In Corda, what data is sent to a non-validating no

Question

This question frequently comes up in conversations: When a Corda transaction is sent to a non-validating notary service for finalisation, what can the notary service see and deduce about the world?

Answer 1

Before sending a transaction to a non-validating notary, it is filtered as follows:

stx.buildFilteredTransaction(Predicate { 
    it is StateRef || it is TimeWindow || it == notaryParty 
})

(see NotaryFlow.kt in the main Corda repo). This means that the non-validating notary will only see:

• Any inputs, in the form of StateRefs
• The time-window, if it exists (since the notary is also the timestamping authority)
• The identity of the transaction's notary

Because the transaction is a Merkle tree (see https://docs.corda.net/_images/merkleTree.png), although the remaining components have been removed and can't be seen by the notary, the contents of the transaction can't be changed later once the notary signature has been applied.