T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:324- Finding
Live-Trading Risk Controls Are Incompletely Enforced
- Content
View full analysis
tuple[bool, str]: p = getattr(market, "current_probability", None) if not isinstance(p, (int, float)): return False, "missing probability" spread_cents = getattr(market, "spread_cents", None) if isinstance(spread_cents, (int, float)) and spread_cents / 100 > MAX_SPREAD: return False, f"Spread {spread_cents/100:.1%} > {MAX_SPREAD:.1%}" resolves_at = getattr(market, "resolves_at", None) if resolves_at: try: resolves = datetime.fromisoformat(resolves_at.replace("Z", "+00:00")) days = (resolves - datetime.now(timezone.utc)).days if days < MIN_DAYS: return False, f"Only {days} days to resolve" except Exception: pass return True, "ok" ``` Position sizing uses the minimum trade value without capping the result at `MAX_POSITION`: ```python def compute_signal(market, opportunity: tuple | None) -> tuple[str | None, float, str]: ok, why = valid_market(market) if not ok: ...[truncated 5499 chars]- Remediation
View remediation
0`. - Require `0 <= MAX_SPREAD <= 1`. - Require `0 < YES_THRESHOLD < 0.5`. - Require `0.5 < NO_THRESHOLD < 1`. - Require `MAX_POSITIONS` to be a positive integer. 3. Apply an explicit upper bound to every order: ```python size = min(MAX_POSITION, max(MIN_TRADE, round(conviction * MAX_POSITION, 2))) ``` 4. Query the account's currently open positions before execution and calculate remaining capacity: ```python remaining = MAX_POSITIONS - current_open_position_count ``` Stop trading when `remaining <= 0`, and update the count after each successful order. 5. In live mode, fail closed when context retrieval, slippage validation, volume retrieval, or resolution-date parsing fails. Simulation mode may retain a configurable warning-only policy. 6. Add a maximum aggregate exposure limit independent of the number of positions. 7. Add unit tests covering malformed market metadata, context API failures, repeated runs, low-volume markets, and contradictory tunables. ]]>