- snip -
- Provide each user a unique "deposit" bitcoin address to send to. This now means I need to create and manage a pub/private key pair for each user, and then monitor each of these for incoming payments. Not my favorite approach. Tedious and more spammy.
- snip -
Addresses are not account numbers. You shouldn't re-use addresses. You should think of an address more like an invoice number. It is a unique identifier that you give to someone so that they can send you a payment. If they will send you a new payment, they should get a new address. You should give a new address for EVERY payment you will receive.
- Provide one bitcoin address for everyone to deposit to and look at the sender bitcoin address.
Bitcoins don't have "sender addresses". Some services make an attempt to guess at the sender based on some assumptions about the previous transactions, but there is always a chance you will guess wrong. This will result in confusion and frustrated customers.
Are there any other options that are cleaner than these?
Yes. Do it the right way. Treat each address as a unique payment identifier, and generate a new address for every payment that any user will be sending you. Then keep that list of addresses in a database that you can reference.
Any errors in my assumptions?
Yes.
You cannot count on a user having control over what address their bitcoins were previously received at. Do not attempt to guess at a "Sending address" on a transaction. The bitcoin protocol does not spend bitcoins from addresses, it uses unspent outputs to provide value to a transaction. Those unspent outputs might not have been received at any address at all, they might have been received at multiple addresses, the address they were previously received at might not even be under the control of the user that is sending you bitcoins.