0

I'm new to this and I want to simply allow users to deposit ETH to an address (not a contract).

I was wondering what is a safe way to do this? for example using the code below on client side i can simply create transaction and open up metamask for user to confirm it

        web3.eth.sendTransaction({
        to: add,
        from: web3.eth.accounts[0],
        value: web3.toWei(depositInput.value, "ether")
    }, (err, res) => {
        if (err != null) {
            console.error(err);
        } else {
            console.log("success, ", res);
        }
    });

and then send the depositInput.value to server side and add it to user's account.

but i don't think this would b a safe way to do this (safe in terms of users being able to modify the code)

I would appreciate some help :)

1

As you are using an Owned account and not a smart contract, there is no way to control how much someone can send to you. If your application need to verify that the transactions to your account should have an specific value, you should implement a simple smart contract, for instance:

address owner; // this is where you want the money to go

function getPayment() payable external{
    require(msg.value=='put here your minimal payment');
    owner.transfer(msg.value);
}

Like this your users send the money to the contract, the contract checks that they sent the correct amount and then sends the money to you personal account.

Hope this helps.

1

What you could do to check if address is contract or not is run the following code:

web3.eth.getCode("0x2C2fcb7A5a5b759eA285aED1C9EFa0A3c97a6E7b")

If the result is different than '0x' then the address is contract.

However this is keeping ONLY your front-end users safe. You should always start the protection from the other way around and secure your smart contract first. You can do that by adding this piece of code to your smart contract:

function isContract(address _addr) public returns (bool isContract){
    uint32 size;
    assembly {
        size := extcodesize(_addr)
    }
    return (size > 0);
}
0

how about creating this code as/in a contract, where it cannot be manipulated?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.