T09 · Insecure Skill Coding Practices
Error
- Location
- src/fetcher.ts:23
- Finding
- Fabricated On-Chain Data Returned as Genuine Results When the Etherscan Key Is Missing## Vulnerability Details **File Location**: `src/fetcher.ts:23-25, 62, 78-103, 126-139` **Vulnerability Type**: Silent production fallback to fabricated financial data **Risk Level**: High **Complete Code Snippet**: ```ts async function callEtherscan(params: Record<string, string>): Promise<unknown> { // API 키 없을 경우 Mock 반환 (테스트용) if (!process.env.ETHERSCAN_API_KEY) { console.warn('[Etherscan] API 키 없음. Mock 데이터 반환.'); return null; // Mock 데이터는 개별 함수에서 처리하거나 여기서 분기 가능 } ``` ```ts export async function fetchBalance(address: string): Promise<number | null> { console.log(`[Fetcher] 잔액 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) return 1.2345; // Mock Balance } ``` ```ts export async function fetchTransactions(address: string): Promise<TxRecord[]> { console.log(`[Fetcher] 트랜잭션 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) { // Mock Transactions return [ { hash: '0xmockhash1', from: '0xSender', to: address, value_eth: 5.0, timestamp: new Date().toISOString(), type: 'in' }, { hash: '0xmockhash2', from: address, to: '0xReceiver', value_eth: 12.5, timestamp: new Date(Date.now() - 60000).toISOString(), type: 'out' } ]; } ``` ```ts export async function fetchTokenTransfers(address: string): Promise<TokenTransferRecord[]> { console.log(`[Fetcher] 토큰 전송 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) { // Mock Token Transfers return [ { token_name: 'USDC', token_symbol: 'USDC', from: '0xSender', to: address, value: '1000000000', timestamp: new Date().toISOString() } ]; } } ``` ### Technical Analysis The production data-access functions silently return fixed ...[truncated 1941 chars]
- Remediation
- ## Remediation Suggestions - Fail closed when `ETHERSCAN_API_KEY` is unavailable and return an explicit configuration error. - Remove mock responses from production data-access functions. - Place mock implementations in a separate test adapter that can only be selected through an explicit test configuration such as `NODE_ENV === "test"`. - Add a startup configuration check so the process cannot advertise readiness without required credentials. - If demonstration mode is required, require an explicit opt-in flag and include an unambiguous `data_source: "mock"` marker in every response. - Add automated tests verifying that missing production credentials result in an error rather than a successful report.