Back to Details

feast-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Feast script audit

Feast 脚本审计

A strategy script runs with the user's money, so it passes two stages first. Both are bound to the file's sha256: any edit is a new file and needs a new audit.
FL
is the runtime's command, as in the feast-league skill:
bash
node "${FEAST_LEAGUE_RUNTIME:-$HOME/.feast-league/runtime}/src/league/bin.mjs"
策略脚本会使用用户的资金运行，因此必须先通过两个阶段的检查。两个阶段均与文件的 sha256 绑定：任何编辑都会产生一个新文件，并需要重新审计。
FL
是 runtime 的命令，与 feast-league skill 中的用法相同：
bash
node "${FEAST_LEAGUE_RUNTIME:-$HOME/.feast-league/runtime}/src/league/bin.mjs"

Stage 1: the static rules (deterministic)

阶段 1：静态规则（确定性）

bash
FL audit <file.mjs>
The runtime parses the file; it never runs it.
RuleRefuses
A1any direct wallet or process access: 
baw
, child processes, 
process
, workers
A2imports of any kind: 
import
, 
import()
, 
require
, 
import.meta
A3network: 
fetch
, sockets, URLs to any host but feast.meme
A4secrets: key-shaped hex, seed-phrase-shaped words, API keys, key files
A5dynamic code and reaching for globals: 
eval
, 
Function
, 
globalThis
, 
constructor
, 
__proto__
, keys it cannot read
A6unbounded loops (
while
, unbounded 
for
, recursion) and timers
A7the wrong shape: other exports, a tick outside 15–3600 s, code at the top level, over 64 KB
A8any 
api
member but 
buy
, 
sell
, 
launch
, 
read.*
, 
state
, 
params
, 
log
A9(a warning) literal sizes over the per-trade limit
If it refuses:
  1. Show every hit with its rule and line.
  2. Stop.
  3. If you wrote the script, offer to fix it and audit again. Do not argue a rule away.
bash
FL audit <file.mjs>
runtime 会解析文件；绝不会运行文件。
规则拒绝的情况
A1任何直接的钱包或进程访问：
baw
、子进程、
process
、workers
A2任何类型的导入：
import
、
import()
、
require
、
import.meta
A3网络访问：
fetch
、sockets，以及指向 feast.meme 以外任何 host 的 URL
A4密钥：密钥形态的十六进制值、seed-phrase 形态的单词、API keys、key files
A5动态代码和访问 globals：
eval
、
Function
、
globalThis
、
constructor
、
__proto__
、runtime 无法读取的 keys
A6无界循环（
while
、无界 
for
、递归）和定时器
A7结构错误：存在其他 exports、tick 超出 15–3600 s 范围、存在顶层代码、体积超过 64 KB
A8使用除 
buy
、
sell
、
launch
、
read.*
、
state
、
params
、
log
以外的任何 
api
成员
A9（警告）直接写入的数值超过单笔交易上限
如果检查拒绝：
  1. 显示每一条命中项及其规则和行号。
  2. 停止。
  3. 如果脚本是你编写的，提出修复并重新审计的方案。不要试图辩称某条规则不适用。

Stage 2: your model read

阶段 2：模型审查

Before you start:
  • Read the whole file yourself, against references/checklist.md.
  • Answer every question in writing, in a few lines each.
  • Be the user's advocate. You are looking for a script that would surprise them with their own money.
  • Code you wrote yourself gets no exemption.
Record the verdict:
bash
FL audit <file.mjs> --model-verdict pass --notes "M1: … M2: … M3: … M4: … M5: … M6: … M7: … M8: …"
FL audit <file.mjs> --model-verdict refuse --notes "M2: buys on every tick with no condition …"
Refuse when any answer is a real concern:
  • it trades more than the user asked
  • it has no exit
  • it is obfuscated
  • it does something the user did not ask for
Then tell the user in two sentences what the script does, and whether it passed.
开始之前：
  • 自行完整阅读整个文件，并对照 references/checklist.md。
  • 以书面形式回答每一个问题，每个问题用几行说明。
  • 站在用户一边。你要查找的是这样一个脚本：它可能使用用户自己的钱做出令用户意外的行为。
  • 即使代码是你自己编写的，也不豁免。
记录裁决：
bash
FL audit <file.mjs> --model-verdict pass --notes "M1: … M2: … M3: … M4: … M5: … M6: … M7: … M8: …"
FL audit <file.mjs> --model-verdict refuse --notes "M2: 每个 tick 都会买入，且没有任何条件 ……"
只要任一答案构成实质性隐患，就应拒绝：
  • 交易量超过用户要求的程度
  • 没有退出机制
  • 经过混淆处理
  • 执行了用户未要求的操作
**然后用两句话告诉用户：**脚本会做什么，以及它是否通过。

Then

接下来

A script with both stages passed can be planned and started (see the feast-league skill). It runs in the warm-up tier:
  • its first 5 trades are at 0.001 BNB
  • two failures in a row, or any hard-limit hit, stop it and notify the user
The runtime refuses to start a script whose current bytes lack either pass.
通过两个阶段的脚本可以进行规划并启动（参见 feast-league skill）。它会在**预热层（warm-up tier）**中运行：
  • 前 5 笔交易使用 0.001 BNB
  • 连续两次失败，或触发任何 hard limit，都会停止脚本并通知用户
如果脚本当前字节未绑定两个阶段的通过结果，runtime 会拒绝启动该脚本。