From 752652f463f885784b0e17153727d3611c1655b3 Mon Sep 17 00:00:00 2001 From: k Date: Sat, 30 May 2026 01:03:02 +0800 Subject: [PATCH] =?UTF-8?q?fix(safety):=20force=20Auto-Trade=20OFF=20on=20?= =?UTF-8?q?paper=E2=86=92live=20promotion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Money-safety bug: subscribe() changed paper_mode on a paper→live promotion but left auto_trade untouched. A user could flip Auto-Trade ON while in paper mode (harmless — SystemControl only checks 'subscribed', not paper), then promote to live and add an API key — at which point the next high-confidence Trump signal opens a REAL position, carried over from a switch they flipped when it cost nothing. Now: when paper_mode transitions True→False AND auto_trade is on, force auto_trade=False. The user must re-enable it explicitly while live (a signed, intentional action). Risk-raising transition resets the dangerous switch — standard financial-product safety. Frontend handleUpgradeToLive copy updated to say Auto-Trade is turned off on the switch. Co-Authored-By: Claude Sonnet 4.6 --- app/api/subscribe.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/app/api/subscribe.py b/app/api/subscribe.py index 6875a46..68259a4 100644 --- a/app/api/subscribe.py +++ b/app/api/subscribe.py @@ -63,6 +63,18 @@ async def subscribe(request: Request, db: AsyncSession = Depends(get_db)): # Re-subscribing is allowed to change paper mode (e.g. user wants to # promote from paper to live). Otherwise leave existing flag alone. if paper_mode != sub.paper_mode: + # SAFETY: promoting paper → live raises the risk level from + # "simulated" to "real money". Force Auto-Trade OFF on that + # transition so a switch the user flipped while it was harmless + # (paper) can NEVER carry over and silently start opening real + # positions the moment they add an API key. They must re-enable + # Auto-Trade explicitly while live — an intentional, signed action. + if sub.paper_mode and not paper_mode and sub.auto_trade: + sub.auto_trade = False + logger.info( + "Subscription %s promoted paper→live — Auto-Trade forced " + "OFF (must be re-enabled explicitly while live)", wallet, + ) sub.paper_mode = paper_mode await db.commit()