Find Out Who Signed a Transaction Using dSteem

On Steem one account can give any authority (owner, active, or posting) to another account or a key. Authorized account can do authority specific tasks on first account's behalf using authorized account's key. This feature enables SteemAuto or SteemConnect Apps, SmartSteem or MinnowBooster to vote and post on your behalf.

About a month ago @crokkon did an excellent analysis of vote selling by user accounts using Smartsteem and MinnowBooster. In that he used Beem's Signed_Transaction class to find out the public key of the signer.

I do not know python but trying to learn Node JS, so I tried to do the same using dSteem. The code is very simple but I had to do some digging. 😛

const {
  Client,
  Signature,
  cryptoUtils,
} = require('dsteem');


const client = new Client('https://api.steemit.com');

const args = process.argv.slice(2);

(async () => {
  // Pulling transaction data
  const trx = await client.database.getTransaction({ block_num: args[0], id: args[1] });

  // New signature object from transaction signature
  const sig = Signature.fromString(trx.signatures[0]);

  // Recreting transaction message
  const msg = {
    expiration: trx.expiration,
    extensions: trx.extensions,
    operations: trx.operations,
    ref_block_num: trx.ref_block_num,
    ref_block_prefix: trx.ref_block_prefix,
  };

  const digest = cryptoUtils.transactionDigest(msg);

  // Finding public key of the private that was used to sign
  const key = (new Signature(sig.data, sig.recovery)).recover(digest);

  const publicKey = key.toString();

  // Finding owner of that public key
  const [owner] = await client.database.call('get_key_references', [[publicKey]]);

  console.log(`Public Key: ${publicKey}`);
  console.log(`Owner: ${owner}`);
})();

Code is available also in this Gist.

How to use?

Save the code in a JS file e.g. whosigned.js, open up Terminal and type

node whosigned.js BLOCK_NUM TRX_ID

Output will be something like this:

Public Key: STM7qkG8G4GMNeFvksdzi2UpaoNwLXuL5t97tRtFY7QMm1KkywZV5
Owner: reazuliqbal

condenser_api.get_transaction method is disabled in main APIs, so we need block number as well as transaction id of the transaction. You can find those easily by clicking on the timestamp for each transaction on steemd.com and copying from the URL in the next page.

^{Code screenshot was taken using this awesome project.}