Skip to content

Instantly share code, notes, and snippets.

View bremea's full-sized avatar

bremea bremea

View GitHub Profile
@bremea
bremea / dbug.md
Created February 9, 2023 14:24
Discord API ban exploit (fixed)

A while ago, some friends and I discovered an issue with Discord's new slash-command mention feature. This feature allowed you to mention a slash command in the same way you could mention a user or channel. The mentions are formatted as </command_name:command_id>.

I was working on a Discord Bot at the time and was messing around with the command mention feature. I had a bug in my bot that accidentally caused it to mention an invalid version of one of the bot's commands (/guess). This resulted in the bot sending </guess:1046990336163069975>, which is an invalid command mention.

My friend maxx#0003 noticed a while later that any channel in which my bot had sent this message was causing the client to send a lot of requests to the Discord API very, very quickly. We soon pinpointed the issue to the invalid command mention, and after further experimenting, we realized that any command mention that was invalid would cause this bug to o