I am aware that security on the network is done at the private key level, but would love to know the security implications of having an additional password/string and time-based level of security on a smart contract.

A simple implementation of that would be something like this:

pragma solidity ^0.4.21;

contract PasswordTimeLock {
    uint timelock;
    bytes32 hashlock;
    address owner;
    string data = "hello world";

    function PasswordTimeLock(string _password) public {
        owner = msg.sender;
        hashlock = keccak256(owner, _password);

    function unlock(string _password) public returns (bool) {
        require(keccak256(owner, _password) == hashlock);
        timelock = now + 20 seconds;
        return true;

    function read() public view returns (string) {
        require(now < timelock);
        return data;

Is there any exposure to the actual string passed to the unlock function or the constructor?

  • 1
    It's a public blockchain. Anyone can read the string you passed in the constructor.
    – user19510
    Commented Mar 12, 2018 at 21:39
  • @smarx Figured as much. How would one get to the string passed in the constructor?
    – ReyHaynes
    Commented Mar 12, 2018 at 22:39

1 Answer 1


As smarx says in his comment, anyone can read the password passed in the constructor. To answer your question directly, yes, the string passed to unlock is also exposed. Additionally, data can be read by anybody directly from the blockchain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.