harden: gate swap amounts on presence, not truthiness, so a figure always matches its token (closes #359)

Token and amount were gated on truthiness and gated independently. An address is never falsy once set but 0n is, so a hop supplying a zero amount fixed the token permanently while leaving the amount open, and the next hop's figure was rendered against the first hop's token at that token's scale -- 0.5 WETH shown as 500000000000.0000 USDT. Nine defective gates are now presence checks, and fourteen address gates were converted defensively so a sixth instance of this class cannot grow.

Zero is not one thing. Established from v4-periphery: OPEN_DELTA is 0 and V4Router substitutes the full credit unconditionally, so a zero V4 exact-in amount means "swap the whole balance" and now reads "All available (V4 open delta)" rather than 0.0000, which would assert the exact inverse. amountOutMinimum gets no such mapping and universal-router special-cases only CONTRACT_BALANCE, so a zero minimum and a zero V2/V3 amount stay literal -- a zero floor reads "None (no minimum guaranteed)".

closes #364

tests/uniswap.test.js

@@ -94,6 +94,69 @@ function encodeV4Swap(actions, params) {
     return coder.encode(["bytes", "bytes[]"], [actions, params]);
 }
 
+// V4 inner action IDs, as src/shared/uniswap.js names them.
+const V4_SWAP_EXACT_IN = 0x07;
+const V4_SWAP_EXACT_IN_SINGLE_ID = 0x06;
+const V4_SETTLE_ID = 0x0b;
+const V4_TAKE_ID = 0x0e;
+const ZERO_ADDR = "0x0000000000000000000000000000000000000000";
+
+// Helper: V4 SETTLE params — (address currency, uint256 maxAmount, bool payerIsUser)
+function encodeV4Settle(currency) {
+    return coder.encode(["address", "uint256", "bool"], [currency, 0n, true]);
+}
+
+// Helper: V4 TAKE params — (address currency, address recipient, uint256 amount)
+function encodeV4Take(currency) {
+    return coder.encode(
+        ["address", "address", "uint256"],
+        [currency, USER_ADDR, 0n],
+    );
+}
+
+// Helper: V4 ExactInputParams — (address currencyIn,
+//   tuple(address,uint24,int24,address,bytes)[] path,
+//   uint128 amountIn, uint128 amountOutMin)
+function encodeV4ExactIn(currencyIn, pathTokens, amountIn, amountOutMin) {
+    return coder.encode(
+        [
+            "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
+        ],
+        [
+            [
+                currencyIn,
+                pathTokens.map((t) => [t, 3000, 60, ZERO_ADDR, "0x"]),
+                amountIn,
+                amountOutMin,
+            ],
+        ],
+    );
+}
+
+// Helper: V4 ExactInputSingleParams —
+//   (tuple(address,address,uint24,int24,address) poolKey, bool zeroForOne,
+//    uint128 amountIn, uint128 amountOutMin, bytes hookData)
+function encodeV4ExactInSingle(currency0, currency1, amountIn, amountOutMin) {
+    return coder.encode(
+        [
+            "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
+        ],
+        [
+            [
+                [currency0, currency1, 100, 1, ZERO_ADDR],
+                true, // zeroForOne: in = currency0, out = currency1
+                amountIn,
+                amountOutMin,
+                "0x",
+            ],
+        ],
+    );
+}
+
+function detail(result, label) {
+    return result.details.find((d) => d.label === label);
+}
+
 describe("uniswap decoder", () => {
     test("returns null for non-execute calldata", () => {
         expect(uniswap.decode("0x", ROUTER_ADDR)).toBeNull();
@@ -118,6 +181,18 @@ describe("uniswap decoder", () => {
         expect(tokenIn.value).toContain("USDT");
         expect(tokenIn.address.toLowerCase()).toBe(USDT_ADDR.toLowerCase());
 
+        // Genuine native ETH on the output side, on a real mainnet fixture:
+        // V4's TAKE names it as Currency.wrap(address(0)), which reaches the
+        // decoder as the explicit zero address and must still read as ETH.
+        const tokenOut = result.details.find((d) => d.label === "Token Out");
+        expect(tokenOut.value).toBe("ETH");
+        expect(result.details.find((d) => d.label === "Amount").value).toBe(
+            "Unlimited",
+        );
+        expect(
+            result.details.find((d) => d.label === "Min. received").value,
+        ).toBe("0.0002 ETH");
+
         const steps = result.details.find((d) => d.label === "Steps");
         expect(steps.value).toContain("Permit2 Permit");
         expect(steps.value).toContain("V4 Swap");
@@ -181,8 +256,7 @@ describe("uniswap decoder", () => {
         expect(tokenIn.value).toBe("ETH (native)");
 
         const amount = result.details.find((d) => d.label === "Amount");
-        expect(amount.value).toContain("1.0000");
-        expect(amount.value).toContain("ETH");
+        expect(amount.value).toBe("1.0000 ETH");
     });
 
     test("decodes UNWRAP_WETH as ETH output", () => {
@@ -338,6 +412,211 @@ describe("uniswap decoder", () => {
         expect(steps.value).toContain("V4 Swap");
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/364 — the input half.
+    //
+    // Fails against c9ebac8: `if (!inputAmount) inputAmount = s.amountIn`
+    // cannot tell the V3 hop's genuine 0n from "not yet set", so the V2 hop's
+    // 0.5 WETH overwrote it while Token In stayed pinned to the V3 hop's USDT.
+    // Observed there: Amount = "500000000000.0000 USDT".
+    test("a hop's zero amountIn is a real amount, not an opening for the next hop's figure", () => {
+        const data = buildExecute(
+            solidityPacked(["uint8", "uint8"], [0x00, 0x08]),
+            [
+                encodeV3SwapExactIn(USER_ADDR, 0n, 0n, [USDT_ADDR, WETH_ADDR]),
+                encodeV2SwapExactIn(
+                    USER_ADDR,
+                    500000000000000000n, // 0.5 WETH
+                    1000000n,
+                    [WETH_ADDR, USDC_ADDR],
+                ),
+            ],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+
+        // The amount and the token it is counted in come from the same hop.
+        expect(detail(result, "Token In").address.toLowerCase()).toBe(
+            USDT_ADDR.toLowerCase(),
+        );
+        expect(detail(result, "Amount").value).toBe("0.0000 USDT");
+        expect(detail(result, "Amount").value).not.toContain("500000000000");
+    });
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/359 — the output half, in
+    // the shape the issue measured: a V4 step that states a minimum of zero
+    // and names no output currency.
+    //
+    // Fails against c9ebac8: `if (v4.amountOutMin) minOutput = ...` and the
+    // `else if` beside it both read 0n as absent, so neither the figure nor
+    // the token moved. Observed there: Token Out = "WETH (0xC02aaA39...)" and
+    // Min. received = "0.5000 WETH" — the V3 hop's guarantee shown for a
+    // transaction whose final leg guarantees nothing.
+    test("a V4 step with a zero amountOutMin states no minimum instead of keeping an earlier hop's", () => {
+        const data = buildExecute(
+            solidityPacked(["uint8", "uint8"], [0x00, 0x10]),
+            [
+                encodeV3SwapExactIn(USER_ADDR, 2000000n, 500000000000000000n, [
+                    USDT_ADDR,
+                    WETH_ADDR,
+                ]),
+                encodeV4Swap(new Uint8Array([V4_SWAP_EXACT_IN]), [
+                    encodeV4ExactIn(
+                        WETH_ADDR,
+                        [], // no path: this step names no output currency
+                        1000000000000000000n,
+                        0n, // no slippage floor at all
+                    ),
+                ]),
+            ],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+
+        expect(detail(result, "Token Out").value).toBe(
+            "Unknown (not named in the calldata)",
+        );
+        expect(detail(result, "Min. received").value).toBe(
+            "None (no minimum guaranteed)",
+        );
+        expect(detail(result, "Min. received").value).not.toContain("0.5000");
+    });
+
+    // The same zero floor, but with the final leg's output currency named:
+    // the figure must belong to the token beside it. Against c9ebac8 this
+    // rendered Token Out = USDC with Min. received = "500000000000.0000 USDC",
+    // the V3 hop's 0.5e18 WETH figure re-scaled to USDC's six decimals.
+    test("a zero minimum is stated against the token that supplied it", () => {
+        const data = buildExecute(
+            solidityPacked(["uint8", "uint8"], [0x00, 0x10]),
+            [
+                encodeV3SwapExactIn(USER_ADDR, 2000000n, 500000000000000000n, [
+                    USDT_ADDR,
+                    WETH_ADDR,
+                ]),
+                encodeV4Swap(
+                    new Uint8Array([
+                        V4_SETTLE_ID,
+                        V4_SWAP_EXACT_IN_SINGLE_ID,
+                        V4_TAKE_ID,
+                    ]),
+                    [
+                        encodeV4Settle(WETH_ADDR),
+                        encodeV4ExactInSingle(
+                            WETH_ADDR,
+                            USDC_ADDR,
+                            1000000000000000000n,
+                            0n,
+                        ),
+                        encodeV4Take(USDC_ADDR),
+                    ],
+                ),
+            ],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+
+        expect(detail(result, "Token Out").value).toContain("USDC");
+        expect(detail(result, "Min. received").value).toBe(
+            "None (no minimum guaranteed)",
+        );
+    });
+
+    // The other half of the same invariant: a final leg that names an output
+    // currency but no minimum leaves Min. received unstated. Against c9ebac8
+    // the V3 hop's figure stayed on screen beside the new token, rendering
+    // "500000000000.0000 USDC".
+    test("a final leg with no minimum drops the line rather than keeping an earlier hop's figure", () => {
+        const data = buildExecute(
+            solidityPacked(["uint8", "uint8"], [0x00, 0x10]),
+            [
+                encodeV3SwapExactIn(USER_ADDR, 2000000n, 500000000000000000n, [
+                    USDT_ADDR,
+                    WETH_ADDR,
+                ]),
+                encodeV4Swap(new Uint8Array([V4_SETTLE_ID, V4_TAKE_ID]), [
+                    encodeV4Settle(WETH_ADDR),
+                    encodeV4Take(USDC_ADDR),
+                ]),
+            ],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+
+        expect(detail(result, "Token Out").value).toContain("USDC");
+        expect(detail(result, "Min. received")).toBeUndefined();
+    });
+
+    // V4 spells "swap the whole open delta" as an amountIn of zero
+    // (v4-periphery ActionConstants.OPEN_DELTA = 0, applied by V4Router's
+    // _swapExactInputSingle / _swapExactInput). It is not a quantity, and
+    // printing "0.0000 WETH" for it would state the exact inverse of what the
+    // step does. Against c9ebac8 the Amount line was omitted entirely.
+    test("a V4 open-delta amountIn is named, not printed as zero", () => {
+        const data = buildExecute(
+            "0x10",
+            [
+                encodeV4Swap(
+                    new Uint8Array([
+                        V4_SETTLE_ID,
+                        V4_SWAP_EXACT_IN_SINGLE_ID,
+                        V4_TAKE_ID,
+                    ]),
+                    [
+                        encodeV4Settle(WETH_ADDR),
+                        encodeV4ExactInSingle(
+                            WETH_ADDR,
+                            USDC_ADDR,
+                            0n, // ActionConstants.OPEN_DELTA
+                            990000n,
+                        ),
+                        encodeV4Take(USDC_ADDR),
+                    ],
+                ),
+            ],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+
+        expect(detail(result, "Token In").value).toContain("WETH");
+        expect(detail(result, "Amount").value).toBe(
+            "All available (V4 open delta)",
+        );
+        expect(detail(result, "Min. received").value).toBe("0.9900 USDC");
+    });
+
+    // Pins what https://git.eeqj.de/sneak/AutistMask/pulls/356 changed without
+    // testing: a non-swap execute() carrying only PERMIT2_PERMIT names no
+    // output currency, so it says so and titles itself "Uniswap Swap" rather
+    // than inventing "Token Out: ETH".
+    test("a PERMIT2_PERMIT-only execute() invents no output token", () => {
+        const data = buildExecute(
+            "0x0a",
+            [encodePermit2(USDT_ADDR, 5000000n, ROUTER_ADDR)],
+            9999999999n,
+        );
+
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(result).not.toBeNull();
+        expect(result.name).toBe("Uniswap Swap");
+
+        expect(detail(result, "Token In").value).toContain("USDT");
+        expect(detail(result, "Token Out").value).toBe(
+            "Unknown (not named in the calldata)",
+        );
+        expect(detail(result, "Token Out").address).toBeUndefined();
+        expect(detail(result, "Min. received")).toBeUndefined();
+    });
+
     test("handles unknown tokens gracefully", () => {
         const fakeToken = "0x1111111111111111111111111111111111111111";
         const data = buildExecute(