T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apex.mjs:179- Finding
Trading Orders Accept Unvalidated Size and Price Values Without Exposure Controls
- Content
View full analysis
`); } const side = command === 'market-buy' ? 'BUY' : 'SELL'; const symbolInfo = apexClient.symbols?.[symbol]; if (!symbolInfo?.l2PairId) { throw new Error(`Unknown symbol: ${symbol}`); } let price = ''; try { const worst = await apexClient.privateApi.getWorstPrice(symbol, size, side); price = worst?.worstPrice || ''; } catch (err) { const ticker = await getTickerPrice(apexClient, symbol); price = ticker?.lastPrice || ''; } if (!price) throw new Error(`Unable to determine price for ${symbol}`); const makerFeeRate = apexClient.account?.contractAccount?.makerFeeRate || '0'; const takerFeeRate = apexClient.account?.contractAccount?.takerFeeRate || '0'; const limitFee = calculateLimitFee(price, size, takerFeeRate, symbolInfo.baseCoinRealPrecision); const order = { pairId: symbolInfo.l2PairId, makerFeeRate, takerFeeRate, symbol, side, type: 'MARKET', size: String(size), price: String(price), limitFee, reduceOnly: false, timeInForce: 'IMMEDIATE_OR_CANCEL', expiration: Math.floor(Date.now() / 1000 + 30 * 24 * 60 * 60), }; const result = await apexClient.privateApi.createOrder(order); ``` The limit-order path has the same weakness: ```js const size = args[2]; const price = args[3]; if (!symbol || !size || !price) { throw new Error(`Usage: apex ${command} `); } const side = command === 'limit-buy' ? 'BUY' : 'SELL'; const symbolInfo = apexClient.symbols?.[symbol]; if (!symbolInfo?.l2PairId) { throw new Error(`Unknown symbol: ${symbol}`); } const makerFeeRate = apexClient.account?.contractAccount?.makerFeeRate || '0'; const takerFeeRate = apexClient.account?.contractAccount?.takerFeeRate || '0'; const limitFee = calcul ...[truncated 2557 chars]- Remediation
View remediation