Solana Funding Rate Arbitrage

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:44 AM UTC
• Version: 2.1.0

Overview

This is not clear malware, but its live trading paths are under-scoped and incomplete in ways that could put wallet funds at risk.

Only install or run this after treating it as experimental financial automation. Keep it in dry-run mode unless you have reviewed the code, use a dedicated low-balance wallet, do not reuse important private keys, and avoid cron/live trading until the venue support, mock-data behavior, and failed-leg unwind handling are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (45)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises executable workflows that use environment variables and network access, but it does not declare permissions. Hidden or undeclared capabilities reduce user visibility into what the skill can access, which is especially risky for a trading bot that may read wallet secrets and contact live endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A description-behavior mismatch is a serious trust and scope issue: users are told this is a Drift/Flash funding arbitrage skill, while the detected behavior suggests much broader trading, data collection, dashboard exposure, and persistent state handling. That mismatch can cause users to authorize actions or expose funds and data under false assumptions about what the skill actually does.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The guide claims support for GMTrade and Zeta Markets, while the skill metadata only describes Drift and Flash Trade. In a trading/auto-execution context, overstating supported venues can mislead users about tested integrations, risk models, and execution paths, which may cause unsafe operational assumptions or deployment decisions.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The user guide advertises a web dashboard that is not disclosed in the manifest. Hidden or undocumented network-facing UI components increase risk because users and reviewers may not evaluate exposed ports, browser attack surface, or local service behavior when deciding whether to install or run the skill.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The documentation frames wallet/private-key setup as a future execution feature, while the manifest claims full auto-trading capabilities. In a financial automation skill, ambiguity around whether private keys are currently used can cause users to expose sensitive credentials without a clear understanding of when, how, or whether live trading logic will access them.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The script prints a backtest header claiming '30 Days, 3x Leverage, 0.1% Fee per trade', while the implementation details can diverge from the assumptions a user relies on when interpreting profitability and risk. In a financial auto-trading skill, misleading labels on leverage/fee assumptions can cause users to trust overstated or understated returns and deploy capital under false premises.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the advertised skill purpose: it performs spot-token DEX arbitrage over Jupiter, Raydium, Orca, and Meteora instead of perpetual funding-rate arbitrage on Drift and Flash Trade. In an auto-trading skill, this mismatch is dangerous because users may supply capital and permissions under false assumptions about strategy, venue, and risk profile, leading to unintended live trades and losses.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The comment says trades are executed atomically, but the code actually submits the buy and sell legs sequentially and explicitly notes partial execution risk. That exposes the wallet to directional market risk if the first leg confirms and the second fails, which is especially dangerous in a fast-moving automated arbitrage context where losses can exceed expected spread capture.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file’s implementation materially differs from the skill’s advertised capability: it only queries Drift’s /contracts endpoint and prints funding data, while the manifest describes cross-DEX Drift/Flash Trade arbitrage and auto-trading. In a trading automation context, this kind of capability mismatch is dangerous because operators may rely on the skill for strategy selection or risk assumptions it does not actually satisfy, leading to incorrect execution decisions and financial loss.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The method `findDeltaNeutralPairs` labels combinations of different-symbol long and short positions as 'delta-neutral', but cross-asset long/short pairings within Drift are not inherently delta-neutral because their price exposures, betas, and basis risks differ. In the context of an arbitrage/trading skill, this mislabeling can directly induce users or downstream automation to take materially directional positions while believing risk is hedged, creating significant loss potential.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The opportunity scanner prints 'LONG perp + SHORT spot' for negative-funding cases even though the execution path explicitly skips that hedge direction ('need to borrow, skip for simplicity'). This can mislead an operator into believing the bot supports a delta-neutral strategy it cannot actually execute, creating unhedged exposure and unsafe trading decisions in a high-risk auto-trading context.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The UI tells users that wallet connection enables 'Live Trading' and renders 'Execute Trade' actions, but the execution path is only a placeholder and explicitly marked TODO. In a financial trading skill, this kind of misleading affordance is dangerous because users may connect wallets and make trust decisions under the false impression that vetted execution exists, increasing phishing-style risk and unsafe wallet exposure.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: When the live Flash API call fails, the code silently substitutes randomized mock funding rates and prices, which can be mistaken for real market data by downstream trading logic. In an auto-trading arbitrage skill, this can directly trigger false signals, bad hedges, and unintended order execution with real funds, making the fallback materially dangerous in context.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: When the live GooseFX API call fails, the code silently returns fabricated funding rates, prices, and open interest using random values. In an auto-trading funding arbitrage skill, this can directly drive false opportunity detection and order execution on nonexistent market conditions, creating financial loss and masking upstream outages.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The code documentation states that live funding data is sourced from on-chain Solana RPC, but the implementation actually retrieves it from an external HTTP API and retains an unused RPC connection. In an auto-trading arbitrage skill, this mismatch can cause operators to trust data provenance, availability, and integrity assumptions that are false, leading to bad trading decisions or silent dependence on a centralized upstream service.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: When the live Jupiter API call fails, the code silently substitutes fabricated funding rates, prices, and open interest values via getMockRates(). In an auto-trading/funding-arbitrage skill, this can drive trading decisions from fake market data, causing real financial loss, invalid backtests, and hidden operational failures instead of failing safely.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: parseRates() claims to parse the real API response but always returns an empty array, meaning the integration can silently behave as if no markets exist even when valid data was received. In a scanner/auto-trader context this suppresses signals, masks integration breakage, and can trigger unsafe fallback behavior like the mock-data path elsewhere in this file.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: On API failure, the code silently substitutes fabricated funding-rate data and returns it through the same interface as real market data. In the context of a scanner and auto-trader for funding arbitrage, this can directly drive trading, backtesting, or risk decisions using false inputs, creating a serious integrity failure with potential financial loss.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file is documented as a Mango Markets integration, but parseRates returns an empty array and the error path fabricates values, so the implementation does not reliably provide genuine Mango data. In an automated trading skill, this mismatch is dangerous because operators may trust the module as production-ready and enable execution based on incomplete or synthetic market inputs.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: On API failure, the integration silently substitutes randomized mock funding rates and prices, making downstream scanners, backtests, or auto-trading logic believe the data is real. In a trading skill explicitly marketed for automated funding arbitrage, this can directly trigger false signals, bad position sizing, and unintended live trades based on fabricated market conditions.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file presents itself as a real Zeta Markets integration, but parseRates is nonfunctional and the runtime behavior degrades to mock data, creating a misleading trust boundary between documentation and actual behavior. In this skill’s context, users may enable automated strategy execution assuming genuine exchange connectivity, increasing the chance of acting on nonexistent or simulated opportunities.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The client is presented in skill metadata as supporting full auto-trading on Flash Trade, but the real execution paths for non-dry-run mode are unimplemented and return errors. In an automated arbitrage system, this can create false assumptions about hedge execution, causing one leg of a supposedly delta-neutral strategy to execute elsewhere while the Flash leg never opens, leading to unhedged market exposure and operational loss.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The positions API claims to represent user positions but, outside dry-run mode, silently returns an empty list instead of querying on-chain state. In a trading bot, this can hide existing exposure, prevent correct reconciliation, and cause duplicate or conflicting trades, which is especially dangerous in leveraged perp strategies.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The broad activation wording could cause the skill to trigger for general trading, analysis, or automation requests beyond the narrow intended scope. In the context of an auto-trading skill, over-broad invocation increases the chance of accidental execution of risky workflows, including wallet-connected operations.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The quick-start section includes a live trading command with no prominent warning that it can execute real trades using wallet funds. In a financial skill, missing safety interlocks can lead to immediate monetary loss from accidental execution, slippage, liquidation, or misconfiguration.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/dashboard/server.ts:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/protocols/drift.ts:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/trading/drift-client.ts:74

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/src/trading/flash-client.ts:68