jarrodwatts/jev-trader

Review signals: 1 connection review, 27 known vulnerability, 1 outside write, 1 sensitive read.

Reviewed as expected for a test run: read only test files inside the test workspace or its temporary folders; the Bun runtime wrote its own trace marker.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 27 distinct locations. 20 attributed processes.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 27 findings.

Repository processes attempted these writes outside documented output/cache paths. //package.json 1 attributed processes.

PID 2698: <guest-path> · <guest-path>

A repository process attempted to read this sensitive path. <guest-path> 1 attributed processes.

PID 2698: <guest-path> · <guest-path>

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• With no PRIVATE_KEY it dry-runs: Not replayable as a claim: 'bun run start' is a long-running server, and the claim path waits for the process to exit within a 120 s window (stays_running is not honored for claims; it timed out). Dry-run mode is instead checked by the probe: GET / on the started server returns "dryRun":true with no PRIVATE_KEY set (the banner also prints DRY RUN when started by hand).

  Source: With no `PRIVATE_KEY` it dry-runs: real book, real decisions, simulated fills.

  Observed: Not replayable as a claim: 'bun run start' is a long-running server, and the claim path waits for the process to exit within a 120 s window (stays_running is not honored for claims; it timed out). Dry-run mode is instead checked by the probe: GET / on the started server returns "dryRun":true with no PRIVATE_KEY set (the banner also prints DRY RUN when started by hand).

Examples

• signs a buy and a sell offline, asserts the calldata matches the SDK: Not run to success: the script reads the live Kuru MON-USDC book first, and at the time of testing the book had 0 bids and 9 asks at every block (checked over ~10 minutes, and the Kuru SDK itself also returned 0 bids), so buildBook throws 'empty book side'. Not a repo decoding fault; needs a two-sided live market.

  Source: README.md ## Layout / The 300 ms budget: bun run scripts/dry-encode.ts

  Expected: documented command completes successfully

  Observed: Not run to success: the script reads the live Kuru MON-USDC book first, and at the time of testing the book had 0 bids and 9 asks at every block (checked over ~10 minutes, and the Kuru SDK itself also returned 0 bids), so buildBook throws 'empty book side'. Not a repo decoding fault; needs a two-sided live market.

• book reader vs the SDK: exactness and latency: Not run to success for the same reason: the live book is one-sided (0 bids), so the reader throws before the SDK comparison. The SDK was checked directly and also reports 0 bids. Needs a two-sided live market.

  Source: README.md ## The 300 ms budget: bun run scripts/bench-read.ts

  Expected: documented command completes successfully

  Observed: Not run to success for the same reason: the live book is one-sided (0 bids), so the reader throws before the SDK comparison. The SDK was checked directly and also reports 0 bids. Needs a two-sided live market.

Cycles

• Every new block runs one trader cycle (decision, then quote): Live Kuru MON-USDC book had zero bids for the whole test window, so each block's cycle throws 'empty book side' before any decision. The cycle does fire per block (blocks are logged), but no decision or quote can be produced to check.

  Source: src/index.ts

  Input: live Monad block feed for MON-USDC with 0 bids at every block observed

  Expected: a decision and dry-run quote for the block

  Observed: Live Kuru MON-USDC book had zero bids for the whole test window, so each block's cycle throws 'empty book side' before any decision. The cycle does fire per block (blocks are logged), but no decision or quote can be produced to check.

Local or hosted: local

Run the jev-trader dry-run server (no PRIVATE_KEY) and read its GET / snapshot; then exercise the per-block decision/quote loop against the live Kuru MON-USDC book.

cd <guest-path> && ls -la && id -u && python3 --version && git status 2>&1 | head -3; cat README.md 2>/dev/null | head -200
ls -la <guest-path> /inputs 2>&1; ls -la <guest-path> 2>&1
cd <guest-path> && cat package.json; echo ---; cat .env.example; echo ---; ls -la .coldpass scripts src web; echo ---; which bun node npm uv 2>&1; node --version 2>&1; bun --version 2>&1; cat Dockerfile; echo; cat .dockerignore
cd /tmp && (curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.0" 2>&1 | tail -5); ls -la ~/.bun/bin 2>&1; ~/.bun/bin/bun --version 2>&1
sudo -n true && echo SUDO_OK; sudo -n apt-get install -y unzip 2>&1 | tail -3; cd /tmp && (curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.0" 2>&1 | tail -5); ls -la $HOME/.bun/bin 2>&1; $HOME/.bun/bin/bun --version 2>&1
sudo -n apt-get update 2>&1 | tail -2; sudo -n apt-get install -y unzip 2>&1 | tail -2; cd /tmp && (curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.0" 2>&1 | tail -5); $HOME/.bun/bin/bun --version 2>&1
export PATH="$HOME/.bun/bin:$PATH"; export NODE_USE_ENV_PROXY=1; cd <guest-path> && cp .env.example .env && bun install 2>&1 | tail -15; echo EXIT=$?
export PATH="$HOME/.bun/bin:$PATH"; cd <guest-path> && (timeout 25 bun run start > /tmp/jev-start.log 2>&1 &) ; sleep 20; cat /tmp/jev-start.log | head -60; echo ---; curl -s -m 5 http://localhost:3000/ | head -c 1500; echo; echo ---; curl -s -m 5 http://localhost:3000/history | head -c 300
cd <guest-path> && cat src/server.ts; echo ---; cat src/index.ts; echo ---; grep -n "empty book" -B5 -A5 src/*.ts | head -60; echo ---; cat CLAUDE.md | head -60
export PATH="$HOME/.bun/bin:$PATH"; cd <guest-path> && timeout 120 bun run scripts/dry-encode.ts 2>&1 | tail -30; echo EXIT=${PIPESTATUS[0]}; echo ----; timeout 150 bun run scripts/bench-read.ts 2>&1 | tail -25; echo EXIT=${PIPESTATUS[0]}
export PATH="$HOME/.bun/bin:$PATH"; cd <guest-path> && sed -n 1,40p scripts/dry-encode.ts; echo ----; timeout 60 bun run scripts/dry-encode.ts 2>&1 | head -12
export PATH="$HOME/.bun/bin:$PATH"; cd <guest-path> && for i in 1 2 3 4; do timeout 60 bun run scripts/dry-encode.ts > /tmp/de-$i.log 2>&1; echo "try $i exit=$?"; grep -E "^market|^ok|^FAIL|error:" /tmp/de-$i.log | head -8; sleep 25; done
export PATH="$HOME/.bun/bin:$PATH"; cd <guest-path> && timeout 150 bun run scripts/bench-read.ts 2>&1 | head -30; echo; sed -n 1,30p scripts/bench-read.ts | cut -c1-200
export PATH="$HOME/.bun/bin:$PATH"; mkdir -p /tmp/diag && cat > /tmp/diag/sdkbook.ts <<'EOF'
import { ethers } from "<guest-path>";
import * as Kuru from "<guest-path>";
const MARKET = "0x065C9d28E428A0db40191a54d33d5b7c71a9C394";
const provider = new ethers.providers.StaticJsonRpcProvider("https://rpc.monad.xyz", 143);
const params = await Kuru.ParamFetcher.getMarketParams(provider, MARKET);
const b = await Kuru.OrderBook.getFormattedL2OrderBook(provider, MARKET, params);
console.log("block", b.blockNumber, "bids", b.bids.length, "asks", b.asks.length, "top bid", b.bids[0], "top ask", b.asks.at(-1));
EOF
cd /tmp/diag && timeout 90 bun run sdkbook.ts 2>&1 | tail -8; echo EXIT=${PIPESTATUS[0]}
sudo -n ln -sf $HOME/.bun/bin/bun /usr/local/bin/bun && which bun && bun --version; (ss -ltnp 2>/dev/null | grep ':3000' || echo "port 3000 free"); pgrep -fa "bun run" || echo "no bun processes"; cd <guest-path> && grep -nF 'With no `PRIVATE_KEY` it dry-runs: real book, real decisions, simulated fills.' README.md | cut -c1-120; grep -nF 'bun run scripts/dry-encode.ts' README.md; grep -nF 'bun run scripts/bench-read.ts' README.md; grep -nF '`GET /` snapshot: model, wallet, dryRun, latest block event' README.md | cut -c1-120; find . -path ./node_modules -prune -o \( -name '*.test.*' -o -name '*.spec.*' \) -print | head
cd <guest-path> && grep -nF 'startBlockFeed((block) => trader.onBlock(block));' src/index.ts; grep -n "setInterval\|subscribe\|newHeads\|poll" src/chain.ts | head; mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"http","argv":["bun","run","start"],"cwd":"<guest-path>","url":"http://localhost:3000/","expected_text":"\"dryRun\":true"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"With no PRIVATE_KEY it dry-runs","source":"With no `PRIVATE_KEY` it dry-runs: real book, real decisions, simulated fills.","input":"default .env from .env.example (PRIVATE_KEY empty, DRY_RUN=true)","expected":"startup banner reports DRY RUN","probe_kind":"cli","argv":["bun","run","start"],"cwd":"<guest-path>","stays_running":true,"expected_text":"DRY RUN"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"signs a buy and a sell offline, asserts the calldata matches the SDK","source":"README.md ## Layout / The 300 ms budget: bun run scripts/dry-encode.ts","reason":"Not run to success: the script reads the live Kuru MON-USDC book first, and at the time of testing the book had 0 bids and 9 asks at every block (checked over ~10 minutes, and the Kuru SDK itself also returned 0 bids), so buildBook throws 'empty book side'. Not a repo decoding fault; needs a two-sided live market."},
{"kind":"example","claim":"book reader vs the SDK: exactness and latency","source":"README.md ## The 300 ms budget: bun run scripts/bench-read.ts","reason":"Not run to success for the same reason: the live book is one-sided (0 bids), so the reader throws before the SDK comparison. The SDK was checked directly and also reports 0 bids. Needs a two-sided live market."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Every new block runs one trader cycle (decision, then quote)","source":"src/index.ts","quote":"startBlockFeed((block) => trader.onBlock(block));","schedule":"each new Monad block from the block feed (WebSocket newHeads plus polling backstop)","method":"not run: a manual cycle needs a two-sided live book, which was unavailable","input":"live Monad block feed for MON-USDC with 0 bids at every block observed","expected":"a decision and dry-run quote for the block","testable":false,"reason":"Live Kuru MON-USDC book had zero bids for the whole test window, so each block's cycle throws 'empty book side' before any decision. The cycle does fire per block (blocks are logged), but no decision or quote can be produced to check."}]}
EOF
python3 -I -c 'import json;[json.load(open(".coldpass/"+f)) for f in ["probe.json","claims.json","examples.json","cycles.json"]];print("json ok")'
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"With no PRIVATE_KEY it dry-runs","source":"With no `PRIVATE_KEY` it dry-runs: real book, real decisions, simulated fills.","testable":false,"reason":"Not replayable as a claim: 'bun run start' is a long-running server, and the claim path waits for the process to exit within a 120 s window (stays_running is not honored for claims; it timed out). Dry-run mode is instead checked by the probe: GET / on the started server returns \"dryRun\":true with no PRIVATE_KEY set (the banner also prints DRY RUN when started by hand)."}]
EOF
python3 -I -c 'import json;json.load(open(".coldpass/claims.json"));print("ok")'; ss -ltnp | grep ':3000' || echo "port 3000 free"; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -40; echo EXIT=${PIPESTATUS[0]}
pkill -f "bun run src/index.ts" ; pkill -f "bun run start"; sleep 2; ss -ltnp | grep ':3000' || echo "port 3000 free"; pgrep -af "src/index.ts" || echo "no product servers"; rm -rf /tmp/diag /tmp/jev-start.log /tmp/de-*.log; ls <guest-path>
ss -ltnp | grep ':3000' ; for p in $(ss -ltnp | grep ':3000' | grep -o 'pid=[0-9]*' | cut -d= -f2); do kill $p && echo "killed $p"; done; sleep 2; ss -ltnp | grep ':3000' || echo "port 3000 free"; rm -rf /tmp/diag /tmp/jev-start.log /tmp/de-*.log; ls <guest-path>
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "blocked",
  "fault_owner": "prerequisite",
  "operation": "Run the jev-trader dry-run server (no PRIVATE_KEY) and read its GET / snapshot; then exercise the per-block decision/quote loop against the live Kuru MON-USDC book.",
  "operation_scope": "Linux guest, Bun 1.3.0 (Dockerfile pins oven/bun:1.3), public Monad RPC (rpc.monad.xyz), live Kuru MON-USDC market 0x065C9d28E428A0db40191a54d33d5b7c71a9C394, DRY RUN with the mock model. The server start and snapshot were exercised. The decision/quote path was not, because the live book had zero bids throughout testing.",
  "steps": [
    "cp .env.example .env",
    "bun install",
    "bun run start  (server on :3000, DRY RUN banner)",
    "GET http://localhost:3000/  -> {\"model\":\"mock\",...,\"dryRun\":true,...}",
    "bun run scripts/dry-encode.ts  (failed: empty book side)",
    "bun run scripts/bench-read.ts  (failed: empty book side)"
  ],
  "deviations": [
    "Bun was not installed. The official installer (curl -fsSL https://bun.sh/install | bash -s bun-v1.3.0) failed first with 'unzip is required to install bun'. Fixed with sudo apt-get update && sudo apt-get install -y unzip, then re-ran the installer: bun 1.3.0 installed to ~/.bun/bin.",
    "Symlinked bun to /usr/local/bin/bun (sudo ln -sf) so the checker's PATH can find it.",
    "The README has no installer step for Bun; the Dockerfile's oven/bun:1.3 was used as the version guide.",
    "Claim 'With no PRIVATE_KEY it dry-runs' is recorded as testable:false. The claim path waits for the process to exit within 120 s and times out on the long-running server, so the claim could not be replayed. The HTTP probe covers dry-run mode instead (GET / returns dryRun:true).",
    "scripts/dry-encode.ts and scripts/bench-read.ts both failed with 'empty book side at block N (bids=0 asks=9)'. The Kuru SDK's own getFormattedL2OrderBook also returned 0 bids, so this is market state, not the repo's decoder. Recorded as examples with reasons.",
    "The manual cycle could not be triggered with a decision: each block's onBlock throws on the empty bid side before any decision or quote. Recorded in cycles.json as testable:false with the reason.",
    "The checker path /inputs/coldpass-preflight.py does not exist in this guest; used <guest-path> as provided in the task.",
    "Each test server was stopped after use; port 3000 was confirmed free."
  ],
  "stuck_step": "bun run scripts/dry-encode.ts (and bench-read) reading the live order book",
  "main_blocker": "The live Kuru MON-USDC order book has no bids: every block reports bids=0 asks=9, for roughly 10 minutes of observation, and the Kuru SDK agrees.",
  "plain_failure": "The trading bot cannot make any buy or sell decision or post a quote right now, because the live market it trades has no buy orders. The server itself starts correctly, reports dry-run mode, and serves its status page.",
  "suggested_fix": "Re-run once the market has two-sided liquidity. Separately, the bot could treat a one-sided book as a skipped block with a clear log line, and the README scripts could report 'no two-sided book' instead of exiting with an error."
}
EOF
python3 -I -c 'import json;json.load(open(".coldpass/report.json"));print("report ok")'; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -5 | cut -c1-1500; echo EXIT=${PIPESTATUS[0]}; ss -ltnp | grep ':3000' || echo "port 3000 free"