T09 · Insecure Skill Coding Practices
Error
- Location
fee_aware_divergence.py:96- Finding
Missing Fee and Spread Data Fail Open During Trade Evaluation
- Content
View full analysis
MAX_SPREAD: return None, f"spread-too-wide:{spread:.3f}", {} ``` The resulting values are later used to authorize a trade: ```python raw_div = ai - price cost = fee + spread + SAFETY_MARGIN net_edge = abs(raw_div) - cost if net_edge < MIN_NET_EDGE: return None, f"insufficient-net-edge:{net_edge:.3f}<{MIN_NET_EDGE:.3f}", math side = "yes" if raw_div > 0 else "no" return side, "ok", math ``` ### Technical Analysis The evaluation logic treats a missing, null, or otherwise false-valued `fee_rate_bps` or `spread_pct` as a verified cost of zero. This is a fail-open design for data that directly controls whether a financial transaction is allowed. Consequently, an incomplete market-context response can artificially increase `net_edge`. The implementation may therefore approve a trade without accounting for the actual fee or bid-ask spread. This conflicts with the skill's documented purpose of placing trades only after fees and spread have been included. The code also does not verify that these fields are numeric, finite, and non-negative. The absence of explicit validation weakens the trust boundary between the remote SDK response and the trade authorization logic. ### Attack Path 1. The process requests market context through `client.get_market_context(m.id)`. 2. The returned context omits `fee_rate_bps`, omits `spread_pct`, or supplies a null value. 3. The code converts the missing cost component to `0`. 4. The computed `cost` is lower than the actual transaction cost. 5. The inflated `net_edge` passes the configured minimum- ...[truncated 729 chars]- Remediation
View remediation