needmoney90's comments

Regardless of the currency paid in, guaranteed refunds pegged to an exchange rate at the time the refund is issued will be a potential vector for manipulation. Consider these two cases using relevant historical data.

Case 1, Bitcoin refunds are pegged to the USD price at the time of sale and refund (your current strategy): It is currently 12/7/2014. The price per Bitcoin is approximately $380. I purchase a Christmas gift for someone,which just so happens to be exactly $380. I pay one Bitcoin, and my package is shipped. I receive the package on the 18th, at which point the exchange rate is approximately $310 per Bitcoin (about a 20% drop). At a 3% fee, I decide it would be prudent to ask for a refund, so I initiate the process and send back my gift. I am refunded $380 in Bitcoin at $310 each, and therefore receive 1.225 Bitcoin in return. I have effectively short-sold my Bitcoins while simultaneously locking the USD value in at the higher exchange rate (the value of the gift). This is a no-risk hedge, and is effective at any point the exchange rate fluctuates downwards more than 3% over the maximum refund interval. If the price goes up, I don't get a refund, and keep the gift, effectively locking in its value.

Case 2, Bitcoin refunds are pegged to the amount of Bitcoin initially spent: It is currently 11/4/2014. The price per Bitcoin is approximately $320. I buy a really nice bottle of Scotch from someone, that happens to cost exactly $320. I pay with one Bitcoin. On 11/13/2014, the price has risen to $420 per Bitcoin. I decide to get a refund, and as the amount of Bitcoin I spent is refunded, I receive 1 Bitcoin in return. This is again a no-risk hedge, as if the price drops, I keep the Scotch (or sell it, and increase my net Bitcoin holdings).

The only way that I can see you guys not having a financial risk as a counterparty, is if you do refunds in a way pegged to both USD and Bitcoin. You could achieve this by refunding an amount of Bitcoin equal to the product value in USD pegged to the exchange rate at the time of refund if the exchange rate rises, and refund an amount of Bitcoin equal to the amount initially paid if the exchange rate falls. This (rightly, in my opinion) puts all risk of exchange rate fluctuations solely on the person requesting the refund.

I understand that in charging a 3% fee on each transaction, all users of Stripe are in effect insuring your company against anyone attempting to game the system in this way, so my point may be moot (you can eat the losses from the malicious <1% of users), but I am of the strong belief that any system that can be gamed for a profit, most likely will be gamed, by some unscrupulous individual. Your company is effectively able to be used (currently) as a hedge against falling prices (scenario 1) in what is, at the moment, a year-long bear market for the exchange rate. This doesn't really feel to me like the smartest road to go down. What are your thoughts on this?

I cited one of his papers actually, I didn't know that site with all his works existed though. Thanks for the link, I'll read some more of his writings.

I'm not surprised that someone else had the idea. Honestly, the fact that it wasn't in the wild yet surprised me. Great code, I'll be looking over it in my free time!

(I'm one of the authors of the paper)

You suspected correctly. Christopher and I wrote this for a computer security class at UCSC (taught by Ethan Miller, who I expect will at some point read this), and I posted it to reddit to see what people thought. The paper was a bit rushed, and isn't proofread at all, if I had known it would pop up on HN, I would have polished it a bit more.

It is not. I wrote this for a computer security class, and the paper itself was (unfortunately) last minute. I posted it to reddit last night as an afterthought, found it here in the morning. I'm sorry if it isn't up to any sort of standards, this draft was rushed, and I wasn't expecting it to get any sort of traction.

Author here! I'm surprised to see this up on HN, I checked the front page, and here it was. This was written for a computer security class, and definitely hasn't been proofread yet. If anyone has any questions, I can answer anything you like.