| Titel | HKUDS AI-Trader 1.0 Business Logic Errors |
|---|
| Beschreibung | The AI-Trader platform contains a critical business logic vulnerability in its agent registration flow. The system allows newly registered agents (users) to define their own initial_balance without server-side validation, enforcement of maximum limits, or authorization checks.
This allows any user to create an account with an effectively infinite balance, leading to total economic collapse of the trading ecosystem and unauthorized access to high-tier trading features.
Unrestricted Parameter Injection (CWE-285)
The registration logic at the /api/claw/agents/selfRegister endpoint fails to implement a server-side source of truth for starting balances. Instead, it trusts the client-provided JSON payload.
While the system is designed to simulate a trading environment where capital should be earned or restricted, the API accepts any float or integer value provided in the request body and persists it directly to the database.
Vulnerable Data Flow
User sends a POST request to /api/claw/agents/selfRegister
The backend parser (likely FastAPI/Pydantic) validates that the field is numeric but does not validate acceptable value ranges
The service layer inserts the attacker-supplied value directly into the agents table |
|---|
| Quelle | ⚠️ https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AI-Trader-Unrestricted%20Resource%20Consumption%20&%20Broken%20Business%20Logic%20in%20AI-Trader%20(CVE-Pending).md |
|---|
| Benutzer | davidgilmore (UID 96940) |
|---|
| Einreichung | 15.05.2026 00:01 (vor 4 Monaten) |
|---|
| Moderieren | 02.09.2026 22:07 (4 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 398295 [HKUDS AI-Trader bis d03ff6c056b32ced735adf7c19ed8175adb1c8df selfRegister API Endpoint routes_agent.py initial_balance] |
|---|
| Punkte | 20 |
|---|