2

I'm making a bitcoin-based online marketplace. I've been reading/studying the Bitcoin API commands, and some of the commands need "unlocked wallet". Does this mean a wallet without a passphrase? I think it's vital that the wallet be encrypted at all times. Still, if I've understood everything correctly, I need to decrypt the wallet (at least for a while) to be able to send bitcoins to another wallet. So how should I proceed? If someone on the website wants to take his/her coins on to another wallet, do I need to make it so the API removes the PIN or encryption from the wallet, sends the bitcoins and encrypts it again? Is it secure to do so?

Oh, and I'm using Bitcoin-QT to handle the coins.

Improve this question
1
  • "unlocked wallet" means an encrypted wallet for which the encryption key is known. Bitcoin-Qt/bitcoind doesn't actually support decrypting a wallet.
    – Pieter Wuille
    Aug 4, 2013 at 18:25

2 Answers 2

Reset to default
1

To send bitcoins using the API:

It is recommended to have some knowledge of AJAX if using this method

WORD OF WARNING: Using this method can cause large amounts of inputs being set as miners fees. I suggest you continue with caution and start by using small inputs.

That being said...

Using the commands listunspent, createrawtransaction, signrawtransaction and submitrawtransaction.

To access the Bitcoin-qt console:

launch your bitcoin client as usual and wait for it to load the blockchain and start up
click on 'help' in the menu bar (top right)
click on 'debug window'
select the 'console' tab
  1. Use listunspent to get an array of you spendable inputs in your wallet
  2. This is where you set you transaction fee: Use createrawtransaction to generate a transaction in the form createrawtransaction [{\"txid\":\"[txid of the input transaction]\",\"vout\":[vout that relates to the txid of the input transaction]},...] {\"[address to send your bitcoins to]\":[amount of bitcoins to send to this address],...} All inputs that are not spent in a transaction are used as miners fees.
  3. Use signrawtransaction [the output of createrawtransaction] to sign your generated transaction Note: Your wallet must be unlocked to perform this command. If not type walletpassphrase [your passphrase] 21600
  4. Use submitrawtransaction [the output of signrawtransaction] to send your signed transaction to the network to be included into a block

You can see your transaction by going to http://blockchain.info/tx/[txid output from submitrawtrasaction]

Improve this answer
0

You are absolutely right.
Look at the end of API calls list.
There is walletpassphrase command. Use it to decrypt for some time, send money, then do walletlock.
Regarding security, it is not the best option, but still better than unencrypted wallet.
Consider using PHP or other script languages to decrypt wallet: usually, if the attacker can access your unencrypted wallet, he can also find a password in PHP files and decrypt encrypted wallet.
Compiled languages are a bit more secure, but the password is still there. Someone with Hex Editor could afterall find the password.

Improve this answer
2
  • So you're saying that anyone with Hex Editor and a bit of time could "hack" any wallet that is used by any PHP-based site? I think either you or I have misunderstood something. :)
    – Lebu
    Aug 4, 2013 at 19:22
  • Not anyone. If he accessed your filesystem, he would be able to read your unencrypted wallet, as well as to read PHP files in order to find password for your encrypted wallet. The password is stored somewhere in your code, which in case of PHP is clear text. You don't need Hex then. If you use for instance C++, then the password would be in a compiled binary, and then you can use Hex editor.
    – ripazha
    Aug 5, 2013 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.