T09 · Insecure Skill Coding Practices
Warning
- Location
scan.js:37- Finding
Unvalidated and Unenforced Financial Risk Controls
- Content
View full analysis
c.trim().toUpperCase()); i++; break; case '--output': config.outputDir = next; i++; break; ``` ```javascript console.log('\n🏆 Recommended Actions:'); for (const s of strong.slice(0, 3)) { console.log(` ${s.coin}: Long ${config.maxLeverage}x | Stop-loss ${config.stopLossPct*100}% | Rate ${s.rate}% | Annual ${s.annualized3x}%`); } ``` ### Technical Analysis The command-line parser converts user-controlled arguments with `parseFloat()` and `parseInt()` but performs no subsequent validation. It does not reject missing values, non-finite values, negative values, zero, excessive leverage, or stop-loss percentages outside a meaningful range. Consequently, inputs such as the following are accepted: ```bash node scan.js --max-leverage 100 --stop-loss -1 node scan.js --max-leverage Infinity --min-volume NaN node scan.js --max-coins -50 ``` The resulting values are presented under a “Safety” heading and inserted directly into recommended actions. This contradicts the documented maximum leverage of 3x and minimum stop-loss expectations. Additional controls are configured but not enforced: ...[truncated 2272 chars]- Remediation
View remediation
max) { throw new Error(`${name} must be a finite number between ${min} and ${max}`); } return value; } config.maxLeverage = requireFiniteRange( '--max-leverage', Number(next), 1, 3 ); ``` ]]>