Search code examples
blockchainweb3js

I want to know principle of call smart contract in web3.js

Explain my current situation.

  1. I deployed smart contract using Remix IDE on Ganache local environment.
  2. I call smart contract function in web3.js on express.js server. like below await contract.methods['myMethod'](parameters).send({from: walletAddress, gas: '1000000'});

in this situation, I have first question.

Q1. When calling Ganache's smart contract, it's call with only public wallet address, but how do I prevent the situation of indiscriminately call smart contract function with someone else's wallet address?

And I wanted to experience this situation on Public Ethereum Testnet (Sepolia), so I deployed a simple experimental contract using Remix IDE, MetaMask Provider, and MetaMask Sepolia wallets.

my simple experimental contract address in Sepolia. (0x56926CB88108126d30AF0844FDBB12522A34D01a) https://sepolia.etherscan.io/address/0x56926cb88108126d30af0844fdbb12522a34d01a

When i create contract instance in Ganache, like below.

const web3 = new Web3(new Web3.providers.HttpProvider('http://127.0.0.1:7545'));
const contractAddress = '...' const contractABI = [...]
const contract = new web3.eth.Contract(contractABI, contractAddress);

in this progress, I have second question.

Q2. What kind of Provider should I use to call smart contract on Sepolia?

and My last question

Q3. Is that possible to view my simple experimental contract original code on etherscan? How to do that?

The best thing I found is the below. but that is not my original code. https://sepolia.etherscan.io/bytecode-decompiler?a=0x56926CB88108126d30AF0844FDBB12522A34D01a

Thanks for reading. please tell me if anyone know this.

I wrote this in the details

Solution

  • Q1. When calling Ganache's smart contract, it's call with only public wallet address, but how do I prevent the situation of indiscriminately call smart contract function with someone else's wallet address?

    You can validate the value of msg.sender, a global variable that reflects the address of the caller.

    For example

    function foo() external {
    require(msg.sender == address(0x123), "Not authorized");
}

    If this function is called by anyone else than the address 0x123, it throws the error Not authorized.

    This mechanism is also used in the widely known OpenZeppelin Ownable library, where the authorized address is known as the owner.

    Q2. What kind of Provider should I use to call smart contract on Sepolia?

    There are quite a few 3rd party providers that enable you to interact with contracts on Sepolia. Most of them have a free tier that should be sufficient for your use case. Google "sepolia RPC provider".

    Q3. Is that possible to view my simple experimental contract original code on etherscan? How to do that?

    You need to verify your source code on each blockchain explorer where you want the code to be displayed (in your case Etherscan).

    What you see now, is the compiled (machine-readable) bytecode that was generated from the Solidity (human-readable) source code.

    Here's a link to the Etherscan verification tutorial: https://docs.etherscan.io/tutorials/verifying-contracts-programmatically You can verify the code either using their UI or programmatically.