Visibility in Solidity: How It Impacts Your Application’s Security

In recent weeks, we have explored various crucial aspects of secure development in blockchain, from basic practices to the importance of robust auditing. Today, we will delve into a fundamental yet critical concept for the blockchain ecosystem: visibility of functions and variables in Solidity.

Solidity, the predominant programming language for writing smart contracts, offers different levels of visibility for functions and variables. These levels determine how and from where a function or variable can be accessed, being crucial for contract security.

Functions

• External: Exclusive access outside the contract.
• Public: Accessible inside and outside the contract.
• Internal: Access allowed only within the contract and by derived contracts.
• Private: Strictly limited access to the declared contract.

Variables

• Public: Similar to public functions, with the addition of an automatically generated getter function by Solidity.
• Internal: Accessible only within the contract and its derived contracts.
• Private: Restricted access to the declaring contract.

By default, variables are internal, underscoring Solidity’s preference for access restriction as a security measure. But what happens when we want to store sensitive information, such as passwords, in private variables? Although the variable itself is inaccessible directly by other contracts, it is crucial to understand that all data on the blockchain is public. Therefore, visibility controls access rather than the visibility of the data itself.