Solana Funding Arb Cn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:17 PM UTC
• Version: 1.0.1

Overview

This is a real Solana arbitrage tool, but its live-trading code and scheduled runner have safety gaps that could put a wallet's funds at risk.

Install only after careful review. Keep it in scan or dry-run mode unless the live-trading paths are audited and fixed, use a dedicated low-balance wallet, avoid unattended cron with wallet secrets, and do not rely on the advertised risk controls as complete protection against loss.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/src/trading/auto-trader.ts:286

Finding

Live execution can leave an unhedged Drift position

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/src/trading/drift-client.ts:97

Finding

Hard-coded fallback market data can trigger live orders

Content

View full analysis

{ try { const response = await axios.get(`${DRIFT_API}/perpMarkets`, { timeout: 10000 }); const markets: DriftMarketInfo[] = []; for (const m of response.data) { const fundingRate = parseFloat(m.lastFundingRate || '0') / 1e9; const fundingApy = fundingRate * 24 * 365 * 100; markets.push({ marketIndex: m.marketIndex, symbol: m.symbol || `MARKET-${m.marketIndex}`, oraclePrice: parseFloat(m.oraclePrice || '0') / 1e6, markPrice: parseFloat(m.markPrice || m.oraclePrice || '0') / 1e6, fundingRate, fundingRateApy: fundingApy, openInterest: parseFloat(m.openInterest || '0') / 1e6, volume24h: parseFloat(m.volume24h || '0') / 1e6 }); } markets.sort((a, b) => Math.abs(b.fundingRateApy) - Math.abs(a.fundingRateApy) ); return markets; } catch (error: any) { logger.warn(`Drift API error, using backup data: ${error.message}`); return this.getBackupMarketData(); } } private getBackupMarketData(): DriftMarketInfo[] { const mockMarkets = [ { symbol: 'SOL-PERP', index: 0, price: 185, rate: 0.0005 }, { symbol: 'BTC-PERP', index: 1, price: 98000, rate: 0.0002 }, { symbol: 'ETH-PERP', index: 2, price: 3250, rate: 0.0004 }, ]; return mockMarkets.map(m => ({ marketIndex: m.index, symbol: m.symbol, oraclePrice: m.price, markPrice: m.price, fundingRate: m.rate, fundingRateApy: m.rate * 24 * 365 * 100, openInterest: 10000000, volume24h: 50000000 })); } ``` The returned fallback records flow int ...[truncated 1990 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/src/trading/position-manager.ts:398

Finding

Stop-loss and drawdown controls operate on stale zero-valued PnL

Content

View full analysis

sum + p.notional, 0 ); const totalUnrealizedPnl = positions.reduce( (sum, p) => sum + (p.unrealizedPnl || 0), 0 ); if (totalNotional === 0) return 0; return Math.abs(Math.min(0, totalUnrealizedPnl)) / totalNotional * 100; } ``` The risk decision trusts this value: ```ts // Check max drawdown const dd = this.positionManager.calculateMaxDrawdown(); if (dd > this.config.max_dd_pct) { logger.warn( ` ⚠️ Max drawdown exceeded: ${dd.toFixed(2)}% > ` + `${this.config.max_dd_pct}%` ); if (this.config.auto_execute) { logger.info(` Closing arbitrage...`); await this.closeArbitrage(arb); } } ``` Positions are initialized with zero PnL: ```ts fundingCollected: 0, unrealizedPnl: 0, lastUpdate: Date.now() ``` Although `PositionManager.updatePosition` can update these values, the audited run and rebalance flow does not invoke it before calculating drawdown. The separately configured `risk.stop_loss_pct` is not enforced. ### Technical Analysis The drawdown calculation is arithmetically valid only if each position contains current price and PnL information. In this implementation, position PnL starts at zero and remains stale because the live rebalance path only retrieves market funding information; it does not reconcile actual positions or update their current prices and unrealized PnL. Consequently, `calculateMaxDrawdown` commonly returns zero even when the real account is losing money. The presence of a configured stop-loss value creates ...[truncated 1015 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/src/dex/jupiter.ts:124

Finding

Remote API transactions are signed without instruction validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cron-runner.sh:15

Finding

Scheduled runner executes the secret environment file as shell code and uses unsafe npx resolution

Content

View full analysis

> "$LOG_FILE" echo "[$(date)] Starting funding arb check..." >> "$LOG_FILE" cd "$SCRIPT_DIR" npx ts-node --transpile-only src/trading/auto-trader.ts >> "$LOG_FILE" 2>&1 ``` The schedule is explicitly documented: ```bash # Add to crontab -e 0 */4 * * * ~/clawd/skills/solana-funding-arb/scripts/cron-runner.sh ``` ### Technical Analysis The cron mechanism is disclosed, manually installed by the user, and relevant to periodic scanning. It is therefore not a hidden persistence backdoor. However, `source` does not parse the file as passive environment data. It evaluates all content as shell syntax in the current process. A command substitution, function definition, redirection, or arbitrary shell command placed in `~/.secrets/.env` executes with the privileges of the cron user. The file contains or is expected to contain wallet credentials, making this a particularly sensitive trust boundary. The script checks only whether the path exists. It does not verify that the file is a regular file, is owned by the current user, has restrictive permissions, or is not a symbolic link. The use of `npx ts-node` in an unattended job adds supply-chain risk. If the local binary is missing, damaged, or resolution behavior changes, `npx` may attempt package acquisition or execute an unintended resolved package instead of a previously installed, pinned local binary. ### Attack Path ...[truncated 1369 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (110)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A complete absence of funding-rate-specific arbitrage logic, combined with broader spot-arbitrage infrastructure, indicates that the skill may be fundamentally misrepresented. Misrepresentation is especially dangerous in financial automation because users may trust strategy claims when deciding to provide wallet access and enable scheduling.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README presents live trading commands alongside scan and dry-run commands without a sufficiently prominent warning that live mode can place real trades using real funds. In a financial automation context, this omission is dangerous because a user can move from exploration to irreversible execution with a single command and limited friction.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · USER_GUIDE.md (reported line 51)May include surrounding context.

1. Create Environment File

bash

cp .env.example .env

2. Configure RPC (Optional but Recommended)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 23)May include surrounding context.

1. Create Environment File

bash

cp .env.example .env

2. Configure RPC (Optional but Recommended)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 98)May include surrounding context.

│ ├── dashboard/ # Web UI │ └── execution/ # Trade execution (future) ├── package.json └── .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cron-runner.sh (reported line 15)May include surrounding context.

sh

mkdir -p "$LOG_DIR"

# Load environment
if [ -f "$HOME/.secrets/.env" ]; then
  source "$HOME/.secrets/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

source "$HOME/.secrets/.env" executes the contents of the file as shell code, not just environment assignments. If that file is modified by an attacker, replaced via symlink, or populated with malicious shell syntax, the cron job will execute arbitrary commands with the privileges of the user running it, which is especially sensitive in an automated trading context that likely has access to wallet or API secrets.

Content

Scanner excerpt · scripts/cron-runner.sh (reported line 16)May include surrounding context.

sh

# Load environment
if [ -f "$HOME/.secrets/.env" ]; then
  source "$HOME/.secrets/.env"
fi

# Set defaults

Known Vulnerable Dependency: @solana/web3.js==1.73.2 — 1 advisory(ies): CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability )

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This lockfile pins @solana/web3.js 1.73.2 in a transitive dependency chain, and the cited advisory indicates untrusted input can trigger a crash. In a Solana arbitrage skill that consumes on-chain/network data continuously, an availability bug in a core blockchain client is a real operational risk because malformed RPC or market data can halt monitoring or execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.1.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

axios 1.1.2 is explicitly present as a transitive dependency and has multiple advisories including SSRF/proxy bypass and prototype-pollution-related request handling issues. For a trading/arbitrage skill that fetches remote pricing, funding, and exchange data, unsafe HTTP client behavior can expose internal services, credentials, or allow manipulated outbound requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

ws 7.5.10 is flagged for memory-exhaustion DoS from fragmented frames, and it is present in the dependency tree. Because this skill likely relies on websocket feeds for Solana market or funding-rate updates, a malformed or hostile websocket peer could degrade or crash the process through resource exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @grpc/grpc-js==1.14.3 — 2 advisory(ies): CVE-2026-48068 (@grpc/grpc-js: A malformed request can cause a server crash); CVE-2026-48069 (@grpc/grpc-js: An incoming malformed compressed message can cause a client or se)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

@grpc/grpc-js 1.14.3 is included and the advisories describe malformed message/request crashes affecting client or server availability. Since Solana/trading integrations may interact with relays or data services over gRPC, this can create a reachable denial-of-service condition if untrusted or compromised peers send crafted traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @solana/web3.js==1.87.6 — 1 advisory(ies): CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability )

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

@solana/web3.js 1.87.6 appears elsewhere in the dependency graph and is also covered by the same crash-on-untrusted-input advisory. Given this skill's Solana-specific trading role, repeated exposure to external RPC/websocket data makes this more dangerous than in a purely offline package because availability is central to safe arbitrage execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

axios 1.13.4 is directly locked at the top level and is reported with multiple advisories. While some advisories may depend on specific usage patterns, a network-heavy arbitrage service using axios against external APIs makes at least the request-manipulation, redirect, proxy-bypass, or SSRF classes materially relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

bigint-buffer 1.1.5 is present and flagged for a buffer overflow in toBigIntLE(). In blockchain tooling, binary parsing helpers are often used on untrusted serialized data, so a malformed input causing memory corruption or crashes can threaten service stability even if exposure depends on specific call paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

brace-expansion 1.1.12 is vulnerable to expansion-based DoS, but it is usually only exploitable when attacker-controlled glob or brace patterns are processed. In this package-lock context it is transitive and likely part of tooling rather than runtime request handling, so it is a real dependency weakness with lower practical risk here.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

form-data 4.0.5 has a CRLF injection issue in multipart field names/filenames, which can alter outbound multipart requests when untrusted input is embedded. If this skill uploads data or forwards externally supplied filenames/fields to APIs, the bug could enable request smuggling or header/body manipulation against downstream services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements an automated cross-DEX spot arbitrage engine that signs and submits live Solana transactions, while the skill metadata describes funding-rate arbitrage monitoring/execution. This capability mismatch is dangerous because users may invoke or trust the skill under a lower-risk mental model, but the code can immediately trade on-chain and expose funds to market, execution, and custody risk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/dashboard/server.ts:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/protocols/drift.ts:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/trading/drift-client.ts:74

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/trading/flash-client.ts:68