This question frequently comes up in conversations: When a Corda transaction is sent to a non-validating notary service for finalisation, what can the notary service see and deduce about the world?
1 Answers
Before sending a transaction to a non-validating notary, it is filtered as follows:
stx.buildFilteredTransaction(Predicate {
it is StateRef || it is TimeWindow || it == notaryParty
})
(see NotaryFlow.kt in the main Corda repo). This means that the non-validating notary will only see:
- Any inputs, in the form of
StateRefs - The time-window, if it exists (since the notary is also the timestamping authority)
- The identity of the transaction's notary
Because the transaction is a Merkle tree (see https://docs.corda.net/_images/merkleTree.png), although the remaining components have been removed and can't be seen by the notary, the contents of the transaction can't be changed later once the notary signature has been applied.
Related