not storing bitcoins in a game and still using them?

[tutkarz]

I don't know if there is solution for this already but recently I think I found solution for my problem.
I'm designing a game where players will be able to sell/buy game gold for bitcoins from other players. But I didn't want to store their bitcoins in game accounts like it often happens in such cases. I decided to not store their bitcoins for two reasons: less trust needed because people are not handing me anything directly and if someone will hack site they wont be able to steal users bitcoins.

So how to do this? Players will have to save with their game account info some bitcoin address. They will create this address for this game themselves somewhere and submit only public part of this account (and eventually request signed message by that address so I know they have private key for it). When they will use my page to buy gold I will simply check if two stored addresses had transaction with specified amount between them and then send gold between accounts.
The only problem I found for this method is to force unique addresses, so one player can't submit already submitted address of other player. . Do you think this is good method for handling player transactions and maybe you can see something there I forgot to mention?

[1714886322]

1714886322

[1714886322]

1714886322

[1714886322]

1714886322

[bittyweb]

Instead of this, you can rather offer players to buy virtual points in your site through bitcoins, and then they can buy/sell gold through points, or even transfer to other players. So in this way, there will be no issue.

Rather than long process. This is what most of the sites are doing. Correct me if i am wrong. I am saying as per my experience.

[tutkarz]

Instead of this, you can rather offer players to buy virtual points in your site through bitcoins, and then they can buy/sell gold through points, or even transfer to other players. So in this way, there will be no issue.

Rather than long process. This is what most of the sites are doing. Correct me if i am wrong. I am saying as per my experience.

But game gold is already something like virtual points.

[bittyweb]

Instead of this, you can rather offer players to buy virtual points in your site through bitcoins, and then they can buy/sell gold through points, or even transfer to other players. So in this way, there will be no issue.

Rather than long process. This is what most of the sites are doing. Correct me if i am wrong. I am saying as per my experience.

But game gold is already something like virtual points.

Okay, i have understood now. So basically your idea is good, i like it. I thought something different at the first time.

[tutkarz]

Maybe I was not clear enough. I will try to explain it in different way.

Usual method:
1. create in game account with bitcoin address created by game.
2. send bitcoins to that address and you lose control over them basically.

My method
1. create in game account
2. create or use your own bitcoin address and submit only public part of it.
3. send signed message to prove you are the owner.

The rest is transparent for player and in my method player has full control over his account and nobody knows his private key except himself.

Edit: the only problem I see now is that player have to make order in game and then send bitcoins manually to specified address, so he has to do two things instead of one. But still I think safety is more important in this case.

[Reverb]

Hmm. Well, I rather do 2 things instead of one if that increases the safety of my bitcoins.
I think more people agree with me. Also very nice idea.

[olsn]

I like the approach, but I doubt that it will work hassle-free for the user.
In your wallet you have most likely multiple addresses, the standard way of BitcoinQT is just to send bitcoin from your wallet, not from a specific address.
So if your wallet contains 3 addresses with 1 BTC each, there is currently no (simple) way for the average joe to predict the address the btc are sent from. (I know that it IS possible, just not for the average every day consumer)
And 90% of the users will expect that it works with any address in their wallet. So unless you have all addresses of your wallet registered with your site, you will get in trouble tracking the correct transactions.

So to make this work with just 1 address, most users would have to create a seperat wallet (maybe somewhere online?), then send BTC to that wallet (which contains only 1 address) and from that special single-address-wallet they then initiate the "real" transaction, that will be tracked by your servers.

As I said, I do like the idea(even if not flawless apart from the address-issue), maybe you can find some ways around this, but I will stick with Reverb on this one: Most users want it easy and hassle-free, the word "security" is just in their minds, they will put more trust in an image that says  "Verified Certified Trusted Service by Scamtrustifier XXX" than in some complex payment process they cannot fully understand.

[tutkarz]

I like the approach, but I doubt that it will work hassle-free for the user.
In your wallet you have most likely multiple addresses, the standard way of BitcoinQT is just to send bitcoin from your wallet, not from a specific address.
So if your wallet contains 3 addresses with 1 BTC each, there is currently no (simple) way for the average joe to predict the address the btc are sent from. (I know that it IS possible, just not for the average every day consumer)
And 90% of the users will expect that it works with any address in their wallet. So unless you have all addresses of your wallet registered with your site, you will get in trouble tracking the correct transactions.

So to make this work with just 1 address, most users would have to create a seperat wallet (maybe somewhere online?), then send BTC to that wallet (which contains only 1 address) and from that special single-address-wallet they then initiate the "real" transaction, that will be tracked by your servers.

As I said, I do like the idea(even if not flawless apart from the address-issue), maybe you can find some ways around this, but I will stick with Reverb on this one: Most users want it easy and hassle-free, the word "security" is just in their minds, they will put more trust in an image that says  "Verified Certified Trusted Service by Scamtrustifier XXX" than in some complex payment process they cannot fully understand.

you have some very good observations, which could be fixed by simple wallet where you will be operating on one address. The problem is more people would have to use this method so having such wallet would have a point.
Also I could request to copy transaction tx or sign message with address which was used for transaction but still its not simple for average user.
If I won't be able to find solution I would have to set up second server which will be responsible for transactions only and wont be visible from game server but this is more expensive.