I am aware that metamask will enable effective security for processing via the web browser a payable function action to a smart contract.

What happens in batch?

I have an API service which then needs to call payable functions in smart contracts. There would be no direct human involvement in the call. It would be all machine based.

Is there a secure way to call the function so that the private keys are not exposed on the server or in the code under these conditions?

I wondered if truffle would work for this.


If you are running in batches, on a schedule, you could presign the transactions offline, and simply broadcast them when you want to process them.

There is no way to sign transactions in realtime without having a key somewhere. It doesn't necessarily have to be on the primary server, but it will have to be on some system that your primary server can request a signature from.

| improve this answer | |
  • That then means a rawTransaction can then be executed without any other checks? Is that a security risk anyway? But how metamask store the private keys securely? When I use metamask, I just enter my password, so it must store the private key somewhere. Can the same method be used but in batch? – Trevor Lee Oakley Oct 11 '18 at 13:36
  • It stores your private key locally somewhere in the browser extension storage. If you have presigned transactions prepared with incrementing nonces on an offline machine, you can broadcast them at any time without requiring the private key. You still need the key to sign it offline, though. – Raghav Sood Oct 11 '18 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.