T09 · Insecure Skill Coding Practices
Error
- Location
- mispricing_events.py:123
- Finding
- Market Safety Validation Fails Open When Context Retrieval Fails<![CDATA[ ## Vulnerability Details **File Location**: `mispricing_events.py:123-126` **Vulnerability Type**: Fail-open safety control **Risk Level**: High ```python except Exception: return True, "context unavailable" ``` ### Technical Analysis The `check_context` function is intended to prevent trades when the SDK reports severe flip-flop behavior, excessive slippage, or insufficient edge. However, every exception raised while retrieving or processing that context is caught and converted into an affirmative trading decision. This violates the fail-closed principle for a financial operation. Context retrieval failure does not establish that a trade is safe, particularly when `TRADING_VENUE` may be set to `live`. The broad `Exception` handler also conceals malformed responses, SDK defects, authentication failures, and programming errors. ### Attack Path 1. The Skill identifies a candidate trade. 2. An attacker or operational failure disrupts the Simmer context request, causes a timeout, or produces a malformed response. 3. `client.get_market_context()` or subsequent response processing raises an exception. 4. The exception handler returns `(True, "context unavailable")`. 5. The main loop treats the safety check as successful and proceeds to submit the trade without validated slippage, flip-flop, or edge information. ### Impact Assessment This does not independently grant new system privileges, but it bypasses safeguards controlling an authenticated trading capability. In live mode, it can result in real-money trades under unsafe market conditions, including excessive slippage or unstable trading behavior. The scope is limited by the account permissions associated with `SIMMER_API_KEY`, configured trade-size caps, and available trading capital. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Fail closed whenever market context cannot be retrieved or validated: ```python except Exception as exc: log.warning("Context validation failed for %s: %s", market_id, exc) return False, "context unavailable" ``` - In live mode, require successful validation of all mandatory controls before permitting a trade. - Catch narrowly defined SDK, timeout, JSON-decoding, and schema-validation exceptions rather than all exceptions. - Validate the types and expected ranges of `slippage_pct`, recommendations, and warning fields. - Add tests confirming that network errors, malformed responses, and SDK exceptions always prevent trade submission. - Consider allowing an explicitly configured fail-open policy only for paper trading, never as the default. ]]>