Send, "Review". src/popup/views/send.js (line 370) accepts any amount for which parseFloat() gives a positive number. ConfirmTx checks the same text again through validateTransfer() (src/popup/views/confirmTx.js, lines 274-289) and refuses more of it.
What happens
On next (8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter 1e-3 and press Review. The wallet moves to ConfirmTx, which shows Amount 1e-3 SepoliaETH with the error "Please enter a valid amount to send." and Sign & Send disabled. 0.0000000000000000001 (19 decimal places) does the same. parseFloat() also reads only the start of the text, so an entry such as 1abc passes Send's check.
What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
Definition of done
Send and ConfirmTx apply one amount rule; 1e-3, 1abc and an amount with more decimal places than the token has are refused on Send with a flash message.
Tests cover those entries.
Model: opus-5-5
## Where
Send, "Review". `src/popup/views/send.js` (line 370) accepts any amount for which `parseFloat()` gives a positive number. ConfirmTx checks the same text again through `validateTransfer()` (`src/popup/views/confirmTx.js`, lines 274-289) and refuses more of it.
## What happens
On `next` (8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter `1e-3` and press Review. The wallet moves to ConfirmTx, which shows `Amount 1e-3 SepoliaETH` with the error "Please enter a valid amount to send." and Sign & Send disabled. `0.0000000000000000001` (19 decimal places) does the same. `parseFloat()` also reads only the start of the text, so an entry such as `1abc` passes Send's check.
## What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
## Definition of done
- [ ] Send and ConfirmTx apply one amount rule; `1e-3`, `1abc` and an amount with more decimal places than the token has are refused on Send with a flash message.
- [ ] Tests cover those entries.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 05:00:02 +02:00
Plan: one amount rule, kept in src/shared/txValidation.js with validateTransfer(), which already owns what ConfirmTx refuses. Send's two parseFloat() checks in src/popup/views/send.js (around lines 264 and 370) call that same rule instead, with the selected token's decimals, so an entry ConfirmTx would refuse gets Send's flash message and no screen change: 1e-3, 1abc, an amount with more decimal places than the token has, zero and negative amounts. If the rule today lives only inside validateTransfer(), it is pulled out as one exported function there that both callers use; no new module. Tests, in tests/txValidation.test.js if it exists or a new tests/sendAmountRule.test.js: those entries are refused on Send and by ConfirmTx's check alike, and an ordinary amount such as 0.5 passes both.
Model: opus-5-5
Plan: one amount rule, kept in `src/shared/txValidation.js` with `validateTransfer()`, which already owns what ConfirmTx refuses. Send's two `parseFloat()` checks in `src/popup/views/send.js` (around lines 264 and 370) call that same rule instead, with the selected token's decimals, so an entry ConfirmTx would refuse gets Send's flash message and no screen change: `1e-3`, `1abc`, an amount with more decimal places than the token has, zero and negative amounts. If the rule today lives only inside `validateTransfer()`, it is pulled out as one exported function there that both callers use; no new module. Tests, in `tests/txValidation.test.js` if it exists or a new `tests/sendAmountRule.test.js`: those entries are refused on Send and by ConfirmTx's check alike, and an ordinary amount such as `0.5` passes both.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where
Send, "Review".
src/popup/views/send.js(line 370) accepts any amount for whichparseFloat()gives a positive number. ConfirmTx checks the same text again throughvalidateTransfer()(src/popup/views/confirmTx.js, lines 274-289) and refuses more of it.What happens
On
next(8e52528), release build, Chrome, Sepolia chain id: on Send, with a valid recipient, enter1e-3and press Review. The wallet moves to ConfirmTx, which showsAmount 1e-3 SepoliaETHwith the error "Please enter a valid amount to send." and Sign & Send disabled.0.0000000000000000001(19 decimal places) does the same.parseFloat()also reads only the start of the text, so an entry such as1abcpasses Send's check.What should happen
README, Send: "Review" with an invalid amount gives a flash message and no screen change. Send should refuse every amount ConfirmTx would refuse, with the same rule, so the user is never taken to a confirmation screen for an amount that cannot be sent.
Severity: minor
Definition of done
1e-3,1abcand an amount with more decimal places than the token has are refused on Send with a flash message.Model: opus-5-5
Plan: one amount rule, kept in
src/shared/txValidation.jswithvalidateTransfer(), which already owns what ConfirmTx refuses. Send's twoparseFloat()checks insrc/popup/views/send.js(around lines 264 and 370) call that same rule instead, with the selected token's decimals, so an entry ConfirmTx would refuse gets Send's flash message and no screen change:1e-3,1abc, an amount with more decimal places than the token has, zero and negative amounts. If the rule today lives only insidevalidateTransfer(), it is pulled out as one exported function there that both callers use; no new module. Tests, intests/txValidation.test.jsif it exists or a newtests/sendAmountRule.test.js: those entries are refused on Send and by ConfirmTx's check alike, and an ordinary amount such as0.5passes both.Model: opus-5-5
clawbot referenced this issue2026-10-18 20:29:37 +02:00