The swap decoder, src/shared/uniswap.js, and the approval and transaction detail screens. A PERMIT2_TRANSFER_FROM moves an amount of the user's tokens to a recipient. After #604 the recipient is named, but the amount it moves is never shown, whether it goes to another address or to the V2 pair the next swap spends.
What happens
A PERMIT2_TRANSFER_FROM of 1,000,000 USDT to another address, then a swap of 1 USDT, reads Amount 1.0000 USDT. The screen names the other address but not that a million USDT go to it.
What should happen
The approval screen states what the user is authorizing. Every amount of the user's tokens a step moves, and where it goes, is shown with its token, so the user can see what leaves the wallet.
Severity: major
Definition of done
Each PERMIT2_TRANSFER_FROM shows its token, its amount and its recipient.
The swap's Amount line is not left as the only amount shown when other amounts of the user's tokens move.
Tests with the move going to another address, to the V2 pair, and to the router.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/604.
## Where
The swap decoder, `src/shared/uniswap.js`, and the approval and transaction detail screens. A `PERMIT2_TRANSFER_FROM` moves an amount of the user's tokens to a recipient. After https://git.eeqj.de/sneak/AutistMask/pulls/604 the recipient is named, but the amount it moves is never shown, whether it goes to another address or to the V2 pair the next swap spends.
## What happens
A `PERMIT2_TRANSFER_FROM` of 1,000,000 USDT to another address, then a swap of 1 USDT, reads `Amount 1.0000 USDT`. The screen names the other address but not that a million USDT go to it.
## What should happen
The approval screen states what the user is authorizing. Every amount of the user's tokens a step moves, and where it goes, is shown with its token, so the user can see what leaves the wallet.
Severity: major
## Definition of done
- [ ] Each `PERMIT2_TRANSFER_FROM` shows its token, its amount and its recipient.
- [ ] The swap's `Amount` line is not left as the only amount shown when other amounts of the user's tokens move.
- [ ] Tests with the move going to another address, to the V2 pair, and to the router.
Model: opus-5-5
clawbot
self-assigned this 2026-10-19 13:37:43 +02:00
Plan: one PR to next. In src/shared/uniswap.js, each PERMIT2_TRANSFER_FROM the decoder reads adds one line to the summary, whatever its recipient, giving the amount, the token (with its address, as the Token In line gives it) and where it goes: the named address, the router, or the V2 pair the next swap spends. The Paid to lines, and so Min. received against Min. paid out, stay as they are: a move into the V2 pair the next swap spends is that swap's input, not a payment. TxApproval and TransactionDetail already show every line the decoder gives, so they need only the README wording. Tests with the move going to another address, to the V2 pair and to the router, each failing on next.
Model: opus-5-5
Plan: one PR to `next`. In `src/shared/uniswap.js`, each `PERMIT2_TRANSFER_FROM` the decoder reads adds one line to the summary, whatever its recipient, giving the amount, the token (with its address, as the `Token In` line gives it) and where it goes: the named address, the router, or the V2 pair the next swap spends. The `Paid to` lines, and so `Min. received` against `Min. paid out`, stay as they are: a move into the V2 pair the next swap spends is that swap's input, not a payment. TxApproval and TransactionDetail already show every line the decoder gives, so they need only the README wording. Tests with the move going to another address, to the V2 pair and to the router, each failing on `next`.
Model: opus-5-5
Built in #620. Every PERMIT2_TRANSFER_FROM now gets three lines after Amount: Moved from the sender (the amount), Token moved (the token, given as Token In gives it) and Moved to (The router, The V2 pair the next swap spends, The sender, or the address). The Paid to lines and the minimum's label are unchanged.
Deviation from the plan: three lines per move, not one. A line that carries an address is shown as that address alone, so the amount, the token and a destination address each need a line of their own.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/AutistMask/pulls/620. Every `PERMIT2_TRANSFER_FROM` now gets three lines after `Amount`: `Moved from the sender` (the amount), `Token moved` (the token, given as `Token In` gives it) and `Moved to` (`The router`, `The V2 pair the next swap spends`, `The sender`, or the address). The `Paid to` lines and the minimum's label are unchanged.
Deviation from the plan: three lines per move, not one. A line that carries an address is shown as that address alone, so the amount, the token and a destination address each need a line of their own.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #604.
Where
The swap decoder,
src/shared/uniswap.js, and the approval and transaction detail screens. APERMIT2_TRANSFER_FROMmoves an amount of the user's tokens to a recipient. After #604 the recipient is named, but the amount it moves is never shown, whether it goes to another address or to the V2 pair the next swap spends.What happens
A
PERMIT2_TRANSFER_FROMof 1,000,000 USDT to another address, then a swap of 1 USDT, readsAmount 1.0000 USDT. The screen names the other address but not that a million USDT go to it.What should happen
The approval screen states what the user is authorizing. Every amount of the user's tokens a step moves, and where it goes, is shown with its token, so the user can see what leaves the wallet.
Severity: major
Definition of done
PERMIT2_TRANSFER_FROMshows its token, its amount and its recipient.Amountline is not left as the only amount shown when other amounts of the user's tokens move.Model: opus-5-5
Plan: one PR to
next. Insrc/shared/uniswap.js, eachPERMIT2_TRANSFER_FROMthe decoder reads adds one line to the summary, whatever its recipient, giving the amount, the token (with its address, as theToken Inline gives it) and where it goes: the named address, the router, or the V2 pair the next swap spends. ThePaid tolines, and soMin. receivedagainstMin. paid out, stay as they are: a move into the V2 pair the next swap spends is that swap's input, not a payment. TxApproval and TransactionDetail already show every line the decoder gives, so they need only the README wording. Tests with the move going to another address, to the V2 pair and to the router, each failing onnext.Model: opus-5-5
Built in #620. Every
PERMIT2_TRANSFER_FROMnow gets three lines afterAmount:Moved from the sender(the amount),Token moved(the token, given asToken Ingives it) andMoved to(The router,The V2 pair the next swap spends,The sender, or the address). ThePaid tolines and the minimum's label are unchanged.Deviation from the plan: three lines per move, not one. A line that carries an address is shown as that address alone, so the amount, the token and a destination address each need a line of their own.
Model: opus-5-5