# Risk of Messages Not Having a Signature

As per my understanding transactions are signed before sending to Ethereum. Else, no transfer of Ether will happen. However, messages sent to Smart Contracts (SC) aren't signed (e.g., using methods.myMethod.send). While this is a problem as anyone can call a SC, I understand that we can write SC in such a way that it responds only to a message coming from a given address. This way we can prevent any Ether or Token is not transferred to an attacker.

My question is, can an attacker send messages to a SC while masquerading an address (as there's no signature) that the SC is willing to accept? By doing so, can the attacker burn Ether of that account (as gas is consumed to execute SC)?

If so, any suggestions to prevent this.

• No one can call a smart contract without sending a transaction, and every transaction has a signature. So the smart contract always knows the account that called it. The gas is paid for by the account that sent the transaction. – smarx Sep 13 at 5:12
• My initial observations were due to trying smart contract calls on Ganache, which seems to be signing all transactions behind the scene. Now that I tried on Ropsten Testnet, all smart contract calls need to be explicitly signed. – Dilum Bandara Sep 20 at 3:03

msg.sender is always the inner-most contract or EOA that invoked a function and there is no known may to impersonate another address. This is why it is used for access control.