search

dckc / awesome-ocap

Awesome Object Capabilities and Capability Security
The Unlicense
335 stars 24 forks source link

Add Cadence to the list of programming languages #36

Closed turbolent closed 1 year ago

dckc commented 1 year ago

Interesting... Cadence has interesting support for capabilities...

I also see

To get the addresses of the signers of a transaction, use the address field of each signing AuthAccount that is passed to the transaction's prepare phase. -- https://developers.flow.com/cadence/language/environment-information

That seems like ethereum's msg.sender or (non-strict) JavaScript's caller, which aren't consistent with complete encapsulation.

To what extent is the address field used in Cadence smart contracts like msg.sender is used in ethereum to control access to contracts, such as giving administrative access?

turbolent commented 1 year ago

Transactions are passed AuthAccount objects, which are essentially capabilities to the accounts which signed the transaction. They do have an address field, but a good analogy is how a "directory capability" might get passed and it provides the path.

These account objects are only available as arguments in the transaction entry point, and not implicitly available anywhere else, so unlike msg.sender in Solidity.

You can learn more at https://developers.flow.com/cadence/solidity-to-cadence#msgsender-considered-harmful