The swap decoder names the older routers' NFT commands as V4 commands and decodes one as a V4 swap #592

Open
opened 2026-10-19 05:48:17 +02:00 by clawbot · 0 comments
Collaborator

Found by the worker on #535 (#591).

Where

The swap decoder, src/shared/uniswap.js. Its command names follow the V2 Universal Routers, for every router in its list.

What happens

On UniversalRouterV1 and UniversalRouterV1_2_V2Support, commands 0x10 to 0x13 are NFT commands, as those routers' verified Commands.sol declares. The decoder names them as V4 commands in the Steps line, and decodes 0x10 as a V4 swap, so a call to one of those routers can be shown with swap lines it does not perform.

What should happen

README, Transaction Decoding: the Steps line names each command as the router will execute it. On those two routers, 0x10 to 0x13 are named as their NFT commands (or as a step the decoder does not read), and no swap lines are drawn from them.

Severity: major (a step encoded as a V4 swap ending in TAKE_ALL reads Min. received on those routers although the router runs an NFT command; #598 (comment))

Definition of done

  • Commands 0x10 to 0x13 sent to the V1 and V1_2 routers are not named or decoded as V4 commands.
  • Tests send each to a V1 router and to a V2 router.
  • On UniversalRouterV1, command 0x0e (an unused slot the router always reverts on) is not named "Balance Check" and sets no minimum (found by the worker on #612). Check the older routers' other command names against their pinned command lists the same way.

Model: opus-5-5

Found by the worker on https://git.eeqj.de/sneak/AutistMask/issues/535 (https://git.eeqj.de/sneak/AutistMask/pulls/591). ## Where The swap decoder, `src/shared/uniswap.js`. Its command names follow the V2 Universal Routers, for every router in its list. ## What happens On `UniversalRouterV1` and `UniversalRouterV1_2_V2Support`, commands `0x10` to `0x13` are NFT commands, as those routers' verified `Commands.sol` declares. The decoder names them as V4 commands in the Steps line, and decodes `0x10` as a V4 swap, so a call to one of those routers can be shown with swap lines it does not perform. ## What should happen README, Transaction Decoding: the Steps line names each command as the router will execute it. On those two routers, `0x10` to `0x13` are named as their NFT commands (or as a step the decoder does not read), and no swap lines are drawn from them. Severity: major (a step encoded as a V4 swap ending in `TAKE_ALL` reads `Min. received` on those routers although the router runs an NFT command; https://git.eeqj.de/sneak/AutistMask/pulls/598#issuecomment-147892) ## Definition of done - [ ] Commands `0x10` to `0x13` sent to the V1 and V1_2 routers are not named or decoded as V4 commands. - [ ] Tests send each to a V1 router and to a V2 router. - [ ] On `UniversalRouterV1`, command `0x0e` (an unused slot the router always reverts on) is not named "Balance Check" and sets no minimum (found by the worker on https://git.eeqj.de/sneak/AutistMask/pulls/612). Check the older routers' other command names against their pinned command lists the same way. Model: opus-5-5
clawbot self-assigned this 2026-10-19 05:48:17 +02:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#592