The transaction detail screen decodes a token transfer against its recipient, naming the recipient as the token #515

Open
opened 2026-10-14 04:39:17 +02:00 by clawbot · 0 comments
Collaborator

Where

TransactionDetail, opened from an ERC-20 transfer row. src/popup/views/transactionDetail.js line 186 calls loadFullTxDetails(tx.hash, tx.to, tx.chainId), and line 316 decodes the calldata against that address. For a token transfer row, tx.to is the transfer's recipient (parseTokenTransfer() in src/shared/transactions.js), not the contract the transaction was sent to, which is tx.contractAddress.

What happens

On next (8e52528), release build, Chrome, local chain with chain id 11155111: send 1234.5 of a tracked 6-decimal token, open the transfer from the token's history. The top of the screen is right (Amount 1234.5 TDOL, Token contract 0x74de…1b37), but the decoded Action well below it reads:

  • Token: 0x711e691962E5c054b78071C789A0C8CE657377aD, which is the recipient
  • Recipient: the same address
  • Amount: 1234500000 base units (decimals unknown)

So the screen names the recipient as the token, and calls the token's scale unknown although the wallet tracks it.

What should happen

README calls this screen "the authoritative record of a specific transaction". Its decoded details should name the token contract the transaction called, and state the amount at the token's known scale, as the approval screen does for the same calldata.

Severity: major

Definition of done

  • The decoded details of a token transfer opened from any history list are decoded against the contract the transaction was sent to.
  • A test opens an ERC-20 transfer row and checks the decoded Token line and amount.

Model: opus-5-5

## Where TransactionDetail, opened from an ERC-20 transfer row. `src/popup/views/transactionDetail.js` line 186 calls `loadFullTxDetails(tx.hash, tx.to, tx.chainId)`, and line 316 decodes the calldata against that address. For a token transfer row, `tx.to` is the transfer's recipient (`parseTokenTransfer()` in `src/shared/transactions.js`), not the contract the transaction was sent to, which is `tx.contractAddress`. ## What happens On `next` (8e52528), release build, Chrome, local chain with chain id 11155111: send 1234.5 of a tracked 6-decimal token, open the transfer from the token's history. The top of the screen is right (Amount `1234.5 TDOL`, Token contract `0x74de…1b37`), but the decoded Action well below it reads: - Token: `0x711e691962E5c054b78071C789A0C8CE657377aD`, which is the recipient - Recipient: the same address - Amount: `1234500000 base units (decimals unknown)` So the screen names the recipient as the token, and calls the token's scale unknown although the wallet tracks it. ## What should happen README calls this screen "the authoritative record of a specific transaction". Its decoded details should name the token contract the transaction called, and state the amount at the token's known scale, as the approval screen does for the same calldata. Severity: major ## Definition of done - [ ] The decoded details of a token transfer opened from any history list are decoded against the contract the transaction was sent to. - [ ] A test opens an ERC-20 transfer row and checks the decoded Token line and amount. Model: opus-5-5
clawbot self-assigned this 2026-10-14 04:39:17 +02:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#515