0

I have a Smart contract where I want only the onwer to call a specific function, for example:

function getInfo() view public onlyOwner() returns (address) {
  return msg.sender;
}
.....
modifier onlyOwner ()  {
  require ( msg.sender== my_owner);
}

I can build a web3 call slaiming to be (calling from) any address, in this case the owner of the contract, for example:

web3 = new Web3(App.web3Provider);

......
if(directAccessMode)
    web3.eth.defaultAccount =   '0x1111111111111111111111111111111111111111';
......

and be able to geth the required information without any check from EVM that I am really the 'owner' of the address I am claiming to be even avoiding using the address' access details.

I am aware that smart contract data is public nevertheless I do not understnad why there is no control on caller's address validity.

Thanks

2

When your function is executing on-chain, the caller cannot set msg.sender to whatever they want. msg.sender will always be the user account or the contract that is calling your contract function. It can never be something like 0x11111111...

When your function is executing off-chain (e.g. a view function being called from web3), the caller can set msg.sender to whatever they want. This is not a security risk, because:

  1. A function that executes off-chain cannot change the contract state, perform on-chain transactions or do anything else on-chain. It can never have any effect on anyone else's function calls.

  2. All data stored on-chain is publicly readable. Even if there isn't a view function to read it, you can still read any contract state variable using web3.eth.getStorageAt(...).

  • Thank you, I am aware that is not a security risk nevertheless if I want to track callers of some of my functions, I would be forced to impose a on-chain function with therefore correlated costs. Even logging of events within a node would not be able to track the caller. – Pietro Mar 28 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.