T09 · Insecure Skill Coding Practices
Error
- Location
- main.py:174
- Finding
- Unbounded Repeated Financial Transactions<![CDATA[ ## Vulnerability Details **File Location**: `main.py:174-194` **Vulnerability Type**: Unbounded automated order submission **Risk Level**: High ### Vulnerable Code ```python while True: try: price = get_polymarket_price(cfg) if price is None: logger.info("No price available; retrying later.") else: logger.info("Current price: %s", price) if should_place_order(cfg, price): logger.info("Price condition met; placing order.") try: result = place_polymarket_order(cfg, price) logger.info("Order placed: %s", json.dumps(result)) except RuntimeError as e: logger.error("Order failed: %s", e) else: logger.debug("Condition not met; no order placed.") except requests.RequestException as e: logger.warning("Network error: %s", e) except Exception as e: logger.exception("Unexpected error: %s", e) time.sleep(cfg.poll_interval_seconds) ``` ### Technical Analysis The trading loop continues after a successful order. If the configured price condition remains true, the Skill submits another GTC order after every polling interval. There is no one-shot termination, duplicate-order detection, open-order check, position limit, cumulative spending limit, order-count limit, or post-trade cooldown. Consequently, the implementation can create substantially more financial exposure than a user may infer from the documentation's singular description of placing an order when a condition is met. This behavior exceeds the minimum privilege and transaction scope necessary for a basic threshold-triggered order unless repeated trading is explicitly requested and bounded. ### Attack Path 1. A user configures a market, order size, and reachable price threshold. 2. The user starts the Skill with a trading-capable API credential. 3. The market price satisfies ...[truncated 940 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Stop execution after one successful order by default. - Require an explicit configuration option, such as `repeat_trading: true`, before permitting repeated orders. - Check existing open orders and current positions before submitting another order. - Generate and persist an idempotency key or transaction identifier to prevent duplicate submissions. - Add configurable limits for: - Maximum number of orders per run. - Maximum cumulative order size. - Maximum monetary exposure. - Maximum position per market. - Minimum cooldown after a successful order. - Pause or terminate after repeated API errors rather than retrying indefinitely. - Clearly disclose repeat-order behavior and require explicit user confirmation for unbounded automation. ]]>