SHL-003
What shortlink verification cannot prove
Token, ownership, dwell and caps are the honest limit. None of them prove the provider's page was ever seen — the daily cap is what bounds the loss.
It is worth being explicit about the ceiling, because sites get built on the assumption that a clever enough check makes shortlink earning safe.
The return trip proves someone came back with a token you issued, after a plausible delay. It does not prove they saw the provider's page, did not use an extension that skips it, or were not a script with a headless browser. Only a provider-side postback proves the view, and the providers do not offer one.
So the control that actually bounds your exposure is the daily cap per user per link, and the rate you pay. Set both at a level you could afford to see fully abused, because eventually one of them will be.
/**
* The three numbers that bound shortlink losses, in one place.
* Everything else — tokens, dwell, referrer checks — raises the effort.
* These decide what the maximum costs you.
*/
function shortlink_exposure(PDO $pdo): array
{
$perLink = setting_int('shortlink_daily_per_link', 3);
$rate = (float) setting('shortlink_reward_usd', '0.0005');
$links = (int) scalar('SELECT COUNT(*) FROM shortlinks WHERE is_active = 1', [], 0);
$users = (int) scalar('SELECT COUNT(*) FROM users WHERE status = 1', [], 0);
$maxPerUserDay = $links * $perLink * $rate;
return [
'per_user_per_day' => $maxPerUserDay,
'all_users_per_day' => $maxPerUserDay * $users,
// What it costs if a single determined user automates everything.
'worst_single_user_month' => $maxPerUserDay * 30,
];
}
/** Enforced at the point of starting a run, not at crediting. */
function shortlink_remaining(PDO $pdo, int $userId, int $linkId): int
{
$cap = setting_int('shortlink_daily_per_link', 3);
$st = $pdo->prepare(
'SELECT COUNT(*) FROM shortlink_runs
WHERE user_id = ? AND link_id = ? AND status = "done"
AND completed_at > NOW() - INTERVAL 1 DAY'
);
$st->execute([$userId, $linkId]);
return max(0, $cap - (int) $st->fetchColumn());
}Using it
Put the worst-case figure on the admin dashboard. A number you can see is a number you will tune.
Cap per link and per day rather than with one global allowance, so adding a provider does not silently multiply exposure.
Watch the ratio of starts to completions per user. A real user abandons some; one that completes everything at the minimum dwell is worth a look.
What bites people
Do not describe the dwell check to users as proof of anything. It is a timer, and saying more invites someone to test it.
A referrer check on the return does not help much — gateway links rarely carry one, and blocking on it breaks legitimate completions.
Raising the reward without lowering the cap raises your worst case proportionally. They are one decision, not two.
This one touches real money. Point it at a throwaway wallet and watch a full cycle before you trust it with a live balance.