← Back to home

Track record

Confirmed Findings

Four bugs I found by reading open-source trading-bot code, reported publicly, and that the maintainers confirmed and fixed. Every item links to the original report and to the fix, so you can check it yourself instead of taking my word for it.

I review trading-bot code for one class of problem: code that behaves differently than its README or its backtest claims it does. The method is the same each time. I read the code, open a public issue describing what I found and why it matters, and leave the fix to the maintainer. I do not exploit anything.

Not every report gets a reply. These four did. Dates are taken from the linked GitHub pages.

Missing slippage clamp

1. A slippage guard that stopped guarding at 100%

Project: 0xfnzero/sol-trade-sdk

The Bonk/LetsBonk slippage helpers did not apply the maximum-slippage clamp that the PumpFun path already used. At 100% slippage the minimum accepted output became zero, which means no price protection at all, and one helper could divide by zero.

Stale price in the exit path

2. A stop-loss that priced its own exit off the entry price

Project: chainstacklabs/pumpfun-bonkfun-bot

The exit sell passed the position's entry price into the seller, and that value is the slippage floor. An exit fires precisely when the price has moved away from entry, so the floor was priced off the wrong number. Separately, position monitoring could stop silently after a failed sell.

Wrong aggregation

3. A dashboard that added returns instead of compounding them

Project: thanhphan20/freq-trading-bot

The dashboard aggregator summed each trade's profit percentage instead of compounding it, so total return diverged from reality as trades accumulated. The Sharpe ratio was computed on raw dollar P&L rather than on a return series.

A crash that removes the safety net

4. An exception that could take the stop-loss down with it

Project: titouannwtt/freqtrade-ultimate

One strategy retried a data fetch twice, but the third attempt sat outside any error handling, so a routine failure of the unofficial data source interrupted the whole bot cycle. The strategy's stop-loss only exists while the process is running, so a crash with a position open leaves that position unprotected.

What I did and did not do

Want the same read on your bot?

The Quick Risk Check ($48) covers stop-loss, position sizing, cooldowns, exposure limits and the kill switch, and returns one pass/partial/fail line per item. For the whole bot, see the Full Bot Audit ($298). You can also run through the free Safety-Net Checklist yourself first.

Contact

Get in touch

Not investment advice. Honest Backtest provides technical code review and backtest recalculation only — an honest read on what the code and the numbers actually show, not a recommendation to trade.
Photography via Unsplash.