Let's assume that I have small crypto exchange site called "MyExchangeWebsite". It works like this: user creates ETH-BTC order, specifies his BTC address and sends ETH to my ETH address, I exchange it on Bitfinex and send resulting BTC to the specified user's address. Site is very simple and doesn't have accounts (non-custodial model).
By some reason user made a one-character typo in his BTC address for ETH-BTC order and it's impossible now to withdraw BTC, as checksum is bad. User noticed that he didn't receive BTC and contacts me to provide right address.
- Am I right in my understanding that it's safe to change user's address and it's impossible to scam MyExchangeWebsite by third person who knows about typo and user's order details?
- If it's not one-character, but N-characters typo. At what N it becomes unsafe to change N characters in user's address?
- What is the best way to make sure that I'm in contact with the real order creator?