Bitcoin Forum

Let's say you have to send user's account balance back.
For security reasons you have locked it so that it can be cashed out only to the address that sent the money.

Now when user sends money you see  2 addresses. The one that has sent/spent the money and the one that got the "change" back. Right?

To which one of them you think would be wiser to send the money back?

The original one is spent, so i'm not sure what happens with it and for how long it's kept?
The one that got the change is also owned by the user (unless there are some exceptions with web based wallets and the like?)

So do you see any drawbacks or advantages to any of the options?
What would you do?

I would sit down and read about how Bitcoin works, then come back here and ask a different question.

Seriously.

Wise words

You should also not assume every address in the inputs is controlled by the sender.  Generally you could send to any of them and the user should be able to receive them, but exceptions are things like sending from an exchange or webwallet where that address isn't owned by the user; or the co-signing stuff people have been playing with, where multiple parties pool their outputs for privacy/taint-confusion purposes (in this case not all input addresses are necessarily owned by the person who sent you the coins.)

So, if you're dead-set on sending back to one of the sending addresses, you should tell the user beforehand, and probably let them choose which one to send it to.

What should I do then guys?
Aren't there some best practices or something?

I understand that my questions might be lame and I have a lot of reading to do. And I'm getting there. But I would appreciate if someone experienced gives me a hand in the meantime, because i'm kinda pressed by time right now.

that's obviosly for an app, so i need a general solution

It wasn't obvious from your question that this was for an app, it could just as well have been a single transaction that you needed to reverse.

So for an app, let the user specify a withdrawal address. That way he or she can choose to which address any returned bitcoins will be sent.
Of course, if you want to lock that you'd need a way to unlock and change it, preferrably with something like 2FA to be reasonably sure that it was the user who requested the change.

Onkel Paul

Yes to both. I think letting the user specify an address when signing up is the best practice. The second solution is fine, except it limits the users in what wallets theyvuse every time they send you money.

Ok, when a user sends money, bitcoind sees 2 addresses and if i have understood correctly we can't tell whch is change and which the original input right?
so sending to any of those will be fine as long as the user is not using a web wallet, is that right?


if he is using a web wallet, the only way is to let him set his own receive address, right?

Whatever the case make him specify his address

No, this is never right.  There is no such thing as a "from address".  Banish the idea from your mind.

Sure, when the user establishes their relationship with you request they give you an emergency refund address.  Maybe it's one they use for other things too, maybe not.  Then you have one on file that you can safely use.

Ideally every time a user requests a payment from you, you should prompt for a new address.  Address reuse gums up the privacy of Bitcoin users and fungibility of Bitcoin... but keeping an emergency refund address on file is a best practice for anyone who holds someone elses funds.

First learn to walk before you run.  You have fundamental misunderstandings about how transactions in Bitcoin work.  Start here: https://en.bitcoin.it/wiki/Transactions

If you have this little clue on how things work, you should not even consider writing an app, as it will almost certainly lose a lot of money for whoever uses it.  Try reading before making a lot of dumb assumptions and arguing with people who know a lot more than you.

why there is no such thing as from address?

Fundamentally it is because of how *new* coins are created (a tx that goes to an address but has no UTXO that it came *from*).

Also in many tx's there will be more than one UTXO (therefore more than one *from* address if you look at it that way) and in the future things like "multi-sig" tx's just make it even more complicated.

Coins are not sent to addresses but to portions of scripts...
Seriously, there's a wiki other there. As a developper aren't you supposed to learn about something before coding about it?

Making a bitcoin-spending bot without knowing how bitcoin works? It's just flushing your money to the toilet

Ready fire aim.

Yeah, can't forget about this one Mtgox did...

https://bitcointalk.org/index.php?topic=50206