Able to Tip Myself on ArcBlock Community
On the ArcBlock Community Discussions (Feeds tab) (link), users are able to tip their own posts, which defeats the purpose of the tipping feature and can lead to abuse.
Steps to Reproduce:
- Log in to ArcBlock Community.
- Go to Discussions → Feeds tab.
- Find one of your own posts.
- Click on the Tip button.
- Complete the tipping process.
Expected Result:
- Users should not be able to tip themselves.
- The Tip button should be hidden or disabled on a user’s own posts.
Actual Result:
- The system allows tipping on your own posts.
- Tokens are transferred back to the same wallet, making the tipping system meaningless.
Bug Description: The tipping mechanism does not restrict self-tipping. This could be exploited to:
- Artificially inflate tipping statistics.
- Mislead community metrics.
- Cause confusion or waste gas fees if blockchain transactions are involved.
Severity Classification:
- Severity Level: 🔴 High
Suggested Fix:
- Add a validation check:
if sender == recipient → block transaction. - Hide or disable the Tip button for a user’s own posts in the UI.
- Display error message: “You cannot tip your own post.”
Priority: 🚨 High – Must fix to preserve tipping system integrity.
1 reply
This is allowed only if the sender did and receiver did are not the same.