T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apex.mjs:192- Finding
Trading Orders Accept Unvalidated Size and Price Parameters
- Content
View full analysis
Vulnerability Details
File Location:
scripts/apex.mjs:192-246
Vulnerability Type: Insufficient validation of financial transaction parameters
Risk Level: HighVulnerable Code
js case 'market-buy': case 'market-sell': { const apexClient = await createPrivateClient(); const symbol = normalizeSymbol(args[1]); const size = args[2]; if (!symbol || !size) { throw new Error(`Usage: apex ${command} <coin> <size>`); } const side = command === 'market-buy' ? 'BUY' : 'SELL'; const symbolInfo = apexClient.symbols?.[symbol]; if (!symbolInfo?.l2PairId) { throw new Error(`Unknown symbol: ${symbol}`); } let price = ''; try { const worst = await apexClient.privateApi.getWorstPrice(symbol, size, side); price = worst?.worstPrice || ''; } catch (err) { const ticker = await getTickerPrice(apexClient, symbol); price = ticker?.lastPrice || ''; } if (!price) throw new Error(`Unable to determine price for ${symbol}`); const makerFeeRate = apexClient.account?.contractAccount?.makerFeeRate || '0'; const takerFeeRate = apexClient.account?.contractAccount?.takerFeeRate || '0'; const limitFee = calculateLimitFee( price, size, takerFeeRate, symbolInfo.baseCoinRealPrecision, ); const order = { pairId: symbolInfo.l2PairId, makerFeeRate, takerFeeRate, symbol, side, type: 'MARKET', size: String(size), price: String(price), limitFee, reduceOnly: false, timeInForce: 'IMMEDIATE_OR_CANCEL', expiration: Math.floor(Date.now() / 1000 + 30 * 24 * 60 * 60), }; const result = await apexClient.privateApi.createOrder(order); console.log(JSON.stringify(result, null, 2)); break; } case 'limit-buy': case 'limit-sell': { const apexClient = await createPrivateClient(); const symbol = normalizeSymbol(args[1]); const si ...[truncated 2115 chars]- Remediation
View remediation
Remediation Suggestions
- Parse
sizeandpricewithBigNumberand reject invalid, non-finite, zero, or negative values. - Validate size, price, and notional against the exchange metadata for the selected symbol.
- Enforce decimal precision before constructing the order.
- Retrieve current account equity, available margin, and existing exposure before submission.
- Define an explicit maximum notional and reject or require heightened confirmation for trades exceeding it.
- Compare limit prices with a fresh market price and reject or prominently confirm prices outside a configured deviation.
- Generate a complete order preview and require explicit confirmation immediately before
createOrder(). - Add automated tests for negative numbers, zero, exponent notation,
NaN,Infinity, excessive precision, and extreme notional values.
- Parse