What's the correct cleos command to yield the active/owner permissions of a deployed contract to "eosio.code", exclusively?
1 Answer
cleos set account permission MYACCOUNT active '{"threshold": 1, "keys":[], "accounts":[{"permission":{"actor":"eosio.null","permission":"active"},"permission":{"actor":"MYACCOUNT","permission":"eosio.code"},"weight":1}], "waits":[] }' owner -p MYACCOUNT
cleos set account permission MYACCOUNT owner '{"threshold": 1, "keys":[], "accounts":[{"permission":{"actor":"eosio.null","permission":"owner"},"permission":{"actor":"MYACCOUNT","permission":"eosio.code"},"weight":1}], "waits":[] }' -p MYACCOUNT@owner
Some additional points:
- The permissions must be given in alphabetical order (of account name), so I am assuming that your account name would come alphabetically after
eosio.null. If that isn't true, then you have to rearrange the permissions such that it is alphabetically correct. - Be aware, that the
eosio.codepermission can be used to authorise any action that the permission could normally achieve. This means that it can be used to change the keys within the contract itself. Assuming the point of nulling the keys is to make the contract immutable and provide confidence in the contract, then you will have to make it open source so that people can see that you haven't snuck a function in there that will be called at some point and change the keys so you can regain access.
answered Mar 10, 2019 at 6:25
-
I'm getting the following error, using the first line (replacing "MYACCOUNT" for "wubiubitoken"): Error 3010004: Invalid authority Ensure that your authority JSON is valid follows the following format! (...) Error Details: Fail to parse Authority JSON '{"threshold": 1, "keys":[], "accounts":[{"permission":{"actor":"eosio.null","permission":"active"},{"permission":{"actor":"wubiubitoken","permission":"eosio.code"},"weight":1}], "waits":[] }' Expected '"' but read '{' while parsing token '' Error parsing object Attempting to parse array [] Error parsing object Commented Mar 10, 2019 at 11:58
-
I think I solved the parse error (an extra "{"), but the second command now gives the following error (which says "active" but I'm setting the owner): Error 3090003: Provided keys, permissions, and delays do not satisfy declared authorizations Ensure that you have the related private keys inside your wallet and your wallet is unlocked. Error Details: transaction declares authority '{"actor":"wubiubitoken","permission":"active"}', but does not have signatures for it. Commented Mar 10, 2019 at 12:57
-
I changed the end of the second command to " -p wubiubitoken@owner " and it went through. Commented Mar 10, 2019 at 12:58
-
oops my mistake. By all means edit the answer as appropriate. Where is the extra
{? Commented Mar 11, 2019 at 5:47 -
It's in the second "permission" statement. It should be ," instead of ,{" Stackoverflow doesn't let me edit it because it's less than 6 characters Commented Mar 11, 2019 at 18:39