Fix/sign and verify

[goldstarhigher]

Finish #6

All requirements are satisfied, except:

• Checking the balance and transaction history of any other user requires knowing the user's ID. It would be easier to just ask them their balance.
• Creating a Stats Endpoint requires access to the server that will host this bot.
• It's doubtful whether it's really necessary to set limits to transaction, cashout and deposit.

[chrlschwb]

I think the remaining requirements can be worked on after discord finishes updating to "Unique Usernames"

[bedeho]

hey, I'm seeing references to "sign/verify", which is a tell tale sign of being in conflict with these requiresments: https://github.com/Joystream/discord-bot/issues/6

I have to be crystal clear, if this does not comply with these requirements, we will not run this on the Discord.

[DzhideX]

Hi @HeinrichOlfert @chrlschwb ,

I just finished reviewing the work on the tip bot here and here are my thoughts. I didn’t go deeply into the code itself because the functionality has some problems which need to be ironed out first. These are some of the problems I’ve found:


• It seems the bot needs a secret seed to deposit funds. Not doing this is one of the requirements.
• Also, as @bedeho has made his opinion on this very clear I think it makes sense to implement the skipped requirements as well (to whatever capacity it is possible at the moment). For the stats endpoint I think it makes sense to have the code for this right next to the bot (e.g., api.ts ~ you can use express.js here) and whoever runs the bot can also run the stats endpoint.
• You shouldn’t be able to use an address that is not valid. I used decodeAddress from @polkadot/util-crypto to validate addresses before.
• Withdrawing with a wrong address set crashes the bot.
• Passing -1 or a string as a value to withdraw crashes the bot.
• Passing negative values in transfer does certainly not lead to expected results.

I would say maybe let’s try and focus on adding more validation and doing more rigorous functionality testing to make sure that everything works as intended. It also seems to me like not all of the comments from my previous review (https://github.com/Joystream/discord-bot/pull/4) were taken into account so it might be a good idea for that to be revisited.