Store data in transactions instead of in the contract

Question

I want to store vehicle history in the blockchain. Each historical "event" would contain the vehicle VIN, mileage and date. There are a lot of vehicles and the history per vehicle is fairly small. So deploying a new contract for each vehicle seems wasteful, but storing all vehicles in one contract isn't scalable.

So I was thinking of storing the history simply in the events themselves that the "registrar" contract generates.

Something like this:

pragma solidity ^0.4.21;

contract VehRegistry {
    address public owner;

    event Event(string vin, string mileage, string date);

    function VehRegistry() public {
        owner = msg.sender;
    }

    function registerEvent(string vin, string mileage, string date) public {
        require(msg.sender == owner);
        emit Event(vin, mileage, date);
    }

}

Is this a secure solution (in terms of data integrity)?

And would I be able to look up all events for a given registry address?

Answer 1

Unsure what you mean with "secure" solution. If you mean "can someone else read the data" the answer is definite yes. If you mean whether someone can fake the data, the answer is no - just listen to events from that specific contract and you should be fine.

I'm also a bit unsure what you mean with registry address. There is only one address used in your contract and that is the contract owner. If you need more data in your contract you can just add more parameters - for example registry address (whatever that is).

Storing the data in events is a cheap solution but that way contracts can't access the data. This might be fine for your solution. If you'd need contracts to have access the data you should keep all in one contract - but yes, gas usage will increase.

Answer 2

"Secure" is an overloaded term. I incline to think of it as any combination of three separate concerns:

1. Confidentiality. Is it hidden from entities that should not see it?
2. Availability. What is the assurance that we can get it back?
3. Integrity. If we get it back, what is the assurance that it is authentic?

The above stateless design:

1. Is not confidential. Everyone can see all the details.
2. Is highly available, but not to contracts, including itself - only off-chain observers.
3. Will only be updated by a trusted user and will not be distorted. There is no on-chain validation of the inputs, so responsibility for data integrity is vested in the trusted account.

Stateless design is useful. I incline to the idea that smart contracts should enforce application integrity so it cannot become corrupt or misleading under any circumstance. That usually involves some on-chain storage to ensure that nonsense is not acceptable (does that VIN exist?) even if it originates from a trusted source.

Hope it helps.