0

I think I misunderstand something. I'm using a Ganache for developing dApp. I built a default ERC-20 smart-contract. I've built it with truffle. And just for test I write some code in NodeJS:

        const res = await contract.methods
            .approve('0xbB5fed33E455bA3efB1a6622c388A9aDaD9D9EB5', this.web3.utils.toWei('10'))
            .send({
                from: '0xD73292923DA1Fc18b04fADC4a004bb7dffB5f7Ca'
            });
        const tr = await contract.methods
            .transferFrom(
                '0xD73292923DA1Fc18b04fADC4a004bb7dffB5f7Ca',
                '0x460923eA0B788cBF8921f1cd1a696D3de7Fd487a',
                this.web3.utils.toWei('10')
            )
            .send({ from: '0xbB5fed33E455bA3efB1a6622c388A9aDaD9D9EB5' });

And this code works perfectly. Is it means that anybody who knows my address and ABI of a contract can call the same code in Main Network (Ethereum). Because all this information (ABI and my address) is public. I think it's quite silly question, but I can't find an answer. What I'm missing?

1

You can execute .send({from: 'SomeAccount'}) only after unlocking SomeAccount on the node that you're communicating with via your Web3 instance.

On public nodes this is usually not even an option, and you can therefore execute a transaction only via web3.eth.sendSignedTransaction (and only after signing the transaction with your private key).

So in short, the code in your question means that you've unlocked those two accounts (using their private keys) when you started Ganache.

  • So, it means that in REAL application in Main Network I have to sign transaction with private key before execution? And in fact this approach guarantee security? Anyway, thanks for your answer! – Kirill Varikov May 1 '20 at 8:47
  • @KirillVarikov: Yes. – goodvibration May 1 '20 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.