Orders: CreateOrderRequest.buy_max_cost validator accepts bool — silently becomes 1 cent #243

Summary

Money risk. buy_max_cost=True slips through as integer 1 (= 1 cent cap), matching the exact failure mode #225 closed for DollarDecimal/FixedPointCount where bool was rejected because it is an int subclass.

A caller who accidentally passes a flag (risk_check_passed, dry_run) where cents were expected places an order capped at $0.01 with no error.

Location

• kalshi/models/orders.py:194-217 — _reject_decimal_and_float_buy_max_cost validator

Evidence

@field_validator("buy_max_cost", mode="before")
@classmethod
def _reject_decimal_and_float_buy_max_cost(cls, v: object) -> object:
    ...
    if isinstance(v, Decimal):
        raise ValueError(...)
    if isinstance(v, float):
        raise ValueError("buy_max_cost must be int (cents), not float...")
    return v   # bool falls through here

Recommended fix

Add if isinstance(v, bool): raise ValueError("buy_max_cost must be int (cents), not bool — bool is an int subclass.") ahead of the int passthrough, mirroring _coerce_decimal. Add a regression test that asserts CreateOrderRequest(buy_max_cost=True, ...) raises.

Severity & category

high / correctness