T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:280- Finding
Market Context Safety Checks Fail Open
- Content
View full analysis
tuple[bool, str]: """Check flip-flop and slippage safeguards.""" try: ctx = client.get_market_context(market_id) if not ctx: return True, "no context" if ctx.get("discipline", {}).get("is_flip_flop"): reason = ctx["discipline"].get("flip_flop_reason", "recent reversal") return False, f"Flip-flop: {reason}" slip = ctx.get("slippage", {}) if isinstance(slip, dict) and slip.get("slippage_pct", 0) > 0.15: return False, f"Slippage {slip['slippage_pct']:.1%}" for w in ctx.get("warnings", []): safe_print(f" [warn] {w}") except Exception as e: safe_print(f" [ctx] {market_id}: {e}") return True, "ok" ``` ### Technical Analysis The function is responsible for rejecting trades when market context indicates excessive slippage or recent flip-flop behavior. However, it approves the trade when no context is returned and also catches every exception before returning `True`. Consequently, timeouts, authentication errors, malformed API responses, SDK failures, and unexpected context schemas all bypass the intended safeguards. This is a fail-open design in a control directly preceding financial order submission. ### Attack Path 1. The program detects a candidate market and produces a trade signal. 2. The program calls `client.get_market_context(market_id)`. 3. The context service returns no data or raises an exception due to an outage, malformed response, or other failure. 4. The function returns `True`, despite not having verified slippage or flip-flop status. 5. In live mode, execution proceeds to `client.trade()`. 6. A real order can therefore be submitted without the advertised cont ...[truncated 514 chars]- Remediation
View remediation