8

I was wondering if there was an ability to store secrets, such as an API credential within a smart contract. When the contract gets executed it checks something remote. Maybe a weird example, but for example my paypal balance. Under certain conditions maybe even execute certain API functions (send money) if certain conditions are met.

To do that some sort of secret needs to be stored and associated with a wallet address.

I know it sounds crazy, but I'm interested in the technical ability of Cardano/Plutus.

Thanks

2 Answers 2

3

I think, this I not possible. If you want your smart contract to know about your balance or any off-chain fact (including random numbers), then you need to push this fact either to the blockchain or give it as an input to the smart contract.

This former is done by oracles. The operator of the oracle regularly pushes information (such as exchange rates, random numbers...) to the smart contract which stores this information on the blockchain. Other smart contracts can then query the oracle (usually paying a fee) to obtain this information.

For storing credentials or your PayPal balance this is obviously a bad solution. Here it would be better to use the second approach and give the balance as input to the smart contract. Here, you want of course the input to be 'validable' by the smart contract - otherwise you could hand over any value to the smart contract. To achieve this, what you can do is to require that the balance is signed by the third party (Paypal). The smart contract stores the public key of Paypal and checks the signature of the input before using it.

4
  • thanks for your answer Aug 22, 2021 at 12:21
  • You are welcome. Please assess if the response answers your question and accept it as answer if it does.
    – Jey
    Aug 23, 2021 at 19:28
  • @Jey what about SC where someone gets a reward when guesses a password?
    – sloik
    Aug 26, 2021 at 20:05
  • 1
    @sloik You could store a commit to the password in the smart contract. This commit is a hash of the combination of the password and a random string. This random string needs to be a secret. Users push a guess onto the blockchain in a first step. The operator of the game then validates the guess. The commit makes sure that the users can verify that the operator of the game effectively rewards correct guesses.
    – Jey
    Aug 27, 2021 at 22:19
0

What you are asking is commonly referred to as Oracles in the cryptoworld. Which is some way to interact with assets outside of the blockchain, the problem with that is that since what is happening is impossible to verify by the blockchain. It can however work the other way, that the server which whom you wanted to communicates instead communicates with the blockchain, and immutably and publicly commits to whatever your smart contract does.

The blockchain cannot really contain secrets, since they would be visible for everyone, however what can be done is to "encrypt" the input to a smart contract, and at a later stage send proof that can unlock or recreate that value on the chain and proving that the value you sent now that is readable to everyone is actually the input that would recreate the encrypted value from before.

A real world example of this would to put a playing card face down on a table, everyone can see that there has been a card placed on the table, but the value is not visible (it's a secret). Later someone flips the card over and the value is visible to everyone (reveal). If you can demonstrate that the flipped card is indeed the same card that was put on the table face down and has not been replaced by another card (this would be equivalent to the cryptographic proof). Everyone can agree that the cards value is valid, and can be used to determine the outcome of the card game.

1
  • thanks for your answer! Aug 22, 2021 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.