search

jagrosh / GiveawayBot

🎉 Hold giveaways quickly and easily on your Discord server!
https://giveawaybot.party
Apache License 2.0
649 stars 304 forks source link

Escrow for prizes #82

Closed heftymouse closed 3 years ago

heftymouse commented 3 years ago

It would be useful if the host of the giveaway could put prizes, which are more often than not redemption codes for software and such, in some kind of 'escrow' with the bot. Then, the winner(s) would be able to automatically collect their prizes unattended by the host.

Sanduhr32 commented 3 years ago

This is already a planned feature.

heftymouse commented 3 years ago

Ah, very nice. Eagerly awaiting this!

jagrosh commented 3 years ago

This is already a planned feature.

To be a bit more specific, this was a planned feature. However, due to the scale of the bot, having the bot store the actual prizes would undoubtedly lead to problems.

We already have to deal with complaints about the bot "being rigged," despite the source code being public and statistics backing almost every scenario that has been presented. Most of these boil down to a user not trusting the bot, and having the bot store the prizes would definitely make this worse.

Beyond the surface-level user concerns, storing the prizes also increases security concerns on our end. While I've never had anyone successfully attack the database of any of my bots, storing prizes would not only mean that a successful attack would be more detrimental, but also that the frequency of attempted attacks would likely increase. In reality, I think the chances of a successful attack are very, very low (as I take measures to keep things secure), but it's not impossible.

We do see prize management as a hurdle for servers that do frequent giveaways, and we do want to make improvements to make it easier, but because of the reasons I've listed, I don't think the bot storing the prizes is a good idea. Something that we may consider would be if the prize contents were being sent via the bot (ie the host uses a command in DMs to instantly relay a message to the winner), but the bot never actually stores it. There are other facets to this as well, such as users deciding to not claim a prize, or the time-frame for claiming a prize expiring (and the bot possibly auto-rerolling). I think an ideal setup would mean that the bot would automate everything up until the host gets some kind of notification about a claimed prize and can provide the prize at that time to be instantly relayed to the recipient.