T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:139- Finding
Declared Slippage and Flip-Flop Safeguards Are Never Enforced
- Content
View full analysis
tuple[bool, str]: """Check flip-flop and slippage safeguards.""" try: ctx = client.get_market_context(market_id) if not ctx: return True, "no context" if ctx.get("discipline", {}).get("is_flip_flop"): reason = ctx["discipline"].get("flip_flop_reason", "recent reversal") return False, f"Flip-flop: {reason}" slip = ctx.get("slippage", {}) if isinstance(slip, dict) and slip.get("slippage_pct", 0) > 0.15: return False, f"Slippage {slip['slippage_pct']:.1%}" for w in ctx.get("warnings", []): safe_print(f" [warn] {w}") except Exception as e: safe_print(f" [ctx] {market_id}: {e}") return True, "ok" ``` ```python # Pre-filter: only call context_ok on markets that pass signal check candidates = [] for m in markets: side, size, reasoning, sig = compute_signal(m) if side: candidates.append((m, side, size, reasoning, sig)) safe_print(f"[micro-spread-sniper] {len(candidates)} pass signal filter") placed = 0 attempts = 0 max_attempts = min(len(candidates), MAX_POSITIONS + 5) for m, side, size, reasoning, sig in candidates: if placed >= MAX_POSITIONS or attempts >= max_attempts: break attempts += 1 try: trade_kwargs = dict( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) if sig: trade_kwargs["signal_data"] = sig r = client.trade(**trade_kwargs) ``` ### Technical Analysis The `context_ok()` function implements two explicit trade-blocking controls: 1. It rejects a market when the context reports recent flip-f ...[truncated 1832 chars]- Remediation
View remediation
0.15`; - context API failure; - safe context results. 5. Assert in those tests that `client.trade()` is never called for rejected or unverifiable contexts. 6. Consider adding a configurable aggregate run-level loss or notional limit in addition to per-trade limits. ]]>