0

Is there a way we can pass some value checks from web to solidity contract Just for example if we want to make sure, the person who is calling contract function is present on our website and not suing some other source of calling like bot or compilers

My function is a payable function with which ethers are transferred to users on calling the receive () function.

If any such solution to make a check and pass it to contract where it be a conditional require or some other check to make sure users is present on the site.

  • Of course, have you considered the Truffle framework? – goodvibration Feb 3 at 15:58
  • No I am new and have not used it yet – Ophelia Feb 3 at 16:00
  • @goodvibration learning in remix to make things and properly learn – Ophelia Feb 3 at 16:01
1

There are two patterns to start with.

It's important to think about who/what will send the transaction to the contract.

Server-Centric option: If it's the server, then the contract would check that the sender is the trusted server address and then proceed on the basis that the server is trustworthy and wouldn't tell it to send funds to a non-user. This means the overall system is quite centralized and depends on the server for the logic to work.

Consider:

modifier onlyServer {
  require(msg.sender == serverAddress);
  _;
}

function receive(address payable receiver, uint amount) public onlyServer {
  receiver.transfer(amount); 
  emit ...
}

Whitelist Option: If it's the user (their browser), then the contract would check an approved whitelist of addresses that are allowed to use the function. The server would still have a "role" in the contract. It would add and remove users from the whitelist. That would be less centralized but not entirely decentralized in that the central authority is still important.

Consider:

mapping(address => bool) public userAuthorized;

modifier onlyUser {
  require(isUser(msg.sender));
  _;
}

function isUser(address candidate) public view returns(bool isIndeed) {
  return userAuthorized[candidate];
}

function receive() public view onlyUser {
  msg.sender.transfer(amount);
  emit ...
}

function addRemoveUser(address user, bool isAuthorized) public onlyServer {
  userAuthorized[user] = isAuthorized;
  emit ...
}

It would be difficult to implement a combination even though that might seem like the intuitive way to approach this. If the user kicks off the transaction and then the contract is to check with the server, first, before sending funds, that is a multistep process that involves using an Oracle pattern and still puts the server in the center of a centralized process. So, more complex with questionable benefits.

Hope it helps.

  • Thanks for being so helpful. Issue is I have already used isAuthorized in the form of is Blacklisted and made the same check but this solution comes to play once we found something happening wrong on the contract like bot attacks trying to transfer() etc. What i am trying to do is just like we set PHP session and check if session is valid then pay user otherwise not, in same can we set some unique id value on web side and then pass it with a function update into contract and make it require() so user can only receive() if his session like id is set otherwise not.... – Ophelia Feb 3 at 16:38
  • Hmmm ... you're trying to make the contract aware of a transient session state in another system. Oracle would do that but it shouldn't be necessary. You can use the server to direct activities or use the contract to approve/reject requests based on their membership in the group without regard to server session status. Blacklist approach approves everyone by default. Whitelist rejects everyone unless on they're on the list. It's generally better because it is not possible to blacklist all the unwanted addresses. – Rob Hitchens - B9lab Feb 3 at 17:02
  • That would make for a good new question. It's an anti-pattern but the explanation would take some space. Please accept my answer if you agree the original question is addressed. – Rob Hitchens - B9lab Feb 3 at 17:45
  • Already done that, I have used this function and its perfect solution for me. Now issue is please guide me how I can make an update function to update value of keccak256(_pw) whenever i need to update this secret answer. Thanks for your kind help and support – Ophelia Feb 3 at 17:54
  • Did you post a new question? – Rob Hitchens - B9lab Feb 3 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.