0

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either.

Let's take for example the code below:

pragma solidity >=0.4.22 <0.7.0;

/**
 * @title Storage
 * @dev Store value in a variable
 */
contract Storage {

    uint256 private number;
    
    constructor () public {
        number = uint(keccak256(abi.encodePacked(now, msg.sender))) % 100;
    }
}

Can someone know what the number is? Could some miner repeat the calculation and get the same number?

I deployed this smart contract on rinkeby and I don't see any getters to read the value of number.

  • 1
    Private variables cannot be counted for as a secret, if that's what you wanna know. – goodvibration Jul 10 at 11:02
  • Thank you for your answer. Can I ask you to explain a bit better, I'm not sure I understood. – Agilulfo Jul 10 at 11:04
  • Others can read the values of private variables in your contract. It's not as easy and straightforward as it is to read the values of public variables, but it is still feasible. So don't count on the value of a private variable as being secret. – goodvibration Jul 10 at 11:10
  • I have a question, maybe silly: is it possible to have a smart contract generate that random number and send/save it to an oracle? If yes, could some miner repeat the transaction and get the same random number I got? If no, could be reasonable to save the secret in an oracle (as provable) and use that secret in the contract by always communicating with the oracle? I'm trying to understand if it's possible to have a generated secret which no one knows, including the developers, that the smart contract could use for some operations. Thank you in advance. – Agilulfo Jul 10 at 11:29
  • Every calculation made In an smart contract can be reproduced because the code and the data used is public, therefore any one can't retrieve it. – Jaime Jul 12 at 6:02
1

private in the context of solidity smart contracts doesn't mean the value is a secret. It just means the variable is incapsulated and another contract will not be able to reference it directly. However the value itself is always visible when the block is introspected, or the transaction that set the value is analyzed.

It is also a best security practice to avoid saving any private information (PII, secrets, ..etc) on-chain.

https://solidity.readthedocs.io/en/v0.5.3/contracts.html#visibility-and-getters

| improve this answer | |
  • Thank you for your answer. Do you know of some other Blockchain that can do this? I've heard about Quorum and Algorand.. – Agilulfo Jul 12 at 18:26
  • In Quorum you can have private smart contracts in which only the participants specified during the contract creation phase will be able to read/interact with the contract. Quorum does that by having two states private and public, where the private state content is broadcasted to the participants tx manager out of band. for more info docs.goquorum.com/en/latest. Keep in mind even in Quorum you cant have a secret variable within a public contract, it is the whole contract or nothing. For more about Quorum security; docs.goquorum.com/en/latest/Security/Framework/Overview – cucrisis Jul 12 at 18:45
  • Thank you, very explanotary. I don't like the fact that for what I understood Quorum is a private Blockchain (right?), So it doesn't meet some important requirements about using Blockchain, but it seems to fit my needs. One question I would like to ask: does Quorum have a deployed Blockchain deployed in mainnet to which I can attach (same as Ethereum) and with its explorer? Or do I need to run my own Blockchain and find other nodes to partecipate? – Agilulfo Jul 12 at 19:14
  • Quorum is an enterprise Ethereum client and it fully supports privacy and permissioning. Please reference the documents i linked. – cucrisis Jul 12 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.