0

Via the wallet-rpc api

  1. An integrated address is generated for a one-time payment
  2. User pays to address
  3. User is refunded excess payments

It is currently implemented like so:

  1. A walletRPC wrapper object is serialized and put into the users session, representing an interface to the walletRPC object and the information about the payment (ie: integrated address, payment ID, amount to be paid)

  2. The payment details are stored in an sql database

  3. If the user logs out, the payment object is restored from a payment entry in the payments table

  4. When the user pays, the script calls the get_payments RPC method every time the user checks the payment status

  5. Once get_payments returns enough $XMR, the order is sent through to the seller

  6. Once the payment is made, a refund is made to the users refund wallet, specified once the order is placed.

In the last point is my problem, I realised the only protection against infinitely draining the wallet through withdrawals was using my own PHP code. It bothers me because I don't want to mess up, I would rather there be a hard-limit on the amount withdrawable funds.

What is the best way to go about this? Just delete the payment once the refund has been made? Or is there another thing I am missing?

TL;DR:

I want a good refunding process that makes it impossible for the user to refund indefinately.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.