2

Consider a getter function with a restriction on who can read it, like

function getData()
    public
    view
    returns (uint x)
{
    require(msg.sender = '0x123..123');
    x = data;
}

This prevents people from getting this data via Remix or from another contract unless its address is 0x123..123; the requester must know not just the address, but possess its private key.

Yet via web3.js, I can pull this by using

EthContract.methods.getData.cacheCall({ 'from': '0x123..123' })

Here I do not need the private key.

I was wondering if there was a way to call web3.js programs within the blockchain, which would allow one to effectively get around the private key ownership requirement.

1
  • 2
    It works off-chain because no signature is verified and you can use a fake msg.sender to get pass the require. When running on the EVM to get pass through the verification you have to be the correct msg.sender.
    – Ismael
    Dec 4, 2019 at 20:25

1 Answer 1

2

IMHO restricted access to getters is a pointless contract design.

It is always possible to access every value. Indeed, every full node has full access necessarily because they need that to process contract functions.

If the contract doesn't "permit" access it is really only inconveniencing a determined adversary.

Here's a way to circumvent the contract's rules. How to read a private variable from a contract?

Hope.it helps

3
  • 1
    Getting the value within a solidity contract and getting it outside the contract are very different things, as the latter takes trust. I'm curious if these outside ways can be somehow pulled inside the EVM. Dec 4, 2019 at 19:46
  • Not possible from inside a contract. Completely doable outside looking in. Dec 4, 2019 at 20:46
  • 2
    If I understand what you are getting at, it would always be a contract trying read the state of another contract without using a function that was made for that purpose. A contract cannot read another contract's storage directly. Dec 4, 2019 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.