clawbot
45f11ee920
When two addresses' explorer reports disagree on a token's decimals, the Send screen showed the stored figure while the confirmation screen said the balance was unknown. One function in send.js now gives both the balance and scale, so both read `unknown (SYMBOL)`. The confirmation screen's fee-unknown message names its cause: for an unknown scale it says the wallet does not know the token's decimal places and the transaction cannot be sent, instead of asking for a retry that cannot help. Other causes keep the old sentence. Model: opus-5-5
552 lines
21 KiB
JavaScript
552 lines
21 KiB
JavaScript
// Transaction confirmation view with inline password.
|
||
// Shows transaction details, warnings, errors. On Sign & Send,
|
||
// reads inline password, decrypts secret, signs and broadcasts.
|
||
|
||
const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
|
||
const {
|
||
$,
|
||
showError,
|
||
hideError,
|
||
showView,
|
||
addressTitle,
|
||
escapeHtml,
|
||
displaySymbol,
|
||
renderAddressHtml,
|
||
attachCopyHandlers,
|
||
goBack,
|
||
onViewLeave,
|
||
formatFee,
|
||
} = require("./helpers");
|
||
const { state } = require("../../shared/state");
|
||
const { getSignerForAddress } = require("../../shared/wallet");
|
||
const { decryptWithPassword } = require("../../shared/vault");
|
||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||
const { getProvider } = require("../../shared/balances");
|
||
const {
|
||
getLocalWarnings,
|
||
getFullWarnings,
|
||
} = require("../../shared/addressWarnings");
|
||
const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
|
||
const {
|
||
displayedDecimals,
|
||
transferAmountUnits,
|
||
} = require("../../shared/transferAmount");
|
||
const { assertWithinCeilings } = require("../../shared/approvalVerify");
|
||
// The balance lines, the fee reserve and the insufficient-balance messages go
|
||
// through it, as the approval screen's amounts do.
|
||
const { truncateAmountNeverZero } = require("../../shared/amountDisplay");
|
||
const {
|
||
CODES,
|
||
FEE_PENDING,
|
||
FEE_KNOWN,
|
||
FEE_UNAVAILABLE,
|
||
feeReserveWei,
|
||
feeEstimateWei,
|
||
validateTransfer,
|
||
} = require("../../shared/txValidation");
|
||
const { log } = require("../../shared/log");
|
||
const makeBlockie = require("ethereum-blockies-base64");
|
||
const txStatus = require("./txStatus");
|
||
|
||
let pendingTx = null;
|
||
// Network fee for the transaction currently on screen. Reset by show() and
|
||
// filled in by estimateGas() when the estimate resolves or fails.
|
||
let feeStatus = FEE_PENDING;
|
||
let feeWei = null;
|
||
|
||
function restore() {
|
||
const d = state.viewData;
|
||
if (d && d.pendingTx) {
|
||
show(d.pendingTx);
|
||
}
|
||
}
|
||
|
||
function blockieHtml(address) {
|
||
const src = makeBlockie(address);
|
||
return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||
}
|
||
|
||
function confirmAddressHtml(address, ensName, title) {
|
||
const blockie = blockieHtml(address);
|
||
return (
|
||
`<div class="mb-1">${blockie}</div>` +
|
||
renderAddressHtml(address, { title, ensName })
|
||
);
|
||
}
|
||
|
||
function valueWithUsd(text, usdAmount) {
|
||
if (usdAmount !== null && usdAmount !== undefined && !isNaN(usdAmount)) {
|
||
return text + " (" + formatUsd(usdAmount) + ")";
|
||
}
|
||
return text;
|
||
}
|
||
|
||
function show(txInfo) {
|
||
pendingTx = txInfo;
|
||
feeStatus = FEE_PENDING;
|
||
feeWei = null;
|
||
|
||
const isErc20 = txInfo.token !== "ETH";
|
||
// The raw symbol is the price-table key; the capped one is what the
|
||
// screen says. Truncating before the lookup would silently drop the
|
||
// price of any token whose symbol is long enough to be capped.
|
||
const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||
const symbol = displaySymbol(rawSymbol);
|
||
|
||
// Transaction type
|
||
if (isErc20) {
|
||
$("confirm-type").textContent =
|
||
"ERC-20 token transfer (" + symbol + ")";
|
||
} else {
|
||
$("confirm-type").textContent = "Native ETH transfer";
|
||
}
|
||
|
||
// Token contract section (ERC-20 only)
|
||
const tokenSection = $("confirm-token-section");
|
||
if (isErc20) {
|
||
$("confirm-token-contract").innerHTML = renderAddressHtml(
|
||
txInfo.token,
|
||
{},
|
||
);
|
||
tokenSection.classList.remove("hidden");
|
||
attachCopyHandlers(tokenSection);
|
||
} else {
|
||
tokenSection.classList.add("hidden");
|
||
}
|
||
|
||
// From (with blockie)
|
||
const fromTitle = addressTitle(txInfo.from, state.wallets);
|
||
$("confirm-from").innerHTML = confirmAddressHtml(
|
||
txInfo.from,
|
||
null,
|
||
fromTitle,
|
||
);
|
||
|
||
// To (with blockie)
|
||
const toTitle = addressTitle(txInfo.to, state.wallets);
|
||
$("confirm-to").innerHTML = confirmAddressHtml(
|
||
txInfo.to,
|
||
txInfo.ensName,
|
||
toTitle,
|
||
);
|
||
$("confirm-to-ens").classList.add("hidden");
|
||
|
||
// Amount (with inline USD)
|
||
const ethPrice = getPrice("ETH");
|
||
const tokenPrice = getPrice(rawSymbol);
|
||
const amountNum = parseFloat(txInfo.amount);
|
||
const price = isErc20 ? tokenPrice : ethPrice;
|
||
const amountUsd = price ? amountNum * price : null;
|
||
$("confirm-amount").textContent = valueWithUsd(
|
||
txInfo.amount + " " + symbol,
|
||
amountUsd,
|
||
);
|
||
|
||
// Balance (with inline USD)
|
||
if (isErc20) {
|
||
// null is a balance whose scale nothing knows, not a balance of zero
|
||
// (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
|
||
// refused at encode time for the same missing scale; what this line
|
||
// must not do is state a quantity nobody established.
|
||
const bal = txInfo.tokenBalance;
|
||
const balUsd =
|
||
tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
|
||
$("confirm-balance").textContent =
|
||
bal == null
|
||
? "unknown (" + symbol + ")"
|
||
: valueWithUsd(
|
||
truncateAmountNeverZero(bal) + " " + symbol,
|
||
balUsd,
|
||
);
|
||
} else {
|
||
const bal = txInfo.balance || "0";
|
||
const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
|
||
$("confirm-balance").textContent = valueWithUsd(
|
||
truncateAmountNeverZero(bal) + " ETH",
|
||
balUsd,
|
||
);
|
||
}
|
||
|
||
// Check for warnings (synchronous local checks)
|
||
const localWarnings = getLocalWarnings(txInfo.to, {
|
||
fromAddress: txInfo.from,
|
||
});
|
||
|
||
const warningsEl = $("confirm-warnings");
|
||
if (localWarnings.length > 0) {
|
||
warningsEl.innerHTML = localWarnings
|
||
.map(
|
||
(w) =>
|
||
// Only the three hardcoded strings in
|
||
// src/shared/addressWarnings.js reach this today, but
|
||
// src/shared/etherscanLabels.js already builds a
|
||
// `warning` out of scraped explorer markup, so this is
|
||
// one wiring change away from carrying remote text.
|
||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
|
||
)
|
||
.join("");
|
||
warningsEl.style.visibility = "visible";
|
||
} else {
|
||
warningsEl.innerHTML = "";
|
||
warningsEl.style.visibility = "hidden";
|
||
}
|
||
|
||
// The two fee messages are mutually exclusive per transaction type, and
|
||
// the type is known here, before the first paint. Drop the one that can
|
||
// never apply and reserve the space of the one that can, so the async
|
||
// estimate landing later never moves anything.
|
||
$("confirm-amount-fee-error").classList.toggle("hidden", isErc20);
|
||
$("confirm-gas-error").classList.toggle("hidden", !isErc20);
|
||
|
||
// The fee-unknown message names its cause, which is also known here.
|
||
// Without the token's scale estimateGas() cannot encode the transfer, so
|
||
// the estimate fails every time and going back cannot help; any other
|
||
// failure may clear on a retry.
|
||
$("confirm-fee-unknown-error").textContent =
|
||
isErc20 && txInfo.tokenDecimals == null
|
||
? "The network fee could not be estimated, because this wallet" +
|
||
" does not know how many decimal places this token uses, so" +
|
||
" this transaction cannot be sent."
|
||
: "The network fee could not be estimated, so this transaction" +
|
||
" cannot be checked against your balance. Please go back and" +
|
||
" try again.";
|
||
|
||
renderValidation(txInfo);
|
||
|
||
// Reset password field and error
|
||
$("confirm-tx-password").value = "";
|
||
hideError("confirm-tx-password-error");
|
||
|
||
// Gas estimate — show placeholder then fetch async
|
||
$("confirm-fee").style.visibility = "visible";
|
||
$("confirm-fee-amount").textContent = "Estimating...";
|
||
setVisible("confirm-fee-reserve", false);
|
||
state.viewData = { pendingTx: txInfo };
|
||
showView("confirm-tx");
|
||
attachCopyHandlers("view-confirm-tx");
|
||
|
||
// Reset async warnings to hidden (space always reserved, no layout shift)
|
||
$("confirm-recipient-warning").style.visibility = "hidden";
|
||
$("confirm-contract-warning").style.visibility = "hidden";
|
||
$("confirm-burn-warning").style.visibility = "hidden";
|
||
$("confirm-etherscan-warning").style.visibility = "hidden";
|
||
|
||
// Show burn warning via reserved element (in addition to inline warning)
|
||
if (isBurnAddress(txInfo.to)) {
|
||
$("confirm-burn-warning").style.visibility = "visible";
|
||
}
|
||
|
||
estimateGas(txInfo);
|
||
checkRecipientHistory(txInfo);
|
||
}
|
||
|
||
// Render the balance check for the transaction on screen. Called once during
|
||
// show() and again when the fee estimate resolves or fails. Every element it
|
||
// touches already occupies its space, so re-running it never moves anything.
|
||
function renderValidation(txInfo) {
|
||
const isErc20 = txInfo.token !== "ETH";
|
||
const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
|
||
|
||
const { canSend, codes } = validateTransfer({
|
||
isErc20,
|
||
amount: txInfo.amount,
|
||
ethBalance: txInfo.balance,
|
||
tokenBalance: txInfo.tokenBalance,
|
||
feeStatus,
|
||
feeWei,
|
||
});
|
||
|
||
// Messages carrying the user's own numbers are built here; the fixed
|
||
// sentences live in the reserved elements in index.html, except the
|
||
// fee-unknown one, which show() sets.
|
||
const messages = [];
|
||
if (codes.includes(CODES.AMOUNT_INVALID)) {
|
||
messages.push("Please enter a valid amount to send.");
|
||
}
|
||
if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
|
||
messages.push(
|
||
txInfo.tokenBalance == null
|
||
? "This token's balance is unknown, because nothing this" +
|
||
" wallet can consult reports how many decimal places it" +
|
||
" uses, so the amount you are trying to send cannot be" +
|
||
" checked against it."
|
||
: "Insufficient " +
|
||
symbol +
|
||
" balance. You have " +
|
||
truncateAmountNeverZero(txInfo.tokenBalance) +
|
||
" " +
|
||
symbol +
|
||
" but are trying to send " +
|
||
txInfo.amount +
|
||
" " +
|
||
symbol +
|
||
".",
|
||
);
|
||
}
|
||
if (codes.includes(CODES.INSUFFICIENT_ETH)) {
|
||
messages.push(
|
||
"Insufficient balance. You have " +
|
||
truncateAmountNeverZero(txInfo.balance || "0") +
|
||
" ETH but are trying to send " +
|
||
txInfo.amount +
|
||
" ETH.",
|
||
);
|
||
}
|
||
|
||
const errorsEl = $("confirm-errors");
|
||
if (messages.length > 0) {
|
||
errorsEl.innerHTML = messages
|
||
.map((m) => `<div class="text-xs">${escapeHtml(m)}</div>`)
|
||
.join("");
|
||
errorsEl.style.visibility = "visible";
|
||
} else {
|
||
errorsEl.innerHTML = "";
|
||
errorsEl.style.visibility = "hidden";
|
||
}
|
||
|
||
setVisible(
|
||
"confirm-amount-fee-error",
|
||
codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
|
||
);
|
||
setVisible(
|
||
"confirm-gas-error",
|
||
codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
|
||
);
|
||
setVisible(
|
||
"confirm-fee-unknown-error",
|
||
codes.includes(CODES.FEE_UNAVAILABLE),
|
||
);
|
||
|
||
// While the estimate is in flight there is no error to show — the fee
|
||
// line already reads "Estimating..." — but sending stays blocked so a
|
||
// transaction the fee would break cannot be signed in the meantime.
|
||
const sendBtn = $("btn-confirm-send");
|
||
sendBtn.disabled = !canSend;
|
||
sendBtn.classList.toggle("text-muted", !canSend);
|
||
}
|
||
|
||
function setVisible(id, visible) {
|
||
$(id).style.visibility = visible ? "visible" : "hidden";
|
||
}
|
||
|
||
async function estimateGas(txInfo) {
|
||
try {
|
||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||
const feeData = await provider.getFeeData();
|
||
let gasLimit;
|
||
|
||
if (txInfo.token === "ETH") {
|
||
gasLimit = await provider.estimateGas({
|
||
from: txInfo.from,
|
||
to: txInfo.to,
|
||
value: parseEther(txInfo.amount),
|
||
});
|
||
} else {
|
||
const contract = new Contract(txInfo.token, ERC20_ABI, provider);
|
||
// The scale the screen is rendering with, not the contract's own
|
||
// answer: the estimate has to be for the transfer that would be
|
||
// signed, and that one is encoded from what was displayed. See
|
||
// transferAmount.js. A pending transaction that carries no usable
|
||
// scale throws here, which reports the fee as unknown and leaves
|
||
// Send blocked — an amount that cannot be checked against the
|
||
// screen is never estimated for, let alone sent.
|
||
const amount = parseUnits(
|
||
txInfo.amount,
|
||
displayedDecimals(txInfo.tokenDecimals),
|
||
);
|
||
gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
|
||
from: txInfo.from,
|
||
});
|
||
}
|
||
|
||
// What the node will require to be reserved, which is what the gate
|
||
// must be: the send pins no fee fields, so it is broadcast as a
|
||
// type-2 transaction priced at maxFeePerGas.
|
||
const gasCostWei = feeReserveWei(gasLimit, feeData);
|
||
if (gasCostWei === null) {
|
||
throw new Error("no usable gas price from the provider");
|
||
}
|
||
// What the transaction is expected to cost, which is a different and
|
||
// usually much smaller number. Both are shown: quoting only the
|
||
// reserve overstates the typical cost by roughly double on mainnet,
|
||
// and quoting only the estimate contradicts the balance check.
|
||
const estimateWei = feeEstimateWei(gasLimit, feeData);
|
||
// The user may have left this transaction while the estimate was in
|
||
// flight; a stale fee must not reach the screen or the balance check.
|
||
if (pendingTx !== txInfo) return;
|
||
|
||
// The fee line goes through formatFee(), as the approval screen's
|
||
// does, so the same fee reads the same on both.
|
||
if (estimateWei !== null && estimateWei < gasCostWei) {
|
||
$("confirm-fee-amount").textContent = "~" + formatFee(estimateWei);
|
||
$("confirm-fee-reserve").textContent =
|
||
"up to " +
|
||
truncateAmountNeverZero(formatEther(gasCostWei)) +
|
||
" ETH reserved";
|
||
setVisible("confirm-fee-reserve", true);
|
||
} else {
|
||
// No spread to report: either there is no estimate, or the node
|
||
// quotes a gas price at or above maxFeePerGas, so the expected
|
||
// cost is not below the reserve. Show the reserve alone.
|
||
$("confirm-fee-amount").textContent = formatFee(gasCostWei);
|
||
setVisible("confirm-fee-reserve", false);
|
||
}
|
||
feeStatus = FEE_KNOWN;
|
||
feeWei = gasCostWei;
|
||
renderValidation(txInfo);
|
||
} catch (e) {
|
||
log.errorf("gas estimation failed:", e.message);
|
||
if (pendingTx !== txInfo) return;
|
||
$("confirm-fee-amount").textContent = "Unable to estimate";
|
||
setVisible("confirm-fee-reserve", false);
|
||
feeStatus = FEE_UNAVAILABLE;
|
||
feeWei = null;
|
||
renderValidation(txInfo);
|
||
}
|
||
}
|
||
|
||
// Populate the transaction this send describes, enforce the fee bound against
|
||
// the fees that were actually filled in, then sign and broadcast it. The send
|
||
// pins no fee fields, so ethers fills maxFeePerGas and the gas limit from what
|
||
// the configured RPC node answers, with nothing otherwise bounding what a
|
||
// hostile node can set — the dApp path's ceilings never reached this one.
|
||
// Populating before the check is what makes assertWithinCeilings() see the
|
||
// same numbers that would be signed; it throws an ApprovalMismatchError when
|
||
// the product gasLimit × maxFeePerGas is over the bound, which the caller
|
||
// shows in the reserved error area rather than sending.
|
||
async function populateVerifyAndSend(connectedSigner, tx) {
|
||
let request;
|
||
if (tx.token === "ETH") {
|
||
request = { to: tx.to, value: parseEther(tx.amount) };
|
||
} else {
|
||
const contract = new Contract(tx.token, ERC20_ABI, connectedSigner);
|
||
// The contract's decimals() is read to be COMPARED with the scale the
|
||
// screen rendered this amount at, not to encode with: encoding from it
|
||
// signs whatever the contract answers now, which is not what the user
|
||
// read. A disagreement throws. See transferAmount.js.
|
||
const amount = transferAmountUnits(
|
||
tx.amount,
|
||
tx.tokenDecimals,
|
||
await contract.decimals(),
|
||
);
|
||
request = await contract.transfer.populateTransaction(tx.to, amount);
|
||
}
|
||
const populated = await connectedSigner.populateTransaction(request);
|
||
assertWithinCeilings(populated);
|
||
return connectedSigner.sendTransaction(populated);
|
||
}
|
||
|
||
// Show a full-sentence send failure in the reserved errors box, the same
|
||
// element and markup renderValidation() uses for messages carrying the user's
|
||
// own numbers, so it never moves anything on the screen.
|
||
function showSendError(message) {
|
||
const el = $("confirm-errors");
|
||
el.innerHTML = `<div class="text-xs">${escapeHtml(message)}</div>`;
|
||
el.style.visibility = "visible";
|
||
}
|
||
|
||
async function checkRecipientHistory(txInfo) {
|
||
try {
|
||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
|
||
fromAddress: txInfo.from,
|
||
});
|
||
for (const w of asyncWarnings) {
|
||
if (w.type === "contract") {
|
||
$("confirm-contract-warning").style.visibility = "visible";
|
||
}
|
||
if (w.type === "new-address") {
|
||
$("confirm-recipient-warning").style.visibility = "visible";
|
||
}
|
||
if (w.type === "etherscan-phishing") {
|
||
$("confirm-etherscan-warning").style.visibility = "visible";
|
||
}
|
||
}
|
||
} catch (e) {
|
||
log.errorf("recipient history check failed:", e.message);
|
||
}
|
||
}
|
||
|
||
// Drop the password from the DOM. Registered as the view-leave handler so
|
||
// it does not sit in the hidden view once the screen navigates on — to the
|
||
// wait screen after a send, or anywhere else the user goes.
|
||
function clearPassword() {
|
||
$("confirm-tx-password").value = "";
|
||
hideError("confirm-tx-password-error");
|
||
}
|
||
|
||
function init(_ctx) {
|
||
onViewLeave("confirm-tx", clearPassword);
|
||
|
||
$("btn-confirm-send").addEventListener("click", async () => {
|
||
const password = $("confirm-tx-password").value;
|
||
if (!password) {
|
||
showError(
|
||
"confirm-tx-password-error",
|
||
"Please enter your password.",
|
||
);
|
||
return;
|
||
}
|
||
|
||
const wallet = state.wallets[state.selectedWallet];
|
||
let decryptedSecret;
|
||
hideError("confirm-tx-password-error");
|
||
|
||
try {
|
||
decryptedSecret = await decryptWithPassword(
|
||
wallet.encryptedSecret,
|
||
password,
|
||
);
|
||
} catch {
|
||
showError(
|
||
"confirm-tx-password-error",
|
||
"That password is incorrect. Please try again.",
|
||
);
|
||
return;
|
||
}
|
||
|
||
$("btn-confirm-send").disabled = true;
|
||
$("btn-confirm-send").classList.add("text-muted");
|
||
|
||
let tx;
|
||
try {
|
||
const signer = getSignerForAddress(
|
||
wallet,
|
||
state.selectedAddress,
|
||
decryptedSecret,
|
||
);
|
||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||
const connectedSigner = signer.connect(provider);
|
||
|
||
tx = await populateVerifyAndSend(connectedSigner, pendingTx);
|
||
|
||
// Best-effort: clear decrypted secret after use.
|
||
// Note: JS strings are immutable; this nulls the reference but
|
||
// the original string may persist in memory until GC.
|
||
decryptedSecret = null;
|
||
txStatus.showWait(pendingTx, tx.hash);
|
||
} catch (e) {
|
||
decryptedSecret = null;
|
||
// A fee over the bound is refused before anything is broadcast, so
|
||
// there is no transaction that may have reached the network to warn
|
||
// about: the message stays on the confirmation screen where the
|
||
// user can go back, rather than routing to the sent/failed screen.
|
||
if (e && e.approvalMismatch) {
|
||
showSendError(e.message);
|
||
return;
|
||
}
|
||
const hash = tx ? tx.hash : null;
|
||
txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
|
||
} finally {
|
||
$("btn-confirm-send").disabled = false;
|
||
$("btn-confirm-send").classList.remove("text-muted");
|
||
}
|
||
});
|
||
|
||
$("btn-confirm-back").addEventListener("click", () => {
|
||
goBack();
|
||
});
|
||
}
|
||
|
||
module.exports = { init, show, restore, populateVerifyAndSend };
|