ConfirmTx. checkRecipientHistory() in src/popup/views/confirmTx.js shows the recipient warning boxes when its lookups return, with no check that the screen still shows the transaction it was started for. estimateGas() in the same file has that check (if (pendingTx !== txInfo) return;).
What happens
The user reviews a send to an address that has never sent a transaction and holds no ETH, goes back, changes the recipient to an ordinary address, and reviews again. If the lookups for the first recipient answer after the second screen is drawn, the "never sent a transaction" box appears on the second recipient's screen. The contract box and the Etherscan phishing box can be carried over the same way.
What should happen
A warning on ConfirmTx describes the recipient on screen. A result for a transaction the user has left is dropped, as the fee estimate already does.
Severity: minor
Definition of done
A late result of the recipient checks for a transaction the user has left never changes the warning boxes.
A test covers it: the first recipient's answer arrives after the second recipient's screen is shown.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/571.
## Where
ConfirmTx. `checkRecipientHistory()` in `src/popup/views/confirmTx.js` shows the recipient warning boxes when its lookups return, with no check that the screen still shows the transaction it was started for. `estimateGas()` in the same file has that check (`if (pendingTx !== txInfo) return;`).
## What happens
The user reviews a send to an address that has never sent a transaction and holds no ETH, goes back, changes the recipient to an ordinary address, and reviews again. If the lookups for the first recipient answer after the second screen is drawn, the "never sent a transaction" box appears on the second recipient's screen. The contract box and the Etherscan phishing box can be carried over the same way.
## What should happen
A warning on ConfirmTx describes the recipient on screen. A result for a transaction the user has left is dropped, as the fee estimate already does.
Severity: minor
## Definition of done
- [ ] A late result of the recipient checks for a transaction the user has left never changes the warning boxes.
- [ ] A test covers it: the first recipient's answer arrives after the second recipient's screen is shown.
Model: opus-5-5
clawbot
self-assigned this 2026-10-19 02:34:35 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #571.
Where
ConfirmTx.
checkRecipientHistory()insrc/popup/views/confirmTx.jsshows the recipient warning boxes when its lookups return, with no check that the screen still shows the transaction it was started for.estimateGas()in the same file has that check (if (pendingTx !== txInfo) return;).What happens
The user reviews a send to an address that has never sent a transaction and holds no ETH, goes back, changes the recipient to an ordinary address, and reviews again. If the lookups for the first recipient answer after the second screen is drawn, the "never sent a transaction" box appears on the second recipient's screen. The contract box and the Etherscan phishing box can be carried over the same way.
What should happen
A warning on ConfirmTx describes the recipient on screen. A result for a transaction the user has left is dropped, as the fee estimate already does.
Severity: minor
Definition of done
Model: opus-5-5