1

We are wondering how we can build a wallet that talks to our website and gives the user the ability to request a withdrawal of his funds. We do not know what is the right question for this type of functionality that we want to build is, so any advice would be much appreciated:

The flow would be the following -> a: User got rewarded in crypto (BTC, XRP, ETH, LINK) (a digit on the database). b: User withdraws his reward to their address.

The reward gets credited to the user's account (simply a digit on the database), and NOT to user's wallet address, as the wallet should NOT generate new addresses for deposits, as we do not want to allow deposits at all.

To help with the explanation, Bitcoin faucet websites have such functionality usually, where you can withdraw your earnings but not deposit funds in them.

Cheers

Improve this question

1 Answer 1

Reset to default
1

There are many layers to this question. Also, I'm going to assume using just Bitcoin, for simplicity. For other cryptocurrencies the procedure would be mostly similar with important differences mostly in the backend.

On the Bitcoin layer, the simplest solution would be to have a separate wallet for the website.

On the interface layer, you can have a simple form on your website where the user can input the address when requesting fund withdrawal.

On the backend layer, your website can use any wallet software with an API or CLI, Electrum should be good, but is just an example. This API or CLI could be then invoked to make payments to users.

Your server would necessarily have access to the private keys for the website wallet, therefore security should be an important consideration. The wallet file on the server needs to be protected and the backend of your website must properly check the withdrawal amounts, properly authenticate users and properly mitigate common attacks. If you don't have experience with website security, there are many potential holes that can open avenues for attack. Elaborating on them is beyond the scope of Bitcoin StackExchange. The important precaution would be not to keep more funds than necessary on the website wallet and deposit more as needed, manually, from a wallet on your own computer.

(This answer was edited by author as a result of a discussion in the comments)

Improve this answer
6
  • 2
    There is no need for a 'master address', just a wallet that can programatically process withdrawal requests. A master address is just bad privacy for everyone involved.
    – chytrik
    May 15, 2020 at 10:57
  • That's a valid point, @chytrik. Using a modern wallet with change addresses is much better for privacy, although it doesn't really protect from transaction linking by determined attacker. There are also transaction cost considerations, especially with small amounts of BTC. I don't really think it's a "universally bad" practice, it all depends on the details.
    – Hubert Jasieniecki
    May 15, 2020 at 11:07
  • Maintaining privacy against a determined attacker is tricky, but re-using an address like that just makes the attackers job unnecessarily easy. Transaction costs are not any different, whether you send wallet top-ups and change to the same address, or new addresses. There is no difference in number of transactions, or byte size of transactions.
    – chytrik
    May 15, 2020 at 11:23
  • @chytrik I believe that using change addresses may lead to output fragmentation and therefore subsequent transactions will require more than one input, which would definitely make them larger in terms of byte size. I believe I have seen it happen in my own Electrum wallet. Some transactions can easily go to thousands of bytes instead of the usual ~250 bytes per one-to-one transaction. Also, while I would appreciate your answer if I'm mistaken about change addresses, I do believe that this thread is becoming an "extended discussion" and not suitable for comments.
    – Hubert Jasieniecki
    May 15, 2020 at 12:08
  • 1
    the specific address a new UTXO is locked to will not affect the fragmentation of the user’s UTXO set. Multiple UTXOs locked to the same address do not combine, they are still spent individually. So it is the same in either case, no extra cost. Your answer isn’t bad otherwise, I just comment because I hope to see builders of btc infrastructure using best practices, not re-using addresses :)
    – chytrik
    May 15, 2020 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.