T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/execute-buyback.sh:14
- Finding
- Automated buyback can swap the payment wallet's entire USDC balance<![CDATA[ ## Vulnerability Details **File Location**: `server.js:237-245`, `scripts/execute-buyback.sh:14-39`, `scripts/execute-buyback.sh:52-58`, and `SKILL.md:556-559` **Vulnerability Type**: Unbounded automated financial transaction **Risk Level**: High ### Vulnerable Code ```javascript // Auto-buyback cron job (runs every hour) cron.schedule('0 * * * *', async () => { console.log('⏰ Running automated buyback check...'); try { const { execSync } = require('child_process'); execSync('./scripts/execute-buyback.sh 100', { stdio: 'inherit' }); } catch (error) { console.error('Buyback failed:', error); } }); ``` ```bash # Get current USDC balance USDC_BALANCE=$(node scripts/get-balance.js "$PAYMENT_WALLET_ADDRESS" "$USDC_ADDRESS") echo "💰 Current USDC balance: $USDC_BALANCE" # Minimum threshold MIN_THRESHOLD=${1:-100} if (( $(echo "$USDC_BALANCE < $MIN_THRESHOLD" | bc -l) )); then echo "⏸️ Balance below threshold ($MIN_THRESHOLD USDC). Skipping buyback." exit 0 fi echo "🔄 Executing buyback..." echo "Amount: $USDC_BALANCE USDC" echo "Target: $BANKR_TOKEN" echo "" # Execute swap via Uniswap RESULT=$(node scripts/uniswap-swap.js \ --from "$USDC_ADDRESS" \ --to "$BANKR_TOKEN" \ --amount "$USDC_BALANCE" \ --slippage 2) ``` ```bash # Optional: Burn or distribute if [[ "$BUYBACK_ACTION" == "burn" ]]; then echo "🔥 Burning $BANKR_BOUGHT BANKR..." node scripts/burn-tokens.js "$BANKR_TOKEN" "$BANKR_BOUGHT" elif [[ "$BUYBACK_ACTION" == "distribute" ]]; then echo "📤 Distributing $BANKR_BOUGHT BANKR to holders..." node scripts/distribute-to-holders.js "$BANKR_BOUGHT" else echo "💎 Holding $BANKR_BOUGHT BANKR in treasury" fi ``` The documentation also recommends an operating-system cron entry: ```bash # Add to crontab 0 * * * * cd /path/to/skill && ./scripts/execute-buyback.sh ``` ### Technical Analysis Starting the API registers an in-process hourly task that invokes the buyback script. The documentation separately ...[truncated 2590 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a dedicated buyback wallet that never stores unrelated funds or operational reserves. 2. Track verified fee payments in an append-only ledger and make the eligible buyback amount no greater than accounted, settled revenue. 3. Enforce explicit per-transaction, hourly, and daily spending limits. 4. Retain a configurable reserve rather than swapping the complete wallet balance. 5. Calculate and enforce an absolute `amountOutMinimum` from an independent price source; reject stale quotes and excessive price impact. 6. Validate the chain ID, USDC contract, BANKR contract, router address, and token decimals before signing. 7. Make automatic buybacks disabled by default and require an explicit opt-in configuration. 8. Require manual or multisignature approval for transactions above a conservative threshold. 9. Separate portfolio-analysis service credentials from transaction-signing infrastructure. 10. Do not enable both the in-process scheduler and operating-system cron simultaneously. 11. Add idempotency and locking so overlapping jobs cannot submit duplicate transactions. 12. Implement and review the currently absent helper scripts before enabling this workflow. ]]>