How to fix withdrawal / deposits limits for a custom asset?

Question

I am working on a private Stellar network with Docker and Stellar Laboratory.

I have deploy an asset with issuing and distributor accounts, but i want to establish some daily limits for withdrawals and deposits of my customers. How can I do it ?

I saw that I can add a maximum limit of tokens to an account during the Trust operation but it doesn't care about time. I also saw that I can use Stellar Smart Contracts "Time Bounds" to put limitations on the time period over which a transaction is valid. Maybe there is trick using this 2 functionnalities to solve my issue?

There is also the bridge & compliance servers that can be used I think but I did not really catch how to use them . Here there is a sendMax limit for the compliance, this is close to what I want : https://github.com/stellar/bridge-server/blob/master/src/github.com/stellar/gateway/protocols/bridge/payment.go

Thanks in advance

---

Sorry for the late I was on holidays.

Thanks for your response @sui, but I started to use a compliance server. I inspired from this Stellar documentation link to define my callbacks : compliance server but I have 2 questions :

---

1st point :

I can authorize a transaction with my callbacks but if i set the parameter "needs_auth" to true in compliance.cfg then my fetch_info callback doesn't receive any informations (request.body is undefined).

It is writted in the docs that the "needs_auth" parameter is used to check the information of a person receiving a payment. (link)

I can't access to the JSON AUTH_RESPONSE containing the field "dest_info". I don't understand to which server this response is sent.

Question 1) With needs_auth to true I only get the sender infos in my callbacks and not the destination infos (the 2nd call to fetch_info provide an undefined request.body), is it normal ?

UPDATE : Response to question 1 : the issue was that federation's SQL query was not responding the memo but only the stellar_address and account_id. So the 2nd call to fetch_info wasn't able to check KYC.

Solution in federation.cfg :

[queries]

federation = 'SELECT id, name as memo, 'text' as memo_type FROM people WHERE name = ? AND domain = ?"

---

2nd Point :

I saw that the SEP6 can also provide verifications about limits but the implementations are currently not finished yet : SEP6 implementation 1 , SEP6 implementation 2

Question 2) Can i do the same verification than the SEP6 with my own compliance callbacks?

Answer 1

You could set up a "regulated asset" which would require you to kind of approve every transaction and thus allow you to deny any transaction that does not comply with your custom limitations.

I'm aware of two approaches. For both you have to set the auth_required flag on your issuing account to prevent users to create a trust line without your authorization.

Approach 1) Require users to add you as a co-signer to their account (don't allow trust unless they have). This way they can not make transactions without a signature from you.

Approach 2) Require users to prepend/append a change_trust allow/revoke operation to every transaction. This way they also need a signature from you for the change_trust operations and get a temporary authorization for that single transaction only.

A way of handling the co-signing process is described in SEP-8.