I am working on an exchange platform with users having separate pair of public and private keys using blockcypher api. I encountered Blockcypher Wallet API, and it seems its a pleasant way of collating Set of Public Addresses to Query Together. For some reasons, i intend to add all new generated public addresses created by any user under a single wallet name (the site name) using the "Wallet API", this will come in handy in the case where by i need to filter all incoming transactions webhook to only the public addresses under the site name into a callback url. So i needed to confirm if this is a secure way to handle it. I would appreciate if an elegant way to handle this can be suggested.
1
-
If you’re building an exchange, and want ‘a secure way to handle things’, you should consider running your own node, not trusting a third party.– chytrikSep 28, 2018 at 19:55
Add a comment
|
1 Answer
When using a third party, you will be trusting them to give you correct information. This is not just about being dishonest but also about not having bugs.
For instance consider the recent cve-2010-5141 vulnerability. If you are running a full node on your own, you can know what is going on and you can upgrade when you find out about it. But if you rely on a third party you have to trust that they upgrade and are aware of it.
As a matter of fact they apparently have not yet upgraded and on TestNet they are showing a block with exploiting transaction as valid. So theoretically you, as an exchange, can lose money if you were relying on them and if this was MainNet.
answered Sep 29, 2018 at 4:16
