How escrow, audits, and admin accountability actually work.
We're happy to announce that DonutTrade is source-open. The full platform — API, web frontend, bots, escrow logic, admin tooling — lives on GitHub under the Functional Source License (FSL 1.1). Every endpoint, every admin check, every cryptographic operation: all readable, all verifiable.
> github.com/givey999/donuttradeAvailable today for reading, learning, and non-commercial use. Auto-converts to Apache 2.0 two years after each release. See LICENSE in the repo for the exact terms.
We don't want to store passwords — so we don't. Sign-in goes through Microsoft or Discord OAuth. DonutTrade never sees your password. You'll notice scaffolding for an email+password sign-in path in the repo — we're intentionally not shipping it, precisely because we don't want to be in the business of storing credentials.
When you sign in with Microsoft, we request the openid, email, profile, and offline_access scopes. From the returned ID token we extract your Microsoft account ID and, if present, your email address.
We store the Microsoft account ID to identify you on future logins, and the email address in the users table (nullable — not all Microsoft accounts include one).
The Microsoft access token is used once at sign-in and never stored.
If you link or sign in with Discord, we request the identify and email scopes. From /users/@me we receive your Discord user ID, username, and email address (if your Discord account has one verified).
We store your Discord user ID and username. The email is stored in the shared users.email field.
We do not read your messages, server list, friend list, or any other Discord content.
You can unlink Discord at any time from /dashboard.
[t=0] buyer.submit_order(item=zombie_spawner, price=45000) [t=0.01] api.issue_code(order_id=42, hmac=sha256(payload + CODE_SIGNING_SECRET)) [t=0.02] escrow.lock_funds(buyer, amount=45000) [t=1h] seller.submit_fill(order_id=42, code=<verified>) [t=1h] escrow.verify_hmac(order_id, code) → OK [t=1h] escrow.release_to_seller(amount=44100) // -2% platform fee [t=1h] escrow.deliver_item(buyer) [t=1h] audit.log(action=trade_completed, order_id=42)
Every line above corresponds to a real function call. Grep packages/api/src/ in the public repo to find them — starting with packages/api/src/lib/deposit-code.ts for the HMAC generation.
| TIMESTAMP | USER | ACTION | TARGET | METADATA |
|---|---|---|---|---|
| 2026-04-14 14:32:01 | xDarkKnight | deposit_code_issued | zombie_spawner ×3 | DT-DEP-xJk...Lm |
| 2026-04-14 14:35:47 | admin@platform | deposit_approved | DT-DEP-xJk...Lm | verified_in_game |
| 2026-04-14 14:40:12 | xDarkKnight | order_created | order_id=42 | price=45000 |
| 2026-04-14 15:12:08 | CraftMaster99 | order_filled | order_id=42 | hmac=OK |
| 2026-04-14 15:12:08 | escrow.service | funds_released | CraftMaster99 | amount=44100 |
| 2026-04-14 15:45:30 | CraftMaster99 | withdrawal_requested | DT-WTH-p8Q...Rn | amount=44100 |
| 2026-04-14 16:02:11 | admin@platform | withdrawal_confirmed | DT-WTH-p8Q...Rn | delivered_in_game |
| 2026-04-14 16:02:12 | system | trade_completed | order_id=42 | fee=900 |
The audit log is append-only at the database level. Admins — including the platform owner — cannot edit or delete rows. Your real activity lives at /dashboard. Example rows shown above are illustrative.
Deposit and withdrawal codes are signed with HMAC-SHA256 using a secret that lives only on the server. Only the server can create a valid code. Even an admin, without the secret, cannot forge one.
// packages/api/src/lib/deposit-code.ts
const payloadStr = Buffer.from(JSON.stringify(fullPayload)).toString('base64url');
const signature = createHmac('sha256', config.CODE_SIGNING_SECRET)
.update(payloadStr)
.digest('base64url');
return {
code: `${prefix}${payloadStr}.${signature}`,
expiresAt,
};The full implementation (including verifyCode with timing-safe comparison) is in packages/api/src/lib/deposit-code.ts in the public repo.
2% of each completed trade, shown in the UI at order creation. Split between buyer and seller.
Item sellers will be able to pay for top placement on the marketplace. Sponsored rows will be tagged SPONSORED. Not yet live.
Occasional banner ads from DonutSMP-adjacent services, arranged through Discord tickets. Not programmatic; we know every advertiser.
We don't sell your data · We don't profile users · We don't tax trades hidden in the spread
DonutTrade is run by givey999. Reach out directly on Discord — the link is in the footer.