Bitcoind JSON-RPC - PHP user handling

Question

I asked this question on bitcoin forum too (just for the record): https://bitcointalk.org/index.php?topic=430972.new#new

I am trying to develop a php web application (a game, and not a gambling site) where users can make in-game purchases. Now if I am understanding it right, The architecture (using bitcoind and Json-rpc api) should be:

• When a new user registers - generate a new address for the new user:

  $bitcoin->getnewaddress("username");

  Store that wallet address for later use in my DB.

  Display that address and let a user send bitcoins to that address.

  Check the balance of that address using the

  $bitcoin->getbalance($username,0)

  for unonfirmed balance and

  getbalance($username,6)

  confirmed balance.

  Now I can let the user buy my in-game items and use

  $bitcoin->move($useraddress, $myaddress, $amount)

  to debit his account and give him the stuff he needs.

Questions:

1. Does this sound about right?  Or am I completely off here! 
2. How long does it take for the unconfirmed balance to show up?  [$bitcoin->getbalance($username,0)] 
3. $bitcoin->move($useraddress, $myaddress, $amount)  is a change of bitcoins between addresses within my wallet, so this should be
offchain and instantaneous, right? 
4.  How can some gambling dice sites like coinroll.it ( https://bitcointalk.org/index.php?topic=191176.0) accept unconfirmed
transactions and lets  people play instantly? are they just taking
the risk or there is something that I am not aware of. 
5. How can I test out my bitcoind/php application with testnet? Anyone has any experience of this?
6. Suggestions on Security are welcome...

I am going to make parts of my code open source when I figure this shit out

Answer 1

You are very correct, but:

1. I would use getaccountaddress instead of getnewaddress. If the user doesn't exist, which is the case for a new user, the wallet will create a new one anyway.
2. I always would use the user's name to recover from the wallet his address, there's no sense to store it again on a DB. ¿?

The time for a balance to be confirmed depends on the coin and its network.

$bitcoin->move($useraddress, $myaddress, $amount) Yes, it is instantaneous. There's no transaction broadcasted to the net.

How can I test out my bitcoind/php application with testnet? Anyone has any experience of this? ---> Go to the wiki, U have to set a specific parameter on bicoin.conf

Answer 2

Do not use bitcoind's accounts feature. Handle user/address associations in your DB instead.

Even Gavin Andresen himself has said:

... the bitcoind "accounts" code hasn't been optimized for that. For example, computing an account's balance loops through all transactions in the wallet, so will take an increasing amount of time the more transactions you have in the wallet.

https://bitcointalk.org/index.php?topic=40430.0

As for how to handle transactions/purchases in your game, I'd recommend setting up a field in your users table to store a user's balance. When a user deposits to their personal deposit address you'd update the field with their new balance. Set up a cron task that runs every minute and calls a script that does something like this:

1. Pull latest 10000 transactions from bitcoind and store them in an array.
2. Filter out transactions with less than 2 confirmations, or whatever number makes you feel comfortable.
3. Insert all confirmed transactions into a DB table called "transactions." Don't allow duplicates. Add a boolean field called "processed"
4. When you're ready to process transactions to the users' accounts, pull all rows where processed = 0 and category = 'receive'. Process each deposit by adding the value of the transaction to the user's account, and set processed = 1 on the processed transactions.

When a user buys something in-game, just subtract the purchase amount from their balance.

This will be a lot more efficient, scalable, and easy-to-use than relying on bitcoind for user balance-keeping. It will also be a lot easier to migrate data around in the future, if necessary.

Answer 3

You are correct on most of it rest can be experienced in development process. So I suggest you to start development and ask if you find it difficult to fix issues.