Via the wallet-rpc api

  1. An integrated address is generated for a one-time payment
  2. User pays to address
  3. User is refunded excess payments

It is currently implemented like so:

  1. A walletRPC wrapper object is serialized and put into the users session, representing an interface to the walletRPC object and the information about the payment (ie: integrated address, payment ID, amount to be paid)

  2. The payment details are stored in an sql database

  3. If the user logs out, the payment object is restored from a payment entry in the payments table

  4. When the user pays, the script calls the get_payments RPC method every time the user checks the payment status

  5. Once get_payments returns enough $XMR, the order is sent through to the seller

  6. Once the payment is made, a refund is made to the users refund wallet, specified once the order is placed.

In the last point is my problem, I realised the only protection against infinitely draining the wallet through withdrawals was using my own PHP code. It bothers me because I don't want to mess up, I would rather there be a hard-limit on the amount withdrawable funds.

What is the best way to go about this? Just delete the payment once the refund has been made? Or is there another thing I am missing?


I want a good refunding process that makes it impossible for the user to refund indefinately.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.