TxApproval, and the decoded details on TransactionDetail. decodeCalldata() in src/popup/views/approval.js (line 184) hands any calldata to uniswap.decode() in src/shared/uniswap.js (line 452), which recognises the call by the execute(bytes,bytes[],uint256) selector alone and never looks at the address it is sent to. The result always says "Swap via Uniswap Universal Router" and puts the destination address under "Protocol" (lines 619-623 and 740).
What happens
On next (8e52528), release build, Chrome, Sepolia chain id: a connected site sends eth_sendTransaction with Universal Router execute() calldata (wrap 0.01 ETH, V3 swap into a token) to 0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A, an ordinary address with no code. The approval screen's Action well reads "Swap ETH → TDOL", "Swap via Uniswap Universal Router", with Protocol 0x0b00…D79A, Token In, Amount, Min. received and Deadline, exactly as for the real router. Any contract can be made to look like a Uniswap swap this way, whatever it does with the value sent to it.
What should happen
README, Transaction Decoding: decoding is a display convenience for calls to common contracts, and the decoder covers "Uniswap Universal Router: execute() calls". A call to an address that is not a Universal Router deployment should not be described as a swap through it.
Severity: major
Definition of done
The swap summary is shown only for a transaction sent to a Universal Router address known for the active network; other execute() calldata is shown as raw data.
Tests cover the same calldata sent to the router and to another address.
Model: opus-5-5
## Where
TxApproval, and the decoded details on TransactionDetail. `decodeCalldata()` in `src/popup/views/approval.js` (line 184) hands any calldata to `uniswap.decode()` in `src/shared/uniswap.js` (line 452), which recognises the call by the `execute(bytes,bytes[],uint256)` selector alone and never looks at the address it is sent to. The result always says "Swap via Uniswap Universal Router" and puts the destination address under "Protocol" (lines 619-623 and 740).
## What happens
On `next` (8e52528), release build, Chrome, Sepolia chain id: a connected site sends `eth_sendTransaction` with Universal Router `execute()` calldata (wrap 0.01 ETH, V3 swap into a token) to `0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A`, an ordinary address with no code. The approval screen's Action well reads "Swap ETH → TDOL", "Swap via Uniswap Universal Router", with Protocol `0x0b00…D79A`, Token In, Amount, Min. received and Deadline, exactly as for the real router. Any contract can be made to look like a Uniswap swap this way, whatever it does with the value sent to it.
## What should happen
README, Transaction Decoding: decoding is a display convenience for calls to common contracts, and the decoder covers "Uniswap Universal Router: `execute()` calls". A call to an address that is not a Universal Router deployment should not be described as a swap through it.
Severity: major
## Definition of done
- [ ] The swap summary is shown only for a transaction sent to a Universal Router address known for the active network; other `execute()` calldata is shown as raw data.
- [ ] Tests cover the same calldata sent to the router and to another address.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 04:46:08 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where
TxApproval, and the decoded details on TransactionDetail.
decodeCalldata()insrc/popup/views/approval.js(line 184) hands any calldata touniswap.decode()insrc/shared/uniswap.js(line 452), which recognises the call by theexecute(bytes,bytes[],uint256)selector alone and never looks at the address it is sent to. The result always says "Swap via Uniswap Universal Router" and puts the destination address under "Protocol" (lines 619-623 and 740).What happens
On
next(8e52528), release build, Chrome, Sepolia chain id: a connected site sendseth_sendTransactionwith Universal Routerexecute()calldata (wrap 0.01 ETH, V3 swap into a token) to0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A, an ordinary address with no code. The approval screen's Action well reads "Swap ETH → TDOL", "Swap via Uniswap Universal Router", with Protocol0x0b00…D79A, Token In, Amount, Min. received and Deadline, exactly as for the real router. Any contract can be made to look like a Uniswap swap this way, whatever it does with the value sent to it.What should happen
README, Transaction Decoding: decoding is a display convenience for calls to common contracts, and the decoder covers "Uniswap Universal Router:
execute()calls". A call to an address that is not a Universal Router deployment should not be described as a swap through it.Severity: major
Definition of done
execute()calldata is shown as raw data.Model: opus-5-5