T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:320- Finding
Trading safeguards fail open when market context retrieval fails
- Content
View full analysis
dict: """Get market context with safeguards and edge analysis.""" try: if my_probability is not None: return get_client()._request( "GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability} ) return get_client().get_market_context(market_id) except Exception: return None def check_safeguards(context: dict) -> tuple[bool, list[str]]: """Check context for safeguards. Returns (should_trade, reasons).""" if not context: return True, [] ``` The returned approval is subsequently used to authorize a trade: ```python ctx = get_market_context( market_id, my_probability=fair_cut_p if side == "yes" else 1 - fair_cut_p ) ok, reasons = check_safeguards(ctx) if not ok: log(f" Skipped: {'; '.join(reasons)}") skip_reasons.extend(reasons) continue if not dry_run: result = execute_trade( market_id, side, size, reasoning=(f"Data reaction: regime={regime or 'neutral'} " f"implied_cpi={implied_cpi or 'N/A'} " f"fair={fair_cut_p:.1%} market={price:.1%} edge={edge:+.1%}"), ``` ### Technical Analysis `get_market_context()` suppresses every exception and returns `None`. The safeguard function explicitly interprets missing or empty context as permission to trade by returning `(True, [])`. Consequently, all context-dependent controls are bypassed if the SDK or context endpoint fails. These controls include: - Resolved-market detection - Minimum time-to-resolution enforcement - Liquidity validation - Slippage limits - Severe flip-flop warnings Safety checks controlling financial tra ...[truncated 1427 chars]- Remediation
View remediation
tuple[bool, list[str]]: if not isinstance(context, dict) or not context: return False, ["Market context unavailable or invalid"] ``` 2. Preserve a sanitized diagnostic message instead of silently discarding all exceptions: ```python except Exception as exc: safe_print(f"Context retrieval failed for market {market_id}: {exc}") return None ``` Ensure logs do not expose API keys, authorization headers, or private-key material. 3. Validate the context response schema before trading. Required fields for live trading should include resolution status, time to resolution, liquidity, and applicable slippage estimates. 4. Distinguish dry-run analysis from live authorization. Missing context may be tolerated for displaying an opportunity, but it must never authorize a live transaction. 5. Consider bounded retries with exponential backoff for transient errors. If validation remains unavailable after retries, skip the trade. 6. Add tests proving that `None`, `{}`, malformed context, request exceptions, and missing required fields all prevent live execution. ]]>