wallet notification not working for multisig address

Question

I am new in bitcoin. I started research about bitcoin(Couple of days ago) for my project.I setup bitcoin node on my linux server and it is fully synchronized. here is my bitcoin.conf

prune=600
maxconnections=10
maxuploadtarget=20
rpcuser=XXXXX
rpcpassword=XXXXX
keypool=100
server=1
rescan=1
alertnotify=php \var\www\html\alert.php %s
blocknotify=php \var\www\html\block.php %s
walletnotify=php \var\www\html\wallet.php %s

Case 1: I created address using getnewaddress [account_name] then I sent some BTC from other wallet and I can get wallet notification.

Case 2: I created address using addmultisigaddress command then I sent some BTC from other wallet and I can get wallet notification.

Case 3 : I have created multisig address using createmultisig command. And I sent some BTC from other wallet (Check transaction status ). That transaction have enough confirmation But I can not get wallet notification.

Why i can not getting wallet notification of multisig address (Case 3)?

addmultisigaddress command will save redeemScript and attache it to that address. this is work for me and I can get notification.

So here i also want to know how secure is my multisig address if i create it using addmultisigaddress command? Suppose my server hacked, Attacker easily get redeemscript(using validateaddress command) and also can get sign address associate with it and privet key of that addresses. My BTC can be easly Theft.

Please suggest me the best way to create multisig address or answer me why I am not getting wallet notification of multisig address and what is alternative solution?

Info: I want to develop BTC wallet website where my user can create BTC address and can send and receive BTC. I want to create multisig address for every user. What is best way to create multisig address for them? any security advice welcome.

I searched lots of about this multsig address but I can't get any idea how to implement it (Multisig address using createmultisig command) in my project and wonder how other how other website support multisig address and handle it? Are they using addmultisigaddress command ? If yes then how secure is that account ?

if I can't get wallet notification then how can I credit or debit BTC from my user account (In my project).

Thank you in advance.

Answer 1

First of all, the createmultisig will not add the generated address to your wallet, it will only generate the address and the redeemScript.

The addmultisigaddress was probably working for you because you generated both addresses on the same core-client and then added them with the addmultisigaddress command. However, the addmultisigaddress call will not add the multisig address to the wallet if not at least m of the public keys belong to this wallet (Where m is the minimum number of signatures required to spend from this address). This is because you can't add an address to the wallet if you can't spend from it. However, if you are only interested in adding the address for the purpose of watching it, you can do the following:

• Generate n public keys for the m-of-n multisig address. Theses can be generated within or outside of the core client
• Receive all the public keys on the core client and create the multisig address with createmultisig n '''[<LISTS_OF_M_KEYS>]'''
• after you execute the step above you will recive the multisig address and the redeem script. You may store these to a DB if you would like
• In order for walletNotify to work you need to import the address with importaddress command (you may want to set the rescan parameter to false since you just created the address anyway)
• Optionally, you can add the address to a particular account with the setaccount command

Note: The account feature in bitcoind is planned to be deprecated and replaced by a labels feature (see: [1] [2] [3]) and this should be taken into account if you want to plan ahead for forward compatability