T09 · Insecure Skill Coding Practices
Error
- Location
- trader.py:18
- Finding
- Declared Minimum-Volume Safeguard Is Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `trader.py:18-25, 166-193` **Vulnerability Type**: Missing enforcement of a financial risk control **Risk Level**: High ### Complete Code Snippet ```python MAX_POSITION = float(os.environ.get("SIMMER_MAX_POSITION", "35")) MIN_VOLUME = float(os.environ.get("SIMMER_MIN_VOLUME", "1000")) MAX_SPREAD = float(os.environ.get("SIMMER_MAX_SPREAD", "0.1")) MIN_DAYS = int(os.environ.get( "SIMMER_MIN_DAYS", "0")) MAX_POSITIONS = int(os.environ.get( "SIMMER_MAX_POSITIONS", "6")) YES_THRESHOLD = float(os.environ.get("SIMMER_YES_THRESHOLD", "0.42")) NO_THRESHOLD = float(os.environ.get("SIMMER_NO_THRESHOLD", "0.58")) MIN_TRADE = float(os.environ.get("SIMMER_MIN_TRADE", "5")) ``` ```python placed = 0 for m in markets: if placed >= MAX_POSITIONS: break side, size, reasoning = compute_signal(m) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" print(f" [trade] {side.upper()} ${size} {tag} {status} — {reasoning[:70]}") if r.success: placed += 1 except Exception as e: print(f" [error] {m.id}: {e}") ``` ### Technical Analysis `MIN_VOLUME` is loaded from the environment and presented as a tunable risk parameter, but neither `compute_signal()` nor the trading loop compares a market's volume against it. Consequently, the configured minimum-volume value has no effect. Liquidity checks are important for prediction-market automation because low-volume markets are more suscepti ...[truncated 1008 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Obtain volume from a trusted, normalized market field before signal computation. - Reject markets when volume is missing, malformed, negative, or below `MIN_VOLUME`; use fail-closed behavior for live trading. - Distinguish between total historical volume and currently executable liquidity. - Add tests proving that markets below the threshold cannot reach `client.trade()`. - Log the observed volume and configured threshold for every rejection. - Consider validating order-book depth for the intended position size in addition to aggregate market volume. Example hardening logic: ```python volume = getattr(m, "volume", None) if volume is None: if live: print(f" [skip] Missing volume for {m.id}") continue else: try: if float(volume) < MIN_VOLUME: print(f" [skip] Volume ${float(volume):,.2f} below ${MIN_VOLUME:,.2f}") continue except (TypeError, ValueError): print(f" [skip] Invalid volume for {m.id}") continue ``` ]]>