T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/src/trading/drift-client.ts:101
- Finding
- Live Trading Can Use Fabricated Fallback Market Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/src/trading/drift-client.ts:101-151`; `scripts/src/trading/flash-client.ts:89-143`; `scripts/src/trading/auto-trader.ts:485-493` **Vulnerability Type**: Fail-open use of synthetic financial data during live trading **Risk Level**: High ### Vulnerable Code ```ts // scripts/src/trading/drift-client.ts:101-151 const response = await axios.get(`${DRIFT_API}/perpMarkets`, { timeout: 10000 }); // ... } catch (error: any) { logger.warn(`Drift API error, using backup data: ${error.message}`); return this.getBackupMarketData(); } /** * Backup market data when API fails */ private getBackupMarketData(): DriftMarketInfo[] { // Use CoinGecko API for fallback funding rates const mockMarkets = [ { symbol: 'SOL-PERP', index: 0, price: 185, rate: 0.0005 }, { symbol: 'BTC-PERP', index: 1, price: 98000, rate: 0.0002 }, { symbol: 'ETH-PERP', index: 2, price: 3250, rate: 0.0004 }, ]; return mockMarkets.map(m => ({ marketIndex: m.index, symbol: m.symbol, oraclePrice: m.price, markPrice: m.price, fundingRate: m.rate, fundingRateApy: m.rate * 24 * 365 * 100, openInterest: 10000000, volume24h: 50000000 })); } ``` ```ts // scripts/src/trading/flash-client.ts:89-143 try { const response = await axios.get( `${COINGECKO_API}/derivatives/exchanges/flash_trade`, { timeout: 10000 } ); if (!response.data?.tickers) { throw new Error('No ticker data'); } // Live response processing omitted } catch (error: any) { logger.warn(`Flash API error: ${error.message}`); return this.getBackupMarketData(); } private getBackupMarketData(): FlashMarketInfo[] { return [ { symbol: 'SOL-PERP', oraclePrice: 185, fundingRate: 0.0008, fundingRateApy: 700, openInterest: 5000000, volume24h: 20000000 }, { symbol: 'BTC-PERP', oraclePrice: 98000, fundingRate: 0.0003, fundingRateApy: 262, openInterest: 10000000, volume24h: 50000000 }, { symbol: 'ET ...[truncated 2712 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Fail closed whenever live market data cannot be obtained or validated. 2. Restrict hard-coded fallback data to an explicit simulation-only implementation that cannot construct live trading clients. 3. Add metadata to every quote: - Data source - Retrieval timestamp - Market timestamp - Simulation status - Freshness and validation status 4. Reject execution if either leg uses synthetic, stale, incomplete, or untrusted data. 5. Cross-check prices and funding rates against at least one independent source before live execution. 6. Apply maximum data-age limits and circuit breakers for anomalous rate or price changes. 7. Require all markets used in one arbitrage decision to be from a consistent observation window. 8. Emit a high-priority alert and suspend trading when a required upstream data source fails. ]]>