0

It does not seem to be the case that MyEtherWallet.com is supporting read function sender restrictions such as onlyOwner modifiers or similar, so basically it is impossible to restrict particular function reads to certain groups/tiers of people. Why is this not an option? I believe it should be possible to confirm similar to write functions by accessing a wallet through one of the many options.

Improve this question

1 Answer 1

Reset to default
1

Modifiers like onlyOwner cannot be enforced on view or pure (or the deprecated constant) functions, since when reading from outside, any view-able data is public. A simple read operation does not involve a transaction, and thus does not have a msg.sender.

I imagine calling a view function with an onlyOwner limitation from another contract might fail, however, but there is no way to prevent it from web3.

Edit: As smarx points out, it is possible to set msg.sender for a view function call, but perhaps not through MyEtherWallet. In any case, this is optional and should not be relied upon for security. Any data on the blockchain should be treated as public and readable by all.

Improve this answer
5
  • 1
    eth_call does take an optional from parameter (though I don't think MEW supplies it). When a from address is supplied, that is the value of msg.sender.
    – user19510
    Aug 18, 2018 at 4:37
  • @smarx Thanks for pointing that out, I've edited the answer
    – Raghav Sood
    Aug 18, 2018 at 5:04
  • "As smarx points out, it is possible to set msg.sender for a view function call, but perhaps not through MyEtherWallet." this is what I observed as well. But it doesn't really answer the question regarding why it shouldn't be possible? how is any view-able data public when reading from outside, this is only true if the data is stored in the contract, if it's a calculation then this is false and if the function call reverts on trial then the return data calculation remains private
    – NowsyMe
    Aug 18, 2018 at 11:06
  • @NowsyMe Even if you could enforce that, the raw data itself is still public, and stored on every node's storage. Anyone could go and pick it out of the actual chain state if they wished. Remember, nothing is encrypted in the chain, only signed and verified. The actual data is effectively plaintext
    – Raghav Sood
    Aug 18, 2018 at 11:13
  • I see what you mean, thanks for elaborating on the subject
    – NowsyMe
    Aug 18, 2018 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.