0

Since the transaction needs to be signed, it requires a private key, so how can the users interact with the backend API and send the private key securely.

I wonder what is the purpose of signing a smart contract from the backend API? Is there any solid real-world use case where a number of users need to interact through the backend to smart contract instead of frontend metamask to smart contract?

1 Answer 1

1

Mostly automated actions from your own wallet, so that you don't have to sign the transactions manually.

  • Trading bot sending automated buy and sell orders to a DEX contract from your own wallet based on some off-chain analysis. The script can run 24/7 not having to prompt you to sign the transaction each time.
  • Oracle pattern. Your own wallet is an authorized address on your sports bets contract, feeding it off-chain data who won a match. This way you can automate the process and not have to sign the transaction manually after each match.

As always in IT security, a chain is as strong as its weakest link. There are ways to securely store and use private keys. For example use a secrets management system, exclude sensitive values from logs, set up and review access to sensitive data (only certain users or apps are able to access it), ... Specifics depend on your implementation and how much value is at stake.

5
  • What if I want to build an API endpoint where users can transfer tokens to each other, is it possible in practice?
    – Bird
    Commented May 2, 2022 at 7:37
  • Is there a way of sending a user transaction, let them sign, and sending back to backend to process? What is the approach that suit this kind of task?
    – Bird
    Commented May 2, 2022 at 7:48
  • @KrittamookAksornchindarat MetaMask and WalletConnect currently do not support "just" signing the transaction without broadcasting it (that you could broadcast later from your backend app) - they always broadcast the signed transaction. They do support signing a message (that is not broadcasted by design) but that's not the same thing... So unless the users give you their private key (so that you could sign the transaction with their key), they'll need to use a software wallet (and not an API) to sign the transaction and broadcast it.
    – Petr Hejda
    Commented May 2, 2022 at 8:10
  • So, if I want to save their transaction on the database, the only way, without touching their private keys, is to listen to their broadcast of the signed transaction right?
    – Bird
    Commented May 2, 2022 at 8:38
  • @KrittamookAksornchindarat Browser wallets usually return just the transaction hash (but not its other details). So you can wait until the tx is mined (tx receipt has a non-null value after it's mined) and then process the tx receipt data on your backend app for example.
    – Petr Hejda
    Commented May 2, 2022 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.