Owner ID mismatch & authorization inconsistency in Discord integration
Severity: High (Security / Authorization logic)
Environment:
Discord server (2 members only)
OpenClaw bot connected
Fresh session
Commands used: /reset, /compact, /new
Config modifications attempted via shared context
---
Description
OpenClaw refuses configuration changes in a Discord server by claiming that:
1. The server owner is a specific Discord numeric ID (4053691417430xxxxx)
2. The requesting user is not the owner
3. However:
The bot inconsistently exposes that owner ID publicly in group chat
It sometimes confuses username vs Discord ID
It cannot see the requester’s Discord numeric ID in metadata
It relies on a hardcoded owner ID instead of dynamic verification
This creates:
Authorization confusion
Potential information leakage (owner ID exposed)
Incorrect identity resolution
False refusal of legitimate owner actions
---
Reproduction Steps
1. In Discord server with OpenClaw bot
2. Ask bot to apply config modification
3. Bot refuses saying only "Yannis (ID 4053691417430xxxx)" can apply
4. Ask bot what your ID is
5. Bot:
Cannot access numeric ID
Sees only username
Confuses identity mapping
Exposes owner ID publicly
---
Expected Behavior
Bot should validate ownership via:
Discord role check
Guild owner check
Token-authenticated verification
Bot should NEVER expose owner numeric ID publicly
Bot should correctly resolve requester identity
Bot should not rely on static hardcoded ID
---
Observed Issues
Owner ID appears to be statically configured
Username ≠ Discord ID confusion
Metadata does not include numeric Discord ID
Security model is brittle and spoofable
Possible social engineering surface
---
Security Impact
Owner ID leakage
Authorization bypass risk if ID spoofing possible
Misaligned trust boundary
Group-chat identity ambiguity
Bot behavior was inconsistent and confusing.
Environment:
Discord server (2 members only)
OpenClaw bot connected
Fresh session
Commands used: /reset, /compact, /new
Config modifications attempted via shared context
---
DescriptionOpenClaw refuses configuration changes in a Discord server by claiming that:
1. The server owner is a specific Discord numeric ID (4053691417430xxxxx)
2. The requesting user is not the owner
3. However:
The bot inconsistently exposes that owner ID publicly in group chat
It sometimes confuses username vs Discord ID
It cannot see the requester’s Discord numeric ID in metadata
It relies on a hardcoded owner ID instead of dynamic verification
This creates:
Authorization confusion
Potential information leakage (owner ID exposed)
Incorrect identity resolution
False refusal of legitimate owner actions
---
Reproduction Steps1. In Discord server with OpenClaw bot
2. Ask bot to apply config modification
3. Bot refuses saying only "Yannis (ID 4053691417430xxxx)" can apply
4. Ask bot what your ID is
5. Bot:
Cannot access numeric ID
Sees only username
Confuses identity mapping
Exposes owner ID publicly
---
Expected BehaviorBot should validate ownership via:
Discord role check
Guild owner check
Token-authenticated verification
Bot should NEVER expose owner numeric ID publicly
Bot should correctly resolve requester identity
Bot should not rely on static hardcoded ID
---
Observed IssuesOwner ID appears to be statically configured
Username ≠ Discord ID confusion
Metadata does not include numeric Discord ID
Security model is brittle and spoofable
Possible social engineering surface
---
Security ImpactOwner ID leakage
Authorization bypass risk if ID spoofing possible
Misaligned trust boundary
Group-chat identity ambiguity
Bot behavior was inconsistent and confusing.
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
131,281Members
Resources
Similar Threads
Was this page helpful?
