Draw bot has not been upgraded yet but the draw is suspended anyway.  What other bots did you try?

Which bot is that?

while that gets fixed, you can add bots through that page https://obyte.io/bots

An important security update is released.  It fixes two serious vulnerabilities discovered and reported to us by security researcher pearl:

*    text messages in chat were incorrectly handled which allowed attackers to execute arbitrary code on victim's wallet. An attacker could supply arbitrary code in angularjs {{}} expressions and the victim's wallet would evaluate it. The attack vector could be used to steal the private keys. The vulnerability existed in all versions of Obyte wallet since the first release in 2016. However, to exploit the vulnerability, an attacker needs to first trick the victim to pair with the attacker's wallet or chatbot. Users who had their wallets protected with a good password and seed words deleted were better protected against such an attack. We have no reports of this vulnerability being actually exploited. The fix makes sure that user input is always treated as text and never evaluated.

*    restore from full backup function allowed file paths with directory traversal (../) characters in backup archive, which could enable an attacker to overwrite important user files, such as .bashrc. on Linux. The vulnerability existed in all versions of Obyte wallet since restore from full backup was introduced in mid 2017. However, to exploit the vulnerability, an attacker needs to first trick the victim to restore from a maliciously crafted backup file. We have no reports of this vulnerability being actually exploited. The fix checks for directory traversal characters in file paths in the backup archive and ignores such files.

Since the two vulnerabilities are now publicly disclosed and each can be used to inflict serious damage to Obyte users who are not aware of them yet, the hub at obyte.org will refuse connections from non-upgraded wallets to keep them safe. All known operators of other hubs have been notified and recommended to apply the same policy.

Only GUI wallets are affected by the vulnerabilities and the upgrade is mandatory for them, headless nodes (wallets, hubs, relays) are not affected.

Please upgrade https://github.com/byteball/obyte-gui-wallet/releases

Thanks for keeping an eye on it!  Addresses referred by wgf90cxkyv are now removed from the draw.  Please let us know if you find any other signs of fraudulent activity.

That would be cool, but I don't know if it's possible because if that smart-contract is between you and steem attestation bot then draw bot has no idea what this address is about until somebody withdraws from it. Maybe it could guess that it's locked reward address by who funded it, but I am not sure.

That is shared address (based on hash of smart-contract definition) and you can see who deposited bytes to that address on explorer, but the definition is only in your and bots wallet. Definition is private only until somebody spends from it, so until you have not withdraw bytes from smart-contract to your actual wallet, others can't see what are the conditions of the smart-contract, this private info becomes available on Explorer when you have withdrawn (1 year from attestation) or bot has withdrawn (2 years from attestation).

If you see the smart-contract address in your Receive tab then it probably means that you have selected the sub-wallet (smart-contract), you need to click the down arrow after wallet address and select your main wallet to see or spend from your main wallet.

Smart-contracts (until they are not spent), contacts, private attestation profile data are all private data and only stored in your wallet, so it can't be backed up with seed words, but only with full backup.

Seed words (user friendly version of private key) can restore only data that is on public DAG. When you create a smart-contract then the contract definition is only stored in wallet of both participant side. The definition is posted to DAG only when either side spends from that smart-contract because that's when other nodes need to validated if the transaction is valid.

So, it doesn't have separate private key and cannot be exported separately, it just doesn't have all the public data in DAG when created. Restore from full backup and create full backups after every time you create a smart-contract/multi-sig/attestation that you can't afford to lose.