This question is about Solidity code that reads the state of a deployed contract on a Geth node using web3.js. When I call claimsProcessed() with a different account than admin, I expected it to throw my "Security Violation".

Instead it returns a fancy value ...


I have ...

uint256 private claimCount; // == 1    
address admin = 0x123..ce;

and ...

function claimsProcessed() public adminOnly view returns (uint256)
    return claimCount;

modifier adminOnly() {
    require (
        msg.sender == admin, "Security Violation - You are not an admin"

What can I do to get a "Security Violation" when the read operation is performed by another account than the admins.

  • I see a typoo now. Wrong: msg.sender == owner. Correct: msg.sender == admin. Sorry for that. Mar 18 '19 at 11:05

Functions declared as view are usually called off-chain, i.e. outside any block or transaction, and no account is usually involved with the call. When you calls claimsProcessed off-chain, msg.sender is unset and your require statement always throws. Fancy number you see is just decimal representation of the first 32 bytes of ABI-encoded error message: 0x8C379A000000000000000000000000000000000000000000000000000000000. See the very end of this page for details: https://solidity.readthedocs.io/en/v0.5.6/control-structures.html#error-handling-assert-require-revert-and-exceptions.

  • Thank you for spending your time on my question Mikhail. >> your require statement always throws -> that is not the case. When I use it with the admin account, then it works as expected. Mar 18 '19 at 14:12
  • 1
    OK, if you are calling your method off-chain, but with from parameter set to valid admin address, it will not throw. It looks like Web3 implementation in geth does not translate exception in smart contract executed off-chain into JS exception, so there is no reliable way to distinguish successful execution from unsuccessful one. Mar 18 '19 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.