binance / binance/binance-futures-connector-python

[Security] No Leverage Value Validation Allows Dangerous Leverage Settings

Open
#257 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.2k
Forks
326
PR merge metrics
No merged PRs in 30d

Description

## Bug Name
No Leverage Value Validation Allows Dangerous Leverage Settings

## Attack Scenario
change_leverage() accepts leverage:int documented as 1-125 but performs zero validation. check_required_parameters only checks not-empty. leverage=0, 200, 1.5, or -10 all pass the check and get signed and sent.

## Impact
In leveraged futures trading, accidentally setting 125x leverage instead of 12x (typo or off-by-one) could result in immediate liquidation on minor price movements. No client-side safety net for this critical parameter.

## Components
Files: /binance/um_futures/account.py lines 574-592, /binance/cm_futures/account.py lines 520-539. Validation in utils.py line 20-22.

## Reproduction
1. Call change_leverage(symbol='BTCUSDT', leverage=200).
2. Request passes client validation and is signed.
3. Only rejected by server with cryptic error message.

## Fix
Add range validation: if not isinstance(leverage, int) or leverage < 1 or leverage > 125: raise ParameterValueError. Add max_leverage configuration parameter.

## Details
Finding ID: M-02
Severity: Medium

---
Researcher: Independent Security Researcher -- Mefai Security Team

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with binance/um_futures/account.py lines 574-592 and binance/cm_futures/account.py lines 520-539, then read the validation in utils.py lines 20-22. Confirm how change_leverage parameters are checked and signed. Done means invalid leverage values are rejected before signing, with the requested maximum-leverage configuration supported in both futures clients.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.