Send, "Review". src/popup/views/send.js (line 370) accepts any amount for which parseFloat() gives a positive number. ConfirmTx checks the same text again through validateTransfer() (src/popup/views/confirmTx.js, lines 274-289) and refuses more of it.
What happens
On next (8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter 1e-3 and press Review. The wallet moves to ConfirmTx, which shows Amount 1e-3 SepoliaETH with the error "Please enter a valid amount to send." and Sign & Send disabled. 0.0000000000000000001 (19 decimal places) does the same. parseFloat() also reads only the start of the text, so an entry such as 1abc passes Send's check.
What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
Definition of done
Send and ConfirmTx apply one amount rule; 1e-3, 1abc and an amount with more decimal places than the token has are refused on Send with a flash message.
Tests cover those entries.
Model: opus-5-5
## Where
Send, "Review". `src/popup/views/send.js` (line 370) accepts any amount for which `parseFloat()` gives a positive number. ConfirmTx checks the same text again through `validateTransfer()` (`src/popup/views/confirmTx.js`, lines 274-289) and refuses more of it.
## What happens
On `next` (8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter `1e-3` and press Review. The wallet moves to ConfirmTx, which shows `Amount 1e-3 SepoliaETH` with the error "Please enter a valid amount to send." and Sign & Send disabled. `0.0000000000000000001` (19 decimal places) does the same. `parseFloat()` also reads only the start of the text, so an entry such as `1abc` passes Send's check.
## What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
## Definition of done
- [ ] Send and ConfirmTx apply one amount rule; `1e-3`, `1abc` and an amount with more decimal places than the token has are refused on Send with a flash message.
- [ ] Tests cover those entries.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 05:00:02 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where
Send, "Review".
src/popup/views/send.js(line 370) accepts any amount for whichparseFloat()gives a positive number. ConfirmTx checks the same text again throughvalidateTransfer()(src/popup/views/confirmTx.js, lines 274-289) and refuses more of it.What happens
On
next(8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter1e-3and press Review. The wallet moves to ConfirmTx, which showsAmount 1e-3 SepoliaETHwith the error "Please enter a valid amount to send." and Sign & Send disabled.0.0000000000000000001(19 decimal places) does the same.parseFloat()also reads only the start of the text, so an entry such as1abcpasses Send's check.What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
Definition of done
1e-3,1abcand an amount with more decimal places than the token has are refused on Send with a flash message.Model: opus-5-5