A V3_SWAP_EXACT_OUT step is named but never decoded, so its tokens show as not named in the calldata #601

Closed
opened 2026-10-19 08:37:04 +02:00 by clawbot · 2 comments
Collaborator

Seen by the review of #598.

Where

The swap decoder, src/shared/uniswap.js. Command 0x00 (V3_SWAP_EXACT_IN) is decoded by decodeV3SwapExactIn(); command 0x01 (V3_SWAP_EXACT_OUT, (address recipient, uint256 amountOut, uint256 amountInMax, bytes path, bool payerIsUser)) is named in the Steps line but never decoded.

What happens

A swap done with V3_SWAP_EXACT_OUT shows its tokens as unknown ("not named in the calldata") and no amounts, although the calldata names both tokens, the exact amount bought and the most that can be spent.

What should happen

README, Transaction Decoding: the decoder covers Universal Router execute() calls and their swap steps. A V3 exact-out swap is read like the V2 exact-out swap already is: its tokens from the path (which an exact-out V3 path lists output first), and its amounts as the V2 exact-out case shows them.

Severity: minor

Definition of done

  • V3_SWAP_EXACT_OUT steps set Token In, Token Out and their amounts, with the path read in the order the router reads it.
  • Tests for a single-hop and a multi-hop exact-out path.

Model: opus-5-5

Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/598. ## Where The swap decoder, `src/shared/uniswap.js`. Command `0x00` (`V3_SWAP_EXACT_IN`) is decoded by `decodeV3SwapExactIn()`; command `0x01` (`V3_SWAP_EXACT_OUT`, `(address recipient, uint256 amountOut, uint256 amountInMax, bytes path, bool payerIsUser)`) is named in the Steps line but never decoded. ## What happens A swap done with `V3_SWAP_EXACT_OUT` shows its tokens as unknown ("not named in the calldata") and no amounts, although the calldata names both tokens, the exact amount bought and the most that can be spent. ## What should happen README, Transaction Decoding: the decoder covers Universal Router `execute()` calls and their swap steps. A V3 exact-out swap is read like the V2 exact-out swap already is: its tokens from the path (which an exact-out V3 path lists output first), and its amounts as the V2 exact-out case shows them. Severity: minor ## Definition of done - [ ] `V3_SWAP_EXACT_OUT` steps set Token In, Token Out and their amounts, with the path read in the order the router reads it. - [ ] Tests for a single-hop and a multi-hop exact-out path. Model: opus-5-5
clawbot self-assigned this 2026-10-19 08:37:04 +02:00
Author
Collaborator

Plan: one PR to next, in decode() in src/shared/uniswap.js. A decodeV3SwapExactOut() beside decodeV3SwapExactIn() reads (recipient, amountOut, amountInMax, path, payerIsUser), with the path read output first, as the router reads an exact-out V3 path. The step then sets Token In and Token Out and their amounts as a V2_SWAP_EXACT_OUT does (Up to its amountInMax), names its recipient, counts against the router's balance when paid from the router, and joins the total of what the user's steps take (#626), where it is now counted as a take the decoder did not read. Tests for a single-hop and a multi-hop exact-out path, and for one after a V3 exact-in, each failing on next.

Model: opus-5-5

Plan: one PR to `next`, in `decode()` in `src/shared/uniswap.js`. A `decodeV3SwapExactOut()` beside `decodeV3SwapExactIn()` reads `(recipient, amountOut, amountInMax, path, payerIsUser)`, with the path read output first, as the router reads an exact-out V3 path. The step then sets Token In and Token Out and their amounts as a `V2_SWAP_EXACT_OUT` does (`Up to` its `amountInMax`), names its recipient, counts against the router's balance when paid from the router, and joins the total of what the user's steps take (https://git.eeqj.de/sneak/AutistMask/pulls/626), where it is now counted as a take the decoder did not read. Tests for a single-hop and a multi-hop exact-out path, and for one after a V3 exact-in, each failing on `next`. Model: opus-5-5
Author
Collaborator

Built in #636: a V3_SWAP_EXACT_OUT step is now read the same way as a V2_SWAP_EXACT_OUT, with its path read from the token it buys to the token it spends. The PR discloses one judgement call, about a step paid from the router.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/AutistMask/pulls/636: a `V3_SWAP_EXACT_OUT` step is now read the same way as a `V2_SWAP_EXACT_OUT`, with its path read from the token it buys to the token it spends. The PR discloses one judgement call, about a step paid from the router. Model: opus-5-5
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#601