T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:324- Finding
Trading safeguards fail open when market context retrieval fails
- Content
View full analysis
dict: """Get market context with safeguards and edge analysis.""" try: if my_probability is not None: return get_client()._request( "GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability} ) return get_client().get_market_context(market_id) except Exception: return None def check_safeguards(context: dict) -> tuple: """Check context for safeguards. Returns (should_trade, reasons).""" if not context: return True, [] ``` ### Technical Analysis The market-context function suppresses every exception and returns `None`. The safeguard function then interprets missing or empty context as authorization to continue trading. Consequently, all context-dependent controls are bypassed when context retrieval fails, including: - Resolved-market detection - Flip-flop and trading-discipline warnings - Minimum time-to-resolution enforcement - Minimum-liquidity enforcement - Maximum-slippage enforcement The behavior is security-sensitive because `check_safeguards()` is called immediately before `execute_trade()` in the live trading path. A network outage, malformed API response, SDK error, authentication failure, or service-side disruption therefore weakens rather than stops the system. ### Attack Path 1. The Skill identifies a signal that would result in a live order. 2. An attacker or operational failure disrupts the context endpoint, causes an invalid response, or otherwise makes `get_market_context()` raise an exception. 3. The exception is suppressed and the function returns `None`. 4. `check_safeguards(None)` returns `(True, [])`. 5. The Skill calls `execute_trade()` without validating ...[truncated 684 chars]- Remediation
View remediation
tuple: if not isinstance(context, dict) or not context: return False, ["Market context unavailable or invalid"] ``` - Do not suppress all exceptions silently. Catch expected SDK or network exceptions, record the error type, and stop the affected order. - Validate the structure and types of all security-relevant response fields before approving a trade. - Require successful checks for market status, time to resolution, liquidity, and slippage before every live order. - Consider bounded retries with exponential backoff for transient failures, but reject the order if retries are exhausted. - Add tests proving that timeouts, malformed JSON, authentication failures, empty responses, and missing fields all block live execution. ]]>