Cairo function visibility defaults and accidental public access
0 reputation · 12 Apr 2021, 19:25 UTC
Cairo function visibility defaults and accidental public access
When writing StarkNet contracts in Cairo, a developer often relies on the language’s visibility keywords to control which functions can be invoked from outside the contract. However, Cairo’s compiler does not enforce a private or owner‑only semantics; instead, it treats functions as external or internal based on explicit modifiers. The absence of a visibility declaration can lead to unintended exposure of state‑changing logic to any transaction sender, creating a security risk.
To mitigate accidental public access, a clear rule is needed: what is the default visibility for a function that lacks a visibility keyword, and how does that affect the generated ABI and entry‑point routing across different compiler releases? This question remains unresolved in the current documentation, especially when comparing Cairo 1.0 and earlier versions.
Specific questions
- Are functions without an explicit visibility modifier treated as external by default in the latest Cairo compiler?
- Does the compiler expose such functions as entry points in the ABI, making them callable from any StarkNet transaction?
- What compiler or contract‑level patterns can guarantee that a state‑changing function remains internal if no visibility keyword is used?
