I am trying to design UI for a tokensale smart contract where all participants must be whitelisted before purchasing tokens.

The participants submit their address via the UI form, but only the contract owner can add addresses to whitelist.

Would the way to do this be to create an admin section that requires the admin use the owner's account in metamask and manually view and approve a list of submitted addresses?

Or is there another recommended way to implement a whitelisted tokensale?

1 Answer 1


You can authenticate the user with OAuth (or whatever) and link that identifier to their Ethereum address by having them send a signed message to your server.

The actual whitelisting is usually done through a third party/back office process.

In the contract, you would have a privileged account that approves the addresses after the WL process is passed successfully. It's not something the user should be able to do for themselves.

This process will confirm that the ComplianceOfficer attests that the requirements for whitelisting have been fulfilled and the address is authorized to partcipate. Bearing in mind that the ComplianceOfficer may be a server following an automated or semi-automated process.

The contract will never know that "Alice" is "Alice" but it will know that the ComplianceOfficer attests that she (and her Ethereum address) have been approved. It's probably advisable to keep orderly off-chain records.

Hope it helps.

  • Yes I see. The token sale contract has "function addToWhitelist(address _buyer) public onlyOwner" function. Where would this usually be called? Is it common for the contract owner to just interact with the contract using remix or MEW and add the addresses manually?
    – koukotsu
    Commented Apr 9, 2018 at 23:28
  • A trusted employee or a trusted machine that has the signing key and enough ether to pay for gas. Commented Apr 9, 2018 at 23:35
  • Is there a good way of sending the whitelist transaction from the owner's address using the private key and not using metamask etc as provider? How could I go about making this an automated compliance process?
    – koukotsu
    Commented Apr 17, 2018 at 15:12
  • Yes. A signing process will do. Metamask is just a browser way to do it. Use can use nodejs with the Web3 JS API, and use either a geth full node or BaaS like Infura. The "server" would sign with the owner's private key. Commented Apr 17, 2018 at 15:43
  • Thanks, we are using web3.js and infura. We could create an automated process which sends a signed transaction from owner, but wouldn't that potentially expose the hard coded private key?
    – koukotsu
    Commented Apr 17, 2018 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.