I am new to ethereum and solidity , i created a Token app using zeppelin and truffle which generates and sends tokens to others.

My question is if i deployed the contract then msg.sender is my public key (for eg : 0xbb439f37bf26d74aa02d0d85d8748c85530d439a )then i can transfer ownership to other address.If someone knows my public key then can he/she call the transferOwnership method ?

1 Answer 1


Let's use, for this demonstration, our own little transferOwnership method, that I am sure does the same thing that the one you are talking about.

function transferOwnership(address new_owner) {
    require(msg.sender == owner);
    owner = new_owner;

You can see that the function checks if the sender of the message is indeed the owner, so no one else can change ownership.

Even if people know your public key, your address, it's not enough. If they want to change the owner of the contract, which is you, they have to send "a message to the contract that was signed by you", and for that, they need something they surely don't have which is your private key.

So, as long as no one knows it, you are safe! :)

  • 3
    I would also add that msg.sender is set automatically by the EVM and not by the sender of the message.
    – lungj
    Commented Mar 25, 2018 at 15:06
  • 1
    Where do you find this kind of info? Solidity's code (as on Github)? Commented Mar 25, 2018 at 15:31
  • 2
    The sender is part of the Ethereum virtual machine spec (it’s not up to compiler writers like Solidity or clients like Parity) so the best place to look is the Ethereum white paper (or a relevant EIP, which can get hard to track). In this case, it’s in the white paper at github.com/ethereum/wiki/wiki/White-Paper. Specifically, you can find it in the section on messages and what a message contains.
    – lungj
    Commented Mar 25, 2018 at 15:47
  • @WarisAhmedkhan , if you think it answered your question, would you be kind and mark it? ;-) Commented Mar 25, 2018 at 18:16
  • @ElishaDrion i have marked the answer thanks :) . Can i ask you one more query i.e after deployment of smart contract if someone access my truffle project directory through command line then that suspect can be pretend as a contract owner because i used hdwalletprovider-privkey which takes private key as a parameter to sign all transaciton.so is there any way to protect it ? Commented Mar 27, 2018 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.