1

On my website I'd give a user a) a Monero address b) amount to send

But how would I verify a payment in an automatic manner, without a third-pary and, preferably, without a full node either? Would I have to ask a user to enter a transaction ID after he's sent a payment? Meaning, a user would return on a payment page and enter a transaction ID, and my script would verify an incoming payment by it.

Would transaction ID alone be enough? Would he be able to re-use some else's transaction ID in a attempt to cheat me?

Additionaly, would there be an issue in regards to verifying a payment, if I reuse an address among multiple users?

Note that I'm ok with connecting to the public Monero nodes and block explorers. And I might be ok with running a full node too. But I'm not ok with using third-party paid services.

1 Answer 1

3

That would not work, since you cannot check the transaction id is on the chain or not without a node or a third party to do the check for you, without even getting into checking whether that transaction id does pay you.

If you really must have no node and no third party, then...

The customer sends you the block header the tx was mined in, plus the ordered transaction id set in that block, which includes the tx the customer sent you. The customer also sends the actual tx.

Then you can verify that the transaction hash is in the claim tx id set. Then you can calculate the hashing blob, and thus verify the block yields a hash below a high difficulty which corresponds to the rough Monero difficulty.

Doing the above ensures about as much energy was expended in creating the block as was on the real Monero network, so it is unlikely someone would expend thats much work without actually mining. Of course, it can still mean the block was orphaned.

If this is not enough, you can request N blocks prior to the block with the tx, and do the same for those N blocks too.

Once this is done and you know with reasonable certainty the tx is certain to be in the chain (and thus valid), you can check the tx actually pays you and how much. For this, the customer would also send a proof generated by get_tx_proof, which you'd check using check_tx_proof.

If you're worried about the block being orphaned, you can also require M blocks after the block containing the tx, and do the same block checking work for those (do not forget to verify each block does point to the block hash of its purported parent). This will of course mean a delay before such a proof can be made.

6
  • That would not work, since you cannot check the transaction id is on the chain or not without a node or a third party to do the check for you, --- what kind of third-party do you mean? I meant that connecting to the public nodes, in order to gather some information which I'd otherwise garther from a full local node, would be ok for me. Then I'd make a request to any monero public chain explorer using a TX_ID.
    – Kakaraji
    Commented Apr 3, 2021 at 13:34
  • By third party I mean a party which is not you. Like a node operated by someone else. If you're OK with asking a stranger's node, then it's a lot simpler: run your wallet connected to that node as you'd normally do. In that case, the node's operator can still fool you if they know your monero address, by making seemingly valid blocks without valid PoW, including a tx that pays your address.
    – user36303
    Commented Apr 3, 2021 at 16:39
  • Yes, but re-read my question because you've not answered it
    – Kakaraji
    Commented Apr 3, 2021 at 18:39
  • The questios seems to be "would be txid be enough?" If so, no. Ask for a tx proof. This requires knowing secrets other random people will not know.
    – user36303
    Commented Apr 4, 2021 at 9:20
  • Alright. What's "tx proof"? Will then tx id and tx proof be enough, or will anything else be required as well?
    – Kakaraji
    Commented Apr 5, 2021 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.