1

I have a contract which needs to be updated occasionally.

For this purpose, I set up an Ethereum client, namely, a Parity node.

At this point, I see several ways of carrying out the specified task:

  1. Unlock my account once (i.e., at the Parity node command line or toml configuration file), and then simply send a transaction every time I want to update the contract.
  2. Send an 'unlock-account' request to the Parity node followed by a transaction, every time I want to update the contract.
  3. Sign a transaction and send it to the Parity node, every time I want to update the contract.

Options 1 and 2 are achieved with my account's password, while option 3 is achieved with my account's private key.

Advantages of each option:

  1. No need to send the account's password from my server to the parity node
  2. The account becomes unlocked only when necessary
  3. The account is never unlocked

Disadvantages of each option:

  1. The account is always unlocked
  2. The account is sometimes unlocked, and its password needs to be sent on every transaction
  3. The account's private key needs to be sent on every transaction

Between options 1 and 2, I don't see any reason why to use option 2.

Between options 1 and 3, I am not really sure what is the correct approach.

Sending secret information to the Parity node, whether it's a private key or a password, sounds like it can be easily solved (for example, using HTTPS).

However, leaving an unlocked account on the Parity node also sounds like it can be easily solved by allowing access only to my server (for example, using my servers' IP address).

I have read this answer, which explains how to protect option 1, if this were your choice.

But all in all, it feels like option 3 is the more correct choice.

Am I right, and what other considerations have I missed here?

UPDATE:

Not sure why this question was put on hold, because I was planning to add my practical efforts (i.e., some code) and then put it on bounty.

Here is the code that I have for each option:

Option #1:

let transaction = contract.methods.myFunc();
let options = {
    from: ACCOUNT_ADDRESS,
    gasPrice: GAS_PRICE,
    gas: await transaction.estimateGas()
};
await transaction.send(options);

And in the Parity configuration (toml) file, I added:

[account]
unlock = [0xAccountAddress]
password = ["password.txt"]

Option #2:

let transaction = contract.methods.myFunc();
let options = {
    from: ACCOUNT_ADDRESS,
    gasPrice: GAS_PRICE,
    gas: await transaction.estimateGas()
};
await web3.eth.personal.unlockAccount(ACCOUNT_ADDRESS, ACCOUNT_PASSWORD);
await transaction.send(options);

Option #3:

let transaction = contract.methods.myFunc();
let tx = {
    to: contract._address, 
    data: transaction.encodeABI(),
    gasPrice: GAS_PRICE,
    gas: await transaction.estimateGas()
};
let signedTransaction = await web3.eth.accounts.signTransaction(tx, PRIVATE_KEY);
await web3.eth.sendSignedTransaction(signedTransaction.rawTransaction);

As in the title, my question is - should I unlock the account on Parity (options 1 or 2), or should I sign every transaction sent to Parity (option 3)?

Thank you!

  • I think that option 3 is the slowest too :( – Mr_Hmp Jun 29 '18 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.