fix: the swap decoder reads who the router's transfer commands pay (closes #599)

TRANSFER, PAY_PORTION, PAY_PORTION_FULL_PRECISION (0x07, on the routers with
the 0x7f mask), PERMIT2_TRANSFER_FROM, ACROSS_V4_DEPOSIT_V3 (0x40) and V4
TAKE_PORTION were payouts the decoder did not read, so a swap using one read
Min. paid out with an unknown payee. Each recipient is now read: the sender,
the router, a hop into the next V2 pair, or another address, which is named.
Paying all the router holds of a token pays it out as SWEEP does. A
PERMIT2_TRANSFER_FROM into the router is shown with the amount it moves, and a
bridge deposit names the bridge and each of its recipient and depositor that
is not the sender; either keeps the minimum from reading received.

Model: opus-5-5

tests/uniswap.test.js

@@ -954,7 +954,28 @@ describe("uniswap decoder", () => {
             router: "UniversalRouterV2_1_2",
             address: ROUTER_V2_1_2_ADDR,
             command: "0x40",
-            steps: "Command 0x40",
+            steps: "Across Bridge Deposit",
+        },
+        // Only the routers with the 0x7f mask have 0x07, as
+        // PAY_PORTION_FULL_PRECISION; the others revert on it
+        // (https://git.eeqj.de/sneak/AutistMask/issues/599).
+        {
+            router: "UniversalRouterV1",
+            address: ROUTER_V1_ADDR,
+            command: "0x07",
+            steps: "Command 0x07",
+        },
+        {
+            router: "UniversalRouterV2",
+            address: ROUTER_ADDR,
+            command: "0x07",
+            steps: "Command 0x07",
+        },
+        {
+            router: "UniversalRouterV2_1_2",
+            address: ROUTER_V2_1_2_ADDR,
+            command: "0x07",
+            steps: "Pay Portion (Full Precision)",
         },
     ])(
         "command $command sent to $router is listed as $steps",

tests/uniswapRecipient.test.js

@@ -1,12 +1,14 @@
 // The address a swap's output is paid to
-// (https://git.eeqj.de/sneak/AutistMask/issues/594).
+// (https://git.eeqj.de/sneak/AutistMask/issues/594 and
+// https://git.eeqj.de/sneak/AutistMask/issues/599).
 //
-// Every swap command, SWEEP, WRAP_ETH, UNWRAP_WETH and V4 TAKE names the
-// address it pays, and TAKE_ALL pays the sender. The decoder read none of
-// them: a swap whose output went to another address still read "Min.
-// received", as if the user received it. The router reads address(1) as the
-// sender and address(2) as the router itself, which holds what it is paid
-// until a later step pays it out.
+// Every swap command, SWEEP, WRAP_ETH, UNWRAP_WETH, TRANSFER, PAY_PORTION,
+// PAY_PORTION_FULL_PRECISION, PERMIT2_TRANSFER_FROM, ACROSS_V4_DEPOSIT_V3 and
+// V4 TAKE and TAKE_PORTION names the address it pays, and TAKE_ALL pays the
+// sender. The decoder read none of them: a swap whose output went to another
+// address still read "Min. received", as if the user received it. The router
+// reads address(1) as the sender and address(2) as the router itself, which
+// holds what it is paid until a later step pays it out.
 //
 // The screens are driven against a minimal DOM stub in the shape
 // tests/uniswapRouterAddress.test.js uses.
@@ -41,6 +43,8 @@ const transactionDetail = require("../src/popup/views/transactionDetail");
 const ROUTER = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
 // UniversalRouterV2_1_2 on Ethereum Mainnet, whose mask reads 0x07 and 0x40.
 const ROUTER_V2_1_2 = "0x23617e59A5925b2A4Bf75d73ff6711cD0b29De85";
+// UniversalRouterV1 on Ethereum Mainnet.
+const ROUTER_V1 = "0xEf1c6E67703c7BD7107eed8303Fbe6EC2554BF6B";
 const USER = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 const OTHER = "0x7777777777777777777777777777777777777777";
 const MSG_SENDER = "0x0000000000000000000000000000000000000001";
@@ -53,12 +57,21 @@ const WETH = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2";
 const ONE_WETH = 1000000000000000000n;
 const USDT_2000 = 2000000000n;
 const USDC_1990 = 1990000000n;
+// The router's whole-balance amount.
+const CONTRACT_BALANCE = 2n ** 255n;
 
 // The Paid to line's value when no address can be named.
 const UNDECODED = "Unknown (could not be decoded)";
 const UNNAMED = "Unknown (not named in the calldata)";
 const STAYS_IN_ROUTER =
     "The router, where it stays (no later step pays it out)";
+const PAID_TO_BRIDGE =
+    "The bridge, which pays the deposit's recipient on another network";
+// The Paid to line for a PERMIT2_TRANSFER_FROM of `amount` into the router.
+const movedIntoRouter = (amount) =>
+    "The router, " +
+    amount +
+    " from the sender (later steps may not spend all of it)";
 
 const coder = AbiCoder.defaultAbiCoder();
 const routerIface = new Interface([
@@ -89,7 +102,14 @@ function v2Swap(command, recipient, amount, limit, path, payerIsUser = true) {
     ];
 }
 
-function v3SwapExactIn(recipient, amountIn, amountOutMin, tokenIn, tokenOut) {
+function v3SwapExactIn(
+    recipient,
+    amountIn,
+    amountOutMin,
+    tokenIn,
+    tokenOut,
+    payerIsUser = true,
+) {
     return [
         0x00,
         coder.encode(
@@ -102,7 +122,7 @@ function v3SwapExactIn(recipient, amountIn, amountOutMin, tokenIn, tokenOut) {
                     ["address", "uint24", "address"],
                     [tokenIn, 3000, tokenOut],
                 ),
-                true,
+                payerIsUser,
             ],
         ),
     ];
@@ -115,6 +135,64 @@ function sweep(token, recipient) {
     ];
 }
 
+// TRANSFER (0x05), PAY_PORTION (0x06) and PAY_PORTION_FULL_PRECISION (0x07)
+// share one layout. `amount` is a quantity, bips, or 1e18ths respectively.
+function transfer(command, token, recipient, amount) {
+    return [
+        command,
+        coder.encode(
+            ["address", "address", "uint256"],
+            [token, recipient, amount],
+        ),
+    ];
+}
+
+function permit2TransferFrom(token, recipient, amount) {
+    return [
+        0x02,
+        coder.encode(
+            ["address", "address", "uint160"],
+            [token, recipient, amount],
+        ),
+    ];
+}
+
+// ACROSS_V4_DEPOSIT_V3 (0x40) of `inputAmount` of `inputToken`, bridged to
+// chain id 8453.
+function acrossDeposit(
+    depositor,
+    recipient,
+    inputToken,
+    inputAmount,
+    useNative = false,
+) {
+    return [
+        0x40,
+        coder.encode(
+            [
+                "tuple(address,address,address,address,uint256,uint256,uint256,address,uint32,uint32,uint32,bytes,bool)",
+            ],
+            [
+                [
+                    depositor,
+                    recipient,
+                    inputToken,
+                    inputToken,
+                    inputAmount,
+                    1n,
+                    8453n,
+                    ZERO,
+                    0,
+                    0,
+                    0,
+                    "0x",
+                    useNative,
+                ],
+            ],
+        ),
+    ];
+}
+
 function wrapEth(recipient, amount) {
     return [0x0b, coder.encode(["address", "uint256"], [recipient, amount])];
 }
@@ -150,6 +228,15 @@ const SWAP_USDT_FOR_USDC = [
         [[[USDT, USDC, 100, 1, ZERO], true, USDT_2000, USDC_1990, "0x"]],
     ),
 ];
+const SWAP_USDT_FOR_ETH = [
+    0x06, // SWAP_EXACT_IN_SINGLE
+    coder.encode(
+        [
+            "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
+        ],
+        [[[ZERO, USDT, 500, 10, ZERO], false, USDT_2000, ONE_WETH, "0x"]],
+    ),
+];
 // SWAP_EXACT_IN_SINGLE with no parameters, which cannot be read.
 const UNREADABLE_SWAP = [0x06, "0x"];
 const SETTLE_USDT = [
@@ -168,6 +255,15 @@ function take(currency, recipient) {
 function takeAll(currency) {
     return [0x0f, coder.encode(["address", "uint256"], [currency, 0n])];
 }
+function takePortion(currency, recipient, bips) {
+    return [
+        0x10,
+        coder.encode(
+            ["address", "address", "uint256"],
+            [currency, recipient, bips],
+        ),
+    ];
+}
 
 // A V4_SWAP step of `actions`, each [action, params].
 function v4Swap(...actions) {
@@ -422,6 +518,381 @@ describe("an output left in the router is not received", () => {
     });
 });
 
+// https://git.eeqj.de/sneak/AutistMask/issues/599: TRANSFER, PAY_PORTION,
+// PAY_PORTION_FULL_PRECISION and V4 TAKE_PORTION pay a token to an address,
+// and PERMIT2_TRANSFER_FROM moves the user's own tokens to one.
+describe("each transfer command's recipient", () => {
+    // Each pays out all of a swap's output. Paid to another address, this is
+    // the first shape the issue reports.
+    test.each([
+        {
+            kind: "TRANSFER of CONTRACT_BALANCE",
+            data: (r) =>
+                execute(
+                    swapToWeth(ADDRESS_THIS),
+                    transfer(0x05, WETH, r, CONTRACT_BALANCE),
+                ),
+            min: "1.0000 WETH",
+        },
+        {
+            kind: "PAY_PORTION of 10,000 bips",
+            data: (r) =>
+                execute(
+                    swapToWeth(ADDRESS_THIS),
+                    transfer(0x06, WETH, r, 10000n),
+                ),
+            min: "1.0000 WETH",
+        },
+        {
+            kind: "PAY_PORTION_FULL_PRECISION of 1e18",
+            data: (r) =>
+                execute(
+                    swapToWeth(ADDRESS_THIS),
+                    transfer(0x07, WETH, r, 10n ** 18n),
+                ),
+            router: ROUTER_V2_1_2,
+            min: "1.0000 WETH",
+        },
+        {
+            kind: "V4 TAKE_PORTION of 10,000 bips",
+            data: (r) =>
+                execute(
+                    v4Swap(
+                        SWAP_USDT_FOR_USDC,
+                        SETTLE_USDT,
+                        takePortion(USDC, r, 10000n),
+                    ),
+                ),
+            min: "1990.0000 USDC",
+        },
+    ])(
+        "$kind: paid to the user it is received, to the router it stays there, to another address that address is named",
+        ({ data, router = ROUTER, min }) => {
+            const toUser = decode(data(MSG_SENDER), USER, router);
+            expect(labels(toUser)).toEqual(PAID_TO_USER);
+            expect(detail(toUser, "Min. received").value).toBe(min);
+            expect(decode(data(USER), USER, router).details).toEqual(
+                toUser.details,
+            );
+
+            const toRouter = decode(data(ADDRESS_THIS), USER, router);
+            expect(labels(toRouter)).toEqual(PAID_ELSEWHERE);
+            expect(paidTo(toRouter)).toEqual([STAYS_IN_ROUTER]);
+            expect(detail(toRouter, "Min. paid out").value).toBe(min);
+
+            const toOther = decode(data(OTHER), USER, router);
+            expect(labels(toOther)).toEqual(PAID_ELSEWHERE);
+            expect(paidTo(toOther)).toEqual([OTHER]);
+            expect(detail(toOther, "Min. paid out").value).toBe(min);
+        },
+    );
+
+    // The user's USDT, moved to `r`, then a swap of it paid to the user. A
+    // move to another address is the issue's second shape.
+    const movedThenSwapped = (r) =>
+        execute(
+            permit2TransferFrom(USDT, r, USDT_2000),
+            v3SwapExactIn(MSG_SENDER, USDT_2000, ONE_WETH, USDT, WETH, false),
+        );
+
+    test("PERMIT2_TRANSFER_FROM: to the user it pays no one else, to another address that address is named", () => {
+        for (const r of [MSG_SENDER, USER]) {
+            const result = decode(movedThenSwapped(r));
+            expect(labels(result)).toEqual(PAID_TO_USER);
+            expect(detail(result, "Min. received").value).toBe("1.0000 WETH");
+        }
+
+        const toOther = decode(movedThenSwapped(OTHER));
+        expect(labels(toOther)).toEqual(PAID_ELSEWHERE);
+        expect(paidTo(toOther)).toEqual([OTHER]);
+        expect(detail(toOther, "Min. paid out").value).toBe("1.0000 WETH");
+
+        const alone = decode(
+            execute(permit2TransferFrom(USDT, OTHER, USDT_2000)),
+        );
+        expect(detail(alone, "Steps").value).toBe("Permit2 Transfer");
+        expect(paidTo(alone)).toEqual([OTHER]);
+    });
+
+    // Later steps may leave part of what a move into the router moves there,
+    // where anyone can sweep it in a later transaction.
+    test.each([
+        { kind: "address(2)", r: ADDRESS_THIS },
+        { kind: "the router's own address", r: ROUTER },
+    ])(
+        "PERMIT2_TRANSFER_FROM into the router as $kind names what it moves, and nothing is received",
+        ({ r }) => {
+            const result = decode(movedThenSwapped(r));
+            expect(labels(result)).toEqual(PAID_ELSEWHERE);
+            expect(paidTo(result)).toEqual([movedIntoRouter("2000.0000 USDT")]);
+            expect(detail(result, "Min. paid out").value).toBe("1.0000 WETH");
+        },
+    );
+
+    test.each([
+        { kind: "from the router's balance", payerIsUser: false },
+        { kind: "from the user's", payerIsUser: true },
+    ])(
+        "a move of 2,000 USDT into the router, then a swap of 1 USDT $kind paid to the user",
+        ({ payerIsUser }) => {
+            const result = decode(
+                execute(
+                    permit2TransferFrom(USDT, ADDRESS_THIS, USDT_2000),
+                    v3SwapExactIn(
+                        MSG_SENDER,
+                        1000000n,
+                        1n,
+                        USDT,
+                        WETH,
+                        payerIsUser,
+                    ),
+                ),
+            );
+            expect(detail(result, "Amount").value).toBe("1.0000 USDT");
+            expect(paidTo(result)).toEqual([movedIntoRouter("2000.0000 USDT")]);
+            expect(detail(result, "Min. received")).toBeUndefined();
+            expect(detail(result, "Min. paid out")).toBeDefined();
+        },
+    );
+
+    test("a move into the router of a token the wallet does not know names the token", () => {
+        const unknown = "0x5555555555555555555555555555555555555555";
+        const result = decode(
+            execute(
+                permit2TransferFrom(unknown, ADDRESS_THIS, 5n),
+                swapToWeth(MSG_SENDER),
+            ),
+        );
+        expect(paidTo(result)).toEqual([
+            movedIntoRouter("5 base units (decimals unknown) of " + unknown),
+        ]);
+    });
+
+    test("UniversalRouterV1 pays a PERMIT2_TRANSFER_FROM to address(1) or address(2) as written, and maps a TRANSFER's", () => {
+        for (const r of [MSG_SENDER, ADDRESS_THIS]) {
+            const result = decode(movedThenSwapped(r), USER, ROUTER_V1);
+            expect(paidTo(result)).toEqual([r]);
+            expect(detail(result, "Min. received")).toBeUndefined();
+        }
+
+        const transferred = decode(
+            execute(
+                swapToWeth(ADDRESS_THIS),
+                transfer(0x05, WETH, MSG_SENDER, CONTRACT_BALANCE),
+            ),
+            USER,
+            ROUTER_V1,
+        );
+        expect(labels(transferred)).toEqual(PAID_TO_USER);
+    });
+
+    test("TAKE_PORTION does not set Token Out: a TAKE_PORTION of another currency after the TAKE_ALL of the bought one", () => {
+        const result = decode(
+            execute(
+                v4Swap(
+                    SWAP_USDT_FOR_USDC,
+                    SETTLE_USDT,
+                    takeAll(USDC),
+                    takePortion(USDT, OTHER, 25n),
+                ),
+            ),
+        );
+        expect(detail(result, "Token Out").address).toBe(USDC);
+        expect(paidTo(result)).toEqual([OTHER]);
+        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
+    });
+
+    test("a router without command 0x07 does not read it as PAY_PORTION_FULL_PRECISION", () => {
+        const result = decode(
+            execute(
+                swapToWeth(MSG_SENDER),
+                transfer(0x07, WETH, MSG_SENDER, 10n ** 18n),
+            ),
+        );
+        expect(detail(result, "Steps").value).toBe(
+            "V3 Swap (Exact In) → Command 0x07",
+        );
+        expect(paidTo(result)).toEqual([UNDECODED]);
+        expect(detail(result, "Min. received")).toBeUndefined();
+    });
+});
+
+// A payout of only part of what the router holds leaves the rest there.
+describe("a payout of part of the router's output", () => {
+    test.each([
+        {
+            kind: "a TRANSFER of 1 base unit",
+            step: transfer(0x05, WETH, MSG_SENDER, 1n),
+        },
+        {
+            kind: "a PAY_PORTION of 5,000 bips",
+            step: transfer(0x06, WETH, MSG_SENDER, 5000n),
+        },
+        {
+            kind: "a PAY_PORTION_FULL_PRECISION of 1e18 less 1",
+            step: transfer(0x07, WETH, MSG_SENDER, 10n ** 18n - 1n),
+        },
+    ])("$kind to the user leaves the rest in the router", ({ step }) => {
+        const result = decode(
+            execute(swapToWeth(ADDRESS_THIS), step),
+            USER,
+            ROUTER_V2_1_2,
+        );
+        expect(labels(result)).toEqual(PAID_ELSEWHERE);
+        expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
+        expect(detail(result, "Min. paid out").value).toBe("1.0000 WETH");
+    });
+
+    // An interface fee: a share of the output to another address, the rest
+    // to the user. The swap's minimum includes the fee, so it is not what the
+    // user receives.
+    test.each([
+        {
+            kind: "PAY_PORTION of 25 bips, then SWEEP",
+            data: execute(
+                swapToWeth(ADDRESS_THIS),
+                transfer(0x06, WETH, OTHER, 25n),
+                sweep(WETH, MSG_SENDER),
+            ),
+            min: "1.0000 WETH",
+        },
+        {
+            kind: "TRANSFER of a flat fee, then SWEEP",
+            data: execute(
+                swapToWeth(ADDRESS_THIS),
+                transfer(0x05, WETH, OTHER, ONE_WETH / 400n),
+                sweep(WETH, MSG_SENDER),
+            ),
+            min: "1.0000 WETH",
+        },
+        {
+            kind: "PAY_PORTION of 25 bips, then UNWRAP_WETH",
+            data: execute(
+                swapToWeth(ADDRESS_THIS),
+                transfer(0x06, WETH, OTHER, 25n),
+                unwrapWeth(MSG_SENDER),
+            ),
+            min: "1.0000 ETH",
+        },
+        {
+            kind: "V4 TAKE_PORTION of 25 bips, then TAKE_ALL",
+            data: execute(
+                v4Swap(
+                    SWAP_USDT_FOR_USDC,
+                    SETTLE_USDT,
+                    takePortion(USDC, OTHER, 25n),
+                    takeAll(USDC),
+                ),
+            ),
+            min: "1990.0000 USDC",
+        },
+    ])(
+        "a fee by $kind names the fee's recipient and calls nothing received",
+        ({ data, min }) => {
+            const result = decode(data);
+            expect(labels(result)).toEqual(PAID_ELSEWHERE);
+            expect(paidTo(result)).toEqual([OTHER]);
+            expect(detail(result, "Min. paid out").value).toBe(min);
+        },
+    );
+});
+
+// ACROSS_V4_DEPOSIT_V3 hands the bridge what the router holds. The bridge
+// pays the deposit's recipient on another network, and refunds a deposit
+// nobody fills to its depositor; the router passes both on as written.
+describe("a bridge deposit", () => {
+    // A swap of 2,000 USDT for at least 1 WETH paid to the router, then a
+    // deposit of all the router's WETH.
+    const bridged = (depositor, recipient) =>
+        execute(
+            swapToWeth(ADDRESS_THIS),
+            acrossDeposit(depositor, recipient, WETH, CONTRACT_BALANCE),
+        );
+
+    test.each([
+        {
+            kind: "the user is its recipient and its depositor",
+            recipient: USER,
+            depositor: USER,
+            named: [],
+        },
+        {
+            kind: "another address is its recipient",
+            recipient: OTHER,
+            depositor: USER,
+            named: [OTHER],
+        },
+        {
+            kind: "another address is its depositor",
+            recipient: USER,
+            depositor: OTHER,
+            named: [OTHER],
+        },
+        {
+            kind: "address(1) is its recipient and address(2) its depositor",
+            recipient: MSG_SENDER,
+            depositor: ADDRESS_THIS,
+            named: [MSG_SENDER, ADDRESS_THIS],
+        },
+    ])(
+        "when $kind, each that is not the user is named, and nothing is received",
+        ({ recipient, depositor, named }) => {
+            const result = decode(
+                bridged(depositor, recipient),
+                USER,
+                ROUTER_V2_1_2,
+            );
+            expect(detail(result, "Steps").value).toBe(
+                "V3 Swap (Exact In) → Across Bridge Deposit",
+            );
+            expect(paidTo(result)).toEqual([...named, PAID_TO_BRIDGE]);
+            expect(detail(result, "Min. received")).toBeUndefined();
+            expect(detail(result, "Min. paid out").value).toBe("1.0000 WETH");
+        },
+    );
+
+    test("a deposit of part of the router's WETH leaves the rest there", () => {
+        const result = decode(
+            execute(
+                swapToWeth(ADDRESS_THIS),
+                acrossDeposit(USER, USER, WETH, ONE_WETH / 2n),
+            ),
+            USER,
+            ROUTER_V2_1_2,
+        );
+        expect(paidTo(result)).toEqual([PAID_TO_BRIDGE, STAYS_IN_ROUTER]);
+    });
+
+    test("a deposit of all the router's ETH pays out the ETH it holds; one of all its WETH does not", () => {
+        const ethToRouter = v4Swap(
+            SWAP_USDT_FOR_ETH,
+            SETTLE_USDT,
+            take(ZERO, ADDRESS_THIS),
+        );
+
+        const native = decode(
+            execute(
+                ethToRouter,
+                acrossDeposit(USER, USER, WETH, CONTRACT_BALANCE, true),
+            ),
+            USER,
+            ROUTER_V2_1_2,
+        );
+        expect(detail(native, "Token Out").value).toBe("ETH");
+        expect(paidTo(native)).toEqual([PAID_TO_BRIDGE]);
+
+        const weth = decode(
+            execute(
+                ethToRouter,
+                acrossDeposit(USER, USER, WETH, CONTRACT_BALANCE),
+            ),
+            USER,
+            ROUTER_V2_1_2,
+        );
+        expect(paidTo(weth)).toEqual([PAID_TO_BRIDGE, STAYS_IN_ROUTER]);
+    });
+});
+
 // Uniswap's mixed routes pay a V2 pair directly when the next step swaps
 // through it. That V2 swap spends what the pair holds: its amountIn is
 // CONTRACT_BALANCE, paid from the router, or ALREADY_PAID. The pairs below
@@ -430,7 +901,6 @@ describe("an output left in the router is not received", () => {
 describe("a swap paid to the pair the next V2 swap spends", () => {
     // The WETH/USDC pair on Ethereum Mainnet, as its V2 factory reports it.
     const PAIR = "0xB4e16d0168e52d35CaCD2c6185b44281Ec28C9Dc";
-    const CONTRACT_BALANCE = 2n ** 255n;
     const AMOUNTS_IN = [
         { kind: "CONTRACT_BALANCE", amountIn: CONTRACT_BALANCE },
         { kind: "ALREADY_PAID", amountIn: 0n },
@@ -498,6 +968,36 @@ describe("a swap paid to the pair the next V2 swap spends", () => {
         },
     );
 
+    test.each([
+        {
+            kind: "ETH wrapped into the router, then a TRANSFER of all of it",
+            pay: (r) => [
+                wrapEth(ADDRESS_THIS, ONE_WETH),
+                transfer(0x05, WETH, r, CONTRACT_BALANCE),
+            ],
+        },
+        {
+            kind: "a PERMIT2_TRANSFER_FROM of the user's WETH",
+            pay: (r) => [permit2TransferFrom(WETH, r, ONE_WETH)],
+        },
+    ])(
+        "$kind, paid to the pair, is a hop; paid to another address, it is named",
+        ({ pay }) => {
+            const route = (r) =>
+                execute(...pay(r), pairSpends(0n, [WETH, USDC]));
+
+            const toPair = decode(route(PAIR));
+            expect(paidTo(toPair)).toEqual([]);
+            expect(detail(toPair, "Min. received").value).toBe(
+                "1990.0000 USDC",
+            );
+
+            const toOther = decode(route(OTHER));
+            expect(paidTo(toOther)).toEqual([OTHER]);
+            expect(detail(toOther, "Min. received")).toBeUndefined();
+        },
+    );
+
     describe("on Sepolia", () => {
         const SEPOLIA = "0xaa36a7";
         // UniversalRouterV2_1_2 on Sepolia.
@@ -661,13 +1161,17 @@ describe("every step's payee counts, whichever step sets the output", () => {
 });
 
 describe("a payout that cannot be read is never said to be received", () => {
-    test("a V4 TAKE whose recipient word has its top byte set", () => {
+    test.each([
+        { kind: "TAKE", action: take(USDC, OTHER) },
+        { kind: "TAKE_PORTION", action: takePortion(USDC, OTHER, 25n) },
+    ])("a V4 $kind whose recipient word has its top byte set", ({ action }) => {
         const result = decode(
             execute(
                 v4Swap(
                     SWAP_USDT_FOR_USDC,
                     SETTLE_USDT,
-                    withDirtyWord(take(USDC, OTHER), 1),
+                    withDirtyWord(action, 1),
+                    takeAll(USDC),
                 ),
             ),
         );
@@ -689,11 +1193,38 @@ describe("a payout that cannot be read is never said to be received", () => {
         { kind: "SWEEP", step: sweep(WETH, OTHER), word: 1 },
         { kind: "WRAP_ETH", step: wrapEth(OTHER, 1n) },
         { kind: "UNWRAP_WETH", step: unwrapWeth(OTHER) },
+        {
+            kind: "TRANSFER",
+            step: transfer(0x05, WETH, OTHER, 1n),
+            word: 1,
+        },
+        {
+            kind: "PAY_PORTION",
+            step: transfer(0x06, WETH, OTHER, 1n),
+            word: 1,
+        },
+        {
+            kind: "PAY_PORTION_FULL_PRECISION",
+            step: transfer(0x07, WETH, OTHER, 1n),
+            word: 1,
+        },
+        {
+            kind: "PERMIT2_TRANSFER_FROM",
+            step: permit2TransferFrom(WETH, OTHER, 1n),
+            word: 1,
+        },
+        {
+            kind: "ACROSS_V4_DEPOSIT_V3",
+            step: acrossDeposit(USER, OTHER, WETH, 1n),
+            word: 2,
+        },
     ])(
         "a $kind whose recipient word has its top byte set",
         ({ step, word = 0 }) => {
             const result = decode(
                 execute(swapToWeth(MSG_SENDER), withDirtyWord(step, word)),
+                USER,
+                ROUTER_V2_1_2,
             );
             expect(paidTo(result)).toEqual([UNDECODED]);
             expect(detail(result, "Min. received")).toBeUndefined();
@@ -719,17 +1250,8 @@ describe("a payout that cannot be read is never said to be received", () => {
         expect(detail(result, "Min. paid out").value).toBe("1.0000 WETH");
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/599 is to read these. Until
-    // then each is a payout this decoder does not read.
-    const transferShape = (command) => [
-        command,
-        coder.encode(["address", "address", "uint256"], [WETH, OTHER, 1n]),
-    ];
+    // Each is a payout this decoder does not read.
     test.each([
-        { kind: "PERMIT2_TRANSFER_FROM", step: transferShape(0x02) },
-        { kind: "TRANSFER", step: transferShape(0x05) },
-        { kind: "PAY_PORTION", step: transferShape(0x06) },
-        { kind: "PAY_PORTION_FULL_PRECISION", step: transferShape(0x07) },
         {
             kind: "PERMIT2_TRANSFER_FROM_BATCH",
             step: [
@@ -750,24 +1272,10 @@ describe("a payout that cannot be read is never said to be received", () => {
                 0x21,
                 coder.encode(
                     ["bytes", "bytes[]"],
-                    ["0x05", [transferShape(0x05)[1]]],
+                    ["0x05", [transfer(0x05, WETH, OTHER, 1n)[1]]],
                 ),
             ],
         },
-        {
-            kind: "ACROSS_V4_DEPOSIT_V3",
-            step: [0x40, coder.encode(["address"], [OTHER])],
-        },
-        {
-            kind: "V4 TAKE_PORTION",
-            step: v4Swap([
-                0x10,
-                coder.encode(
-                    ["address", "address", "uint256"],
-                    [WETH, OTHER, 10000n],
-                ),
-            ]),
-        },
     ])("a swap paid to the user, then $kind", ({ step }) => {
         const result = decode(
             execute(swapToWeth(MSG_SENDER), step),