When writing and considering push and pull in a smart contract that involves "user" funds...

Withdraw funds rather than push funds to them automatically​ Favor pull over push for external calls as we've seen, external calls can fail for a number of reasons, including external errors. To minimize the damage caused by such failures, it is often better to isolate each external call into its own transaction that can be initiated by the recipient of the call. This is especially relevant for payments, where it is better to let users withdraw funds rather than push funds to them automatically. (This also reduces the chance of problems with the gas limit.)