0

My scenario:

My web server:

  • Generates private and public, and a wallet address from the public key for a user website account
  • Server can not connect to the outside (Can not connect to the Bitcoin network)
  • Has a page that allows anyone to send money to the user account wallet address

What I need to do:

  • The server needs to know when bitcoins were sent to the wallet address, and how many total bitcoins are at the wallet address

Because web server can not access outside internet, I am using Javascript on the browser side to get the wallet address info by getting https://api.blockcypher.com/v1/btc/test3/addrs/miedePxMt4SDQHjWJyfhbCWvXcm33vzDa1/full and/or https://api.blockcypher.com/v1/btc/test3/txs/681b16b4de3676a5865a85e0bba3097afcc195d928f3167e4d5591c388c1e474?includeHex=true ... and sending that data to my webserver using a Ajax call to check for the received bitcoins.

Note: I have sent testnet bitcoins to that wallet.

Everything works except 1 problem: The browser user can easily change the bitcoin amounts and trick the web server into thinking more bitcoin were sent.

My question is: What methods can I use on the webserver to verify that the transaction data was not changed by the browser user. The web server has the pub/priv key of the receiving wallet. The webserver has the "bx" libbitcoin-explorer program available and I could potentially install other software.

Can I use the commands in this diagram at all? https://github.com/libbitcoin/libbitcoin-explorer/wiki/Transaction-Commands

Improve this question

1 Answer 1

Reset to default
1

All sensitive operations must be performed on your side. You cannot perform them on the client side and trust the client to pass you the correct information. If you need to call some API to get wallet information, your server needs to make that call.

Improve this answer
3
  • David thanks. I'm surprised that I can't verify it off line given that I have the private key. Is there any alternative I can use like a different coin that will allow me to do this offline using the Ajax method with a browser client?
    – Skills
    Commented Jan 27, 2020 at 11:35
  • One method I was thinking of is having the server create a new transaction and transfer all of the coins to a new wallet. I'm not sure but maybe I could validate the transaction object after it has been confirmed by the network. I would still have to query the network on the client side but since I'm the sender it would work. I'm not sure
    – Skills
    Commented Jan 27, 2020 at 11:39
  • One thing I forgot about is I can try the callback API blockcypher offer. Maybe they can call my server when the transaction completes.
    – Skills
    Commented Jan 27, 2020 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.