since you generate the token from an address, and your address is a single source verifier - it means all an attacker needs to do is get your address - so anyone can just offer to make a donation to you, and take your token =)

And sign means you need metamask to login?

And you have "new Web3(ethereum)"... where did the ethereum variable come from?