T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sniper.py:126- Finding
Remote Swap Transaction Is Not Semantically Validated Before Signing and Submission
- Content
View full analysis
dict: """Execute swap via Jupiter.""" from solders.keypair import Keypair import base58 keypair = Keypair.from_bytes(base58.b58decode(PRIVATE_KEY)) async with httpx.AsyncClient(timeout=30) as client: resp = await client.post(JUPITER_SWAP, json={ "quoteResponse": quote, "userPublicKey": str(keypair.pubkey()), "wrapAndUnwrapSol": True }) swap_data = resp.json() # Sign and send transaction from solders.transaction import VersionedTransaction import base64 tx_bytes = base64.b64decode(swap_data["swapTransaction"]) tx = VersionedTransaction.from_bytes(tx_bytes) signed = keypair.sign_message(tx.message.serialize()) rpc = get_rpc_url() send_resp = await client.post(rpc, json={ "jsonrpc": "2.0", "id": 1, "method": "sendTransaction", "params": [base64.b64encode(bytes(tx)).decode(), {"skipPreflight": True}] }) return send_resp.json() ``` ### Technical Analysis The Skill treats the serialized transaction returned by the remote Jupiter endpoint as trusted. It decodes the transaction and proceeds toward signing without inspecting its instructions, program IDs, writable accounts, recipients, transfer amounts, output mint, fee recipients, or address lookup tables. TLS reduces ordinary network interception risk, but it does not protect against compromise of the Jupiter service, DNS or certificate trust infrastructure, or an upstream dependency. A compromised service could return a transaction materially different from the requested swap. The use of `"skipPreflight": True` further removes RPC simulation that could otherwise detect some transaction fail ...[truncated 1629 chars]- Remediation
View remediation