0

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either.

Let's take for example the code below:

pragma solidity >=0.4.22 <0.7.0;

/**
 * @title Storage
 * @dev Store value in a variable
 */
contract Storage {

    uint256 private number;
    
    constructor () public {
        number = uint(keccak256(abi.encodePacked(now, msg.sender))) % 100;
    }
}

Can someone know what the number is? Could some miner repeat the calculation and get the same number?

I deployed this smart contract on rinkeby and I don't see any getters to read the value of number.

5
  • 1
    Private variables cannot be counted for as a secret, if that's what you wanna know. Jul 10 '20 at 11:02
  • Thank you for your answer. Can I ask you to explain a bit better, I'm not sure I understood.
    – Agilulfo
    Jul 10 '20 at 11:04
  • Others can read the values of private variables in your contract. It's not as easy and straightforward as it is to read the values of public variables, but it is still feasible. So don't count on the value of a private variable as being secret. Jul 10 '20 at 11:10
  • I have a question, maybe silly: is it possible to have a smart contract generate that random number and send/save it to an oracle? If yes, could some miner repeat the transaction and get the same random number I got? If no, could be reasonable to save the secret in an oracle (as provable) and use that secret in the contract by always communicating with the oracle? I'm trying to understand if it's possible to have a generated secret which no one knows, including the developers, that the smart contract could use for some operations. Thank you in advance.
    – Agilulfo
    Jul 10 '20 at 11:29
  • Every calculation made In an smart contract can be reproduced because the code and the data used is public, therefore any one can't retrieve it.
    – Jaime
    Jul 12 '20 at 6:02
1

private in the context of solidity smart contracts doesn't mean the value is a secret. It just means the variable is incapsulated and another contract will not be able to reference it directly. However the value itself is always visible when the block is introspected, or the transaction that set the value is analyzed.

It is also a best security practice to avoid saving any private information (PII, secrets, ..etc) on-chain.

https://solidity.readthedocs.io/en/v0.5.3/contracts.html#visibility-and-getters

4
  • Thank you for your answer. Do you know of some other Blockchain that can do this? I've heard about Quorum and Algorand..
    – Agilulfo
    Jul 12 '20 at 18:26
  • In Quorum you can have private smart contracts in which only the participants specified during the contract creation phase will be able to read/interact with the contract. Quorum does that by having two states private and public, where the private state content is broadcasted to the participants tx manager out of band. for more info docs.goquorum.com/en/latest. Keep in mind even in Quorum you cant have a secret variable within a public contract, it is the whole contract or nothing. For more about Quorum security; docs.goquorum.com/en/latest/Security/Framework/Overview
    – cucrisis
    Jul 12 '20 at 18:45
  • Thank you, very explanotary. I don't like the fact that for what I understood Quorum is a private Blockchain (right?), So it doesn't meet some important requirements about using Blockchain, but it seems to fit my needs. One question I would like to ask: does Quorum have a deployed Blockchain deployed in mainnet to which I can attach (same as Ethereum) and with its explorer? Or do I need to run my own Blockchain and find other nodes to partecipate?
    – Agilulfo
    Jul 12 '20 at 19:14
  • Quorum is an enterprise Ethereum client and it fully supports privacy and permissioning. Please reference the documents i linked.
    – cucrisis
    Jul 12 '20 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.