You are FTX and your code allows special cases
TL;DR: Don't add hard business rules to your code.
Problems
Open / Closed Principle Violation
Hardcoding
Testability
Solutions
Reify the condition.
Create configuration options and set the exception on the configuration behavior.
Don't use Settings/Configs.
Context
According to Reuters, in a recent FTX scandal, there was a hardcoded condition to skip risk controls to its own portfolio.
The code was explicit and developers were aware of that rule.
Sample Code
Wrong
if (currentExposure > 0.15 && customer != "Alameda") {
// Be extra careful not to liquidate
liquidatePosition();
}
Right
customer.liquidatePositionIfNecessary(0.15);
// This follows the Tell, Don't ask principle
Detection
[X] Semi-Automatic
We can search for primary hardcoded conditions (related to primitive types).
We might have more false positives than actual problems.
Tags
- Hardcoding
Conclusion
If you make code reviews, pay special attention to this kind of hard coding.
