Blog

Bug patterns from real trading-bot audits

Anonymized write-ups of the failure modes that keep showing up when I read live, real-money trading bot code closely — no repo names, no calling anyone out, just the pattern and how to check for it in your own code.

The Risk Gate That Never Gets Its Input

A loss limit can be perfectly written and still never fire, because the number it checks is always zero, never delivered, or read before it exists. Five variants of one bug, including two from my own bot.

Read the post →

The Permanent Halt That Lasts Until the Next Restart

A prop-firm drawdown guard promised a permanent halt after a max-loss breach, but its own startup code cleared the halt and re-anchored the baseline. A one-day fix, and the four-week expiry detail that most fixes miss.

Read the post →

The Guard That Counts the Wrong Thing

A duplicate-trade guard that checks open positions but not resting orders, and a "daily" loss limit that is really since-launch — two bugs from an open-source EA audit, and what the maintainer did when they replied.

Read the post →

The 2:1 Setup That Paid Out at 0.75:1

A stop-loss and take-profit sized for a clean 2:1 reward:risk ratio, correct in price terms, that traded live at roughly 0.75:1. No bug in the exits — the gap was commission eating a narrow stop far more than a wide target.

Read the post →

The request.security() Value That Isn't There Yet

Not from a client audit — a documented TradingView platform mechanic worth ruling out first: why a Pine Script strategy can look profitable in the Strategy Tester and lose money live, and a second, easy-to-miss variant when the requested timeframe isn't actually higher than your chart's.

Read the post →

The Risk State That Only Exists in RAM

Two more bugs from live trading bot audits: a daily loss limit that a routine auto-restart silently wipes to zero, and a trailing stop-loss that moves in a Python variable while the real order resting on the exchange never budges.

Read the post →

The Safety Net That Isn't There

Two more bugs from live trading bot audits — where the protection looked real everywhere except in the one place that mattered: a stop-loss that logs "closed" but never sends an order, and a daily-loss limit fed a hardcoded zero that can never trip.

Read the post →

Stale Price Bug: Why Your Stop-Loss Might Not Protect You

A pattern found across three independent trading bots — including one I run myself: stop-loss and take-profit levels computed from a price that's minutes stale by the time the position actually opens.

Read the post →

Contact

Get in touch

Not investment advice. Honest Backtest provides technical code review and backtest recalculation only — an honest read on what the code and the numbers actually show, not a recommendation to trade.
Photography via Unsplash.