Logic help needed, how to transfer funds to the address who placed bets on winning team?

Question

This is a betting application and

right now -> if I place bets on HOME, the amount gets stored but I want to transfer the amount only to the address who placed bets on winning team. I have developed code until getting the winner from oraclize but cant figure out

how to transfer funds to the address who placed bets on winning team

The issue-> How to check who has placed bets on the winning team and transfer funds

Oraclize query gives back the result which is HOME or the winning team but how to track which address placed bets on winning team and transfer funds to the winner

The workflow is like this

1) Solidity function expecting team number as argument which is being provided by the APP.JS file

2) The solidity function accepts the betting amount -> stores it and sends the request to oraclize to check for the winner

3) Oraclize provides callback providing us with the winning team

4) Now I want to transfer the funds only to the address who placed bets on the team which has won

App.js

  var contract = web3.eth.contract(OraclizeContract.abi).at(OraclizeContract.address);

  var team = document.querySelector("#bet #team").value;

  if(team == "Home")
    {
      team = 1;
    }
    else
    {
      team = 2;
    }
    console.log(team)

    contract.deposit.sendTransaction(team, {value: web3.toWei(betAmount, 'ether'), gas: 3000000}
      ,function (error, result){ 
           if(!error){
               console.log(result);//transaction successful
           } else{
               console.log(error);//transaction failed
           }
         });

Solidity code

  address public homeBet;  
  address public awayBet;

    mapping (address => uint256) public amountStore;

    event LogDeposit(address sender, uint amount, string executed);

    function deposit(uint team) public payable returns(bool success) {
        if(team == 1)
        {
        homeBet = msg.sender;
        amountStore[msg.sender] += msg.value;
        emit LogDeposit(msg.sender, msg.value, "Executed deposit HOME");
        oraclize_query("URL", "json(https://api.crowdscores.com/v1/matches/123945?api_key=).outcome.winner");
        return true;
        }
        else if(team == 2)
        {
        awayBet = msg.sender;
        amountStore[msg.sender] += msg.value;
        emit LogDeposit(msg.sender, msg.value, "Executed deposit AWAY");
        oraclize_query("URL", "json(https://api.crowdscores.com/v1/matches/123945?api_key=).outcome.winner");
        return true; 
        }
    }

This is the callback i recieve from oraclize on this callback i get to know the winning team and want to transfer funds

But the transfer is not working as expected Because i want 1) transfer only to the address who placed the bet on winning team I cannot figure out how to make it work

function __callback(bytes32 id, string result, bytes proof) public {

    makePayment(result);

 }

    function makePayment(string result) public {

    if (result.toSlice().equals("home".toSlice())) --->> IF HOME HAS WON
    {   
       < NEED LOGIC HELP > SEND MONEY TO ADDRESS WHO PLACED BETS ON HOME
    }
    else if(result.toSlice().equals("away".toSlice())) ----->> IF AWAY HAS WON
    {        
       < NEED LOGIC HELP > SEND MONEY TO ADDRESS WHO PLACED BETS ON AWAY
    }

}

Answer 1

For that type of situations it is recommended to use a withdrawal pattern. You do not pay directly but instead you store the winning address, then the winner have to call a withdraw function and it will be able to retrieve the prize.

function makePayment(string result) public {

    if (result.toSlice().equals("home".toSlice())) {   
       winner = homeBet;
    }
    else if(result.toSlice().equals("away".toSlice())) {        
       winner = awayBet;
    }
}

The withdrawal can be something like

function withdraw() {
    require(msg.sender == winner, "Only winner can call withdraw");
    msg.sender.transfer(<PRIZE AMOUNT>); // ** ISTANBUL FORK WARNING **
}

Note: After the Istanbul fork using transfer is no longer the recommended solution to make ether transfers. But there is no better alternative, using call & value is dangerous if you are not careful with possible re-entrancy attacks.