The swap decoder, decodeV4Swap() and the V4_SWAP branch of decode() in src/shared/uniswap.js. A V4 step's input amount is taken from its swap action, never from the SETTLE the user pays.
What happens
A V4 step that swaps 400 USDT and has a SETTLE of 5,000 USDT paid by the user, with the rest taken to another address, reads Amount 400.0000 USDT. The router takes the SETTLE's 5,000 USDT from the user. This happens even when the V4 step is the only step.
What should happen
The approval screen never shows less than leaves the wallet: the amount a V4 step takes from the user is what its SETTLEs paid by the user state, and where that cannot be read, the screen shows no figure that may be too low.
Severity: major
Definition of done
A V4 step whose SETTLE paid by the user states more than its swap action spends shows the SETTLE's amount as what the user pays.
Tests with that step alone and after another step, each failing on next.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/626.
## Where
The swap decoder, `decodeV4Swap()` and the `V4_SWAP` branch of `decode()` in `src/shared/uniswap.js`. A V4 step's input amount is taken from its swap action, never from the `SETTLE` the user pays.
## What happens
A V4 step that swaps 400 USDT and has a `SETTLE` of 5,000 USDT paid by the user, with the rest taken to another address, reads `Amount 400.0000 USDT`. The router takes the `SETTLE`'s 5,000 USDT from the user. This happens even when the V4 step is the only step.
## What should happen
The approval screen never shows less than leaves the wallet: the amount a V4 step takes from the user is what its `SETTLE`s paid by the user state, and where that cannot be read, the screen shows no figure that may be too low.
Severity: major
## Definition of done
- [ ] A V4 step whose `SETTLE` paid by the user states more than its swap action spends shows the `SETTLE`'s amount as what the user pays.
- [ ] Tests with that step alone and after another step, each failing on `next`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-20 01:20:37 +02:00
Folded into #626: its last review found that without this fix that PR reads lower than next on one route (a PERMIT2_PERMIT of 5,000 USDT to the router, then a V4 step swapping 400 USDT with a SETTLE of 5,000 USDT paid by the user, then an unreadable step), so the same PR now applies the rule here to every V4 step, the first one included, and closes this issue too.
Model: opus-5-5
Folded into https://git.eeqj.de/sneak/AutistMask/pulls/626: its last review found that without this fix that PR reads lower than `next` on one route (a `PERMIT2_PERMIT` of 5,000 USDT to the router, then a V4 step swapping 400 USDT with a `SETTLE` of 5,000 USDT paid by the user, then an unreadable step), so the same PR now applies the rule here to every V4 step, the first one included, and closes this issue too.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #626.
Where
The swap decoder,
decodeV4Swap()and theV4_SWAPbranch ofdecode()insrc/shared/uniswap.js. A V4 step's input amount is taken from its swap action, never from theSETTLEthe user pays.What happens
A V4 step that swaps 400 USDT and has a
SETTLEof 5,000 USDT paid by the user, with the rest taken to another address, readsAmount 400.0000 USDT. The router takes theSETTLE's 5,000 USDT from the user. This happens even when the V4 step is the only step.What should happen
The approval screen never shows less than leaves the wallet: the amount a V4 step takes from the user is what its
SETTLEs paid by the user state, and where that cannot be read, the screen shows no figure that may be too low.Severity: major
Definition of done
SETTLEpaid by the user states more than its swap action spends shows theSETTLE's amount as what the user pays.next.Model: opus-5-5
clawbot referenced this issue2026-10-20 02:05:29 +02:00
Folded into #626: its last review found that without this fix that PR reads lower than
nexton one route (aPERMIT2_PERMITof 5,000 USDT to the router, then a V4 step swapping 400 USDT with aSETTLEof 5,000 USDT paid by the user, then an unreadable step), so the same PR now applies the rule here to every V4 step, the first one included, and closes this issue too.Model: opus-5-5