T09 · Insecure Skill Coding Practices
Error
- Location
scripts/execute-buyback.sh:14- Finding
Automated buyback can swap the payment wallet's entire USDC balance
- Content
View full analysis
{ console.log('⏰ Running automated buyback check...'); try { const { execSync } = require('child_process'); execSync('./scripts/execute-buyback.sh 100', { stdio: 'inherit' }); } catch (error) { console.error('Buyback failed:', error); } }); ``` ```bash # Get current USDC balance USDC_BALANCE=$(node scripts/get-balance.js "$PAYMENT_WALLET_ADDRESS" "$USDC_ADDRESS") echo "💰 Current USDC balance: $USDC_BALANCE" # Minimum threshold MIN_THRESHOLD=${1:-100} if (( $(echo "$USDC_BALANCE < $MIN_THRESHOLD" | bc -l) )); then echo "⏸️ Balance below threshold ($MIN_THRESHOLD USDC). Skipping buyback." exit 0 fi echo "🔄 Executing buyback..." echo "Amount: $USDC_BALANCE USDC" echo "Target: $BANKR_TOKEN" echo "" # Execute swap via Uniswap RESULT=$(node scripts/uniswap-swap.js \ --from "$USDC_ADDRESS" \ --to "$BANKR_TOKEN" \ --amount "$USDC_BALANCE" \ --slippage 2) ``` ```bash # Optional: Burn or distribute if [[ "$BUYBACK_ACTION" == "burn" ]]; then echo "🔥 Burning $BANKR_BOUGHT BANKR..." node scripts/burn-tokens.js "$BANKR_TOKEN" "$BANKR_BOUGHT" elif [[ "$BUYBACK_ACTION" == "distribute" ]]; then echo "📤 Distributing $BANKR_BOUGHT BANKR to holders..." node scripts/distribute-to-holders.js "$BANKR_BOUGHT" else echo "💎 Holding $BANKR_BOUGHT BANKR in treasury" fi ``` The documentation also recommends an operating-system cron entry: ```bash # Add to crontab 0 * * * * cd /path/to/skill && ./scripts/execute-buyback.sh ``` ### Technical Analysis Starting the API registers an in-process hourly task that invokes the buyback script. The documentation separately ...[truncated 2590 chars]- Remediation
View remediation