0

I have a few variables in my contract that coded like so:

string test;
bool public isFrozen = false;

From testing I see that I cannot call the test State variable when calling test().call() but I can call the isFrozen public variable with isFrozen().call() and receive the isFrozen variable.

My question is, if I set the test State variable during deployment, is there ANY way for anyone to view what variables were set during deployment? From my testing I cannot get this information, but I just wanted some guidance.

Also, if there is a way to call a State variable, without using a function please let me know.

Dorian Lee
  • 112
  • 1
  • 8

1 Answers1

0

My question is, if I set the test State variable during deployment, is there ANY way for anyone to view what variables were set during deployment?

If someone has the source code then it is easy:

  1. If you set the variable in the constructor it's obviously trivial to know what it was set to by reading the source.
  2. If you pass in the value as a constructor parameter, then the value can be seen in the contract creation transaction. Constructor arguments are just appended to the deployment bytecode. With the contract's ABI (not even the source code) it is fairly easy to decode this and find the values.

Without the source code, it's harder, but not impossible. By looking at the bytecode of the contract, someone can work out the storage location of the variable without too much difficulty and read it using Web3: web3.eth.getStorageAt().

web3.eth.getStorageAt() can be used to get the current value at that storage location (which answers your second question - though technically it is a function too) or any historical value at that location.

It is not easy to hide things on the blockchain - this is a feature, not a bug.

benjaminion
  • 9,247
  • 1
  • 23
  • 36
  • Hey thanks for the detailed explanation! I tried the getStrorageAt() function but that returned "y" when the string I entered was "$2b$12$xiFQSyKFFAf7lqJrdktjneNsdnB94JvEQdjCdq780v/4UCcE7/Zhi". I thought that was interesting, but not enough to trust it. – Dorian Lee Jan 25 '18 at 21:56
  • Yes, string storage is a bit more complicated than uints, but it is still quite possible for someone to trace it through to reconstruct the string if they were sufficiently motivated to do so. Definitely don't store a private key in a contract ;-) – benjaminion Jan 25 '18 at 22:06
  • It was more like a encrypted state variable. – Dorian Lee Jan 25 '18 at 22:11
  • I asked another question if you want to get some points ;) https://ethereum.stackexchange.com/questions/37513/if-i-stored-an-encrypted-variable-in-a-smart-contract-how-long-would-it-take-to – Dorian Lee Jan 25 '18 at 22:25