SBC - Social trading questions

Torkus

I have a question about mirroring trades as suggested in the blog entry. I guess mirroring is all done in numbers (profit/loss percentage) but not in real transactions since we won't have any secret keys to make trades for our followers, just like a sort of fantasy trading. Of course it can be done if we create accounts for our users and we manage them but then managing other people's money is always risky and hacks can be disastrous.

So, should we go with fantasy trading only? The trader will make live transactions but followers will only reflect numbers on the DB, not real trades, right?

strasse86

You can give your users the ability to enter their private key, like https://stellarterm.com/#account does. It stays on client side and it is not accessible to them. Once the transaction is signed on the client side it travels encrypted. You do not have to create users accounts, users with existing private keys should be able to use them to "login" to your website, at least that is how I am implementing it.

My issue is that once a user wants to mimic another trader but he is not online once the trade happens, how his private key is going to be fetched so that he can sign a similar transaction at the same time ?

Torkus

strasse86

"once a user wants to mimic another trader but he is not online once the trade happens, how his private key is going to be fetched so that he can sign a similar transaction at the same time ?"

That's exactly the point of the question. We don't have the keys to mirror the operations as they happen so it's useless unless we do some fantasy trading or create accounts for them, again risking their money.

I'll start playing with fantasy trading and then implement something else as we advance.

mikeyrf

Sounds like you'd need to take a federation approach https://www.stellar.org/developers/guides/anchor/index.html

mikeyrf

Or just have a rebalance button when a user logs back in to the app

mikeyrf

Actually, just use multisig and have the user add your base account as a signer: https://www.stellar.org/developers/guides/concepts/multi-sig.html

Torkus

mikeyrf

That sounds like an interesting option. Right now deciding if the user will add us or we issue a new account with both signers at once, the latter being easier on new users and will allow to track it better since no other transactions will be submitted without both signatures.

Torkus

Ok here is the first draft, this is all fake data just to see how everything fits in place. I have a fixation with dark themes but will offer also a light option just in case. Feedback highly appreciated.

traders

jamesmudgett

Torkus would reduce information down to only a few indicators, drop real photos and names - use gravitatar + username instead, sort based on ROI (maybe a sort by this timespan, 1 week, 1 mo, etc), more color

mikeyrf

Yea I’ll likely be implementing the latter

dandalion98

I'm assuming that trade mirroring has to be automated, i.e. without user intervention? Then multisig would have to be 2/1. Not sure how helpful that would be.

Also (down the line) there will probably be compliance issues with taking custody of the account key. Just look at all the KYC processes Satoshipay is doing- and they're not even custodial.

dandalion98

Is there a way to atomically get the balance and the last transaction? If not seems like there would always be a race condition when trying to see the balance associated with a transaction.

mikeyrf

Not sure what you mean by 2/1. Just set up the mirroring like Example 2: https://www.stellar.org/developers/guides/concepts/multi-sig.html#example-2-joint-accounts

dandalion98

I meant 2 keys, 1 to authorize. I'm not sure what the benefit of having 2 keys is in that case, since you don't need user's approval. It does allow user to revoke the other key. But from a legal perspective I don't think it changes anything.

mikeyrf

Ah got it. True true. You def likely need some nice legal language prompting the user the app has a certain level of control over their account when mirroring and if your apps base account secret key were ever compromised, etc etc

dandalion98

Are there any other Stellar apps that do this today (store a private key on server)? Only one I'm aware of is Stronghold. And they relocated to New Zealand! And obviously we don't have the same kind of legal resources (unless SDF could provide guidance).

mikeyrf

Looks like Lobstr.co stores an encrypted version of users secret keys but I’m not planning on going that approach:
https://galactictalk.org/d/6-stellar-wallets-overview/6

I meant simply keeping one Stellar account associated with your app with keypair stored on your server but never having your users keys sent to the server

mikeyrf

US regulatory stuff for trading seems to be up in the air (see Wyoming: https://www.reddit.com/r/btc/comments/7tx7gs/wyoming_the_grand_cayman_of_cryptocurrency/).

Stronghold probably just wanted to play it safe: https://medium.com/strongholdxchg/stronghold-moves-to-new-zealand-eb8862e43bd8

dandalion98

With that approach still I think if server gets compromised so do all user funds. Because the server key is basically as powerful as the user key. This is the main reason why most Stellar apps don't keep keys on the server.

Torkus

dandalion98 With that approach still I think if server gets compromised so do all user funds

Not necessarily, that's what multisigs are for. If they both have the same threshold then neither the user nor the server can submit any transaction individually reducing the risk of hacks on either side.

At least that's my understanding, correct me if I'm wrong.

mikeyrf

Ahhh good point. That’s a scary thought

mikeyrf

Torkus But doing it that way (like StellarGuard) means the auto mirroring won’t work since the user won’t be there to input their secret key