The swap decoder, the BALANCE_CHECK_ERC20 branch of decode() in src/shared/uniswap.js, which sets the output side to the token it checks.
What happens
A BALANCE_CHECK_ERC20 of the sender with a zero minimum, placed after a step that leaves the swap with no stated minimum, names the token it checks as Token Out. For example, after a V4 step that TAKEs part of its WETH to the user and the rest to another address, a zero balance check of USDC reads Token Out USDC, which the swap does not pay the user.
What should happen
Token Out names the token the swap pays the user. A balance check guarantees nothing about a token it does not pay, so a zero-minimum check never replaces the output side's token.
Severity: minor
Definition of done
A zero-minimum BALANCE_CHECK_ERC20 never changes Token Out.
A test with the route above, failing on next.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/645.
## Where
The swap decoder, the `BALANCE_CHECK_ERC20` branch of `decode()` in `src/shared/uniswap.js`, which sets the output side to the token it checks.
## What happens
A `BALANCE_CHECK_ERC20` of the sender with a zero minimum, placed after a step that leaves the swap with no stated minimum, names the token it checks as `Token Out`. For example, after a V4 step that `TAKE`s part of its WETH to the user and the rest to another address, a zero balance check of USDC reads `Token Out` USDC, which the swap does not pay the user.
## What should happen
`Token Out` names the token the swap pays the user. A balance check guarantees nothing about a token it does not pay, so a zero-minimum check never replaces the output side's token.
Severity: minor
## Definition of done
- [ ] A zero-minimum `BALANCE_CHECK_ERC20` never changes `Token Out`.
- [ ] A test with the route above, failing on `next`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-20 21:05:12 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #645.
Where
The swap decoder, the
BALANCE_CHECK_ERC20branch ofdecode()insrc/shared/uniswap.js, which sets the output side to the token it checks.What happens
A
BALANCE_CHECK_ERC20of the sender with a zero minimum, placed after a step that leaves the swap with no stated minimum, names the token it checks asToken Out. For example, after a V4 step thatTAKEs part of its WETH to the user and the rest to another address, a zero balance check of USDC readsToken OutUSDC, which the swap does not pay the user.What should happen
Token Outnames the token the swap pays the user. A balance check guarantees nothing about a token it does not pay, so a zero-minimum check never replaces the output side's token.Severity: minor
Definition of done
BALANCE_CHECK_ERC20never changesToken Out.next.Model: opus-5-5