T09 · Insecure Skill Coding Practices
Warning
- Location
- fastloop_trader.py:632
- Finding
- Dry-run mode performs an authenticated remote market import## Vulnerability Details **File Location**: `fastloop_trader.py:364-370` and `fastloop_trader.py:632-641` **Vulnerability Type**: Dry-run side effect and unnecessary credential use **Risk Level**: Medium ### Vulnerable Code ```python def import_fast_market_market(api_key, slug): """Import a fast market to Simmer. Returns market_id or None.""" url = f"https://polymarket.com/event/{slug}" result = simmer_request("/api/sdk/markets/import", method="POST", data={ "polymarket_url": url, "shared": True, }, api_key=api_key) ``` ```python # Step 5: Import & Trade log(f"\n🔗 Importing to Simmer...", force=True) market_id, import_error = import_fast_market_market(api_key, best["slug"]) if not market_id: log(f" ❌ Import failed: {import_error}", force=True) return log(f" ✅ Market ID: {market_id[:16]}...", force=True) if dry_run: est_shares = position_size / price if price > 0 else 0 log(f" [DRY RUN] Would buy {side.upper()} ${position_size:.2f} (~{est_shares:.1f} shares)", force=True) ``` ### Technical Analysis The market-import operation is executed before the `dry_run` condition is evaluated. The import is an authenticated HTTP `POST` to the Simmer API and explicitly includes `"shared": True`. Consequently, default dry-run execution is not side-effect free. When the strategy identifies a qualifying signal, it can create or share remote market state and consume account import quota even though no trade is submitted. This conflicts with the documented expectation that dry-run mode only reports what would happen. The behavior also exceeds minimum privilege for simulation: local market analysis and trade estimation do not require an authenticated import or the use of `SIMMER_API_KEY`. ### Attack Path 1. A user follows the documented default invocation and runs the script without `--live`. 2. The script loads `SIMMER_API_KEY` and discovers a qual ...[truncated 1022 chars]
- Remediation
- ## Remediation Suggestions - Move the dry-run branch before `import_fast_market_market()` so simulation performs no authenticated mutation. - Calculate estimated position size and shares using discovered public market data, then return before any import or trade request. - Delay `get_api_key()` until an operation genuinely requires authentication. Public-data dry runs should work without `SIMMER_API_KEY`. - If dry-run import testing is necessary, add a separate explicit option such as `--test-import`, clearly document its remote effects, and default `"shared"` to `False`. - Add automated tests that assert dry-run mode never invokes authenticated `POST`, `PUT`, `PATCH`, or `DELETE` requests. - Document exactly which commands can mutate remote account state.