fix: a V4 swap action not in the deployed shape is shown as not decoded (closes #358)

The four V4 swap actions are read only as the parameter structs deployed
on mainnet and Sepolia. ethers decoded the newer v4-periphery structs,
which add minHopPriceX36, as the deployed ones without an error, and the
newer multi-hop exact-in struct showed the offset of its hop-price array
as the swap amount. A decode now counts only when encoding it again gives
back the same bytes. A swap action that fails that marks its step "V4
Swap (could not be decoded)", and a side of the swap that its SETTLE or
TAKE did not name reads "Unknown (could not be decoded)" instead of
another step's token and figure. The README records both.

Model: opus-5-5

.gitea/workflows/e2e.yml

@@ -35,10 +35,10 @@ on: [push]
 jobs:
     e2e-chrome:
         runs-on: ubuntu-latest
-        # Bounds the image build, a cold cache included, and the three Chrome
+        # Bounds the image build, a cold cache included, and both Chrome
         # programs, so a hung browser frees the shared runner. README.md
         # "In CI" has the measured times.
-        timeout-minutes: 40
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

README.md

@@ -542,29 +542,6 @@ one profile yields a single extension id, not two: Chrome does not load a second
 copy of an id it already has. The assertions are annotated as observations, so a
 Chrome that ever changes this fails the run instead of passing it.
 
-Last, `make test-e2e` runs `tests/e2e/slowApproval.js`, which leaves a
-transaction approval and a signature approval open for seven minutes with both
-windows minimized, then restores and approves both and requires the site to
-receive the hash of the transaction the stub node received and a signature that
-recovers to the address. Before the background worker kept itself running while
-an approval is pending, Chrome stopped it about six minutes in and neither
-request was ever answered
-([#540](https://git.eeqj.de/sneak/AutistMask/issues/540)). The windows are
-minimized through the DevTools protocol (`Browser.setWindowBounds`), and the run
-fails unless both pages then report themselves hidden: Chrome slows a hidden
-page's timers to once a minute, so anything the window did to keep the worker
-running would fail here. It is its own program and does not use Playwright:
-Playwright keeps DevTools attached to the background worker, and Chrome never
-stops a worker DevTools is attached to, so no wait in the suite above can show
-the worker stopping. It starts Chromium itself, speaks the DevTools protocol
-over `--remote-debugging-pipe`, and attaches to pages only. Before raising the
-approvals it requires the worker to stop on its own with nothing pending, so a
-run in which something else keeps the worker running fails. The site is
-connected and the RPC endpoint set through the extension's own screens, against
-the Firefox suite's loopback dApp page and stub node
-(`tests/e2e/firefox/dapp.js`). Unlike the suite above, it does not fail on page
-errors.
-
 ### Firefox (`make test-e2e-firefox`)
 
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
@@ -745,13 +722,11 @@ installing Firefox, geckodriver and their system libraries. Both scripts now
 build their image with `--no-cache`, so every run pays the cold figure. Those
 `e2e-chrome` runs predate the cases that wait in real time for a receipt to end
 in error. `make test-e2e` took 3m51s locally with its image cached, so with the
-image rebuilt every run, an `e2e-chrome` run comes to about seven minutes. The
-approvals left open for seven minutes (`tests/e2e/slowApproval.js`) add about
-eight more, so about fifteen.
+image rebuilt every run, an `e2e-chrome` run comes to about seven minutes.
 
 Each e2e job has a `timeout-minutes` cap, so a hung build or browser ends the
 job instead of holding the shared runner: `e2e-firefox` 15 minutes and
-`e2e-chrome` 40, each over two and a half times the job's slowest cold run. A
+`e2e-chrome` 20, each over two and a half times the job's slowest cold run. A
 job that reaches its cap has hung; read it as a hang, not as a slow run to
 retry. The `check` job has no cap: `.gitea/workflows/check.yml` is the canonical
 copy from `sneak/prompts`, kept byte-identical.
@@ -846,20 +821,6 @@ on the next event. Two consequences shape every recurring job in the background:
   service worker at all — the one remaining user of it, `src/shared/ens.js`,
   runs only in the popup and is marked as such.
 
-Pending approvals are the exception: an approval waiting for the user, and the
-site's request waiting on it, live only in the worker's memory, and only the
-worker that received the request can answer it. Left alone, Chrome stopped the
-worker about six minutes after a site's request even with the approval window
-still open, and the user's answer then reached nobody. So the worker keeps
-itself running while any approval is pending: raising an approval starts a
-`setInterval` that calls `runtime.getPlatformInfo()` every 20 seconds, and
-Chrome counts each extension call as activity. The timer stops itself once
-nothing is pending, and the worker then stops as it otherwise would. The timer
-is the worker's own, so it does not depend on the approval window being visible;
-a timer in the window would, because Chrome slows a hidden page's timers to once
-a minute. A worker that stops for another reason, a crash say, still loses the
-approvals open in it.
-
 The job also carries a freshness guard, and a guard must never be timed to the
 alarm period it gates. The guard is measured from the moment the last run
 finished, which is one run-duration after the alarm that started it, so a guard
@@ -1164,14 +1125,18 @@ read:
 
 The swap's `Token In` and `Token Out` lines name a currency, not an amount; each
 reads `Unknown (not named in the calldata)` when the decoder found no token for
-that side. An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side
-is WETH, on mainnet or Sepolia, or when no step set the output side; a WETH
-`Min. received` figure then reads in ETH. Otherwise `Token Out` and
-`Min. received` keep the output side's own token and figure, whether the swap
-was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
-unwraps the WETH it did not spend shows USDC. The token permission warning on
-the signature screen has its own amount wording, including `Unknown`; the
-SignApproval section below describes it.
+that side, or `Unknown (could not be decoded)` instead when a V4 swap action in
+the transaction could not be read (see Transaction Decoding below). A V4 step
+whose swap action could not be read still sets each side as a swap step does,
+and a side its `SETTLE` or `TAKE` did not name is then unknown: no other step's
+token or figure is shown for it. An `UNWRAP_WETH` step makes `Token Out` ETH
+only when the output side is WETH, on mainnet or Sepolia, or when no step set
+the output side; a WETH `Min. received` figure then reads in ETH. Otherwise
+`Token Out` and `Min. received` keep the output side's own token and figure,
+whether the swap was paid in ETH or in a token: a V2 exact-out swap that buys
+USDC and then unwraps the WETH it did not spend shows USDC. The token permission
+warning on the signature screen has its own amount wording, including `Unknown`;
+the SignApproval section below describes it.
 
 The swap's `Deadline` line is the router's deadline as a UTC date and time, e.g.
 `2026-02-27 08:25:51`. A JavaScript date reaches only to 275760-09-13 00:00:00
@@ -2786,7 +2751,11 @@ Currently supported:
   or recipient, and amount.
 - **Uniswap Universal Router**: `execute()` calls — shows swap direction (e.g.
   "Swap USDT → ETH"), token addresses, amounts, execution steps, and deadline.
-  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks.
+  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap
+  action is read only in the parameter shape deployed on mainnet and Sepolia,
+  not in the newer one on `v4-periphery` `main`, which adds a `minHopPriceX36`
+  field. An action in any other shape is not read, and its step is listed as
+  `V4 Swap (could not be decoded)`.
 
 ### Non-Goals Forever
 

script/test-e2e

@@ -97,18 +97,6 @@ main() {
         -e HOME=/tmp \
         "$(cat "$IIDFILE")" \
         node tests/e2e/storagePartition.js
-
-    # Approvals left open for seven minutes in minimized windows, past the
-    # point where Chrome stopped the background worker when nothing kept it
-    # running. Its own program, without Playwright: Playwright keeps DevTools
-    # attached to the worker, and Chrome never stops a worker DevTools is
-    # attached to. It reaches nothing but its own loopback server.
-    echo "Running the approvals left open for seven minutes..."
-    docker run --rm \
-        --ipc=host \
-        -e HOME=/tmp \
-        "$(cat "$IIDFILE")" \
-        node tests/e2e/slowApproval.js
 }
 
 main "$@"

src/background/index.js

@@ -44,7 +44,6 @@ const {
 
 const {
     actionApi,
-    getPlatformInfo,
     runtimeApi,
     tabsQuery,
     tabsSendMessage,
@@ -68,29 +67,6 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, resolve } }
 const pendingApprovals = {};
 
-// An approval, and the site's request waiting on it, exist only in this
-// worker's memory. Left alone, Chrome stopped the worker about six minutes
-// after the site's request while the user was still deciding, and the approval
-// was lost with it. Chrome counts an extension call as activity, so while any
-// approval is pending this worker makes one every 20 seconds, inside Chrome's
-// 30-second idle limit. Each function below that raises an approval starts the
-// timer, and it stops itself once nothing is pending. It is the worker's own
-// timer, so it runs whether or not the approval window is visible.
-let keepRunningTimer = null;
-
-function keepRunningWhileApprovalsPending() {
-    if (keepRunningTimer) return;
-    keepRunningTimer = setInterval(() => {
-        if (Object.keys(pendingApprovals).length === 0) {
-            clearInterval(keepRunningTimer);
-            keepRunningTimer = null;
-            return;
-        }
-        // Only the call matters; its answer is not used.
-        getPlatformInfo().catch(() => {});
-    }, 20000);
-}
-
 // One transaction approval at a time, wallet-wide.
 //
 // The transaction a site asks for is populated before its approval window
@@ -539,7 +515,6 @@ function requestApproval(origin) {
     return new Promise((resolve) => {
         const id = crypto.randomUUID();
         pendingApprovals[id] = { id, origin, resolve, type: "site" };
-        keepRunningWhileApprovalsPending();
 
         if (actionNs && typeof actionNs.openPopup === "function") {
             showInToolbarPopup(id);
@@ -591,7 +566,6 @@ function requestTxApproval(origin, approvedTx, approvedFrom, slot) {
             type: "tx",
         };
         if (slot) slot.approvalId = id;
-        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });
@@ -612,7 +586,6 @@ function requestSignApproval(origin, signParams, approvedFrom) {
             resolve,
             type: "sign",
         };
-        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });
@@ -633,7 +606,6 @@ function requestNetworkApproval(origin, currentNetworkId, requestedNetworkId) {
             resolve,
             type: "network",
         };
-        keepRunningWhileApprovalsPending();
 
         openApprovalWindow(id);
     });

src/shared/browserApi.js

@@ -145,14 +145,6 @@ function sendMessage(message) {
     return invoke(runtimeApi(), "sendMessage", message);
 }
 
-/**
- * @returns {Promise<Object>} the operating system and processor the browser
- *     runs on.
- */
-function getPlatformInfo() {
-    return invoke(runtimeApi(), "getPlatformInfo");
-}
-
 /**
  * Send a message nobody is expected to answer, and swallow the fact that
  * nobody did.
@@ -270,7 +262,6 @@ module.exports = {
     actionApi,
     alarmsApi,
     extensionApi,
-    getPlatformInfo,
     hasBrowserNamespace,
     notify,
     runtimeApi,

src/shared/uniswap.js

@@ -53,6 +53,11 @@ function formatAmount(raw, decimals) {
 // on a scale — not as a token name, and not as a quantity.
 const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
 
+// The same refusal when a V4 swap action could not be read (see
+// decodeExactly()). That action names both of its currencies, so saying the
+// calldata did not name one would be false.
+const UNDECODED_CURRENCY = "Unknown (could not be decoded)";
+
 // Explicit presence, never truthiness. Every gate in this file that guards a
 // decoded value goes through here: an address is never falsy once set, but an
 // amount of 0n is, and a gate that cannot tell a genuine zero from an absent
@@ -295,6 +300,24 @@ function v4ExactInAmount(raw) {
     return raw === 0n ? OPEN_DELTA : raw;
 }
 
+// The V4 swap actions are read only in the parameter structs V4Router has
+// deployed on mainnet and Sepolia. v4-periphery `main` has since added a
+// `minHopPriceX36` field to all four (`src/interfaces/IV4Router.sol`), and
+// reading a shape nobody has deployed would be guessing. ethers alone would
+// read the newer structs anyway: it takes whatever word sits where a
+// deployed field would be, ignores bytes left over, and holds back an error
+// in a field until that field is used. The newer multi-hop exact-in struct
+// then yields the offset of its hop-price array as `amountIn`. So a decode
+// counts only when encoding the result again gives back the same bytes;
+// otherwise this throws, and decodeV4Swap() marks the step as not decoded.
+function decodeExactly(types, data) {
+    const decoded = coder.decode(types, data);
+    if (coder.encode(types, decoded) !== data) {
+        throw new Error("Not in the deployed V4 parameter shape.");
+    }
+    return decoded;
+}
+
 // Decode V4_SWAP (command 0x10) input bytes.
 // The input is ABI-encoded as (bytes actions, bytes[] params).
 // We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
@@ -309,6 +332,10 @@ function decodeV4Swap(input) {
         let takeToken = null;
         let amountIn = null;
         let amountOutMin = null;
+        // Set when a swap action's parameters are not in the deployed shape
+        // (see decodeExactly()), so nothing was read from that action. SETTLE
+        // and TAKE may still name both currencies.
+        let swapUndecoded = false;
 
         for (let i = 0; i < actions.length; i++) {
             const actionId = actions[i];
@@ -337,7 +364,7 @@ function decodeV4Swap(input) {
                         //   tuple(address,uint24,int24,address,bytes)[] path,
                         //   uint128 amountIn, uint128 amountOutMin)
                         try {
-                            const s = coder.decode(
+                            const s = decodeExactly(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -355,13 +382,13 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            // Fall through — SETTLE/TAKE will provide tokens
+                            swapUndecoded = true;
                         }
                     } else {
                         // ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
                         //   bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
                         try {
-                            const s = coder.decode(
+                            const s = decodeExactly(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -384,7 +411,7 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            // Fall through
+                            swapUndecoded = true;
                         }
                     }
                 } else if (
@@ -393,7 +420,7 @@ function decodeV4Swap(input) {
                 ) {
                     if (actionId === V4_SWAP_EXACT_OUT) {
                         try {
-                            const s = coder.decode(
+                            const s = decodeExactly(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -405,11 +432,11 @@ function decodeV4Swap(input) {
                                 settleToken = path[path.length - 1][0];
                             }
                         } catch {
-                            // Fall through
+                            swapUndecoded = true;
                         }
                     } else {
                         try {
-                            const s = coder.decode(
+                            const s = decodeExactly(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -426,7 +453,7 @@ function decodeV4Swap(input) {
                                     ? poolKey[1]
                                     : poolKey[0];
                         } catch {
-                            // Fall through
+                            swapUndecoded = true;
                         }
                     }
                 }
@@ -440,6 +467,7 @@ function decodeV4Swap(input) {
             tokenOut: takeToken,
             amountIn,
             amountOutMin,
+            swapUndecoded,
         };
     } catch {
         return null;
@@ -465,6 +493,7 @@ function decode(data, toAddress, sources) {
         let minOutput = null;
         let hasUnwrapWeth = false;
         let hasV2ExactOut = false;
+        let swapUndecoded = false;
         const commandNames = [];
 
         // THE INVARIANT: an amount and the token it is counted in always come
@@ -567,7 +596,20 @@ function decode(data, toAddress, sources) {
 
                 if (cmdId === 0x10) {
                     const v4 = decodeV4Swap(inputs[i]);
-                    if (v4) {
+                    if (v4 && v4.swapUndecoded) {
+                        // The unread swap action named this step's currencies
+                        // and amounts, so the step is marked and still sets
+                        // both sides as a swap step does. A side its SETTLE or
+                        // TAKE did not name is set undetermined, not left to
+                        // an earlier or later step's token and figure.
+                        swapUndecoded = true;
+                        commandNames[i] += " (could not be decoded)";
+                        if (!inputEstablished) {
+                            setInput(v4.tokenIn, v4.amountIn);
+                        }
+                        outputToken = v4.tokenOut;
+                        minOutput = v4.amountOutMin;
+                    } else if (v4) {
                         setInputOnce(v4.tokenIn, v4.amountIn);
                         // Always update output: last swap step wins. A step
                         // that carries the Min. received figure but decoded no
@@ -591,16 +633,19 @@ function decode(data, toAddress, sources) {
             }
         }
 
-        // Resolve token info. A null token on either side means the calldata
-        // named no currency for it; tokenInfo() refuses rather than calling it
-        // ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
-        // when the output side is WETH, or when no step set the output side.
-        // Any other output keeps its own token and figure: a swap that buys
-        // USDC and then unwraps the WETH it did not spend receives USDC.
+        // Resolve token info. A null token on either side means no step named
+        // a currency for it, or a V4 step whose swap action went unread left
+        // it undetermined; tokenInfo() refuses rather than calling it ETH.
+        // UNWRAP_WETH turns WETH into ETH, so it makes the output ETH when the
+        // output side is WETH, or when no step set the output side. A step
+        // whose swap action went unread did set it, to undetermined. Any other
+        // output keeps its own token and figure: a swap that buys USDC and
+        // then unwraps the WETH it did not spend receives USDC.
         const outputIsWeth =
             present(outputToken) &&
             WETH_ADDRESSES.includes(outputToken.toLowerCase());
-        const outputUnset = !present(outputToken) && !present(minOutput);
+        const outputUnset =
+            !present(outputToken) && !present(minOutput) && !swapUndecoded;
         const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
             hasUnwrapWeth && (outputIsWeth || outputUnset)
@@ -640,7 +685,10 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default. Same
             // wording as the Token Out refusal below: the two sides of this
             // screen must not describe the same condition in two ways.
-            details.push({ label: "Token In", value: UNNAMED_CURRENCY });
+            details.push({
+                label: "Token In",
+                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
+            });
         }
 
         if (present(inputAmount)) {
@@ -703,7 +751,10 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default, and a
             // Min. received figure below it is never attached to a token the
             // calldata did not state.
-            details.push({ label: "Token Out", value: UNNAMED_CURRENCY });
+            details.push({
+                label: "Token Out",
+                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
+            });
         }
 
         if (present(minOutput)) {

tests/backgroundApproval.test.js

@@ -264,7 +264,6 @@ function loadBackground(options) {
                     connectListener = fn;
                 },
             },
-            getPlatformInfo: jest.fn((cb) => cb({ os: "linux" })),
             lastError: null,
         },
         windows: {
@@ -879,43 +878,6 @@ describe("one transaction approval at a time", () => {
     });
 });
 
-// Chrome stops an idle worker, and the approvals in it go with it
-// (https://git.eeqj.de/sneak/AutistMask/issues/540). tests/e2e/slowApproval.js
-// shows the worker kept running in Chrome; this shows the calls stop once the
-// approval is answered, so the worker can stop again.
-describe("the worker keeps running while an approval is pending", () => {
-    test("an extension call every 20 seconds until the approval is answered", async () => {
-        const startTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-        const stopTimer = jest
-            .spyOn(global, "clearInterval")
-            .mockImplementation(() => {});
-        try {
-            const bg = loadBackground();
-            const calls = global.chrome.runtime.getPlatformInfo;
-            bg.requestTx();
-            await settle();
-            expect(startTimer).toHaveBeenCalledTimes(1);
-            expect(startTimer.mock.calls[0][1]).toBe(20000);
-            const tick = startTimer.mock.calls[0][0];
-
-            tick();
-            expect(calls).toHaveBeenCalledTimes(1);
-
-            // The user closes the approval window, which rejects it.
-            bg.closeWindow(1);
-            await settle();
-            tick();
-            expect(calls).toHaveBeenCalledTimes(1);
-            expect(stopTimer).toHaveBeenCalledWith(1);
-        } finally {
-            startTimer.mockRestore();
-            stopTimer.mockRestore();
-        }
-    });
-});
-
 // A page that asks again before the user has answered its last connection or
 // signature request is refused, instead of opening one more window per call.
 describe("one connection and one signature approval per site at a time", () => {

tests/e2e/slowApproval.js

@@ -1,530 +0,0 @@
-// A transaction approval and a signature approval the user leaves open for
-// seven minutes, their windows minimized, are still answered, and the site
-// receives both results (https://git.eeqj.de/sneak/AutistMask/issues/540).
-//
-// Both approvals, and the site's requests waiting on them, live only in the
-// background worker's memory. With nothing else going on, Chrome stopped that
-// worker about six minutes after the site's request, while the window was
-// still open, and the user's answer then reached nobody. While an approval is
-// pending, the worker now makes an extension call every 20 seconds, which
-// keeps it running (keepRunningWhileApprovalsPending() in
-// src/background/index.js). The windows are minimized for the wait because
-// Chrome slows a hidden page's timers to once a minute after a few minutes,
-// so anything the window itself did to keep the worker running would fail
-// here.
-//
-// A separate program from run.js, and not driven by Playwright: Playwright
-// keeps DevTools attached to the background worker, and Chrome never stops a
-// worker DevTools is attached to, so in run.js the worker outlives any wait
-// and a wait there proves nothing. This program starts Chromium itself and
-// speaks the DevTools protocol over the pipe Chromium opens for it
-// (--remote-debugging-pipe), attaching to pages only, never to the worker.
-// Before the approvals are raised it watches the worker stop on its own, so a
-// run in which something else keeps the worker running cannot pass.
-//
-// The dApp page and the stub node are the Firefox suite's loopback ones
-// (tests/e2e/firefox/dapp.js). The site is connected and the node chosen
-// through the extension's own screens, so nothing is written to its storage
-// from outside.
-//
-// Run through script/test-e2e, which builds the extension and the pinned
-// container.
-//
-//   node tests/e2e/slowApproval.js
-
-"use strict";
-
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { spawn } = require("child_process");
-
-const { chromium } = require("playwright-core");
-const {
-    Transaction,
-    getAddress,
-    getBytes,
-    hexlify,
-    parseEther,
-    toQuantity,
-    toUtf8Bytes,
-    verifyMessage,
-} = require("ethers");
-
-const { PASSWORD } = require("./harness");
-const { STUB_COUNTERPARTY } = require("./network");
-const { startDappServer } = require("./firefox/dapp");
-
-const DIST_CHROME = path.resolve(__dirname, "..", "..", "dist", "chrome");
-
-// Chrome stopped the worker six minutes after the site's request when nothing
-// kept it running, so the approvals are left open for longer than that.
-const APPROVAL_WAIT_MS = 7 * 60 * 1000;
-
-// With nothing pending, Chrome stops the worker 30 seconds after its last
-// event; this is how long the program waits to see that.
-const IDLE_STOP_TIMEOUT_MS = 90000;
-
-const SIGN_HEX = hexlify(toUtf8Bytes("AutistMask e2e: a slow signature"));
-
-const checks = [];
-let failed = 0;
-
-function check(name, cond, detail) {
-    checks.push(name);
-    if (cond) {
-        console.log("ok " + checks.length + " - " + name);
-    } else {
-        failed += 1;
-        console.log("not ok " + checks.length + " - " + name);
-        if (detail) console.log("  " + detail);
-    }
-}
-
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// Poll `probe` until it returns something truthy, and return that.
-async function until(what, probe, timeout = 30000) {
-    const deadline = Date.now() + timeout;
-    for (;;) {
-        const value = await probe().catch(() => null);
-        if (value) return value;
-        if (Date.now() > deadline) {
-            throw new Error(
-                "gave up after " + timeout + "ms waiting for " + what,
-            );
-        }
-        await sleep(250);
-    }
-}
-
-// The DevTools protocol over Chromium's pipe: commands go to its fd 3, and
-// replies and events come back on its fd 4, each one JSON message ended by a
-// NUL byte. Events are not used and are dropped. Returns send(method, params,
-// sessionId), which resolves with the command's result.
-function devtools(browser) {
-    const waiting = new Map();
-    let nextId = 1;
-    let pending = "";
-    const replies = browser.stdio[4];
-    replies.setEncoding("utf8");
-    replies.on("data", (chunk) => {
-        pending += chunk;
-        let end;
-        while ((end = pending.indexOf("\0")) !== -1) {
-            const message = JSON.parse(pending.slice(0, end));
-            pending = pending.slice(end + 1);
-            const caller = waiting.get(message.id);
-            if (!caller) continue;
-            waiting.delete(message.id);
-            if (message.error) {
-                caller.reject(
-                    new Error(caller.method + ": " + message.error.message),
-                );
-            } else {
-                caller.resolve(message.result);
-            }
-        }
-    });
-    replies.on("close", () => {
-        for (const caller of waiting.values()) {
-            caller.reject(new Error("the browser exited"));
-        }
-        waiting.clear();
-    });
-    return (method, params = {}, sessionId) =>
-        new Promise((resolve, reject) => {
-            const id = nextId++;
-            waiting.set(id, { method, resolve, reject });
-            browser.stdio[3].write(
-                JSON.stringify({ id, method, params, sessionId }) + "\0",
-            );
-        });
-}
-
-// Attach to a page and return a function that evaluates an expression in it,
-// awaiting a promise it returns, and resolves with the value.
-async function attach(send, targetId) {
-    const { sessionId } = await send("Target.attachToTarget", {
-        targetId,
-        flatten: true,
-    });
-    return async (expression) => {
-        const r = await send(
-            "Runtime.evaluate",
-            { expression, awaitPromise: true, returnByValue: true },
-            sessionId,
-        );
-        if (r.exceptionDetails) {
-            throw new Error(
-                "evaluating " +
-                    expression.slice(0, 80) +
-                    " threw: " +
-                    JSON.stringify(r.exceptionDetails.exception || {}),
-            );
-        }
-        return r.result.value;
-    };
-}
-
-// Whether the page has loaded and shows the element with this id: the
-// `hidden` class showView() keeps on every other view is on neither it nor
-// anything around it.
-function shows(id) {
-    return (
-        "document.readyState === 'complete' &&" +
-        " !!document.getElementById(" +
-        JSON.stringify(id) +
-        ") && !document.getElementById(" +
-        JSON.stringify(id) +
-        ").closest('.hidden')"
-    );
-}
-
-// Set an input's value and fire the input event typing would fire.
-function typeInto(id, value) {
-    return (
-        "(() => { const el = document.getElementById(" +
-        JSON.stringify(id) +
-        "); el.value = " +
-        JSON.stringify(value) +
-        "; el.dispatchEvent(new Event('input', { bubbles: true })); })()"
-    );
-}
-
-function click(id) {
-    return "document.getElementById(" + JSON.stringify(id) + ").click()";
-}
-
-// The outcome of a request the dApp page started with __dapp.start(), or
-// {settled: "pending"} if it has not settled within `timeout`.
-function settled(key, timeout = 30000) {
-    return (
-        "Promise.race([window.__dapp.settle(" +
-        JSON.stringify(key) +
-        "), new Promise((r) => setTimeout(() => r({ settled: 'pending' }), " +
-        timeout +
-        "))])"
-    );
-}
-
-async function main() {
-    if (!fs.existsSync(path.join(DIST_CHROME, "manifest.json"))) {
-        console.error(
-            "slowApproval: no unpacked build at " +
-                DIST_CHROME +
-                " — run make build first",
-        );
-        process.exitCode = 1;
-        return;
-    }
-
-    const node = await startDappServer();
-    const profile = fs.mkdtempSync(
-        path.join(os.tmpdir(), "autistmask-slow-approval-"),
-    );
-    const browser = spawn(
-        chromium.executablePath(),
-        [
-            "--headless",
-            // The container runs unprivileged, as in harness.js.
-            "--no-sandbox",
-            "--remote-debugging-pipe",
-            "--user-data-dir=" + profile,
-            "--disable-extensions-except=" + DIST_CHROME,
-            "--load-extension=" + DIST_CHROME,
-            // Nothing but the loopback dApp page and stub node can be reached.
-            "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1",
-            "about:blank",
-        ],
-        { stdio: ["ignore", "ignore", "ignore", "pipe", "pipe"] },
-    );
-
-    try {
-        const send = devtools(browser);
-        const targets = async () =>
-            (await send("Target.getTargets")).targetInfos;
-
-        const worker = await until("the background worker", async () =>
-            (await targets()).find(
-                (t) =>
-                    t.type === "service_worker" &&
-                    t.url.startsWith("chrome-extension://"),
-            ),
-        );
-        // The extension id is the host of the worker's URL, as in harness.js.
-        const popupUrl =
-            "chrome-extension://" +
-            new URL(worker.url).host +
-            "/src/popup/index.html";
-        const workerRunning = async () =>
-            (await targets()).some((t) => t.url === worker.url);
-        const openPage = async (url) => {
-            const { targetId } = await send("Target.createTarget", { url });
-            return { targetId, evaluate: await attach(send, targetId) };
-        };
-        const approvalPages = async () =>
-            (await targets()).filter(
-                (t) => t.type === "page" && t.url.includes("?approval="),
-            );
-
-        // A wallet, through the popup's own screens, and the stub node as its
-        // RPC endpoint, through Settings.
-        const popup = await openPage(popupUrl);
-        await until("the welcome screen", () =>
-            popup.evaluate(shows("view-welcome")),
-        );
-        await popup.evaluate(click("btn-welcome-add"));
-        await until("the add wallet screen", () =>
-            popup.evaluate(shows("view-add-wallet")),
-        );
-        await popup.evaluate(click("btn-generate-phrase"));
-        await until("a generated recovery phrase", () =>
-            popup.evaluate(
-                "document.getElementById('wallet-mnemonic').value.trim()" +
-                    ".split(/\\s+/).length >= 12",
-            ),
-        );
-        await popup.evaluate(typeInto("add-wallet-password", PASSWORD));
-        await popup.evaluate(typeInto("add-wallet-password-confirm", PASSWORD));
-        await popup.evaluate(click("btn-add-wallet-confirm"));
-        await until(
-            "the main screen",
-            () => popup.evaluate(shows("view-main")),
-            60000,
-        );
-        await popup.evaluate(click("btn-settings"));
-        await until("the settings screen", () =>
-            popup.evaluate(shows("view-settings")),
-        );
-        await popup.evaluate(typeInto("settings-rpc", node.rpcUrl));
-        await popup.evaluate(click("btn-save-rpc"));
-        await until("the stub node saved as the RPC endpoint", () =>
-            popup.evaluate(
-                "new Promise((resolve) => chrome.storage.local.get(" +
-                    "'autistmask', (r) => resolve(r.autistmask.rpcUrl === " +
-                    JSON.stringify(node.rpcUrl) +
-                    ")))",
-            ),
-        );
-        await send("Target.closeTarget", { targetId: popup.targetId });
-
-        // The site, connected through the real prompt with "Remember", so
-        // the connection is stored rather than held by the worker.
-        const dapp = await openPage(node.url);
-        await until("the injected provider", () =>
-            dapp.evaluate("!!window.ethereum && !!window.__dapp"),
-        );
-        await dapp.evaluate(
-            "window.__dapp.start('accounts', 'eth_requestAccounts', [])",
-        );
-        const prompt = await until(
-            "the connection prompt",
-            async () => (await approvalPages())[0],
-        );
-        const inPrompt = await attach(send, prompt.targetId);
-        await until("the connection prompt's screen", () =>
-            inPrompt(shows("view-approve-site")),
-        );
-        await inPrompt(
-            "document.getElementById('approve-remember').checked = true",
-        );
-        // The prompt closes itself on the click.
-        await inPrompt(click("btn-approve")).catch(() => {});
-        const accounts = await dapp.evaluate(settled("accounts"));
-        if (accounts.settled !== "resolved") {
-            throw new Error(
-                "the site could not be connected: " + JSON.stringify(accounts),
-            );
-        }
-        const address = getAddress(accounts.result[0]);
-        console.log("# address " + address + ", site " + node.origin);
-
-        // The control: with nothing pending, the worker stops on its own.
-        // Were something else keeping it running, the wait below would
-        // prove nothing.
-        const idleStart = Date.now();
-        const stoppedWhenIdle = await until(
-            "the idle worker to stop",
-            async () => !(await workerRunning()),
-            IDLE_STOP_TIMEOUT_MS,
-        ).catch(() => false);
-        check(
-            "with nothing pending, Chrome stops the background worker on its own",
-            stoppedWhenIdle,
-            "the worker was still running " +
-                IDLE_STOP_TIMEOUT_MS / 1000 +
-                "s after its last event, so something other than the " +
-                "approval windows is keeping it running",
-        );
-        console.log(
-            "# idle worker stopped after " +
-                Math.round((Date.now() - idleStart) / 1000) +
-                "s",
-        );
-
-        // A transaction approval and a signature approval, both open at once.
-        await dapp.evaluate(
-            "window.__dapp.start('tx', 'eth_sendTransaction', [" +
-                JSON.stringify({
-                    from: address,
-                    to: STUB_COUNTERPARTY,
-                    value: toQuantity(parseEther("0.01")),
-                }) +
-                "])",
-        );
-        await until("the transaction approval window", async () =>
-            (await approvalPages()).length === 1 ? true : null,
-        );
-        await dapp.evaluate(
-            "window.__dapp.start('sign', 'personal_sign', [" +
-                JSON.stringify(SIGN_HEX) +
-                ", " +
-                JSON.stringify(address) +
-                "])",
-        );
-        const windows = await until("both approval windows", async () => {
-            const pages = await approvalPages();
-            return pages.length === 2 ? pages : null;
-        });
-        let txWindow = null;
-        let signWindow = null;
-        const windowIds = [];
-        for (const page of windows) {
-            const evaluate = await attach(send, page.targetId);
-            const view = await until("an approval screen", () =>
-                evaluate(
-                    "(" +
-                        shows("view-approve-tx") +
-                        ") ? 'tx' : (" +
-                        shows("view-approve-sign") +
-                        ") ? 'sign' : null",
-                ),
-            );
-            if (view === "tx") txWindow = evaluate;
-            if (view === "sign") signWindow = evaluate;
-            const { windowId } = await send("Browser.getWindowForTarget", {
-                targetId: page.targetId,
-            });
-            windowIds.push(windowId);
-        }
-        if (!txWindow || !signWindow) {
-            throw new Error("the two windows are not one of each kind");
-        }
-        const setWindowState = (windowState) =>
-            Promise.all(
-                windowIds.map((windowId) =>
-                    send("Browser.setWindowBounds", {
-                        windowId,
-                        bounds: { windowState },
-                    }),
-                ),
-            );
-
-        // The user minimizes both windows while deciding.
-        await setWindowState("minimized");
-        const bothHidden = await until(
-            "both approval pages hidden",
-            async () =>
-                (await txWindow("document.visibilityState")) === "hidden" &&
-                (await signWindow("document.visibilityState")) === "hidden",
-        ).catch(() => false);
-        check(
-            "both approval windows are minimized, and their pages are hidden",
-            bothHidden,
-            "a page still reports itself visible, so the wait below would " +
-                "not show what happens to a minimized approval",
-        );
-
-        // The user takes seven minutes. The worker is checked every two
-        // seconds, and the wait ends early if Chrome stops it.
-        const opened = Date.now();
-        let stoppedAfter = null;
-        while (Date.now() - opened < APPROVAL_WAIT_MS) {
-            if (!(await workerRunning())) {
-                stoppedAfter = Math.round((Date.now() - opened) / 1000);
-                break;
-            }
-            await sleep(2000);
-        }
-        check(
-            "the background worker keeps running while both approvals wait in minimized windows",
-            stoppedAfter === null,
-            "Chrome stopped the worker " +
-                stoppedAfter +
-                "s after the approvals opened",
-        );
-
-        // Back on screen to be answered.
-        await setWindowState("normal");
-        await txWindow(typeInto("approve-tx-password", PASSWORD));
-        await txWindow(click("btn-approve-tx"));
-        await signWindow(typeInto("approve-sign-password", PASSWORD));
-        // The window closes itself once the signature is handed over.
-        await signWindow(click("btn-approve-sign")).catch(() => {});
-
-        const tx = await dapp.evaluate(settled("tx"));
-        const broadcast = node.broadcast.map((raw) => Transaction.from(raw));
-        check(
-            "the transaction approved after seven minutes reaches the site",
-            tx.settled === "resolved" &&
-                broadcast.length === 1 &&
-                tx.result === broadcast[0].hash &&
-                getAddress(broadcast[0].from) === address,
-            "the page got " +
-                JSON.stringify(tx) +
-                " and the node received " +
-                broadcast.length +
-                " transaction(s)",
-        );
-
-        const sign = await dapp.evaluate(settled("sign"));
-        check(
-            "the signature approved after seven minutes reaches the site",
-            sign.settled === "resolved" &&
-                getAddress(verifyMessage(getBytes(SIGN_HEX), sign.result)) ===
-                    address,
-            "the page got " + JSON.stringify(sign),
-        );
-    } catch (e) {
-        failed += 1;
-        console.log("# ERROR: " + (e && e.stack ? e.stack : e));
-    } finally {
-        if (browser.exitCode === null && browser.signalCode === null) {
-            const exited = new Promise((resolve) =>
-                browser.once("exit", resolve),
-            );
-            browser.kill();
-            await exited;
-        }
-        await node.close();
-        // Chromium's helper processes can still be writing to the profile
-        // for a moment after the browser process itself has exited.
-        fs.rmSync(profile, { recursive: true, force: true, maxRetries: 5 });
-    }
-
-    console.log("1.." + checks.length);
-    if (checks.length === 0) {
-        console.log("# FAILED: this program asserted nothing");
-        process.exitCode = 1;
-        return;
-    }
-    console.log(
-        "# " +
-            (checks.length - failed) +
-            "/" +
-            checks.length +
-            " checks passed",
-    );
-    if (failed > 0) {
-        console.log("# FAILED");
-        process.exitCode = 1;
-    }
-}
-
-main().catch((e) => {
-    console.error("slowApproval: " + (e && e.stack ? e.stack : e));
-    process.exitCode = 1;
-});

tests/uniswap.test.js

@@ -163,6 +163,122 @@ function encodeV4ExactInSingle(currency0, currency1, amountIn, amountOutMin) {
     );
 }
 
+// Each V4 swap action's parameters in two shapes: the struct V4Router has
+// deployed on mainnet and Sepolia, and the one v4-periphery `main` has since
+// moved to, which adds a `minHopPriceX36` field. Each swaps WETH for USDC.
+const POOL_KEY = "tuple(address,address,uint24,int24,address)";
+const PATH_KEY = "tuple(address,uint24,int24,address,bytes)";
+const WETH_USDC_POOL = [WETH_ADDR, USDC_ADDR, 100, 1, ZERO_ADDR];
+const ONE_WETH = 1000000000000000000n;
+const V4_SWAP_ACTION_SHAPES = [
+    {
+        action: "SWAP_EXACT_IN_SINGLE",
+        id: 0x06,
+        deployed: coder.encode(
+            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
+            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, "0x"]],
+        ),
+        newer: coder.encode(
+            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
+            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, 0n, "0x"]],
+        ),
+    },
+    {
+        action: "SWAP_EXACT_IN",
+        id: 0x07,
+        deployed: coder.encode(
+            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
+            [
+                [
+                    WETH_ADDR,
+                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
+                    ONE_WETH,
+                    990000n,
+                ],
+            ],
+        ),
+        newer: coder.encode(
+            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
+            [
+                [
+                    WETH_ADDR,
+                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
+                    [],
+                    ONE_WETH,
+                    990000n,
+                ],
+            ],
+        ),
+    },
+    {
+        action: "SWAP_EXACT_OUT_SINGLE",
+        id: 0x08,
+        deployed: coder.encode(
+            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
+            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, "0x"]],
+        ),
+        newer: coder.encode(
+            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
+            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, 0n, "0x"]],
+        ),
+    },
+    {
+        action: "SWAP_EXACT_OUT",
+        id: 0x09,
+        deployed: coder.encode(
+            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
+            [
+                [
+                    USDC_ADDR,
+                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
+                    990000n,
+                    ONE_WETH,
+                ],
+            ],
+        ),
+        newer: coder.encode(
+            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
+            [
+                [
+                    USDC_ADDR,
+                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
+                    [],
+                    990000n,
+                    ONE_WETH,
+                ],
+            ],
+        ),
+    },
+];
+
+// Helper: execute() with one V4_SWAP step holding the swap action, then
+// SETTLE of WETH and TAKE of USDC.
+function v4SwapCalldata(actionId, swapParams) {
+    return buildExecute(
+        "0x10",
+        [
+            encodeV4Swap(new Uint8Array([actionId, V4_SETTLE_ID, V4_TAKE_ID]), [
+                swapParams,
+                encodeV4Settle(WETH_ADDR),
+                encodeV4Take(USDC_ADDR),
+            ]),
+        ],
+        9999999999n,
+    );
+}
+
+// V4 SETTLE_ALL (currency, maxAmount) and TAKE_ALL (currency, minAmount). The
+// decoder reads neither, so in a V4_SWAP of a swap action and these, only the
+// swap action names the currencies.
+const V4_SETTLE_ALL_ID = 0x0c;
+const V4_TAKE_ALL_ID = 0x0f;
+function encodeV4SettleAll(currency, maxAmount) {
+    return coder.encode(["address", "uint256"], [currency, maxAmount]);
+}
+function encodeV4TakeAll(currency, minAmount) {
+    return coder.encode(["address", "uint256"], [currency, minAmount]);
+}
+
 function detail(result, label) {
     return result.details.find((d) => d.label === label);
 }
@@ -203,9 +319,157 @@ describe("uniswap decoder", () => {
             result.details.find((d) => d.label === "Min. received").value,
         ).toBe("0.0002 ETH");
 
+        // Real mainnet calldata is in the deployed shape, so its V4 step is
+        // not said to be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
-        expect(steps.value).toContain("Permit2 Permit");
-        expect(steps.value).toContain("V4 Swap");
+        expect(steps.value).toBe("Permit2 Permit → V4 Swap");
+    });
+
+    test.each(V4_SWAP_ACTION_SHAPES)(
+        "a V4 $action in the deployed shape is read",
+        ({ id, deployed }) => {
+            const result = uniswap.decode(
+                v4SwapCalldata(id, deployed),
+                ROUTER_ADDR,
+            );
+            expect(detail(result, "Steps").value).toBe("V4 Swap");
+        },
+    );
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/358 — before it, all four
+    // newer structs decoded as the deployed ones without an error, and the
+    // newer SWAP_EXACT_IN showed the offset of its hop-price array as Amount
+    // ("0.0000000000000004 WETH") and its amountIn as Min. received.
+    test.each(V4_SWAP_ACTION_SHAPES)(
+        "a V4 $action in the newer periphery shape is shown as not decoded",
+        ({ id, newer }) => {
+            const result = uniswap.decode(
+                v4SwapCalldata(id, newer),
+                ROUTER_ADDR,
+            );
+            expect(detail(result, "Amount")).toBeUndefined();
+            expect(detail(result, "Min. received")).toBeUndefined();
+            expect(detail(result, "Steps").value).toBe(
+                "V4 Swap (could not be decoded)",
+            );
+            // SETTLE and TAKE keep their own shape and still name both sides.
+            expect(detail(result, "Token In").address).toBe(WETH_ADDR);
+            expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
+        },
+    );
+
+    // Only the unread swap action names the currencies here. The token lines
+    // must not say the calldata did not name them.
+    test.each(V4_SWAP_ACTION_SHAPES)(
+        "a V4 $action in the newer shape, then SETTLE_ALL and TAKE_ALL, says both tokens could not be decoded",
+        ({ id, newer }) => {
+            const data = buildExecute(
+                "0x10",
+                [
+                    encodeV4Swap(
+                        new Uint8Array([id, V4_SETTLE_ALL_ID, V4_TAKE_ALL_ID]),
+                        [
+                            newer,
+                            encodeV4SettleAll(WETH_ADDR, ONE_WETH),
+                            encodeV4TakeAll(USDC_ADDR, 990000n),
+                        ],
+                    ),
+                ],
+                9999999999n,
+            );
+            const result = uniswap.decode(data, ROUTER_ADDR);
+            expect(detail(result, "Steps").value).toBe(
+                "V4 Swap (could not be decoded)",
+            );
+            expect(detail(result, "Token In").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Token Out").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+        },
+    );
+
+    // The user receives the V4 step's USDC, which only its unread swap
+    // action names. The V3 step's WETH and its Min. received figure were
+    // shown instead.
+    test.each(V4_SWAP_ACTION_SHAPES)(
+        "a V3 step, then a V4 $action in the newer shape and TAKE_ALL, does not show the V3 step's output",
+        ({ id, newer }) => {
+            const data = buildExecute(
+                solidityPacked(["uint8", "uint8"], [0x00, 0x10]),
+                [
+                    encodeV3SwapExactIn(USER_ADDR, 2000000n, ONE_WETH, [
+                        USDT_ADDR,
+                        WETH_ADDR,
+                    ]),
+                    encodeV4Swap(new Uint8Array([id, V4_TAKE_ALL_ID]), [
+                        newer,
+                        encodeV4TakeAll(USDC_ADDR, 990000n),
+                    ]),
+                ],
+                9999999999n,
+            );
+            const result = uniswap.decode(data, ROUTER_ADDR);
+            expect(result.name).toBe("Uniswap Swap");
+            expect(detail(result, "Amount").value).toBe("2.0000 USDT");
+            expect(detail(result, "Token Out").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
+    // The user pays the V4 step's WETH, which only its unread swap action
+    // names. The V3 step's USDC and its amount were shown instead.
+    test.each(V4_SWAP_ACTION_SHAPES)(
+        "a V4 $action in the newer shape and SETTLE_ALL, then a V3 step, does not show the V3 step's input",
+        ({ id, newer }) => {
+            const data = buildExecute(
+                solidityPacked(["uint8", "uint8"], [0x10, 0x00]),
+                [
+                    encodeV4Swap(new Uint8Array([id, V4_SETTLE_ALL_ID]), [
+                        newer,
+                        encodeV4SettleAll(WETH_ADDR, ONE_WETH),
+                    ]),
+                    encodeV3SwapExactIn(
+                        USER_ADDR,
+                        990000n,
+                        980000000000000000n,
+                        [USDC_ADDR, DAI_ADDR],
+                    ),
+                ],
+                9999999999n,
+            );
+            const result = uniswap.decode(data, ROUTER_ADDR);
+            expect(result.name).toBe("Uniswap Swap");
+            expect(detail(result, "Token In").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Amount")).toBeUndefined();
+            expect(detail(result, "Min. received").value).toBe("0.9800 DAI");
+        },
+    );
+
+    // UNWRAP_WETH makes Token Out ETH when no step set the output side. An
+    // unread swap action's step did set it, to undetermined.
+    test("an UNWRAP_WETH after an unread V4 swap action does not make Token Out ETH", () => {
+        const { id, newer } = V4_SWAP_ACTION_SHAPES[0];
+        const data = buildExecute(
+            solidityPacked(["uint8", "uint8"], [0x10, 0x0c]),
+            [
+                encodeV4Swap(new Uint8Array([id, V4_TAKE_ALL_ID]), [
+                    newer,
+                    encodeV4TakeAll(USDC_ADDR, 990000n),
+                ]),
+                encodeWrapEth(USER_ADDR, 0n), // UNWRAP_WETH, same encoding
+            ],
+            9999999999n,
+        );
+        const result = uniswap.decode(data, ROUTER_ADDR);
+        expect(detail(result, "Token Out").value).toBe(
+            "Unknown (could not be decoded)",
+        );
     });
 
     test("decodes V2_SWAP_EXACT_IN with known tokens", () => {
@@ -548,9 +812,11 @@ describe("uniswap decoder", () => {
         const result = uniswap.decode(data, ROUTER_ADDR);
         expect(result).not.toBeNull();
 
+        // The V4 swap action's parameters are empty, so that step is said to
+        // be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
         expect(steps.value).toBe(
-            "Permit2 Permit \u2192 V4 Swap \u2192 Unwrap WETH",
+            "Permit2 Permit \u2192 V4 Swap (could not be decoded) \u2192 Unwrap WETH",
         );
     });
 

tests/uniswapUndeterminedTokenIn.test.js

@@ -97,7 +97,11 @@ describe("an execute() whose input currency never decoded", () => {
         ]);
 
     test("says the input token is unknown instead of naming ETH", () => {
-        expect(detail(data(), "Token In").value).toBe(REFUSAL);
+        // The swap action that would name it could not be read, so the line
+        // says that rather than REFUSAL's "not named in the calldata".
+        expect(detail(data(), "Token In").value).toBe(
+            "Unknown (could not be decoded)",
+        );
     });
 
     test("keeps a Token In line, so the screen never omits what is paid", () => {