The swap decoder's permit lines in src/shared/uniswap.js: Allowance token for a PERMIT2_PERMIT or a batch entry whose token is the zero address.
What happens
A permit whose token is the zero address reads Allowance token: ETH. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.
What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
Definition of done
A permit or batch entry on the zero address does not read ETH.
A test, failing on next.
Model: opus-5-5
Seen by the review of https://git.eeqj.de/sneak/AutistMask/pulls/656.
## Where
The swap decoder's permit lines in `src/shared/uniswap.js`: `Allowance token` for a `PERMIT2_PERMIT` or a batch entry whose token is the zero address.
## What happens
A permit whose token is the zero address reads `Allowance token: ETH`. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.
## What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
## Definition of done
- [ ] A permit or batch entry on the zero address does not read ETH.
- [ ] A test, failing on `next`.
Model: opus-5-5
clawbot
self-assigned this 2026-10-21 01:41:53 +02:00
The third review of #679 found a worse case with the same cause: a PERMIT2_PERMIT to the router of 1 wei of the zero address, then a V4 swap of 5 ETH the user settles, reads Amount 0.000000000000000001 ETH. The permit's amount on the zero address is taken as the ETH amount. The fix for this issue covers it: the zero address is never read as ETH, and that route gets a test.
Model: opus-5-5
The third review of https://git.eeqj.de/sneak/AutistMask/pulls/679 found a worse case with the same cause: a `PERMIT2_PERMIT` to the router of 1 wei of the zero address, then a V4 swap of 5 ETH the user settles, reads `Amount 0.000000000000000001 ETH`. The permit's amount on the zero address is taken as the ETH amount. The fix for this issue covers it: the zero address is never read as ETH, and that route gets a test.
Model: opus-5-5
Plan: one PR to next, in decode() in src/shared/uniswap.js. The zero address in a PERMIT2_PERMIT or batch entry is never read as ETH: its Allowance token line names the address, and its amount is never taken as the ETH a later step pays. Jest tests for both, including the 1-wei route in #660 (comment), each failing on next.
Model: opus-5-5
Plan: one PR to `next`, in `decode()` in `src/shared/uniswap.js`. The zero address in a `PERMIT2_PERMIT` or batch entry is never read as ETH: its `Allowance token` line names the address, and its amount is never taken as the ETH a later step pays. Jest tests for both, including the 1-wei route in https://git.eeqj.de/sneak/AutistMask/issues/660#issuecomment-157615, each failing on `next`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Seen by the review of #656.
Where
The swap decoder's permit lines in
src/shared/uniswap.js:Allowance tokenfor aPERMIT2_PERMITor a batch entry whose token is the zero address.What happens
A permit whose token is the zero address reads
Allowance token: ETH. Permit2 has no allowance for ETH; the zero address is not a token, and such a permit grants nothing a user's ETH could be taken under.What should happen
The screen names what the calldata states: the zero address is shown as an address (or as no token), never as ETH.
Severity: minor
Definition of done
next.Model: opus-5-5
The third review of #679 found a worse case with the same cause: a
PERMIT2_PERMITto the router of 1 wei of the zero address, then a V4 swap of 5 ETH the user settles, readsAmount 0.000000000000000001 ETH. The permit's amount on the zero address is taken as the ETH amount. The fix for this issue covers it: the zero address is never read as ETH, and that route gets a test.Model: opus-5-5
Plan: one PR to
next, indecode()insrc/shared/uniswap.js. The zero address in aPERMIT2_PERMITor batch entry is never read as ETH: itsAllowance tokenline names the address, and its amount is never taken as the ETH a later step pays. Jest tests for both, including the 1-wei route in #660 (comment), each failing onnext.Model: opus-5-5