T09 · Insecure Skill Coding Practices
Error
- Location
- trader.py:280
- Finding
- Market Context Safety Checks Fail Open<![CDATA[ ## Vulnerability Details **File Location**: `trader.py:280-297` **Vulnerability Type**: Fail-open error handling in financial safety controls **Risk Level**: High ### Vulnerable Code ```python def context_ok(client: SimmerClient, market_id: str) -> tuple[bool, str]: """Check flip-flop and slippage safeguards.""" try: ctx = client.get_market_context(market_id) if not ctx: return True, "no context" if ctx.get("discipline", {}).get("is_flip_flop"): reason = ctx["discipline"].get("flip_flop_reason", "recent reversal") return False, f"Flip-flop: {reason}" slip = ctx.get("slippage", {}) if isinstance(slip, dict) and slip.get("slippage_pct", 0) > 0.15: return False, f"Slippage {slip['slippage_pct']:.1%}" for w in ctx.get("warnings", []): safe_print(f" [warn] {w}") except Exception as e: safe_print(f" [ctx] {market_id}: {e}") return True, "ok" ``` ### Technical Analysis The function is responsible for rejecting trades when market context indicates excessive slippage or recent flip-flop behavior. However, it approves the trade when no context is returned and also catches every exception before returning `True`. Consequently, timeouts, authentication errors, malformed API responses, SDK failures, and unexpected context schemas all bypass the intended safeguards. This is a fail-open design in a control directly preceding financial order submission. ### Attack Path 1. The program detects a candidate market and produces a trade signal. 2. The program calls `client.get_market_context(market_id)`. 3. The context service returns no data or raises an exception due to an outage, malformed response, or other failure. 4. The function returns `True`, despite not having verified slippage or flip-flop status. 5. In live mode, execution proceeds to `client.trade()`. 6. A real order can therefore be submitted without the advertised cont ...[truncated 514 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make context validation fail closed in live mode. - Reject the trade if the context response is absent, malformed, or cannot be retrieved. - Catch specific expected exceptions rather than using `except Exception`. - Validate the context schema and types before consuming safety-critical fields. - Consider permitting fail-open behavior only in simulation mode, with an explicit warning. Example: ```python except (TimeoutError, ConnectionError, ValueError, KeyError, TypeError) as e: safe_print(f" [ctx] rejected {market_id}: {e}") return False, "Unable to validate market context" ``` Also replace `return True, "no context"` with a rejection for live trading. ]]>