Make function invisible for general user

Question

I have a pretty big contract with a few functions, some are designed for administrative goals. Here's a simplified example:

contract big_contract {
    function user_function_1 (uint32 arg1, string arg2) returns (uint32) {
        // ...
    }

    function user_function_2 (string arg1) returns (string){
        // ...
    }

    function admin_function (bool arg1) {
        // ...
    }
}

The question is - how can I keep admin_function in the contract's code, but make it invisible for general users? I know, that usually, all you need is to add a few lines of code like if (msg.sender == owner) {...}, but I want to hide this function at all.

In my understanding, it's possible to do by editing ABI's code, but I'm not sure. So, in this example, I need to remove definition for admin_function and the contract will still work, just without capability to call admin_function. But for those, who have full ABI, admin_function will still be available.

[
   // {
   //   "constant":false,
   //   "inputs":[
   //      {
   //         "name":"arg1",
   //         "type":"bool"
   //      }
   //   ],
   //   "name":"admin_function",
   //   "outputs":[
   //
   //   ],
   //   "payable":false,
   //   "type":"function"
   // },
   {
      "constant":false,
      "inputs":[
         {
            "name":"arg1",
            "type":"uint32"
         },
         {
            "name":"arg2",
            "type":"string"
         }
      ],
      "name":"user_function_1",
      "outputs":[
         {
            "name":"",
            "type":"uint32"
         }
      ],
      "payable":false,
      "type":"function"
   },
   {
      "constant":false,
      "inputs":[
         {
            "name":"arg1",
            "type":"string"
         }
      ],
      "name":"user_function_2",
      "outputs":[
         {
            "name":"",
            "type":"string"
         }
      ],
      "payable":false,
      "type":"function"
   }

]

Am I right or there are any other ways to make it work?

score 1 · Accepted Answer · edited Apr 13 '17 at 13:01

Your understanding is correct: you can distribute a subset of the ABI and operate on a form of "security by obscurity". But anyone who has the full ABI, or examines (like reverse engineering) the contract code can still invoke all functions. All contract (byte)code on the blockchain is public and the recommended approach is to attach a modifier to such admin functions like:

modifier onlyOwner {
    if (msg.sender != owner) throw;
    _;
}

Related: Solidity functions - private visibility

About the reverse engineering, here's a conceptual example of what a contract is from How is an ABI stored in bytecode?

method_id = first 4 bytes of msg.data
if method_id == 0x25d8dcf2 jump to 0x11
if method_id == 0xaabbccdd jump to 0x22
if method_id == 0xffaaccee jump to 0x33
other code
0x11:
code for function with method id 0x25d8dcf2
0x22:
code for another function
0x33:
code for another function

Someone examining the code can see that there are 3 functions (method ids: 0x25d8dcf2, 0xaabbccdd, 0xffaaccee). They may not know which one is an admin function, but they can certainly try invoking each function and passing different parameters to it and see what happens.

Make function invisible for general user

1 Answers1