I have built a web game where users can purchase virtual items for their avatar with tokens obtained during an ICO.
What is the best solution for delivering the items to the correct web game user? I can imagine 4 solutions (1A2A, 1A2B, 1B2A and 1B2B) that all require an off-chain backend component.
1A) off-chain backend with own Ethereum account generation
- the web game backend creates an ethereum account when a user signs up and connects the private key to his account.
- the user can then send ETH to this new address to 'top up'.
1B) off-chain backend without own Ethereum account generation
- During signup the user has to register a wallet id with his off-chain web game account. He receives a random challenge, then needs to sign it (somehow) and submit the address, the signed message and the signature in a webform to the backend where the signature is verified.
- Upon successful verification, the wallet id is added to the web game account of the logged-in user.
- The user can henceforth 'top up' his web game account by paying from his registered account to the web game account address (same address for all users).
2A) on-chain frontend (dapp)
- Purchases are done by sending ItemTokens together with item ids to the web game's smart contract on Ethereum (for example from a 3rd party wallet)
- The smart contract checks whether the type and amount of items add up to the total value of the transaction and then either rejects the transaction or...
- accepts the transaction and writes item amount and type into the smart contract state (as item inventory)
- the web game frontend checks the blockchain, calculates the web game token balance for the logged-in user and makes items available in the game as they appear on the blockchain.
2B) off-chain frontend
- The web game backend periodically keeps track of blockchain payments (they're public) and updates the user's web game balance accordingly.
- purchases are done in the web app UI, and the cost is subtracted in the web game backend, and items are made available.
- Are these processes correct, implementable and safe?
are there other, better or different purchase processes possible
- Is there a way a wallet can be safely connected with a user account entirely without the use of an off-chain backend (and also without browser extensions such as metamask)?