

Instead of using address _sendingAddress in parameter, what you can do is.

use msg.sender to determine the function caller and compare

msg.sender with approvedAddress

contract Storage {

    address approvedAddress;

    function update( __MORE_HERE__) public {
        if(msg.sender == approvedAddress){
          // Do Stuff
        }
    }
}