T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:146- Finding
Incorrect Probability Normalization Can Trigger Invalid Live Trades
- Content
View full analysis
= 0.50 else 1.0 - p ``` ```python up_probs = [e.up_probability for e in entries] mean_up = statistics.mean(up_probs) ``` ```python consensus_dir = "up" if mean_up >= 0.50 else "down" ``` The resulting signal can reach the live trading operation: ```python r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) ``` ### Technical Analysis `infer_direction()` returns `"down"` when the market probability is below 0.50. The subsequent normalization then converts that probability to `1.0 - p`. Therefore, a 45% probability for Up becomes an `up_probability` of 55%, even though the documented strategy requires it to remain 45%. As a result, every normalized value is at least 0.50. The calculated group mean consequently cannot represent a genuine Down consensus, making the Down-consensus branch effectively unreachable and potentially manufacturing false Up divergences. This behavior also contradicts the documented example, in which a market at 45% Up must be compared directly with other assets at 54%–58% Up. ### Attack Path 1. The skill discovers an eligible market whose YES probability is below 50%. 2. `infer_direction()` labels the market as Down. 3. The normalization logic changes its Up probability from `p` to `1-p`. 4. The inflated value contributes to an artificial Up consensus. 5. `find_divergences()` generates a potentially incorrect trade opportunity. 6. If the probability and context gates pass, an operator running the skill with `--live` causes `client.trade()` to submit ...[truncated 687 chars]- Remediation
View remediation