T09 · Insecure Skill Coding Practices
Error
- Location
src/fetcher.ts:23- Finding
Fabricated On-Chain Data Returned as Genuine Results When the Etherscan Key Is Missing
- Content
View full analysis
Vulnerability Details
File Location:
src/fetcher.ts:23-25, 62, 78-103, 126-139
Vulnerability Type: Silent production fallback to fabricated financial data
Risk Level: HighComplete Code Snippet:
ts async function callEtherscan(params: Record<string, string>): Promise<unknown> { // API 키 없을 경우 Mock 반환 (테스트용) if (!process.env.ETHERSCAN_API_KEY) { console.warn('[Etherscan] API 키 없음. Mock 데이터 반환.'); return null; // Mock 데이터는 개별 함수에서 처리하거나 여기서 분기 가능 }ts export async function fetchBalance(address: string): Promise<number | null> { console.log(`[Fetcher] 잔액 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) return 1.2345; // Mock Balance }ts export async function fetchTransactions(address: string): Promise<TxRecord[]> { console.log(`[Fetcher] 트랜잭션 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) { // Mock Transactions return [ { hash: '0xmockhash1', from: '0xSender', to: address, value_eth: 5.0, timestamp: new Date().toISOString(), type: 'in' }, { hash: '0xmockhash2', from: address, to: '0xReceiver', value_eth: 12.5, timestamp: new Date(Date.now() - 60000).toISOString(), type: 'out' } ]; }ts export async function fetchTokenTransfers(address: string): Promise<TokenTransferRecord[]> { console.log(`[Fetcher] 토큰 전송 조회: ${address}`); if (!process.env.ETHERSCAN_API_KEY) { // Mock Token Transfers return [ { token_name: 'USDC', token_symbol: 'USDC', from: '0xSender', to: address, value: '1000000000', timestamp: new Date().toISOString() } ]; } }Technical Analysis
The production data-access functions silently return fixed ...[truncated 1941 chars]
- Remediation
View remediation
Remediation Suggestions
- Fail closed when
ETHERSCAN_API_KEYis unavailable and return an explicit configuration error. - Remove mock responses from production data-access functions.
- Place mock implementations in a separate test adapter that can only be selected through an explicit test configuration such as
NODE_ENV === "test". - Add a startup configuration check so the process cannot advertise readiness without required credentials.
- If demonstration mode is required, require an explicit opt-in flag and include an unambiguous
data_source: "mock"marker in every response. - Add automated tests verifying that missing production credentials result in an error rather than a successful report.
- Fail closed when