SDK drift: Python `create_order`/`build_order` have dangerous defaults (`side="buy"`, `amount=0`); TypeScript requires them

[realfishsam]

Drift

Python create_order and build_order supply default values for side, type, and amount — required, high-stakes order parameters. TypeScript's CreateOrderParams declares these fields as required with no defaults, forcing callers to be explicit.

TypeScript SDK

sdks/typescript/pmxt/models.ts, lines 470–491 — CreateOrderParams interface with required fields:

// sdks/typescript/pmxt/models.ts lines 470–491
export interface CreateOrderParams {
    marketId?: string;
    outcomeId?: string;
    side: 'buy' | 'sell';         // required — no default
    type: 'market' | 'limit';     // required — no default
    amount: number;                // required — no default
    price?: number;
    fee?: number;
    outcome?: MarketOutcome;
}

sdks/typescript/pmxt/client.ts, line 1435:

async createOrder(params: any): Promise<Order>
async buildOrder(params: CreateOrderParams & { outcome?: MarketOutcome }): Promise<BuiltOrder>

Python SDK

sdks/python/pmxt/client.py, lines 2300–2310 — create_order with defaults:

# sdks/python/pmxt/client.py lines 2300–2310
async def create_order(
    self,
    market_id: Optional[str] = None,
    outcome_id: Optional[str] = None,
    side: str = "buy",          # dangerous default
    type: str = "market",       # dangerous default
    amount: float = 0,          # dangerous default (zero-size order)
    price: Optional[float] = None,
    fee: Optional[float] = None,
    outcome: Optional[MarketOutcome] = None,
    **kwargs,
) -> Order:

build_order has the same signature and same defaults (client.py lines ~2330–2340).

Expected

side, type, and amount should be required (no default) in Python just as they are in TypeScript. Callers must explicitly supply them. If a default is kept for backward-compatibility reasons, at minimum amount=0 should raise a ValidationError before sending to the sidecar.

Impact

A caller who forgets side silently places a buy order. A caller who forgets amount silently submits a zero-size order to the exchange. Both behaviours are financially dangerous and differ from TypeScript, where the compiler enforces that these fields are supplied.

Found by automated SDK cross-language drift audit