I'm building an ERC20 smart contract
which will be accessed via node.js
with web3
library.
I see that web3.eth.Contract
has the send
function, which takes the parameter from
, which is being mapped to the msg.sender
in the smart contract.
As far as I understand (and my debugging supports that), I can change the from
field to just about any address, and by that bypass the business logic of the contract, e.g
token.methods.method_only_owner_can_activate(<some_data>).send({ from: <contract_owner_address>, <gas> });
or even set the owner:
token.methods.setOwner(<my_not_owner_address>).send({ from: <contract_owner_address>, <gas> });
since the address should be public, any user can create a process which mimics this behaveiour and bypasses my security logic.
There are other methods which do sign a transaction with the private key
, but the fact that the send
method is open for bypassing the business logic, seems like a big security concern.
As I missing something?
contract_owner_address
is unlocked on the Ethereum node that you are connected to. Either you are (unknowingly) unlocking it in your code, or the node is (unknowingly) unlocking it for you. – goodvibration Sep 2 '18 at 17:38