T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:32
- Finding
- Automatic USDC Payment Signing Without Enforced Spending Limits<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-45` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```typescript import { Connection, Keypair, PublicKey } from "@solana/web3.js"; import bs58 from "bs58"; import { createLocalWallet } from "@faremeter/wallet-solana"; import { lookupKnownSPLToken } from "@faremeter/info/solana"; import { createPaymentHandler } from "@faremeter/payment-solana/exact"; import { wrap as wrapFetch } from "@faremeter/fetch"; const keypair = Keypair.fromSecretKey(bs58.decode(process.env.SOLANA_PRIVATE_KEY!)); const walletAddress = keypair.publicKey.toBase58(); const connection = new Connection("https://api.mainnet-beta.solana.com", "confirmed"); const usdcInfo = lookupKnownSPLToken("mainnet-beta", "USDC"); const mint = new PublicKey(usdcInfo!.address); const wallet = await createLocalWallet("mainnet-beta", keypair); const paymentHandler = createPaymentHandler(wallet, mint, connection); const paidFetch = wrapFetch(fetch, { handlers: [paymentHandler] }); ``` The Skill then instructs: ```text Use paidFetch for all write endpoints — it automatically handles 402 Payment Required responses by signing and submitting USDC payment transactions. ``` ### Technical Analysis The Skill imports a base58-encoded Solana secret key from `SOLANA_PRIVATE_KEY` and gives the resulting wallet to an automatic x402 payment handler. This capability is required for the declared paid marketplace functionality, and the reviewed files do not directly transmit the private key over the network. However, the documented client initialization does not enforce: - A maximum payment amount per request. - A cumulative spending limit per session. - An allowlist of authorized payment recipients. - Validation that the requested payment equals the documented endpoint price. - Explicit user confirmation before a transaction is signed. - A restriction preventing unexpected endpoints from using the p ...[truncated 2007 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add a strict per-request maximum and reject every x402 challenge above the documented price for the selected endpoint. 2. Maintain an endpoint-to-price policy and require an exact match between the expected and requested payment. 3. Validate the Solana cluster, USDC mint, merchant recipient, and transaction instructions before signing. 4. Add a cumulative session and daily spending budget, defaulting to a small amount. 5. Require explicit user confirmation for purchases, listing-price transfers, unknown recipients, price changes, or payments above a low threshold. 6. Restrict the payment-aware client to an allowlist of exact Agent Soul HTTPS endpoints; use ordinary `fetch` for all other destinations. 7. Display the recipient, amount, token, network, and purpose before approval. 8. Recommend or enforce use of a dedicated wallet containing only the funds required for the immediate workflow. 9. Handle redirects conservatively and never forward payment authorization to a different origin. 10. Fail closed if payment metadata cannot be validated independently. ]]>