Smart Contract firing send ether transaction that's not in the contract

Question

I need some help with my smart contract, here's the smart contract code

pragma solidity ^0.4.18;

contract UserToken {
    mapping (bytes32 => uint8) public tokenBalance;

    bytes32[] public userList;

    // Constructor
    function UserToken(bytes32[] userName) public payable {
        userList = userName;
    }

    // Returns the total votes a candidate has received
    function totalTokensFor(bytes32 user) view public returns (uint8) {
        require(validUser(user));
        return tokenBalance[user];
    }

    // Increments the token count of user
    function buyToken(bytes32 user, uint8 token) public {
        require(validUser(user));
        tokenBalance[user] += token;
    }

    function validUser(bytes32 user) view public returns (bool) {
        for(uint i = 0; i < userList.length; i++) {
          if (userList[i] == user) {
            return true;
          }
        }

        return false;
    }
}

I have a geth node connected to rinkeby and running on my ec2 instance in AWS, from there I've created the eth account address and then imported the JSON file to metamask.

Now this is the problem, whenever I call the function "buyToken", it fires four transactions

The first transaction is this https://rinkeby.etherscan.io/tx/0x3206678cdd6fdcfc4eddf3871002b77320d5e83f3bb5f9e2d9c0c0aa9bbc8817

An ether transfer to another address w/c is not in the contract, and the ether it transferred was 2.994817 Ether, again not in the contract, thus making the next three transactions disappear since there’s not enough balance in the account, original account balance was 3 ether.

Here's the code that calls the BuyToken

var web3 = new Web3(new Web3.providers.HttpProvider("http://localhost:8545"));
var userContract = web3.eth.contract(ABI);
var userInstance = userContract.at(contract address)

$("#buy_button").click(function(e) {
    let tx_hash = userInstance.buyToken("John", 3);
    e.preventDefault();
});

My question is why is this happening? There aren't any ether transfer code in my contract so what's the possible cause of this?

Thanks

Answer 1

Why are you referring to Etherscan for Rinkeby when your code is clearly pointed at your own local chain? http://localhost:8545 not a Rinkeby provider.

Your link to Rinkeby is likely from someone else's action entirely it appears, and your code is pointing at your own local instance of geth

Answer 2

This is not due to your contract and this is due to your network setup.
Please check the network where you have connected, Your problem seems you are creating your own network. Lets come to problem. Such a problem may happen due following configuration you made -

Your network setup

• You configured your node running in AWS is validating node.
• You Enabled the RPC port in same validating node.
• You unlocked account so your validating node works fine.

This is due to geth had this problem and many times we faced this problem. Disable rpc port of validating node and add one more node to interact with the blockchain, this node should do not have any unlocked account so your geth cannot automatically sent ether to arbitrary account.
Hope it helps!