search

noescape00 / DiscordTipBot

Tipping bot for discord that supports STRAT and other cryptocurrencies
GNU General Public License v3.0
5 stars 9 forks source link

Withdraw command should be deleted for security reasons #19

Closed miguelvazsilva closed 6 years ago

miguelvazsilva commented 6 years ago

For security reasons, the message invoking the withdraw command shouldn't stay posted on discord, because everyone can see easily, that per example by searching discord, the user knijia, should have access to a wallet with 324 Strat, and if the user has a big Strat holding, it could be targeted by hackers:

image

Of course, the user could delete the message, after invoking it, but I think that the tipbot should warranty this somehow, if you decide in the future to use the 2nd suggestion for the issue #13 , it would fit nicely for this purpose.

Thanks, best regards

noescape00 commented 6 years ago

@miguelvazsilva this was intentional so that all users can verify that bot actually withdraws specified amount to a target address.

However I've added a security note in the help message: 

Keep in mind that withdrawal address will be publicly visible to all users in this channel. 
To avoid exposing your address use withdraw command in private messages with the bot.
noescape00 commented 6 years ago

Addressed in https://github.com/noescape00/DiscordTipBot/commit/b7584506f16a361df86a470a9cee17209f7ab713