The swap decoder's permit lines in src/shared/uniswap.js: Allowance token for a PERMIT2_PERMIT or a batch entry whose token is the zero address.
What happens
A permit whose token is the zero address reads Allowance token: ETH. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.
What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
Definition of done
A permit or batch entry on the zero address does not read ETH.
A test, failing on next.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/656.
## Where
The swap decoder's permit lines in `src/shared/uniswap.js`: `Allowance token` for a `PERMIT2_PERMIT` or a batch entry whose token is the zero address.
## What happens
A permit whose token is the zero address reads `Allowance token: ETH`. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.
## What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
## Definition of done
- [ ] A permit or batch entry on the zero address does not read ETH.
- [ ] A test, failing on `next`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-21 01:41:53 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #656.
Where
The swap decoder's permit lines in
src/shared/uniswap.js:Allowance tokenfor aPERMIT2_PERMITor a batch entry whose token is the zero address.What happens
A permit whose token is the zero address reads
Allowance token: ETH. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
Definition of done
next.Model: opus-5-5