Skip to content

Commit 90e0b8d

Browse files
Hiksangclaude
Hiksang
and
claude
committed
fix: 32 bugs — runtime logic, JSON output, security hardening
Runtime bugs (21): - bot/engine: grids<2 div-by-zero guard, dailyPnl daily reset, max_daily_loss enforcement, grid fill verification via order history - hyperliquid: typeof check for error response, markPx fallback - lighter: accountIndex<0 guard in setupApiKey - arb/state: addPosition auto-initializes instead of throwing - trade: remove 6 double-output printJson calls, dry-run alias fix - mcp-server: use tryLoadPrivateKey for graceful no-key handling - account: twap-orders pac() wrapped in try/catch with JSON error - funds: relayer deposit key try/catch, bridge exit(1) + JSON error - manage: deprecated withdraw early return, 8 double-output fixes - history: track loop baseline updated each interval - settings: invalid referral action returns JSON error - liquidity: bid-side slippage gate direction fix, recommendedSize - risk: add "critical" liquidation status tier - strategies/grid: trailing-stop NaN guard when peakEquity=0 - strategies/funding-arb: SIGINT/SIGTERM graceful shutdown Security hardening (5): - jobs: shell-escape env values in tmux commands - dashboard/server: bind to 127.0.0.1 only - hyperliquid: monotonic nonce to prevent millisecond collisions - lighter: remove public evmKey getter Verified: tsc clean, 941/941 tests pass, live-tested on all 3 exchanges (Pacifica, Hyperliquid, Lighter) with limit/edit/cancel/stop orders. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent a4504e0 commit 90e0b8d

17 files changed

Lines changed: 117 additions & 62 deletions

File tree

‎src/arb/state.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,12 @@ export function saveArbState(state: ArbDaemonState): void {
105105
renameSync(tmpPath, stateFilePath);
106106
}
107107

108-
/** Add a position to the persisted state. */
108+
/** Add a position to the persisted state. Auto-initializes state if missing. */
109109
export function addPosition(pos: ArbPositionState): void {
110-
const state = loadArbState();
110+
let state = loadArbState();
111111
if (!state) {
112-
throw new Error("No daemon state found. Initialize state before adding positions.");
112+
// State was lost — create minimal valid state to avoid losing position tracking
113+
state = createInitialState({ minSpread: 0, closeSpread: 0, size: 0, holdDays: 0, bridgeCost: 0, maxPositions: 10, settleStrategy: "off" });
113114
}
114115
// Avoid duplicates by symbol
115116
state.positions = state.positions.filter(p => p.symbol !== pos.symbol);

‎src/bot/engine.ts‎

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ interface BotState {
1414
equity: number;
1515
peakEquity: number;
1616
dailyPnl: number;
17+
dailyStartEquity: number;
18+
dailyStartDate: string; // YYYY-MM-DD for daily reset
1719
fills: number;
1820
totalPnl: number;
1921
rebalanceCount: number;
@@ -44,6 +46,8 @@ export async function runBot(
4446
equity: 0,
4547
peakEquity: 0,
4648
dailyPnl: 0,
49+
dailyStartEquity: 0,
50+
dailyStartDate: new Date().toISOString().slice(0, 10),
4751
fills: 0,
4852
totalPnl: 0,
4953
rebalanceCount: 0,
@@ -80,6 +84,7 @@ export async function runBot(
8084
const bal = await adapter.getBalance();
8185
state.equity = parseFloat(bal.equity);
8286
state.peakEquity = state.equity;
87+
state.dailyStartEquity = state.equity;
8388
log(` Starting equity: $${state.equity.toFixed(2)}`);
8489
} catch {
8590
log(chalk.yellow(` Could not fetch initial balance`));
@@ -100,7 +105,13 @@ export async function runBot(
100105
const bal = await adapter.getBalance();
101106
state.equity = parseFloat(bal.equity);
102107
if (state.equity > state.peakEquity) state.peakEquity = state.equity;
103-
state.dailyPnl = state.equity - state.peakEquity; // simplified
108+
// Reset daily baseline at day boundary
109+
const today = new Date().toISOString().slice(0, 10);
110+
if (today !== state.dailyStartDate) {
111+
state.dailyStartEquity = state.equity;
112+
state.dailyStartDate = today;
113+
}
114+
state.dailyPnl = state.equity - state.dailyStartEquity;
104115
} catch { /* non-critical */ }
105116

106117
const context = {
@@ -144,12 +155,15 @@ export async function runBot(
144155

145156
// Check risk limits
146157
const drawdown = state.peakEquity - state.equity;
147-
const riskBreached = drawdown > config.risk.max_drawdown;
158+
const dailyLossBreached = state.dailyPnl < -config.risk.max_daily_loss;
159+
const riskBreached = drawdown > config.risk.max_drawdown || dailyLossBreached;
148160

149161
if (shouldExit || riskBreached) {
150-
const reason = riskBreached
151-
? `drawdown $${drawdown.toFixed(2)} > limit $${config.risk.max_drawdown}`
152-
: "exit condition met";
162+
const reason = dailyLossBreached
163+
? `daily loss $${Math.abs(state.dailyPnl).toFixed(2)} > limit $${config.risk.max_daily_loss}`
164+
: drawdown > config.risk.max_drawdown
165+
? `drawdown $${drawdown.toFixed(2)} > limit $${config.risk.max_drawdown}`
166+
: "exit condition met";
153167
log(chalk.yellow(` ⚠ Exiting: ${reason}`));
154168
state.phase = "exiting";
155169
} else {
@@ -324,6 +338,7 @@ async function placeGridOrders(
324338
currentPrice: number,
325339
log: BotLog,
326340
) {
341+
if (params.grids < 2) throw new Error("Grid requires at least 2 grid lines");
327342
const step = (state.gridUpper - state.gridLower) / (params.grids - 1);
328343
const sizePerGrid = params.size / params.grids;
329344
let placed = 0;
@@ -364,6 +379,7 @@ async function manageGrid(
364379
snapshot: MarketSnapshot,
365380
log: BotLog,
366381
) {
382+
if (params.grids < 2) throw new Error("Grid requires at least 2 grid lines");
367383
const step = (state.gridUpper - state.gridLower) / (params.grids - 1);
368384
const sizePerGrid = params.size / params.grids;
369385

@@ -374,9 +390,22 @@ async function manageGrid(
374390
openOrders.filter(o => o.symbol.toUpperCase() === symbol.toUpperCase()).map(o => o.orderId)
375391
);
376392

393+
// Build filled order IDs from order history for accurate fill detection
394+
let filledIds: Set<string> | null = null;
395+
try {
396+
const history = await adapter.getOrderHistory(100);
397+
filledIds = new Set(history.filter(o => o.status === "filled").map(o => o.orderId));
398+
} catch { /* non-critical — fall back to assuming fills */ }
399+
377400
let newFills = 0;
378401
for (const [idx, orderId] of state.gridOrders.entries()) {
379402
if (!openIds.has(orderId)) {
403+
// Verify the order was actually filled (not just cancelled)
404+
if (filledIds && !filledIds.has(orderId)) {
405+
log(chalk.yellow(` [GRID] Order ${orderId} missing — likely cancelled, skipping`));
406+
state.gridOrders.delete(idx);
407+
continue;
408+
}
380409
// Order filled — place opposite order
381410
newFills++;
382411
state.fills++;

‎src/commands/account.ts‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1034,8 +1034,15 @@ export function registerAccountCommands(
10341034
.command("twap-orders")
10351035
.description("Active TWAP orders")
10361036
.action(async () => {
1037-
const adapter = await getAdapter();
1038-
const p = pac(adapter);
1037+
let p: PacificaAdapter;
1038+
try {
1039+
const adapter = await getAdapter();
1040+
p = pac(adapter);
1041+
} catch (err) {
1042+
if (isJson()) return printJson(jsonError("EXCHANGE_ERROR", err instanceof Error ? err.message : String(err)));
1043+
console.error(chalk.red(`\n ${err instanceof Error ? err.message : String(err)}\n`));
1044+
return;
1045+
}
10391046
const orders = await p.sdk.getTWAPOrders(p.publicKey);
10401047
if (isJson()) return printJson(jsonOk(orders));
10411048

‎src/commands/funds.ts‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { Command } from "commander";
22
import chalk from "chalk";
3-
import { printJson, formatUsd, jsonOk } from "../utils.js";
3+
import { printJson, formatUsd, jsonOk, jsonError } from "../utils.js";
44
import { PacificaAdapter, HyperliquidAdapter, type ExchangeAdapter } from "../exchanges/index.js";
55
import type { Network } from "../pacifica/index.js";
66
import { logExecution } from "../execution-log.js";
@@ -203,7 +203,12 @@ export function registerFundsCommands(
203203

204204
const { ethers } = await import("ethers");
205205
const { loadPrivateKey } = await import("../config.js");
206-
const pk = await loadPrivateKey("hyperliquid");
206+
let pk: string;
207+
try {
208+
pk = await loadPrivateKey("hyperliquid");
209+
} catch (err) {
210+
throw new Error(`Private key not configured for Hyperliquid. Run: perp init`);
211+
}
207212
const wallet = new ethers.Wallet(pk);
208213

209214
try {
@@ -736,8 +741,13 @@ export function registerFundsCommands(
736741
console.log(chalk.gray(`\n Waiting for Circle attestation (~1-3 min)...`));
737742
console.log(chalk.gray(` Check: perp funds bridge-status --hash ${result.messageHash}\n`));
738743
} else {
744+
if (isJson()) {
745+
printJson(jsonError("RELAYER_UNAVAILABLE", "CCTP bridge requires relayer server. Start: cd packages/relayer && pnpm start"));
746+
process.exit(1);
747+
}
739748
console.error(chalk.red("\n CCTP bridge requires relayer server."));
740749
console.error(chalk.gray(" Start: cd packages/relayer && pnpm start\n"));
750+
process.exit(1);
741751
}
742752
});
743753

‎src/commands/history.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1041,8 +1041,8 @@ function registerPnlSubcommands(
10411041

10421042
// Initial snapshot
10431043
const snaps = await takeSnapshot(getAdapterForExchange, exchanges);
1044-
const total = snaps.reduce((s, sn) => s + sn.equity, 0);
1045-
console.log(`${chalk.gray(new Date().toLocaleTimeString())} Total equity: $${formatUsd(total)}`);
1044+
let prevTotal = snaps.reduce((s, sn) => s + sn.equity, 0);
1045+
console.log(`${chalk.gray(new Date().toLocaleTimeString())} Total equity: $${formatUsd(prevTotal)}`);
10461046

10471047
while (!controller.signal.aborted) {
10481048
await new Promise<void>((resolve) => {
@@ -1054,11 +1054,12 @@ function registerPnlSubcommands(
10541054
try {
10551055
const s = await takeSnapshot(getAdapterForExchange, exchanges);
10561056
const t = s.reduce((sum, sn) => sum + sn.equity, 0);
1057-
const delta = t - total;
1057+
const delta = t - prevTotal;
10581058
console.log(
10591059
`${chalk.gray(new Date().toLocaleTimeString())} ` +
10601060
`Total: $${formatUsd(t)} ${formatPnl(delta)}`,
10611061
);
1062+
prevTotal = t;
10621063
} catch (err) {
10631064
console.error(chalk.red(`Snapshot error: ${err instanceof Error ? err.message : err}`));
10641065
}

‎src/commands/manage.ts‎

Lines changed: 7 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -47,18 +47,8 @@ export function registerManageCommands(
4747
const withdrawCmd = manage
4848
.command("withdraw <amount> <address>")
4949
.description("Use 'perp withdraw pacifica <amount>'")
50-
.action(async (amount: string, address: string) => {
50+
.action(async (_amount: string, _address: string) => {
5151
console.log(chalk.yellow("\n Use 'perp withdraw pacifica <amount>' instead.\n"));
52-
const a = await pac();
53-
const result = await a.sdk.withdraw(
54-
{ amount, dest_address: address },
55-
a.publicKey,
56-
a.signer
57-
);
58-
if (isJson()) return printJson(jsonOk(result));
59-
console.log(
60-
chalk.green(`\n Withdrawal of $${amount} to ${address} submitted.\n`)
61-
);
6252
});
6353
(withdrawCmd as any)._hidden = true;
6454

@@ -89,7 +79,7 @@ export function registerManageCommands(
8979
a.signer
9080
);
9181
if (isJson()) return printJson(jsonOk(result));
92-
printJson(jsonOk(result));
82+
console.log(JSON.stringify(result, null, 2));
9383
});
9484

9585
sub
@@ -133,7 +123,7 @@ export function registerManageCommands(
133123
a.signer
134124
);
135125
if (isJson()) return printJson(jsonOk(result));
136-
printJson(jsonOk(result));
126+
console.log(JSON.stringify(result, null, 2));
137127
});
138128

139129
agent
@@ -178,7 +168,6 @@ export function registerManageCommands(
178168
);
179169
if (isJson()) return printJson(jsonOk(result));
180170
console.log(chalk.green(`\n Lake created for ${symbol.toUpperCase()} with $${amount}.\n`));
181-
printJson(jsonOk(result));
182171
});
183172

184173
lake
@@ -266,7 +255,7 @@ export function registerManageCommands(
266255
const a = await pac();
267256
const result = await a.sdk.getBuilderOverview(a.publicKey);
268257
if (isJson()) return printJson(jsonOk(result));
269-
printJson(jsonOk(result));
258+
console.log(JSON.stringify(result, null, 2));
270259
});
271260

272261
builder
@@ -276,7 +265,7 @@ export function registerManageCommands(
276265
const a = await pac();
277266
const result = await a.sdk.getBuilderTrades(code);
278267
if (isJson()) return printJson(jsonOk(result));
279-
printJson(jsonOk(result));
268+
console.log(JSON.stringify(result, null, 2));
280269
});
281270

282271
builder
@@ -286,7 +275,7 @@ export function registerManageCommands(
286275
const a = await pac();
287276
const result = await a.sdk.getBuilderLeaderboard(code);
288277
if (isJson()) return printJson(jsonOk(result));
289-
printJson(jsonOk(result));
278+
console.log(JSON.stringify(result, null, 2));
290279
});
291280

292281
builder
@@ -336,7 +325,6 @@ export function registerManageCommands(
336325
);
337326
if (isJson()) return printJson(jsonOk(result));
338327
console.log(chalk.green(`\n API key "${name}" created.\n`));
339-
printJson(jsonOk(result));
340328
});
341329

342330
apikey
@@ -349,7 +337,7 @@ export function registerManageCommands(
349337
a.signer
350338
);
351339
if (isJson()) return printJson(jsonOk(result));
352-
printJson(jsonOk(result));
340+
console.log(JSON.stringify(result, null, 2));
353341
});
354342

355343
apikey

‎src/commands/settings.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { Command } from "commander";
22
import chalk from "chalk";
3-
import { printJson, jsonOk, withJsonErrors } from "../utils.js";
3+
import { printJson, jsonOk, jsonError, withJsonErrors } from "../utils.js";
44
import { loadSettings, saveSettings, type Settings, type ExchangeFees } from "../settings.js";
55
import type { ExchangeAdapter } from "../exchanges/index.js";
66
import { ENV_FILE, loadEnvFile, setEnvVar, EXCHANGE_ENV_MAP, validateKey } from "./init.js";
@@ -80,6 +80,7 @@ export function registerSettingsCommands(
8080
if (isJson()) return printJson(jsonOk({ referrals: false }));
8181
console.log(chalk.yellow("\n Referrals disabled. No codes will be sent.\n"));
8282
} else {
83+
if (isJson()) return printJson(jsonError("INVALID_ARGS", `Invalid action "${action}". Usage: perp settings referrals <on|off>`));
8384
console.error(chalk.red(`\n Usage: perp settings referrals <on|off>\n`));
8485
}
8586
});

‎src/commands/trade.ts‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@ export function registerTradeCommands(
141141

142142
if (isJson()) return printJson(jsonOk(clientId ? { ...result as object, clientOrderId: clientId } : result));
143143
console.log(chalk.green(`\n Market ${s.toUpperCase()} ${size} ${symbol.toUpperCase()} placed on ${adapter.name}.${opts.smart ? " (smart)" : ""}${clientId ? ` (id: ${clientId})` : ""}\n`));
144-
printJson(jsonOk(result));
145144
});
146145

147146
// Shortcuts: trade buy / trade sell
@@ -177,7 +176,6 @@ export function registerTradeCommands(
177176
}
178177
if (isJson()) return printJson(jsonOk(clientId ? { ...result as object, clientOrderId: clientId } : result));
179178
console.log(chalk.green(`\n Market BUY ${size} ${symbol.toUpperCase()} placed on ${adapter.name}.${opts.smart ? " (smart)" : ""}\n`));
180-
printJson(jsonOk(result));
181179
});
182180

183181
trade
@@ -212,7 +210,6 @@ export function registerTradeCommands(
212210
}
213211
if (isJson()) return printJson(jsonOk(clientId ? { ...result as object, clientOrderId: clientId } : result));
214212
console.log(chalk.green(`\n Market SELL ${size} ${symbol.toUpperCase()} placed on ${adapter.name}.${opts.smart ? " (smart)" : ""}\n`));
215-
printJson(jsonOk(result));
216213
});
217214

218215
// ── Split Order (orderbook-aware) ──
@@ -233,10 +230,8 @@ export function registerTradeCommands(
233230
if (!["buy", "sell"].includes(orderSide)) errorAndExit("Side must be 'buy' or 'sell'");
234231
if (isNaN(totalUsd) || totalUsd <= 0) errorAndExit("USD amount must be > 0");
235232

236-
const exchange = program.opts().exchange ?? "unknown";
237-
if (dryRunGuard("split-order", { exchange, symbol: sym, side: orderSide, totalUsd, ...opts })) return;
238-
239233
const adapter = await getAdapter();
234+
if (dryRunGuard("split-order", { exchange: adapter.name, symbol: sym, side: orderSide, totalUsd, ...opts })) return;
240235
const { runSplitOrder } = await import("../strategies/split-order.js");
241236

242237
const result = await runSplitOrder(adapter, {
@@ -321,7 +316,6 @@ export function registerTradeCommands(
321316

322317
if (isJson()) return printJson(jsonOk(clientId ? { ...result as object, clientOrderId: clientId } : result));
323318
console.log(chalk.green(`\n Limit ${s.toUpperCase()} ${size} ${symbol.toUpperCase()} @ $${price} placed on ${adapter.name}.${clientId ? ` (id: ${clientId})` : ""}\n`));
324-
printJson(jsonOk(result));
325319
});
326320

327321
trade
@@ -490,7 +484,6 @@ export function registerTradeCommands(
490484

491485
if (isJson()) return printJson(jsonOk(result));
492486
console.log(chalk.green(`\n TWAP ${s.toUpperCase()} ${size} ${symbol.toUpperCase()} over ${duration} placed on ${adapter.name}.\n`));
493-
printJson(jsonOk(result));
494487
});
495488

496489
// === Stop / Trigger orders — Pacifica + Hyperliquid ===
@@ -523,7 +516,6 @@ export function registerTradeCommands(
523516

524517
if (isJson()) return printJson(jsonOk(result));
525518
console.log(chalk.green(`\n Stop order placed on ${adapter.name}.\n`));
526-
printJson(jsonOk(result));
527519
});
528520

529521
// === TP/SL — Pacifica + Hyperliquid ===

‎src/dashboard/server.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -409,7 +409,7 @@ export async function startDashboard(
409409
}
410410

411411
return new Promise((resolve) => {
412-
server.listen(port, async () => {
412+
server.listen(port, "127.0.0.1", async () => {
413413
// Start WS feeds (connects to exchange WS APIs)
414414
await feedMgr!.start();
415415
// Start arb REST polling (30s cycle)

0 commit comments

Comments
 (0)