web3j-从已签署的交易中获取交易明细（金额，天然气价格，天然气限额）

Question

I have a frontend in javascript and a backend in Java. I let the user sign a raw transaction with his private key in the frontend with web3js. Afterwards the signed transaction is returned to the Java backend and the backend broadcasts the transaction via a parity instance.

My question: I am afraid of hackers, who can manipulate the raw transaction within their browser in javascript, before signing it. In this way they could change the amount that is being sent. Is there a way to extract the amount which will be sent from a signed transaction with web3j? If yes, I could check that value again before broadcasting the signed transaction.

BTW: If its important somehow, it is a token transaction, not an ETH transaction.

Thanks!

Answer 1

Well this requires a bit of cryptography understanding.

In private / public key pair cryptography, "signing" is basically the only case where you encrypt with the private key and you decrypt with the pub key. If you manage to decrypt it means the signature is valid because whoever that pub key belongs too, it's definitely who signed the content.

So, if you have the pub key you can decrypt a "signed" transaction.

Now, if you are worried about hackers and security, holding keys on the client side and in memory is not good practice. So if this is a serious project you might want to revisit your approach.