What is the non-transactional behavior of the EVM?

Question

This question is about Solidity code that reads the state of a deployed contract on a Geth node using web3.js. When I call claimsProcessed() with a different account than admin, I expected it to throw my "Security Violation".

Instead it returns a fancy value ...

3963877391197344453575983046348115674221700746820753546331534351508065746944

I have ...

uint256 private claimCount; // == 1    
address admin = 0x123..ce;

and ...

function claimsProcessed() public adminOnly view returns (uint256)
{
    return claimCount;
}

modifier adminOnly() {
    require (
        msg.sender == admin, "Security Violation - You are not an admin"
    );
    _;
}

What can I do to get a "Security Violation" when the read operation is performed by another account than the admins.

Answer 1

Functions declared as view are usually called off-chain, i.e. outside any block or transaction, and no account is usually involved with the call. When you calls claimsProcessed off-chain, msg.sender is unset and your require statement always throws. Fancy number you see is just decimal representation of the first 32 bytes of ABI-encoded error message: 0x8C379A000000000000000000000000000000000000000000000000000000000. See the very end of this page for details: https://solidity.readthedocs.io/en/v0.5.6/control-structures.html#error-handling-assert-require-revert-and-exceptions.