binance / binance/binance-futures-connector-python
[Security] No Leverage Value Validation Allows Dangerous Leverage Settings
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 326
- PR merge metrics
- No merged PRs in 30d
Description
## Bug Name
No Leverage Value Validation Allows Dangerous Leverage Settings
## Attack Scenario
change_leverage() accepts leverage:int documented as 1-125 but performs zero validation. check_required_parameters only checks not-empty. leverage=0, 200, 1.5, or -10 all pass the check and get signed and sent.
## Impact
In leveraged futures trading, accidentally setting 125x leverage instead of 12x (typo or off-by-one) could result in immediate liquidation on minor price movements. No client-side safety net for this critical parameter.
## Components
Files: /binance/um_futures/account.py lines 574-592, /binance/cm_futures/account.py lines 520-539. Validation in utils.py line 20-22.
## Reproduction
1. Call change_leverage(symbol='BTCUSDT', leverage=200).
2. Request passes client validation and is signed.
3. Only rejected by server with cryptic error message.
## Fix
Add range validation: if not isinstance(leverage, int) or leverage < 1 or leverage > 125: raise ParameterValueError. Add max_leverage configuration parameter.
## Details
Finding ID: M-02
Severity: Medium
---
Researcher: Independent Security Researcher -- Mefai Security Team
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with binance/um_futures/account.py lines 574-592 and binance/cm_futures/account.py lines 520-539, then read the validation in utils.py lines 20-22. Confirm how change_leverage parameters are checked and signed. Done means invalid leverage values are rejected before signing, with the requested maximum-leverage configuration supported in both futures clients.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 64/100