pumpmarket skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

This is a coherent PumpMarket betting skill, but it enables agent-driven real-SOL mainnet betting and exposes a privileged emergency withdrawal path that users should review carefully.

Install only if you understand that this skill can help an agent spend real SOL on mainnet. Use a dedicated wallet with limited funds, require explicit approval before every createMarket or placeBet transaction, pin dependencies, simulate first, and review the program's emergency withdrawal behavior before depositing meaningful funds.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: pumpbets.json:265
• Finding: Privileged Emergency Withdrawal Can Precede the Advertised Claim Period<![CDATA[ ## Vulnerability Details **File Location**: `pumpbets.json:265-330`; related timing documentation at `skill.md:167-168` **Vulnerability Type**: Excessive privileged withdrawal authority **Risk Level**: High ### Vulnerable Code ```json { "name": "emergencyWithdraw", "docs": [ "Emergency withdrawal - only treasury can call after 1 day delay", "Used to recover stuck funds in case of bugs or unclaimed payouts" ], "accounts": [ { "name": "market", "isMut": false, "isSigner": false }, { "name": "vault", "isMut": true, "isSigner": false, "docs": [ "Vault PDA holding betting funds" ] }, { "name": "authority", "isMut": false, "isSigner": true, "docs": [ "Only treasury can trigger emergency withdrawal" ] }, { "name": "recipient", "isMut": true, "isSigner": false, "docs": [ "Recipient of emergency funds (treasury)" ] }, { "name": "systemProgram", "isMut": false, "isSigner": false } ], "args": [] } ``` The conflicting timing documentation states: ```markdown | **Claim Period** | ~7 days | 1,512,000 slots | Vault can be closed (rent reclaimed) after this | | **Emergency Delay** | ~1 day | 216,000 slots | Only treasury can emergency withdraw after this | ``` ### Technical Analysis The bundled IDL documents an `emergencyWithdraw` instruction that allows the treasury authority to withdraw funds from a market vault after approximately one day. The same Skill advertises a claim period of approximately seven days. If these documented rules reflect the deployed program, the treasury can remove funds roughly six days before the ordinary claim period expires. This creates a centralized custody capability that exceeds the minimum privileges needed to operate normal market settlement and payout claims. The repository does not include the Solana program source or ...[truncated 1467 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the full advertised claim period on-chain before any emergency withdrawal is permitted. 2. Make the emergency delay equal to or longer than the ordinary claim period. 3. Restrict withdrawal to demonstrably excess funds after all outstanding liabilities have been calculated. 4. Require a multisignature treasury rather than a single privileged signing key. 5. Add an on-chain timelock and publicly observable withdrawal proposal period. 6. Require emergency withdrawals to use a fixed, validated recipient rather than a caller-supplied account. 7. Emit detailed events containing the market, amount, recipient, authorization, and reason. 8. Publish and verify the program source so signer, PDA, recipient, timing, and market-state constraints can be independently audited. 9. Clearly disclose the treasury's ability to withdraw funds and avoid describing the claim period as guaranteed if privileged withdrawal can occur earlier. ]]>

T08 · Insecure Dependencies

Warning

• Location: skill.md:104
• Finding: Security-Sensitive Runtime Dependencies Are Installed Without Version Pinning<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:104-106` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install @coral-xyz/anchor @solana/web3.js ``` ### Technical Analysis The setup instructions install security-sensitive Solana and Anchor packages without fixed versions or a lockfile-backed reproducible installation. The selected package versions can therefore change over time as package maintainers publish new releases. These libraries operate in the same process that loads the user's Solana keypair, constructs transactions, and signs mainnet operations. A compromised package release, compromised maintainer account, or unexpectedly incompatible update could execute package lifecycle code during installation or manipulate wallet and transaction behavior at runtime. The package names shown are consistent with the declared functionality, and there is no evidence in the reviewed artifact that the named packages are currently malicious. The risk arises from mutable, unverified dependency resolution in a wallet-enabled environment. ### Attack Path 1. An attacker compromises a relevant npm package, maintainer account, or newly selected transitive dependency. 2. A malicious version is published under a dependency range selected by the unpinned installation command. 3. A user follows the documented `npm install` instruction. 4. Malicious lifecycle or runtime code executes in the wallet-enabled project environment. 5. The malicious code reads accessible environment variables or key files, changes transaction instructions or destinations, or exfiltrates signing material. 6. The attacker uses the exposed key or altered signed transaction to steal funds available to the betting wallet. ### Impact Assessment Successful exploitation could affect any secret or wallet material accessible to the Node.js process, including `PRIVATE_KEY`, files identified by `KEYPAIR_PATH`, and transactio ...[truncated 275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each direct dependency to an explicitly reviewed version. 2. Commit a reviewed `package-lock.json` and instruct users to install with `npm ci`. 3. Enable lockfile integrity verification and review transitive dependency changes before upgrades. 4. Use automated dependency scanning and package-provenance checks. 5. Consider disabling lifecycle scripts during installation with `npm ci --ignore-scripts` when compatible with the selected dependencies. 6. Run wallet-signing code in a minimal, isolated environment with no unnecessary secrets or filesystem access. 7. Continue using a dedicated wallet with strictly limited funds. 8. Require human or policy-based verification of transaction program IDs, recipient accounts, and transferred amounts before signing. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Verify API is healthy
curl -s https://pumpbet-mainnet.up.railway.app/api/health | python3 -m json.tool

# Verify program on-chain (requires solana CLI)
solana program show 3mNbBV3Xc3rNJ4E87pSFzW7VhUZySHQDQVyd4MP2VFG6 --url mainnet-beta

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

solana balance 4iFYGzxKGH2SAeVaR5AxPiCfLCSQD9fdPK8tsDBbmx3f --url mainnet-beta

# Verify active markets exist
curl -s https://pumpbet-mainnet.up.railway.app/api/stats | python3 -m json.tool
```

### Reproduce Account Counts via RPC

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest description frames the skill as a prediction/betting capability for pump.fun token graduations, but this IDL exposes an additional administrative fund-recovery path via `emergencyWithdraw`. That goes beyond merely facilitating predictions and includes a privileged asset-seizure/recovery mechanism over market funds.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The IDL exposes an `emergencyWithdraw` path where only a generic signer `authority` and arbitrary `recipient` are visible at the interface level, while the docs claim this is treasury-only and delayed. If the on-chain implementation fails to strictly enforce that `authority` equals the official treasury and that the time delay and recipient constraints are met, this becomes a direct fund-drain path from the vault.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

import { Keypair } from '@solana/web3.js';
import fs from 'fs';

// Ensure keyfile permissions: chmod 600 ~/.config/solana/id.json
const secret = JSON.parse(fs.readFileSync(process.env.KEYPAIR_PATH!, 'utf-8'));
const keypair = Keypair.fromSecretKey(Uint8Array.from(secret));
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

import { Keypair } from '@solana/web3.js';
import fs from 'fs';

// Ensure keyfile permissions: chmod 600 ~/.config/solana/id.json
const secret = JSON.parse(fs.readFileSync(process.env.KEYPAIR_PATH!, 'utf-8'));
const keypair = Keypair.fromSecretKey(Uint8Array.from(secret));
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

PID=3mNbBV3Xc3rNJ4E87pSFzW7VhUZySHQDQVyd4MP2VFG6

count_by_size () {
  curl -s $RPC -X POST -H 'Content-Type: application/json' -d "{
    \"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getProgramAccounts\",
    \"params\":[\"$PID\",{
      \"encoding\":\"base64\",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends an automated loop that can place bets and submit claim transactions on Solana mainnet using real SOL, but it does not require an explicit user confirmation or spending guard before each transaction. In an agent context, this creates a real risk of autonomous financial loss because the agent is instructed to discover markets, act on signals, and submit on-chain transactions without a human approval checkpoint.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: This JSON manifest contains natural-language instruction docs such as "Create a new prediction market for a pump.fun token" but provides no explicit trigger phrases, activation scope, or exclusion conditions. In a manifest file, that can make skill invocation criteria ambiguous because the descriptions read like general capability statements rather than narrowly scoped triggers.

Static analysis

No suspicious patterns detected.