---
# System prepended metadata

title: Minion with member only private actions

---

# Minion with member only private actions

Currently Minion action data is stored publically on chain and can be viwed by anyone outside of the DAO. Because of this Minion can not be used to execute calls with sensitive data like a DEX transaction.

In this document we propose a way to store action data in a way that it is visible to only DAO members. 

### Steps for creating an action -

1. A user clicks create action
2. User inputs target address
3. User then selects method to be called on target address from ABI
4. User provides input values for method to be called
5. Our code create a symmetric key encryption key to be used for this action
6. Code encrypts action encoded data using this symmetric key
7. Code encrypts symmetric key with public key of action creator
8. Core fetches list of members and their public keys and then create a encrypted symmetric key for every member using their public key
9. When submitting action to contract we submit this mapping of member address to encrypted symmetric key to contract
10. Minion contract saved this mapping

### Steps for verifying an action

1. User visits DAO UI and sees list of proposal
2. If the proposal has been submitted by Minion with pricate data then code gets encrypted symmetric key from Minion mapping for visitor address
3. User is then asked to decrypt symmetric key using his private key from wallet
4. Minion data is decrypted using decrypted symmetric key and shown in UI

### Steps to execute an action

1. Repeat 4 steps in verification flow
2. Call execute method on Minion contract with decrypted symmetric key and decrypted action data
3. Contract verifies that encrypting provided symmetric key with public key of user produces same value as stored in mapping against address of the user
4. Contract verifies that encrypting data provided with symmetric key produces same value as stored in action data
5. Contract calls method on target address


Please feel free to provide feedback and suggestion on how we can improve it to be more secure for such privacy sensitive use cases.
