T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/exchange.mjs:221- Finding
Environment Variable Bypasses Mandatory Order Confirmation
- Content
View full analysis
{ const pendingFile = resolve(__dir, '..', '.pending-order.json'); // Internal calls (from auto-trade.mjs) bypass file-based confirmation const isInternal = process.env.AICOIN_INTERNAL_CALL === '1'; // Step 2: Confirmation — only works if a pending order file exists from Step 1 if (confirmed === 'true' || confirmed === true) { if (isInternal) { // Internal call: execute directly with provided params const ex = await getExchange(exchange, market_type); const orderParams = { ...(params || {}) }; if (exchange === 'okx' && market_type && market_type !== 'spot' && !orderParams.posSide) { if (orderParams.reduceOnly) { orderParams.posSide = side === 'buy' ? 'short' : 'long'; } else { orderParams.posSide = side === 'buy' ? 'long' : 'short'; } } const order = await ex.createOrder(symbol, type, side, amount, price, orderParams); ``` Additional write-capable operations are exposed at `scripts/exchange.mjs:380-386` and `scripts/exchange.mjs:530-547`: ```js cancel_order: async ({ exchange, symbol, order_id, market_type }) => { const ex = await getExchange(exchange, market_type); if (order_id) return ex.cancelOrder(order_id, symbol); return ex.cancelAllOrders(symbol); }, set_leverage: async ({ exchange, symbol, leverage, market_type }) => { const ex = await getExchange(exchange, market_type); return ex.setLeverage(leverage, symbol); }, ``` ```js try { return await ex.transfer(code, amount, from, to); } catch (err) { ``` ### Technical Analysis The normal order workflow stores a pending order and expects a subsequent confirmation. However, setting `AICOIN_ ...[truncated 1510 chars]- Remediation
View remediation