The Full-Node Wallet

The first approach is to use a fully synchronized Ethereum node as the “wallet” for the application. The GETH (Ethereum) or Travis (CyberMiles) software running the node is able to manage keystores (i.e., the web3.personal package), sign transactions, and broadcast transactions to other blockchain nodes. Through the blockchain node’s Remote Procedure Call (RPC) interface, external applications can interact with the blockchain.

You will need to synchronize a full Ethereum (or Ethereum-compatible blockchain, such as CyberMiles) node behind a firewall. The node should turn on RPC services (i.e., the Ethereum default port 8545) so that the server-side web application can access it behind the firewall. It is important that the node’s port 8545 be completely blocked by the firewall and available only inside the firewall, as illustrated in Figure 8.1.

The following code example shows how to call the HelloWorld contract’s updateMessage() function (see Chapter 4) to record a new state in helloMessage onto the blockchain and pay its gas fees. We assume that the web3.js instance on the node.js server is attached to an Ethereum node that already has the keystore containing an account private key. The account has a sufficient balance to pay the gas fee for this transaction. You just need to unlock the account using its passphrase.

Click here to view code image

web3 = new Web3(new Web3.providers.HttpProvider(
              "http://node.ip.addr:8545"));
web3.personal.unlockAccount("...", pass);
hello.updateMessage(new_mesg);

Of course, storing the keystores on the node is still insecure. A single misconfigured firewall setting might expose the node’s port 8545 to attackers. Attackers could easily gain access to all private keys on the server as they are unlocked by the web application.

Raw Transactions

The second approach is to create signed raw transactions and then simply use web3.js to broadcast the transaction onto a blockchain node. In this setup, the blockchain node could be a third-party hosted node outside of the firewall, such as an Infura node. The blockchain node does not store any private key or keystore. The web application itself, however, manages the private keys it needs in a database table. Figure 8.2 illustrates the architecture of this design.

Signing raw transactions is beyond the scope of web3.js. We use the EthereumJS library here to work in conjunction with web3.js. In particular, the ethereumjs-tx project provides ways to sign transactions using private keys. The private keys are typically stored in database tables in this case.

The following code shows how to deploy the HelloWorld smart contract on Ethereum using a signed raw transaction. The gas fee is paid from the account, and the application has access to the private key.

Click here to view code image

const Web3 = require("web3");
const Tx = require('ethereumjs–tx')
web3 = new Web3(new Web3.providers.HttpProvider(
            "http://node.ip.addr:8545"));

var account = "0x1234"; // Ethereum account address
var key = new Buffer('private key', 'hex');

var abi = // ABI of Hello World
var bytecode = // Bytecode of Hello World

var create_contract_tx = {
    gasPrice: web3.toHex(web3.eth.gasPrice),
    gasLimit: web3.toHex(3000000),
    data: bytecode,
    from: account
};

var tx = new Tx(create_contract_tx);
tx.sign(key);

var stx = tx.serialize();
web3.eth.sendRawTransaction('0x' + stx.toString('hex'), (err, hash) => {
    // ... Test if success
});

The next example shows how to call the updateMessage() function on the contract:

Click here to view code image

const Web3 = require("web3");
const Tx = require('ethereumjs–tx')
web3 = new Web3(new Web3.providers.HttpProvider(
            "http://node.ip.addr:8545"));

var account = "0x1234"; // Ethereum account address
var key = new Buffer('private key', 'hex');

var abi = // ABI of Hello World
var contract_address = "0xabcd";
var contract = web3.eth.contract(abi).at(contract_address);
var data = contract.updateMessage.getData(msg);
var nonce = web3.eth.getTransactionCount(account);

var call_contract_tx = {
    nonce: web3.toHex(nonce),
    gasPrice: web3.toHex(web3.eth.gasPrice),
    gasLimit: web3.toHex(3000000),
    from: account,
    to: contract_address,
    value: '0x00',
    data: data
};

var tx = new Tx(call_contract_tx);
tx.sign(key);

var stx = tx.serialize();
web3.eth.sendRawTransaction('0x' + stx.toString('hex'), (err, hash) => {
    // ... Test if success
});

The EthereumJS library is much more than just ethereumjs–tx. It provides the JavaScript to manage private keys, keystores, and wallets. It would be useful if you are doing extensive key management and low-level programming on your own.