RevokeCash / revoke.cash

❌ Revoke or update your token approvals
https://revoke.cash
MIT License
662 stars 237 forks source link

Allow users to receive notifications about Approval events #185

Open Steen3S opened 7 months ago

Steen3S commented 7 months ago

We want to build a notification feature where users can receive transactional emails about new allowances that are being made.

Right now we want to keep this system as simple as possible. So we only send an email when an Approval is made.

Subscribe user

  1. Sign in with Ethereum

  2. Prompt the user for their mail address.

  3. We create an Alchemy webhook for the user's address

    1. GraphQL query will look something like this

      {
          block {
            logs(filter: {topics: ["0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925", ${USER_ADDRESS}]}) {
              account {
                address
              }
              topics
              transaction{
                hash
                index
                to{
                  address
                }
                from {
                  address
                }
                status
              }
            }
          }
        }
  4. When an Approval event is sent by the webhook we need to process this.

    1. Optional, run some filters
    2. send an email to the user.

Unsubscribe user

  1. Sign in with Ethereum
  2. Users clicks on Unsubscribe
  3. We need to remove the alchemy webhook.
  4. Optionally we could delete the user's email address from our DB
rkalis commented 7 months ago

We just talked about this, and it probably makes more sense to have 1 global webhook that listens to all global Approval events. Then on our service we can check if any of the involved addresses belongs to our subscribers. If so we'll have to send an email.

Besides using an Alchemy webhook, we could also look into using a "regular" RPC to listen for events, but Alchemy webhooks are probably easiest to start with.

Steen3S commented 2 months ago

@rkalis and I tested the system and we figured out that email is not the way to go here.

Sending emails as Revoke will open up a lot of possibilities for scammers. If you look at our email template below, you will see why :)

So we discussed this problem. And basically, the problem we want to solve is as follows.

We want to send transaction messages to users in a way that makes it possible for the user to validate that Revoke actually is the sender.

To address this, we can use the Discord server of Revoke by creating a private channel for each user that signs up for the notifications. This channel will only be visible to that user. Using Revoke's server will make it possible for a user to check if it's really Revoke.

Additionally, we could introduce multiple secret channels labeled by transaction topics, such as weekly_summary or set_approval. What’s cool about this approach is that a user can simply mute the topics they are not interested in.

CleanShot 2024-07-12 at 12 13 56@2x