0

I want to design my web app to instantly accept crypto currency like Bitcoin as a payment for a subscription to the app. I will design it to cancel the subscription and ban the user’s account if the transaction does not appear in the blockchain 6 blocks later.

My app is such that malicious users wouldn’t be able to do much with just 1 hour of subscription time even if they constantly make new accounts. I’m counting on them just getting bored of the first few levels and taking the loss if they don’t. If I’m not giving refunds and I make sure not to withdraw pending coins myself, what attacks am I vulnerable to like Mt. Gox?

I have a degree in Computer Science, and I’ve dabbled in crypto for a while. The idea of working on a custom full node wallet for my server excites me. However, if someone has already built exactly what I need I guess I should use that. Are there any online payment services which already accept BTC instantly with an API for reporting false transactions?

2
  • re: "I will design it to cancel the subscription and ban the user’s account if the transaction does not appear in the blockchain 6 blocks later" - banning the user doesn't seem like a good decision, there are lots of legitimate reasons that a user's transaction might not be confirmed after 6 blocks. Otherwise, questions that are asking for service reviews (ie, 'which API service should I use') are not on-topic here. See: bitcoin.stackexchange.com/help – chytrik Oct 22 '20 at 0:55
  • Why do you need a third-party online payment service? If you want to control the BItcoin part of a transaction then using your own wallet API seems more sensible. If you want payment exchanged into a different currency then a payment service is appropriate - but then you need not be concerned with Bitcoin details at all and just cancel the corresponding subscription if the payment provider reverses a fiat transfer. – RedGrittyBrick Oct 22 '20 at 13:12
0

I will design it to cancel the subscription and ban the user’s account if the transaction does not appear in the blockchain 6 blocks later.

It's better if there is a system that waits for few hours before sending an email to the user that subscription maybe cancelled if transaction is not confirmed soon (1 confirmation). If the user fails to make the payment or reach support via email, subscription is cancelled. The reason I am suggesting to use time instead of blocks is because there is no fixed time interval between two blocks. It can take anything from few minutes to few hours for 6 blocks to be mined. The transaction may or may not be included in next 6 blocks depending on the fee rate used in this transaction and fee rate used in other unconfirmed transactions (mempool). Also1-2 confirmations are considered safe to accept a transaction as final.

blocks

If I’m not giving refunds and I make sure not to withdraw pending coins myself, what attacks am I vulnerable to like Mt. Gox?

Not sure if I understand your question correctly, If you can implement the above described process in your web app with no vulnerabilities, there shouldn't be any issues.

Are there any online payment services which already accept BTC instantly with an API for reporting false transactions?

You should research more about btcpayserver and discuss things with the devs involved in it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.