How to create a separate EOS permission for voting using cleos

For added security I decided to create a new account permission called 'vote' which I will be using to place my votes with. It will only have the authority to use the voteproducer action in the eosio system contract. In case the key gets compromised I can simply replace it with a new one using my active permission. All the adversary can do meanwhile is vote on my behalf. This is an intro on what I did as I think it will be useful for others as well.

There are basically two steps you need to do. First you create a new account permission and then you give it the authority to use voteproducer action on eosio contract. As a prerequisite for this instruction I expect that your account's active key is stored in a cleos wallet and the wallet is unlocked.

1. Create new account permission

For the new permission you will need a new key pair. Let's create that using cleos.

cleos wallet create_key -n your_wallet_name

Output of the command should be like this:

Created new private key with a public key of: "EOSPUBLICKEY"

Next, we create the new 'vote' permission on your account. It will use the newly generated key pair.

In the following command replace account_name with your own account name and EOSPUBLICKEY with the value you got from create_key command output in the previous step.

Parameter 'vote' is the name of the new permission. You can use a different name if you wish but remember to use the same value in following commands, too. The last parameter is the parent permission name for the new permission. The default 'active' is fine for this use case.

cleos -u https://api.main.alohaeos.com set account permission account_name vote EOSPUBLICKEY active

2. Authorize the new permission to vote

Now that we have just created the new permission it doesn't have authority to do anything yet. We need to give it the authority to use the voteproducer action in the eosio system contract. This can be achieved with the following command in cleos. Again, replace account_name with your own account name.

cleos -u https://api.main.alohaeos.com set action permission account_name eosio voteproducer vote

Now you are all set up and can start voting with your_account@vote permission!

Notes

Please note that the vote commands in cleos currently ignore the -p option because the account permission is hardcoded to 'active'. You need to use the command 'cleos push action' as a workaround. That command reacts to the -p option properly. For more info see https://github.com/EOSIO/eos/issues/4216. This issue affects only cleos and not other wallets.

For example, if you'd like to delegate your votes to a proxy proxy_account you would issue the following command. Replace account_name with your account name both in the action parameters and in the -p option.

cleos -u https://api.main.alohaeos.com push action eosio voteproducer '{"voter":"account_name","proxy":"proxy_account","producers":[]}' -p account_name@vote