I want to make sure that my function in contract can only be called from just my client. So how can I generate signature and verify it in smart contract?

  • You mentioned this is a common use case on EVM blockchains. Do you need a functionality like onlyOwner to restrict the function call to one address? Or do you want to explicitly verify a signature with a function like ecrecover?
    – leotron
    Commented Feb 11, 2023 at 13:56
  • No, I just need to verify the signature generated by the client in the program.
    – marethyu
    Commented Feb 13, 2023 at 1:51

4 Answers 4


Programs (smart contracts) in chains cannot connect to a server via any protocol.

And you cannot be sure from which client a program is called, it can be reached by any client and even by any other program.

You can be sure who signs the transaction. So your user...

To read some data from outside the chain, let's say from your server, you must send that data to the program via the transaction, as arguments or account data.

  • I edited my question and I want only my client can call specific functions in the contract by verifying signature generated from my client. This usecase is used with EVM blockchain commonly.
    – marethyu
    Commented Jan 30, 2023 at 1:56

Referring to this

Validating Inputs

On Solana it is crucial to validate program inputs. Clients pass accounts and program inputs to programs which means that malicious clients can pass malicious accounts and inputs. Programs need to be written in a way that handles those malicious inputs.

Consider the transfer function in the system program for example. It checks that from has signed the transaction.

fn transfer(accounts, lamports) {
    if !accounts.from.is_signer {
    accounts.from.lamports -= lamports;
    accounts.to.lamports += lamports;

If it didn't do that, anyone could call the endpoint with your account and make the system program transfer the lamports from your account into theirs.

  • sign with your client's keypair to the transaction
  • verify if signer's public key matches to your client's public key (it can be either a constant or can be stored in a kind of authority account)

Hey with anchor you can get the Ed25519 signature instruction, make sure is_verifiable, make sure pubkeys match, signature match and message match.

With this you should be able to verify your Ed25519 signature.

Have a nice day.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.