A V4 settle that names the router as payer hides ETH the transaction value pays #682

Closed
opened 2026-10-27 03:29:51 +01:00 by clawbot · 1 comment
Collaborator

Found by the third review of #679, on a route that PR does not change.

Where

The swap decoder, decode() in src/shared/uniswap.js, a V4 SETTLE of native ETH whose payer is the router.

What happens

A V3 exact-in of 600 USDT, then a V4 swap whose SETTLE of 1 ETH names the router as payer, reads Amount 600.0000 USDT with no ETH line. The router pays native ETH from its own balance, and on this route that balance is the transaction's value, so 1 ETH leaves the wallet. Read from the code on next (33ab99b); not run on a chain.

What should happen

The description never shows less than can leave the wallet. ETH a V4 step settles from the router, when the router holds no ETH from an earlier step, is ETH the transaction's value pays: it gets a Moved from the sender line, or reads as a figure the decoder cannot state.

Severity: minor (the approval screen's transaction value still shows the ETH)

Definition of done

  • On that route, the ETH the V4 step settles from the router reads as moved from the sender, or as a figure the decoder cannot state, never as nothing.
  • A test, failing on next.

Model: opus-5-5

Found by the third review of https://git.eeqj.de/sneak/AutistMask/pulls/679, on a route that PR does not change. ## Where The swap decoder, `decode()` in `src/shared/uniswap.js`, a V4 `SETTLE` of native ETH whose payer is the router. ## What happens A V3 exact-in of 600 USDT, then a V4 swap whose `SETTLE` of 1 ETH names the router as payer, reads `Amount 600.0000 USDT` with no ETH line. The router pays native ETH from its own balance, and on this route that balance is the transaction's value, so 1 ETH leaves the wallet. Read from the code on `next` (`33ab99b`); not run on a chain. ## What should happen The description never shows less than can leave the wallet. ETH a V4 step settles from the router, when the router holds no ETH from an earlier step, is ETH the transaction's value pays: it gets a `Moved from the sender` line, or reads as a figure the decoder cannot state. Severity: minor (the approval screen's transaction value still shows the ETH) ## Definition of done - [ ] On that route, the ETH the V4 step settles from the router reads as moved from the sender, or as a figure the decoder cannot state, never as nothing. - [ ] A test, failing on `next`. Model: opus-5-5
clawbot self-assigned this 2026-10-27 03:29:51 +01:00
Author
Collaborator

Plan: one PR to next, in decode() in src/shared/uniswap.js. A V4 SETTLE of native ETH whose payer is the router, with no earlier step leaving ETH with the router, is paid from the transaction's value. That ETH gets a Moved from the sender line, or reads Unknown (could not be decoded) when its amount is not known; never nothing. When an earlier step may have left ETH with the router, the line reads as an upper bound, never less. A Jest test for the route in the issue fails on next.

Model: opus-5-5

Plan: one PR to `next`, in `decode()` in `src/shared/uniswap.js`. A V4 `SETTLE` of native ETH whose payer is the router, with no earlier step leaving ETH with the router, is paid from the transaction's value. That ETH gets a `Moved from the sender` line, or reads `Unknown (could not be decoded)` when its amount is not known; never nothing. When an earlier step may have left ETH with the router, the line reads as an upper bound, never less. A Jest test for the route in the issue fails on `next`. Model: opus-5-5
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#682