Imagine this scenario:
ACME company is selling a service for 1 AcmeToken to their users.
When a user wants to buy the service, ACME company generates a new Eth address for the user, so there is an association between EthereumAddresses and Users in the company database.
Unfortunately, this common scenario has one problem:
When the company wants to withdraw the tokens from all the addresses they generated, the company may spend a lot of ETH to cover GAS price costs.
So, I trasformed the scenario in this way:
The company receives all the tokens on one single Ethereum address and asks the transaction hash to the user, but.. in this way the user could take old transactions hashes to the same address, so I'm not considering proceeding this way so safe and secure.
How would you identify a single transaction in a safe way without creating a lot of addresses?