T09 · Insecure Skill Coding Practices
Error
- Location
- handler.py:5
- Finding
- Hardcoded Signal Verification Identifier## Vulnerability Details **File Location**: `handler.py`, line 5 **Vulnerability Type**: Hardcoded authentication or source-verification material **Risk Level**: High ### Vulnerable Code ```python MY_UUID = "530032201" ``` ### Technical Analysis The UUID used to identify or verify the source of FMZ trading signals is embedded directly in the distributed source code. The skill documentation describes this UUID as a security mechanism intended to prevent unauthorized signals. Because it is stored in plaintext, anyone with access to the project can recover and reuse it. The UUID does not provide meaningful source authentication after disclosure. If an FMZ robot trusts the value contained in the signal as proof of authorization, an attacker can construct forged messages that appear to originate from this skill. The implementation does not add a cryptographic signature, timestamp, nonce, or other replay protection. ### Attack Path 1. An attacker obtains a copy of the skill or otherwise reads `handler.py`. 2. The attacker extracts the hardcoded UUID `530032201`. 3. The attacker creates a request to the documented FMZ channel endpoint with a forged `cmd` object containing that UUID. 4. The attacker selects an arbitrary supported action, symbol, price, and reason. 5. If a receiving robot treats possession of the UUID as authorization, it accepts the forged signal as trusted. ### Impact Assessment An attacker may impersonate the expected signal source and submit unauthorized trading instructions to robots configured to trust the exposed UUID. Depending on the receiving robot's strategy and exchange permissions, this could influence buy, sell, close, or wait decisions and potentially cause financial loss. The code does not directly expose exchange credentials or independently place exchange orders. The final impact depends on how FMZ and the listening robots validate and execute incoming signals.
- Remediation
- ## Remediation Suggestions - Remove the identifier from source control and rotate the exposed value. - Load deployment-specific credentials from an environment variable or managed secret store. - Fail securely when the required secret is absent rather than using a default value. - Use a cryptographic message authentication code or digital signature over the complete signal payload. - Include a timestamp and unique nonce in each signed message, and reject expired or replayed messages. - Restrict accepted requests at the FMZ receiver by account, robot, source, and permitted action where supported. - Add secret-scanning checks to the development and release pipelines.