Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
I've been tasked with writing a Smart Contract to create NFT/digital collectibles. For the most part, I'm using a standard ERC721 contract.
I will be responsible for deploying the contract. Is there a standard way this company can securely endorse this contract as the official one?
My initial thinking is to have them sign a message containing the deployed contract address and adding that signature after deploying it.
Thoughts?
Trust has to start somewhere.
If, for example, the company has a website that people trust, then you could just put the address of the contract on the website. If there's some other trusted communication channel (Twitter, Telegram, Slack, etc.), it's sufficient to publish the address there.
If there's no trusted website but there is somewhere a public key that people trust is associated with the company, then yes, you could publish a message signed with that private key anywhere. But this is an unlikely scenario, because the public key had to come from somewhere, and usually that means there's some other channel that's already trusted as coming from the company. (And that means they can just publish the address directly.)
This Article goes over the process of creating and (more relevantly) how to go about Verifying your contract on Etherscan. This makes your contract more transparent to your clients.
Taken from Smarx's answer:
Another thought: generate a 256-bit secret (random number) and store the hash of it in the contract. Then show someone the preimage of the hash (the secret) to prove that you're the one who put that hash in there.
This is, again, is subject to MITM attacks and only proves that someone is in possession of the secret (not necessarily that they're the originator).
