T09 · Insecure Skill Coding Practices
Error
- Location
- simmer_momentum_trader.py:111
- Finding
- Market safeguards fail open when context retrieval fails## Vulnerability Details **File Location**: `simmer_momentum_trader.py`, lines 111-119 **Vulnerability Type**: Fail-open financial safety control **Risk Level**: High ### Vulnerable Code ```python client = get_client() try: params = {} if my_probability is not None: params["my_probability"] = my_probability context = client.get_market_context(market_id, **params) except Exception: return None # Can't check context, proceed with caution ``` The caller interprets `None` as approval to continue: ```python skip_reason = should_skip_market(market_id) if skip_reason: print(f" SKIPPED: {skip_reason}") print() continue ``` ### Technical Analysis `should_skip_market()` is intended to prevent trades when severe flip-flop warnings, excessive slippage, or an unfavorable edge recommendation are present. However, every exception raised while retrieving market context is converted into `None`. The function also uses `None` to mean that no reason exists to skip the market. Consequently, authentication errors, network timeouts, rate limiting, malformed responses, SDK failures, and service outages all bypass the advertised safety checks. This is a fail-open design. It also contradicts the documented hard rule in `SKILL.md` that market context is always checked before trading. Although `calculate_signal()` performs another context request, the two requests are independent: the safety request can fail while the later signal request succeeds. ### Attack Path 1. The trader is invoked with `--live`, enabling real orders. 2. An attacker or infrastructure failure disrupts the context request made by `should_skip_market()`. 3. `get_market_context()` raises an exception. 4. The broad exception handler returns `None`. 5. The caller treats this value as approval to proceed. 6. A subsequent context request in `calculate_signal()` succeeds and generates a signal. 7. `execute_tra ...[truncated 561 chars]
- Remediation
- ## Remediation Suggestions Fail closed whenever safety context cannot be obtained: ```python except Exception as exc: return f"Unable to verify market safeguards: {exc}" ``` Additional hardening should include: 1. Catch only expected SDK or network exceptions rather than all `Exception` subclasses. 2. Log the failure type without exposing credentials or sensitive response data. 3. Add bounded retries with exponential backoff for transient failures. 4. Require successful validation of flip-flop status, slippage, and edge analysis before every live order. 5. Use a structured result that distinguishes `SAFE`, `UNSAFE`, and `CHECK_FAILED`, rather than overloading `None`. 6. If fail-open behavior is operationally necessary, place it behind an explicit unsafe command-line option that is disabled by default and emits a prominent warning. 7. Add automated tests proving that context exceptions prevent `client.trade()` from being called.