T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/trenches.js:703
- Finding
- Trenches operations execute on-chain without enforcing the documented confirmation gate<![CDATA[ ## Vulnerability Details **File Location**: `scripts/trenches.js:330-410`, `scripts/trenches.js:703-711`, `scripts/trenches.js:901-909`, `scripts/trenches.js:1034-1042` **Vulnerability Type**: Missing authorization and transaction-confirmation enforcement **Risk Level**: High ### Vulnerable Code ```js function parseArgs() { const args = process.argv.slice(2) const result = { subcommand: null, // create params name: null, symbol: null, description: null, twitter: null, website: null, initialBuy: null, baseToken: null, noAntibot: false, image: null, // buy/sell params token: null, amount: null, all: false, // discovery params window: null, limit: null, // common configDir: process.env.WALLET_CONFIG_DIR || path.join(__dirname, '..', 'config'), rpc: process.env.BASE_RPC_URL || DEFAULT_RPC_URL, } // No --execute or equivalent confirmation argument is parsed. } ``` The creation path directly broadcasts an on-chain transaction: ```js const tx = await roles.execTransactionWithRole( zodiacHelpersAddress, 0n, encodedData, 1, // delegatecall config.roleKey, true, ) console.log(` Transaction: ${tx.hash}`) const receipt = await tx.wait() if (receipt.status !== 1) { console.error('Transaction failed!') process.exit(1) } ``` The buy path does the same: ```js console.log('\nExecuting buy...') const tx = await roles.execTransactionWithRole( zodiacHelpersAddress, 0n, encodedData, 1, // delegatecall config.roleKey, true, ) console.log(` Transaction: ${tx.hash}`) const receipt = await tx.wait() ``` The sell path also immediately executes: ```js console.log('\nExecuting sell...') const tx = await roles.execTransactionWithRole( zodiacHelpersAddress, 0n, encodedData, 1, // delegatecall config.roleKey, ...[truncated 1969 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add an `--execute` argument that defaults to `false`. 2. Separate preview generation from execution: - Resolve the exact token contract. - Obtain and validate a quote. - Display input amount, expected output, minimum output, fees, recipient, factory, and expiry. - Exit without loading the private key unless `--execute` is present. 3. Require the caller to confirm a deterministic quote identifier or hash so that execution cannot silently use parameters different from those previewed. 4. Revalidate balances, quote expiry, token addresses, and all transaction parameters immediately before signing. 5. Keep confirmation enforcement inside the script rather than relying only on agent instructions. 6. Add automated tests proving that create, buy, and sell commands cannot invoke `execTransactionWithRole` without explicit execution authorization. ]]>