Open Source encryption quantitative tool CCXT exposed for default commission

Recently, the open source quantitative trading library CCXT, which is very popular in the cryptocurrency field, has fallen into controversy. Some users discovered that the core code of the software has a preset rebate ID, which allocates a portion of the exchange transaction fee rebate income to the development team's account without the users' knowledge.

This discovery has sparked widespread discussion, revealing not only the potential hidden business models behind Open Source projects but also making many developers and trading teams who rely on its services aware that seemingly free tools may conceal unexpected costs.

CCXT, as a unified encryption currency trading interface, supports connections to numerous trading platforms worldwide. It supports multiple programming languages, including JavaScript, Python, PHP, C#, and Go, greatly enhancing its applicability in different development environments. Through CCXT, users can perform various functions such as market analysis, indicator development, algorithm trading, strategy backtesting, and order placement, and it is regarded as a simplified and free trading analysis tool.

Currently, CCXT supports over 100 cryptocurrency trading platforms, covering almost all major exchanges. On GitHub, CCXT has over 36,000 stars, making it more popular than many well-known open source projects in the financial sector. According to data platform statistics, CCXT's cumulative download count on the official Python package manager PyPI has exceeded 93 million times, reflecting that there is a large number of quantitative traders and development teams globally using this tool.

However, a user recently revealed on social media that he discovered significant anomalies in the rebate fees while using the CCXT framework. Upon inspection, he found that the development team had preset their own broker ID in the source code of multiple exchange adapters in CCXT, resulting in most of the rebate fees being diverted to the development team's account without the user's knowledge or modification. The user stated that approximately $15,000 was siphoned off in just two months across three trading platforms.

By examining the Open Source code of CCXT, it can indeed be found that the default brokerId is included in the Python adapters of multiple mainstream trading platforms. These parameters mostly exist in a hard-coded form, and when users place orders directly using CCXT without explicitly setting or modifying the relevant options, these default broker Ids will be sent along with the request, attributing potential fee rebates to accounts provided by CCXT. However, this point is not emphasized in the official documentation of CCXT.

Looking back at the development history of CCXT, this operation may have originated as early as 2018. In the early days, CCXT offered a paid Pro version subscription service, which later transitioned to being completely free. In 2018, a user suggested adding an optional referral ID to support CCXT on Github, which was welcomed by the main maintainer and relevant code was added in an update. However, the original suggestion mainly targeted referral registration rewards and provided an optional option.

This incident has sparked extensive discussion within the community. Some question whether professional quantitative traders should care about these fee rebates, while others believe that since it is Open Source code, failing to notice and modify these settings during use is the user's own problem. However, considering the widespread use and good reputation of CCXT, this hidden coding method does indeed violate the trust the community has in it.

As of now, the CCXT development team has not made any public response to this matter, and the code continues to be updated daily but has not been modified in the relevant parts.

This incident has sounded the alarm for all users: in the competitive world of encryption currency, one should maintain necessary scrutiny and vigilance towards any "free lunch." Carefully examining every line of "trusted" code may be the most fundamental and critical line of defense to protect one's own rights and interests. Because sometimes, the most expensive costs are hidden beneath the guise of "free."