Controlling access to functions that require ETH is straight forward because you get an address you can trust because it has been signed and verified, and therefore upi can use for access control simply by inspecting the value in the msg.sender field.

I have heard of a similar technique being used in something called "meta-transactions", used for identity purposes in non-SEND transactions. But I don't know enough to be able to execute such a technique. I would need to know how to do both of the operation, from the Node.JS/Web3JS side and the smart contract side. I do know how to create SEND transactions and I am doing that now from my dApp, because I sign the data package I use with sendSignedTransaction(). But I'm not sure how to do this when using a straight method call executed from the Web3JS side. I'm referring to the common technique of calling a contract method from an contract instance object that has the ABI loaded that contains the contract method calls (e.g. - contractInstance.methods.getSomeData().call()).

If I'm correct on this, can someone point me to a code sample or document that would show me how to sign a smart contract method call with VIEW visibility, from a Node.JS/Web3JS app? And then show me on the smart contract side how to validate the signed method call? The data packet I would send would contain the Ethereum address I want to use for access control. Then on the smart contract side I would validate the signature before executing the access control rules.

Can I build a raw transaction like I do with sendSignedTransaction() that contains the method call and then send it to the VIEW function with zero gas? If so, will the smart contract automatically validate the signed data package cryptographically like it does with SEND transactions and provide my contract the address of the signer in the msg.sender field? Or do I need to add some library to my smart contract that does cryptographic validation and verify the signature explicitly with code I add to the contract?

  • 1
    Everything on the blockchain is public. You can require a signature parameter in the call but that will not prevent someone else to access your data from the storage directly bypassing your smart contract. – Ismael Nov 13 '18 at 21:05
  • @ismael That's a good point. I could encrypt the data being stored, but if I do that, then there's no longer a need to control access via signing so either way, it does cast doubt on my whole idea. Thanks. – Robert Oschler Nov 14 '18 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.