0

I would like program an oracle service which I would like to charge a fee for. Therefore, I would store the data of interest as a private variable in my oracle contract. This private variable should only be accessed via a function which requires a minimum value payed by the calling contract.

I wonder, is my private variable really protected against phishing by other contracts? More specifically, is it possible to read a private variable of a different contract by any means? Obviously, it does not work with the standard solidity code but is it possible using assembly?

0

No, smart contract may read only its owner storage, and not the storage of other smart contracts. Though, off-chain applications may read storage or any contract.

  • But it is possible that a contract read another contracts function. Moreover, using delegate call it seems that the contract is able to access any code written in a different contract. I wonder, what prevents the attacking contract to overflow a certain storage area in my contract to access the private variable? Is there a criteria in the EVM which prevents to go to a certain storage area? Maybe I am just too naive and do not understand the working principle in depth. However, given the possibilities, I do not see a reason (yet) why this should not work. – Olympus May 12 at 18:55
0

A Solidity contract is unable to read the state storage of another contract by any means, including assembly. However, this provides no assurance of confidentiality.

All data in all contracts is readable by all nodes. This is because knowledge of the contract states is crucial for evaluating transactions results. By extension, it is well-understood by everyone who can contribute to protocol/node development. So, not uncommon knowledge.

You could separate concerns into on-chain and off-chain components. For example, the on-chain component could take owners, accept fees and emit events, e.g. LogNewOrder(contract address, variable to inspect, callback function, etc). An off-chain Observer would inspect the contract storage and report findings back to your contract or directly to the client's callback.

Such a process is asynchronous because it has to wait for the off-chain part to respond. There is no obvious way to make it synchronous because your on-chain component cannot inspect other contract states.

Hope it helps.

  • I totally get your point. However, I am not not satisfied with your answer in two ways: 1. Let's say I am famous for providing some data in the off-chain world. I proof my authenticity of being the person, able to control the oracle contract. Since my data is publicly available in the off-chain world anyway, it does not matter that if it was also publicly available on the blockchain. The question is if it was possible to built a business model in which I sell my data on-chain using smart contracts. Meaning, is there no workaround for other contracts to steal my data? – Olympus May 13 at 7:08
  • 2. Could you explain me, please, how a contract can access a different contract's function? Do you have a good reference? I would like to understand your point, that "A Solidity contract is unable to read the state storage of another contract by any means, including assembly." Unfortunately, I am not familiar enough to understand the fundamentals of solidity/EVM. For me it seems that it is possible to jump to any place in storage since I could access a contract's function via a simple code like ContractA a = ContractA(addressA). Is this not copying variables but only functions? – Olympus May 13 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.