Can someone read this private variable?

Question

my purpose is to generate a random key when the smart contract is created and save that key in a private variable. I don't what to know its value either.

Let's take for example the code below:

pragma solidity >=0.4.22 <0.7.0;

/**
 * @title Storage
 * @dev Store value in a variable
 */
contract Storage {

    uint256 private number;
    
    constructor () public {
        number = uint(keccak256(abi.encodePacked(now, msg.sender))) % 100;
    }
}

Can someone know what the number is? Could some miner repeat the calculation and get the same number?

I deployed this smart contract on rinkeby and I don't see any getters to read the value of number.

Answer 1

private in the context of solidity smart contracts doesn't mean the value is a secret. It just means the variable is incapsulated and another contract will not be able to reference it directly. However the value itself is always visible when the block is introspected, or the transaction that set the value is analyzed.

It is also a best security practice to avoid saving any private information (PII, secrets, ..etc) on-chain.

https://solidity.readthedocs.io/en/v0.5.3/contracts.html#visibility-and-getters

Answer 2

Would be safer to encrypt your private data on the client dapp side using the client private keys and saving the private data as encrypted. Only the client with the private keys can see their data.