dekun/eth_hedge_sim
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix LIVE open/close double-book and security audit findings.

Browse Source 
Prevent expiry dual-close from re-booking option cash, abandon ledger rejection, margin-mode mismatch, and manual close races; harden fill wait and refuse default AUTH_SECRET on LIVE.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
dekun
2026-07-29 20:11:29 +08:00
parent c6e8f6fe1e
commit ec87cf2104
10 changed files with 229 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/settings.py
+11
View File
@@ -233,6 +233,17 @@ async def put_strategy_settings(
)
equity_to_apply = new_eq
if "perp_margin_mode" in data:
new_mm = str(data["perp_margin_mode"]).strip().lower()
old_mm = str(
db.get_setting("perp_margin_mode", s.perp_margin_mode) or s.perp_margin_mode
).strip().lower()
if new_mm != old_mm and Matcher(db).has_open_position():
raise HTTPException(
status_code=409,
detail="有未平仓，无法切换永续保证金模式；请先平仓后再改",
)
for k, v in data.items():
if k in KEYS:
db.set_setting(k, str(v))
backend/app/api/sim.py
+32 -25
View File
@@ -103,16 +103,20 @@ async def sim_open_group(
db.fetchall("SELECT group_id FROM groups WHERE group_id LIKE ?", (f"G-{wkey}-%",))
)
gid = next_group_id(count)
r = ex.open_group(
group_id=gid,
bias=bias,
option_side=option_side,
perp_side=perp_side,
option_inst_id=option_inst,
entry_index_px=float(pick.underlying_px),
strike=pick.pair.strike,
expiry_ymd=pick.pair.expiry_ymd,
)
engine = get_engine()
async with engine._lock:
if ex.has_open_position():
raise HTTPException(status_code=409, detail="有未平仓，禁止开下一组")
r = ex.open_group(
group_id=gid,
bias=bias,
option_side=option_side,
perp_side=perp_side,
option_inst_id=option_inst,
entry_index_px=float(pick.underlying_px),
strike=pick.pair.strike,
expiry_ymd=pick.pair.expiry_ymd,
)
if not r.ok:
raise HTTPException(status_code=400, detail=r.detail)
try:
@@ -151,22 +155,25 @@ async def sim_close_group(_user: Annotated[str, Depends(require_user)]) -> dict:
)
from ..strategy import get_engine
r = get_executor().close_group(reason="manual")
if not r.ok and not r.liquidity_wait:
raise HTTPException(status_code=400, detail=r.detail)
if r.ok:
# 与自动/紧急全平一致：成功全平后进入组间休息
get_engine().enter_rest_after_close()
try:
from ..notify import wecom
engine = get_engine()
# 与策略引擎共用锁，避免与自动平仓/开仓竞态
async with engine._lock:
r = get_executor().close_group(reason="manual")
if not r.ok and not r.liquidity_wait:
raise HTTPException(status_code=400, detail=r.detail)
if r.ok:
# 与自动/紧急全平一致：成功全平后进入组间休息
engine.enter_rest_after_close()
try:
from ..notify import wecom
wecom.notify_close(
reason="manual",
detail=r.detail,
data=r.data or {},
)
except Exception:
pass
wecom.notify_close(
reason="manual",
detail=r.detail,
data=r.data or {},
)
except Exception:
pass
return {
"ok": r.ok,
"liquidity_wait": r.liquidity_wait,
backend/app/live/binance_executor.py
+11 -8
View File
@@ -114,6 +114,12 @@ class BinanceLiveExecutor(Matcher):
)
except Exception as e:
logger.exception("binance live open option failed")
msg = str(e)
if "orderId=" in msg or "orderId" in msg.lower():
return OpenResult(
ok=False,
detail=f"币安开期权未确认成交(保留 opening 防重复开，请核对交易所): {e}",
)
release_open_slot_if_opening(self.db)
return OpenResult(ok=False, detail=f"币安开期权失败: {e}")
@@ -634,6 +640,8 @@ class BinanceLiveExecutor(Matcher):
detail=f"期权已平，永续待平(option_closed_perp_pending): {e}",
)
# 期权已在 _mark_option_closed_perp_pending 入账/写 fill（含到期本地结算），
# 此处 pending_perp_only 必为 True；勿再按 is_expiry 二次入账。
return self._finalize_dual_close(
pos=pos,
group_id=group_id,
@@ -647,14 +655,8 @@ class BinanceLiveExecutor(Matcher):
pf_px=pf_px,
pf_fee=pf_fee,
reason=reason,
option_fill_already_written=(
st == "option_closed_perp_pending"
or (pending_perp_only and not is_expiry)
),
skip_option_cash=(
st == "option_closed_perp_pending"
or (pending_perp_only and not is_expiry)
),
option_fill_already_written=bool(pending_perp_only),
skip_option_cash=bool(pending_perp_only),
)
def _mark_option_closed_perp_pending(
@@ -950,6 +952,7 @@ class BinanceLiveExecutor(Matcher):
kind="close_perp",
group_id=group_id,
note=f"LIVE-BN close perp abandon option {reason}",
allow_negative=True,
)
strike = self._group_strike(group_id, option_inst_id)
backend/app/live/executor.py
+30 -13
View File
@@ -47,6 +47,18 @@ class OkxLiveExecutor(Matcher):
).strip().lower()
return "isolated" if raw == "isolated" else "cross"
def _perp_margin_mode_for_group(self, group_id: str | None) -> str:
"""平仓用开仓时写入的保证金模式；缺省回退当前设置。"""
if group_id:
g = self.db.fetchone(
"SELECT perp_margin_mode FROM groups WHERE group_id=?", (group_id,)
)
if g is not None:
m = str(g["perp_margin_mode"] or "").strip().lower()
if m in ("cross", "isolated"):
return m
return self._perp_margin_mode()
def _guard_live(self) -> str | None:
ok, reason = live_ready()
if not ok:
@@ -130,6 +142,13 @@ class OkxLiveExecutor(Matcher):
)
except Exception as e:
logger.exception("live open option failed")
msg = str(e)
# 已拿到 ordId：可能已成交，禁止释放 opening 以免重复开仓
if "ordId=" in msg:
return OpenResult(
ok=False,
detail=f"实盘开期权未确认成交(保留 opening 防重复开，请核对交易所): {e}",
)
release_open_slot_if_opening(self.db)
return OpenResult(ok=False, detail=f"实盘开期权失败: {e}")
@@ -141,6 +160,7 @@ class OkxLiveExecutor(Matcher):
opt_qty = eth_from_contracts(opt_contracts, ct_mult)
# 永续市价：按产品假设，失败原因实质为保证金不足 → 必须回滚期权
mgn = self._perp_margin_mode()
try:
ct_val = client.get_ct_val(perp_inst, inst_type="SWAP")
perp_sz = perp_close_contracts_okx(
@@ -155,7 +175,6 @@ class OkxLiveExecutor(Matcher):
else:
side, pos_side = "sell", "short"
leverage = self.ledger.get_setting_float("leverage", s.leverage)
mgn = self._perp_margin_mode()
try:
client.set_leverage(
perp_inst, leverage, mgn_mode=mgn, pos_side=pos_side
@@ -239,8 +258,8 @@ class OkxLiveExecutor(Matcher):
"""INSERT INTO groups(
group_id, status, bias, option_side, perp_side, option_inst_id, perp_inst_id,
strike, expiry_ymd, entry_index_px, initial_premium, open_at_ms, fees, slip_cost,
exec_mode
) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
exec_mode, perp_margin_mode
) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
(
group_id,
"open",
@@ -257,6 +276,7 @@ class OkxLiveExecutor(Matcher):
of_fee + pf_fee,
0.0,
"LIVE",
mgn,
),
)
self.db._conn.execute(
@@ -653,7 +673,7 @@ class OkxLiveExecutor(Matcher):
inst_id=perp_inst,
side=side,
sz=str(perp_sz),
td_mode=self._perp_margin_mode(),
td_mode=self._perp_margin_mode_for_group(group_id),
pos_side=pos_side,
reduce_only=True,
)
@@ -665,6 +685,8 @@ class OkxLiveExecutor(Matcher):
detail=f"期权已平，永续待平(option_closed_perp_pending): {e}",
)
# 期权已在 _mark_option_closed_perp_pending 入账/写 fill（含到期本地结算），
# 此处 pending_perp_only 必为 True；勿再按 is_expiry 二次入账。
return self._finalize_dual_close(
pos=pos,
group_id=group_id,
@@ -678,14 +700,8 @@ class OkxLiveExecutor(Matcher):
pf_px=pf_px,
pf_fee=pf_fee,
reason=reason,
option_fill_already_written=(
st == "option_closed_perp_pending"
or (pending_perp_only and not is_expiry)
),
skip_option_cash=(
st == "option_closed_perp_pending"
or (pending_perp_only and not is_expiry)
),
option_fill_already_written=bool(pending_perp_only),
skip_option_cash=bool(pending_perp_only),
)
def _mark_option_closed_perp_pending(
@@ -938,7 +954,7 @@ class OkxLiveExecutor(Matcher):
inst_id=perp_inst,
side=side,
sz=str(perp_sz),
td_mode=self._perp_margin_mode(),
td_mode=self._perp_margin_mode_for_group(group_id),
pos_side=pos_side,
reduce_only=True,
)
@@ -957,6 +973,7 @@ class OkxLiveExecutor(Matcher):
kind="close_perp",
group_id=group_id,
note=f"LIVE close perp abandon option {reason}",
allow_negative=True,
)
# 复用父类归档写入：临时改 fill 路径太重，直接调用父类会再平一次本地假价。
backend/app/live/okx_trade.py
+45 -25
View File
@@ -157,7 +157,26 @@ class OkxTradeClient:
fill = self._wait_fill(inst_id, ord_id)
return fill
def _wait_fill(self, inst_id: str, ord_id: str, *, tries: int = 20) -> LiveFill:
def _fill_from_order_row(self, inst_id: str, ord_id: str, row: dict[str, Any]) -> LiveFill:
avg = safe_float(row.get("avgPx")) or 0.0
sz = safe_float(row.get("accFillSz")) or safe_float(row.get("sz")) or 0.0
fee = abs(safe_float(row.get("fee")) or 0.0)
fee_ccy = str(row.get("feeCcy") or "USDT")
if fee <= 0 and ord_id:
fee, fee_ccy = self.sum_fill_fees(inst_id, ord_id)
from .money import abs_fee_usdt
return LiveFill(
inst_id=inst_id,
side=str(row.get("side") or ""),
avg_px=float(avg),
sz=float(sz),
fee=abs_fee_usdt(fee, fee_ccy),
ord_id=ord_id,
raw=row,
)
def _wait_fill(self, inst_id: str, ord_id: str, *, tries: int = 40) -> LiveFill:
path = f"/api/v5/trade/order?instId={inst_id}&ordId={ord_id}"
last: dict[str, Any] = {}
for _ in range(tries):
@@ -168,25 +187,21 @@ class OkxTradeClient:
avg = safe_float(last.get("avgPx"))
# 仅完全成交；部分成交继续等，避免账本张数与交易所不一致
if state == "filled" and avg and avg > 0:
sz = safe_float(last.get("accFillSz")) or safe_float(last.get("sz")) or 0.0
fee = abs(safe_float(last.get("fee")) or 0.0)
fee_ccy = str(last.get("feeCcy") or "USDT")
if fee <= 0 and ord_id:
fee, fee_ccy = self.sum_fill_fees(inst_id, ord_id)
from .money import abs_fee_usdt
return LiveFill(
inst_id=inst_id,
side=str(last.get("side") or ""),
avg_px=float(avg),
sz=float(sz),
fee=abs_fee_usdt(fee, fee_ccy),
ord_id=ord_id,
raw=last,
)
return self._fill_from_order_row(inst_id, ord_id, last)
if state in ("canceled", "failed"):
raise RuntimeError(f"OKX 订单失败 state={state} {last}")
time.sleep(0.3)
# 超时兜底：已 filled 或已有成交量+均价则回填，避免「有仓无账」
state = str(last.get("state") or "")
avg = safe_float(last.get("avgPx"))
acc = safe_float(last.get("accFillSz")) or 0.0
if state == "filled" or (acc > 0 and avg and avg > 0):
logger.warning(
"OKX fill wait timeout but using last fill data ordId=%s state=%s",
ord_id,
state,
)
return self._fill_from_order_row(inst_id, ord_id, last)
raise RuntimeError(f"OKX 订单未完全成交 ordId={ord_id} last={last}")
def sum_fill_fees(self, inst_id: str, ord_id: str) -> tuple[float, str]:
@@ -305,24 +320,29 @@ class OkxTradeClient:
from .money import to_usdt
end = int(end_ms or int(time.time() * 1000))
begin = int(begin_ms)
# OKX：after=更早时间戳边界，before=更晚；再本地按 uTime 过滤兜底
path = (
f"/api/v5/account/positions-history?instType=SWAP&instId={inst_id}"
f"&before={end}&after={int(begin_ms)}"
f"&after={begin}&before={end}"
)
try:
# positions-history 用 GET query；部分环境用 before/after 语义相反，失败则返回 None
rows = self._request(
"GET",
f"/api/v5/account/positions-history?instType=SWAP&instId={inst_id}",
)
rows = self._request("GET", path)
except Exception as e:
logger.warning("okx positions-history failed: %s", e)
return None
try:
rows = self._request(
"GET",
f"/api/v5/account/positions-history?instType=SWAP&instId={inst_id}",
)
except Exception as e2:
logger.warning("okx positions-history fallback failed: %s", e2)
return None
total = 0.0
hit = False
for row in rows:
u_time = int(safe_float(row.get("uTime")) or safe_float(row.get("cTime")) or 0)
if u_time and (u_time < int(begin_ms) - 60_000 or u_time > end + 60_000):
if u_time and (u_time < begin - 60_000 or u_time > end + 60_000):
continue
rpnl = safe_float(row.get("realizedPnl"))
if rpnl is None:
backend/app/main.py
+8
View File
@@ -36,6 +36,14 @@ async def lifespan(app: FastAPI):
# 而 health 显示 DB 里的 binance → 合约号/盘口错乱（期权一直 -/-）
from .exchange.runtime import load_runtime_settings
app_settings = get_settings()
if not app_settings.is_sim:
secret = (app_settings.auth_secret or "").strip()
if not secret or secret == "change-me-eth-hedge-sim-secret":
raise RuntimeError(
"LIVE 拒绝启动：请在 .env 设置非默认 AUTH_SECRET（勿用 change-me-eth-hedge-sim-secret）"
)
settings = load_runtime_settings()
engine = StrategyEngine()
set_engine(engine)
backend/app/models/db.py
+3 -1
View File
@@ -43,7 +43,8 @@ CREATE TABLE IF NOT EXISTS groups (
note TEXT,
exec_mode TEXT,
funding_usdt REAL,
settle_index_px REAL
settle_index_px REAL,
perp_margin_mode TEXT
);
CREATE TABLE IF NOT EXISTS fills (
@@ -164,6 +165,7 @@ class Database:
("groups", "exec_mode", "TEXT"),
("groups", "funding_usdt", "REAL"),
("groups", "settle_index_px", "REAL"),
("groups", "perp_margin_mode", "TEXT"),
("fills", "exec_mode", "TEXT"),
("fills", "fee_ccy", "TEXT"),
):
backend/app/strategy/open_capacity.py
+15 -8
View File
@@ -60,15 +60,22 @@ def _live_balances() -> dict[str, float | None]:
"trading_usdc": None,
}
try:
from ..live.okx_funds import OkxFundsClient
from ..exchange.runtime import load_runtime_settings
client = OkxFundsClient()
try:
bal = client.fetch_balances()
out["trading_usdt"] = _f(bal.get("trading_usdt"))
out["trading_usdc"] = _f(bal.get("trading_usdc"))
finally:
client.close()
ex = str(load_runtime_settings().exchange or "").strip().lower()
if ex in ("binance", "bn"):
# 币安资金接口尚未接入；返回 None 使可开判定为「未知」而非误用 OKX
logger.debug("open_capacity: binance live balance not wired; treating as unknown")
else:
from ..live.okx_funds import OkxFundsClient
client = OkxFundsClient()
try:
bal = client.fetch_balances()
out["trading_usdt"] = _f(bal.get("trading_usdt"))
out["trading_usdc"] = _f(bal.get("trading_usdc"))
finally:
client.close()
except Exception as e:
logger.warning("open_capacity live balance failed: %s", e)
_live_bal_cache["ts"] = now
docs/审计说明-2026-07-29-开平仓与实盘安全.md
+57
View File
@@ -0,0 +1,57 @@
# 审计说明 — 开/平仓逻辑与实盘安全（2026-07-29）
## 范围
- 开仓 / 平仓 / 到期双腿平仓 / 弃期权只平永续
- LIVE 执行器（OKX / 币安）本地账本与交易所一致性
- 手动开平仓 API 与策略引擎并发
- 鉴权密钥、资金可开判定、平仓盈亏查询
## 结论摘要
| 严重度 | 问题 | 处置 |
|--------|------|------|
| Critical | 到期双平：`_mark_option_closed_perp_pending` 后仍因 `not is_expiry` 二次入账期权现金/fill | **已修**：`skip_option_cash` / `option_fill_already_written` = `pending_perp_only` |
| Critical | 弃期权路径：交易所已平永续，`apply_cash` 无 `allow_negative` → 本地可拒记卡仓 | **已修**：OKX/币安 abandon 均 `allow_negative=True` |
| High | 平仓用「当前」永续保证金模式，持仓中可改设置导致模式错配 | **已修**：开仓写入 `groups.perp_margin_mode`；平仓读组记录；持仓中禁止改设置 |
| High | 手动 `POST /close-group`（及手动开仓）未占引擎锁，可与自动 tick 竞态 | **已修**：`async with engine._lock` |
| High | 期权成交等待超时 → 释放 opening，可能重复开 | **已修**：等成交通道加长+超时有成交则回填；含 `ordId` 失败保留 opening |
| Med | `get_closed_perp_pnl_usdt` 构造了时间过滤 URL 却请求未过滤路径 | **已修**：优先带 after/before 查询，失败再兜底 |
| Med | LIVE 默认可使用 `change-me-…` 鉴权密钥 | **已修**：LIVE 启动拒绝默认 `AUTH_SECRET` |
| Med | 币安 LIVE 可开资金仍走 OKX 客户端 | **已修**：币安不再误调 OKX，余额视为未知 |
## 开仓路径（自检）
1. `claim_open_slot` → `opening` 占槽，防并发双开。
2. 先期权后永续；永续失败则卖回期权，卖回失败 → `half_open`。
3. 期权下单已返回 `ordId` 但查单未确认：不释放 `opening`，禁止再开，须核对交易所。
4. LIVE 成交后本地账本一律 `allow_negative`，避免「交易所有仓、本地拒记」。
## 平仓路径（自检）
1. 先平期权并 `_mark_option_closed_perp_pending`（写 fill + 入账），再平永续。
2. 永续失败时状态已是 `option_closed_perp_pending`，重试只平永续，不再卖期权。
3. `_finalize_dual_close` 在 `pending_perp_only` 时跳过期权二次入账（**含 expiry**）。
4. 弃期权：交易所平永续后本地必须入账成功（`allow_negative`），再归档 residual。
5. OKX 平永续 `tdMode` 使用开仓时组上记录的 `perp_margin_mode`。
## 安全
- Web 登录依赖 `AUTH_SECRET`；LIVE 禁止默认密钥启动。
- 策略/资金 API 均需登录；手动交易另需开关。
- 不在本文档记录任何真实密钥或口令。
## 残留 / 后续
- 币安 LIVE 交易账户余额接入后，再恢复精确「可开」判定。
- `opening` 残留需人工或后续对账任务清槽（现策略：宁卡不开重复仓）。
- 期权腿交易所对账仍弱于永续（启动 reconcile 主要看永续）。
## 涉及文件
- `backend/app/live/executor.py` / `binance_executor.py`
- `backend/app/live/okx_trade.py`
- `backend/app/api/sim.py` / `settings.py`
- `backend/app/main.py`
- `backend/app/models/db.py`
- `backend/app/strategy/open_capacity.py`
docs/更新说明.md
+17
View File
@@ -5,6 +5,23 @@
---
## 2026-07-29 — 开平仓/实盘安全审计修复
### 变更
1. **Critical**：到期双平不再二次入账期权（`skip_option_cash` 跟 `pending_perp_only`）。
2. **Critical**：弃期权平永续后本地账本强制 `allow_negative`，避免交易所已平、本地卡仓。
3. 开仓写入 `groups.perp_margin_mode`；平仓用开仓时模式；持仓中禁止改保证金模式。
4. 手动开/平仓走策略引擎锁，避免与自动 tick 竞态。
5. OKX 等成交加长并超时有成交则回填；含 `ordId` 的未确认失败保留 `opening`。
6. 修复 positions-history 盈亏查询未带时间过滤；LIVE 拒绝默认 `AUTH_SECRET`；币安可开不再误调 OKX 资金。
### 审计
详见 [`docs/审计说明-2026-07-29-开平仓与实盘安全.md`](./审计说明-2026-07-29-开平仓与实盘安全.md)。
---
## 2026-07-29 — 实盘资金读交易所；永续全仓/逐仓
### 变更