T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:323- Finding
Market safety checks fail open when context retrieval fails
- Content
View full analysis
dict: """Get market context with safeguards and edge analysis.""" try: if my_probability is not None: return get_client()._request( "GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability} ) return get_client().get_market_context(market_id) except Exception: return None def check_safeguards(context: dict) -> tuple: """Check context for safeguards. Returns (should_trade, reasons).""" if not context: return True, [] ``` ### Technical Analysis `get_market_context` catches every exception and converts the failure into `None`. `check_safeguards` then treats missing context as successful validation by returning `(True, [])`. Consequently, authentication failures, network interruptions, malformed API responses, rate limits, and server-side errors bypass the checks that normally reject: - Resolved markets - Severe flip-flop warnings - Markets close to resolution - Insufficient liquidity - Excessive expected slippage This violates the fail-safe default principle. A security or risk-control service becoming unavailable should prevent a live financial action, not authorize it. ### Attack Path 1. The operator starts the Skill with `python trader.py --live`. 2. A market generates a trading signal. 3. The request to `/api/sdk/context/{market_id}` fails because of a network error, API error, malformed response, or other exception. 4. `get_market_context` suppresses the exception and returns `None`. 5. `check_safeguards(None)` returns `(True, [])`. 6. The strategy proceeds to `execute_trade`. 7. A live order can be submitted without validating resolution status, liquidit ...[truncated 765 chars]- Remediation
View remediation
tuple: if not context: return False, ["Unable to retrieve market safety context"] ``` 2. Catch only expected SDK or network exceptions rather than using `except Exception`. 3. Log the failure type without exposing credentials or sensitive response data. 4. Require the safety response to contain all mandatory fields before live execution. 5. Distinguish dry-run behavior from live behavior if availability is important: - Dry run may continue while clearly marking safeguards as unavailable. - Live mode must reject the trade. 6. Add tests covering timeouts, authentication errors, malformed responses, empty dictionaries, resolved markets, high slippage, and missing liquidity data. ]]>