Disclaimer: SynapseBot is only a proof of concept. It is not secure and should never be used for real users, nodes, or transactions.
1. BACKGROUND
This is part one of a series in which we’ll cover different ways to integrate with the Synapse API.
Our goal in building a Slack integration was to leverage the Synapse API to allow users to follow this flow easily over Slack:
- Open a deposit account for savings;
- Connect an existing checking or savings account;
- Set up recurring or one-time transfers from the linked account to the new savings account.
We chose to build our bot in Python, which is what we use internally here at Synapse. We went with the Flask framework for its lightweight and highly customizable nature. We imported the Synapse client library and the Slack client library to make communicating with the APIs a bit simpler.
Source code: https://github.com/SynapseFI/demo.slackbot
2. USING SYNAPSE BOT
Invite Synapse bot to a channel. Type “@synapse help” to see a list of commands:
Synapse bot will send you a registration link if you haven’t signed up yet:
View user information:
View your nodes (bank accounts) and verify micro-deposits:
Create a one-time savings transfer:
Create a recurring savings transfer:
Cancel a transaction:
3. HOW IT WORKS
Available Commands
The Event Loop
This function starts the connection to the streaming Slack Real-Time Messaging (RTM) API, using SlackClient. It listens for new input from the Slack channel every 1 second and relays the message to the bot if found. (modified from https://www.fullstackpython.com/blog/build-first-slack-bot-python.html)
Registration
This form collects everything needed to create a Synapse user, perform KYC, link a bank account, and set up a deposit account in the user’s name. On form submit, the server relays everything to the Synapse API and then links the Synapse user ID to the user’s Slack ID in the database.
The Models
User
The User model ties the Slack user ID to a specific Synapse user ID. It also stores the Synapse node IDs for the linked ACH (debit) node and the SYNAPSE-US (savings/deposit) node.
RecurringTransaction
The RecurringTransaction model stores the amount (in USD) of the recurring transaction and how often (in days) it occurs. Its relationship with User is such that a User has many RecurringTransactions.
User create & KYC logic
Logic for creating a user in Synapse:
SynapseUser is imported from the Synapse Python client library.
Logic for processing KYC info (base document, SSN, and GOVT_ID in this case):
Create Node logic
These functions create the Synapse nodes representing the user’s bank accounts:
- An ACH-US node representing the user’s checking account.
- A SYNAPSE-US node representing an FDIC-insured account that we create in the user’s name.
AchUsNode and SynapseUsNode are imported from the Synapse Python client library.
4. CONSIDERATIONS
Security
The biggest security problem right now is that the registration link is based on the user’s Slack ID and can be guessed easily:
This allows anyone who knows a user’s Slack ID to sign up on their behalf. We could improve this by PMing or emailing the user a secure, randomized link with a timed expiration.
Besides that, we are essentially relying on Slack’s user authentication to ensure the correct person is logged into the account. If an unauthorized user gained access to someone else’s Slack account, they would have access to the owner’s nodes in Synapse and the ability to send funds.This risk is somewhat mitigated in our implementation by the restriction that they would only be able to send funds from the owner’s checking account to the owner’s savings account.
Currently, SynapseBot will post messages in a public Slack channel for other users to see. It would be better to keep these messages private, either visible only to the user or sent as direct message.
We are not saving any user data to our database, other than Synapse ID numbers, so we don’t have to worry too much about handling sensitive user data. This is a good practice that we recommend to anyone integrating with the Synapse API.
Features Wishlist
We could allow users to add nodes through bank login instead of just through account/routing numbers. Since bank logins can have multiple accounts, we would then need a way for users to select which account they want to link.
It would also be cool to allow different periodicities for recurring transactions. For example:
- Every 3 months
- Every 2 weeks
- Every 1st day of the month
- Every Monday
Lastly, it would be really awesome if the bot used webhooks to post a message notifying the user once a transaction settles (or if it’s delayed/canceled for some reason).
