T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apex.mjs:190- Finding
Signed trading operations accept unvalidated order sizes and prices
- Content
View full analysis
`); } const side = command === 'market-buy' ? 'BUY' : 'SELL'; const symbolInfo = apexClient.symbols?.[symbol]; if (!symbolInfo?.l2PairId) { throw new Error(`Unknown symbol: ${symbol}`); } let price = ''; try { const worst = await apexClient.privateApi.getWorstPrice(symbol, size, side); price = worst?.worstPrice || ''; } catch (err) { const ticker = await getTickerPrice(apexClient, symbol); price = ticker?.lastPrice || ''; } if (!price) throw new Error(`Unable to determine price for ${symbol}`); const makerFeeRate = apexClient.account?.contractAccount?.makerFeeRate || '0'; const takerFeeRate = apexClient.account?.contractAccount?.takerFeeRate || '0'; const limitFee = calculateLimitFee(price, size, takerFeeRate, symbolInfo.baseCoinRealPrecision); const order = { pairId: symbolInfo.l2PairId, makerFeeRate, takerFeeRate, symbol, side, type: 'MARKET', size: String(size), price: String(price), limitFee, reduceOnly: false, timeInForce: 'IMMEDIATE_OR_CANCEL', expiration: Math.floor(Date.now() / 1000 + 30 * 24 * 60 * 60), }; const result = await apexClient.privateApi.createOrder(order); console.log(JSON.stringify(result, null, 2)); break; } ``` The limit-order path uses the same insufficient validation pattern: ```js case 'limit-buy': case 'limit-sell': { const apexClient = await createPrivateClient(); const symbol = normalizeSymbol(args[1]); const size = args[2]; const price ...[truncated 3194 chars]- Remediation
View remediation