Function Call Access Keys using JS SDK

[BenKurrek]

I have a question regarding using NAJ and using the JS SDK. If someone deploys a JS contract using deploy_js_contract on the jsvm.testnet account, the only way they can interact with that contract is by calling call_js_contract and passing in the args and specific contract they want to interact with.

My question is around dApps using the JS contract. Generally, when you login to a dApp, you create a function call access key for that dApp to call specific methods on one contract. If dApps are using a JS contract, you’re creating a function call access key that can call the methods call_js_function and view_js_function . Doesn’t this mean that that function call access key can now be used to interact with ANY contract that’s contained within the jsvm.testnet account? In general, if the function call access key gets compromised, it’s not the end of the world since it can only be used on 1 contract to call specific methods but in this case, if the key gets compromised, it can be used to call literally any method on any contract that’s deployed to the VM (assuming there’s no attached deposit). Is that correct?

[BenKurrek]

Answer from @ailisp:

Yes. It's same as EVM. In EVM world there is no function call access key. So any user can call any method from any contract. Logic must be implemented in contract to allow/disallow certain calls can proceed