A Bitcoin project

Some words about hedging

The Bitcoin market is pretty fresh and unstable at the moment. It is greatly affected by any news on this market. We expect slow grow of exchange rates in the long-term. This assumptions is based on the following facts:

• The world requires anonymous currency. It is used not only for illegal transactions (like buying/selling drugs, weapons etc.), but also as a currency which is free from any political influence, not affiliated with any country, etc.
• Close-to-zero transaction fees. If an operation is made within the Bitcoin infrastructure you have no additional fees for running a bitcoin account
• Deflationary nature of bitcoin. The emission amount is fixed and could not be extended. Since (like any other currency) bitcoin's will be lost - the price of the rest should increase to compensate that

Unfortunately, all other *coins (Litecoin, Dogecoin, etc.) have close-to-zero influence on bitcoin exchange rates, while bitcoin exchange rates affects this currencies greatly. Detailed analytics of exchange rates dynamics on 3 different exchange markets revealed 0.00037% probability of getting profit by running exchange operations between different *coins (mostly due to exchange fees of sites)

Our opinion is that it is a nice time to start getting bitcoins :) It's exchange rates have still not recovered after the MtGOX failure, but recent research revealeds that MtGOX may have money on it's account, so we expect constant growing exchange rate of Bitcoin in next 3 months

What needs to be implemented?

This section describes a scope of the project. The main target of current project is to provide an easy way to perform easy transactions within system. So we need just three points of functionality:

• Adding money to amount (cash-in)
• Transferring money to other person's account
• Cash-out

Additionally to simplify people's life transferring money to other person's account should track "friends list" to simplify multiple transactions to other persons.

Since world is mobile now - all that operations should be available both from web-interface and mobile apps.

What will be great to have in future?

This section describes functionality outside initial project scope, but could be considered in future.

• "Send me money" button. When user click's it a popup appears on site where person could send money in one click
• QR-send. Using mobile you could scan a QR-code and confirm sending money in one click

What about security?

Security is a main concern of the project. Since we're building a system on top of bitcoin - there is no way to reverse any transaction.

So let's review possible approaches.

(rejected) Single bitcoin account managing all users accounts

We have just one bitcoin wallet, which contains all coins owned by our users. All in-system transactions are tracked by our system, same applies to account balances.

Pros: + Very easy to implement + Extremely fast (since there are no "real" transactions when we pass money from one person to other)

Cons: + extremely risky. Let's imagine situation when hacker was able to access account. He will be able to move all bitcoins to other address resulting in system crash

(rejected) Separate bitcoin wallet for each user

Each user has one bitcoin wallet. All transactions are performed by real bitcoin transactions

Pros: + Simplifies client logic. We do not need to "count" money - just retrieve them from bitcoin wallet and display to user + Way more secure - user have no real access to other uses wallet

Cons: + harder to implement + When we make transaction from one user to another we need to receive confirmation from bitcoin network which is not immediate. + risky. If hacker was able to compromise not account, but access to system same risks as previous options apply

Separate bitcoin wallet + cash-in-out wallet

The main problem of the previous approach is that a possible hacker has access to all bitcoins in the system, including bitcoins used by the cash-in and cash-out wallet. The solution is to run the system using 2 separate modules (ideally on two different network machines) - one for in-system transactions and one for cash-in/cash-out. The second one should accept just two operations "Give X BTC to user Y in system" or "Take X BTC from user Y". Since the code of second module will be simple and straightforward - it's easier to make it secure. Compromising client accounts will not compromise real money

How that will work?

AAA (Authorization, Authentication, Accounting) is always a compromise between usability and security. We suggest the following approach:

• User registers with his phone number. He may (or may not) enter recovery email address
• When user signs-in into the application two-factor auth is used by default - login, password + OTP (one-time-password) sent by SMS. Two-factor auth may be disabled in the settings by the user
• Each transaction higher than X$ is confirmed by OTP. If total sum of transactions within one hour exceeds X$ - each transaction is confirmed by OTP (that is done to prevent stealing money by millions of small transactions)
• Password recovery - user will have two options - send recovery info to email or to phone. If he selects phone - recovery information is sent within next 48 hours (but not earlier than 24 hours). That is done to ensure that if phone is stolen - user has enough time to block sim-card.

What is the status of development?

We're currently working on server-side stuff - bitcoin's transferring between two separates system. This part of system will be covered by unit tests to ensure security and reliability. Code should be ready soon if anyone is interested