It does not seem to be the case that MyEtherWallet.com is supporting read function sender restrictions such as onlyOwner modifiers or similar, so basically it is impossible to restrict particular function reads to certain groups/tiers of people. Why is this not an option? I believe it should be possible to confirm similar to write functions by accessing a wallet through one of the many options.
1 Answer
Modifiers like onlyOwner
cannot be enforced on view
or pure
(or the deprecated constant
) functions, since when reading from outside, any view-able data is public. A simple read operation does not involve a transaction, and thus does not have a msg.sender
.
I imagine calling a view function with an onlyOwner
limitation from another contract might fail, however, but there is no way to prevent it from web3.
Edit: As smarx points out, it is possible to set msg.sender
for a view function call, but perhaps not through MyEtherWallet. In any case, this is optional and should not be relied upon for security. Any data on the blockchain should be treated as public and readable by all.
-
1
eth_call
does take an optionalfrom
parameter (though I don't think MEW supplies it). When afrom
address is supplied, that is the value ofmsg.sender
. Aug 18, 2018 at 4:37 -
-
"As smarx points out, it is possible to set msg.sender for a view function call, but perhaps not through MyEtherWallet." this is what I observed as well. But it doesn't really answer the question regarding why it shouldn't be possible? how is any view-able data public when reading from outside, this is only true if the data is stored in the contract, if it's a calculation then this is false and if the function call reverts on trial then the return data calculation remains private– NowsyMeAug 18, 2018 at 11:06
-
@NowsyMe Even if you could enforce that, the raw data itself is still public, and stored on every node's storage. Anyone could go and pick it out of the actual chain state if they wished. Remember, nothing is encrypted in the chain, only signed and verified. The actual data is effectively plaintext Aug 18, 2018 at 11:13
-