The swap decoder, src/shared/uniswap.js, and the swap lines on TxApproval. Every swap command's input starts with the address that receives the output (decodeV2SwapExactIn(), decodeV2SwapExactOut(), decodeV3SwapExactIn() and the V3 exact-out decoder), as do SWEEP, UNWRAP_WETH and the V4 TAKE actions. The decoder reads none of these addresses.
What happens
A connected site sends execute() calldata to a Universal Router in which a swap, or the SWEEP / UNWRAP_WETH / TAKE that pays out its result, sends the output to an address that is not the user's. The approval screen still reads "Swap USDT → WETH" with "Min. received 1.0000 WETH", as if the user were the one receiving it. The user approves paying the input and the output goes elsewhere.
What should happen
README, TxApproval and Transaction Decoding: the approval screen states what the user is authorizing. When the output of the swap is paid to an address other than the user's (the router's own placeholders for "the sender" and "the router itself" count as the user and as not yet paid out, respectively), the screen names that address beside the output and does not present the output as received by the user.
Severity: major
Definition of done
A swap whose output is paid to another address, directly or through SWEEP, UNWRAP_WETH or TAKE, shows that address and does not label the output as received by the user.
A swap paid to the user, directly or through the router, reads as it does today.
Tests for each command kind with the output paid to the user and to another address.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/591.
## Where
The swap decoder, `src/shared/uniswap.js`, and the swap lines on TxApproval. Every swap command's input starts with the address that receives the output (`decodeV2SwapExactIn()`, `decodeV2SwapExactOut()`, `decodeV3SwapExactIn()` and the V3 exact-out decoder), as do `SWEEP`, `UNWRAP_WETH` and the V4 `TAKE` actions. The decoder reads none of these addresses.
## What happens
A connected site sends `execute()` calldata to a Universal Router in which a swap, or the `SWEEP` / `UNWRAP_WETH` / `TAKE` that pays out its result, sends the output to an address that is not the user's. The approval screen still reads "Swap USDT → WETH" with "Min. received 1.0000 WETH", as if the user were the one receiving it. The user approves paying the input and the output goes elsewhere.
## What should happen
README, TxApproval and Transaction Decoding: the approval screen states what the user is authorizing. When the output of the swap is paid to an address other than the user's (the router's own placeholders for "the sender" and "the router itself" count as the user and as not yet paid out, respectively), the screen names that address beside the output and does not present the output as received by the user.
Severity: major
## Definition of done
- [ ] A swap whose output is paid to another address, directly or through `SWEEP`, `UNWRAP_WETH` or `TAKE`, shows that address and does not label the output as received by the user.
- [ ] A swap paid to the user, directly or through the router, reads as it does today.
- [ ] Tests for each command kind with the output paid to the user and to another address.
Model: opus-5-5
clawbot
self-assigned this 2026-10-19 06:00:23 +02:00
Ruling on the review's open point (#598 (comment)): a swap paid to an address that the very next step spends as a V2 swap whose input reads as already paid is a hop, not a payout. That address is not listed under "Paid to" and does not stop the minimum being called received, because the router enforces the next swap's own minimum to that swap's recipient. Uniswap's mixed V3-to-V2 routes read as they did before.
Model: opus-5-5
Ruling on the review's open point (https://git.eeqj.de/sneak/AutistMask/pulls/598#issuecomment-147752): a swap paid to an address that the very next step spends as a V2 swap whose input reads as already paid is a hop, not a payout. That address is not listed under "Paid to" and does not stop the minimum being called received, because the router enforces the next swap's own minimum to that swap's recipient. Uniswap's mixed V3-to-V2 routes read as they did before.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #591.
Where
The swap decoder,
src/shared/uniswap.js, and the swap lines on TxApproval. Every swap command's input starts with the address that receives the output (decodeV2SwapExactIn(),decodeV2SwapExactOut(),decodeV3SwapExactIn()and the V3 exact-out decoder), as doSWEEP,UNWRAP_WETHand the V4TAKEactions. The decoder reads none of these addresses.What happens
A connected site sends
execute()calldata to a Universal Router in which a swap, or theSWEEP/UNWRAP_WETH/TAKEthat pays out its result, sends the output to an address that is not the user's. The approval screen still reads "Swap USDT → WETH" with "Min. received 1.0000 WETH", as if the user were the one receiving it. The user approves paying the input and the output goes elsewhere.What should happen
README, TxApproval and Transaction Decoding: the approval screen states what the user is authorizing. When the output of the swap is paid to an address other than the user's (the router's own placeholders for "the sender" and "the router itself" count as the user and as not yet paid out, respectively), the screen names that address beside the output and does not present the output as received by the user.
Severity: major
Definition of done
SWEEP,UNWRAP_WETHorTAKE, shows that address and does not label the output as received by the user.Model: opus-5-5
Ruling on the review's open point (#598 (comment)): a swap paid to an address that the very next step spends as a V2 swap whose input reads as already paid is a hop, not a payout. That address is not listed under "Paid to" and does not stop the minimum being called received, because the router enforces the next swap's own minimum to that swap's recipient. Uniswap's mixed V3-to-V2 routes read as they did before.
Model: opus-5-5