jagrosh / GiveawayBot

🎉 Hold giveaways quickly and easily on your Discord server!
https://giveawaybot.party
Apache License 2.0
646 stars 302 forks source link

giveaway not being random #251

Closed kiki0124 closed 1 year ago

kiki0124 commented 1 year ago

So if someone with admin role enters a giveaway they have higher chance to win than someone without admin role, from my testing I had about 5 giveaways, each with around 25 participants, 3 admins, 1 winner each giveaway, in 3 of those giveaway one of the people with admin roles won.

MichailiK commented 1 year ago

In the code, the winner of a giveaway is determined here:

https://github.com/jagrosh/GiveawayBot/blob/3e12edf366f97a998a5ad3b10e8d2dd8e9e9ec0a/src/main/java/com/jagrosh/giveawaybot/GiveawayManager.java#L138

The selectWinners function calls randDouble:

https://github.com/jagrosh/GiveawayBot/blob/3e12edf366f97a998a5ad3b10e8d2dd8e9e9ec0a/src/main/java/com/jagrosh/giveawaybot/util/GiveawayUtil.java#L54

randDouble uses java.security.SecureRandom to generate a (cryptographically secure) random number.

https://github.com/jagrosh/GiveawayBot/blob/3e12edf366f97a998a5ad3b10e8d2dd8e9e9ec0a/src/main/java/com/jagrosh/giveawaybot/util/GiveawayUtil.java#L36-L41

Every user has 1 entry, and a random entry will be picked based on the random number generated by SecureRandom. Additionally, there doesn't seem to be any logic adding more entries to a user, or otherwise favoring people.

It seems unlikely to me that GiveawayBot is rigged in any way, may it be through favoring admins, or anything else.