Found by the worker on #594 (#598) and its review.
Where
The swap decoder, src/shared/uniswap.js. After #598 it reads who each swap, SWEEP, UNWRAP_WETH, TAKE and TAKE_ALL pays, but not the router's other commands that move tokens to an address: TRANSFER, PAY_PORTION, the V4 TAKE_PORTION action, and on the routers that read commands with the 0x7f mask (UniversalRouterV2_1_1 and V2_1_2) PAY_PORTION_FULL_PRECISION (0x07) and the bridge deposit ACROSS_V4_DEPOSIT_V3 (0x40). PERMIT2_TRANSFER_FROM (0x02) moves the user's own tokens to a recipient the decoder does not read either.
What happens
A swap pays its output to the router, and a TRANSFER or a PAY_PORTION of 100% sends it to another address. Or a PERMIT2_TRANSFER_FROM sends the user's tokens straight to another address. The approval screen does not name that address. 0x07 and 0x40 are listed only as "Command 0x07" / "Command 0x40".
What should happen
As for #594: tokens paid to an address other than the user's or the router's are shown with that address, and an output paid away is never labelled as received by the user, whichever command moves it. A small portion paid as an interface fee may read plainly, as long as the screen does not claim the user receives what was paid away.
Severity: major
Definition of done
Tokens moved to another address by TRANSFER, PAY_PORTION, PAY_PORTION_FULL_PRECISION, TAKE_PORTION, ACROSS_V4_DEPOSIT_V3 or PERMIT2_TRANSFER_FROM show that address, and an output paid away is not labelled as received by the user.
0x07 and 0x40 are named in the Steps line on the routers that have them.
Tests for each, paid to the user (or the router) and to another address.
Model: opus-5-5
Found by the worker on https://git.eeqj.de/sneak/AutistMask/issues/594 (https://git.eeqj.de/sneak/AutistMask/pulls/598) and its review.
## Where
The swap decoder, `src/shared/uniswap.js`. After https://git.eeqj.de/sneak/AutistMask/pulls/598 it reads who each swap, `SWEEP`, `UNWRAP_WETH`, `TAKE` and `TAKE_ALL` pays, but not the router's other commands that move tokens to an address: `TRANSFER`, `PAY_PORTION`, the V4 `TAKE_PORTION` action, and on the routers that read commands with the `0x7f` mask (UniversalRouterV2_1_1 and V2_1_2) `PAY_PORTION_FULL_PRECISION` (`0x07`) and the bridge deposit `ACROSS_V4_DEPOSIT_V3` (`0x40`). `PERMIT2_TRANSFER_FROM` (`0x02`) moves the user's own tokens to a recipient the decoder does not read either.
## What happens
A swap pays its output to the router, and a `TRANSFER` or a `PAY_PORTION` of 100% sends it to another address. Or a `PERMIT2_TRANSFER_FROM` sends the user's tokens straight to another address. The approval screen does not name that address. `0x07` and `0x40` are listed only as "Command 0x07" / "Command 0x40".
## What should happen
As for https://git.eeqj.de/sneak/AutistMask/issues/594: tokens paid to an address other than the user's or the router's are shown with that address, and an output paid away is never labelled as received by the user, whichever command moves it. A small portion paid as an interface fee may read plainly, as long as the screen does not claim the user receives what was paid away.
Severity: major
## Definition of done
- [ ] Tokens moved to another address by `TRANSFER`, `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `TAKE_PORTION`, `ACROSS_V4_DEPOSIT_V3` or `PERMIT2_TRANSFER_FROM` show that address, and an output paid away is not labelled as received by the user.
- [ ] `0x07` and `0x40` are named in the Steps line on the routers that have them.
- [ ] Tests for each, paid to the user (or the router) and to another address.
Model: opus-5-5
clawbot
self-assigned this 2026-10-19 08:17:33 +02:00
clawbot
changed title from A swap output paid away by TRANSFER, PAY_PORTION or TAKE_PORTION still reads as received by the user to Tokens moved by TRANSFER, PAY_PORTION, TAKE_PORTION and the router's other transfer commands are not shown with their recipient2026-10-19 08:37:03 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the worker on #594 (#598) and its review.
Where
The swap decoder,
src/shared/uniswap.js. After #598 it reads who each swap,SWEEP,UNWRAP_WETH,TAKEandTAKE_ALLpays, but not the router's other commands that move tokens to an address:TRANSFER,PAY_PORTION, the V4TAKE_PORTIONaction, and on the routers that read commands with the0x7fmask (UniversalRouterV2_1_1 and V2_1_2)PAY_PORTION_FULL_PRECISION(0x07) and the bridge depositACROSS_V4_DEPOSIT_V3(0x40).PERMIT2_TRANSFER_FROM(0x02) moves the user's own tokens to a recipient the decoder does not read either.What happens
A swap pays its output to the router, and a
TRANSFERor aPAY_PORTIONof 100% sends it to another address. Or aPERMIT2_TRANSFER_FROMsends the user's tokens straight to another address. The approval screen does not name that address.0x07and0x40are listed only as "Command 0x07" / "Command 0x40".What should happen
As for #594: tokens paid to an address other than the user's or the router's are shown with that address, and an output paid away is never labelled as received by the user, whichever command moves it. A small portion paid as an interface fee may read plainly, as long as the screen does not claim the user receives what was paid away.
Severity: major
Definition of done
TRANSFER,PAY_PORTION,PAY_PORTION_FULL_PRECISION,TAKE_PORTION,ACROSS_V4_DEPOSIT_V3orPERMIT2_TRANSFER_FROMshow that address, and an output paid away is not labelled as received by the user.0x07and0x40are named in the Steps line on the routers that have them.Model: opus-5-5
A swap output paid away by TRANSFER, PAY_PORTION or TAKE_PORTION still reads as received by the userto Tokens moved by TRANSFER, PAY_PORTION, TAKE_PORTION and the router's other transfer commands are not shown with their recipient