clawbot 3db066413e fix: a balance check of another address sets no swap minimum (closes #600) ...

BALANCE_CHECK_ERC20 takes (owner, token, minBalance), and every Universal
Router release that has it checks the owner's balance as written, without
map(), so address(1) and address(2) there are plain addresses. The decoder
read only the token and the minimum, so a check of another address's balance
read as Min. received. A check whose owner is not the transaction's sender now
sets neither Token Out nor the minimum, and its step reads "Balance Check (of
another address)"; one whose input does not decode reads "Balance Check (could
not be decoded)". A check of the sender keeps its reading, including the zero
reading for one the router lets fail.

Model: opus-5-5

2026-10-19 16:27:41 +02:00

..

e2e

fix: a send the confirmation screen refuses moves nothing on it (closes #583)

2026-10-19 14:45:01 +02:00

support

test: the popup boot in the jest suite sends no request to the internet (closes #559)

2026-10-19 08:46:18 +02:00

accountsChangedOpaqueOrigin.test.js

fix: a page whose origin has no host is never told an address by accountsChanged (closes #564)

2026-10-19 00:59:39 +02:00

addressKey.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

addressScanCancelled.test.js

fix: a popup that opened on Welcome keeps refreshing once the first wallet is added (closes #530)

2026-10-19 03:19:53 +02:00

addressValue.test.js

chore: escape every value the views write as markup, and cut symbols on code points (closes #329)

2026-10-05 10:43:06 +02:00

addressWarnings.test.js

fix: the recipient warning says what it checked and skips addresses that have received ETH (closes #528)

2026-10-19 02:34:13 +02:00

addWalletSeparatePassword.test.js

fix: say a second wallet's password is separate when one is chosen (closes #374)

2026-09-21 21:11:09 +02:00

alarms.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

applyEnrichment.test.js

chore: bring the token-list enrichment tooling into script/lib (closes #495)

2026-10-14 20:10:30 +02:00

approvalAmount.test.js

test: a token scale of zero decimals is used, not skipped (closes #325)

2026-10-05 05:43:05 +02:00

approvalDisplayFloor.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

approvalNonce.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

approvalOrigin.test.js

fix: only the user switches the wallet's network (closes #408)

2026-10-08 07:30:16 +02:00

approvalTx.test.js

fix: estimate a request even when the site sends its gas limit (closes #554)

2026-10-14 19:46:01 +02:00

approvalVerify.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

approvalWindow.test.js

fix: approval windows open as wide as the page (closes #518)

2026-10-16 05:44:50 +02:00

backgroundApproval.test.js

fix: a site allowed without Remember stays connected when the background worker idles (closes #526)

2026-10-18 23:59:24 +02:00

backgroundStateIsolation.test.js

fix: only the user switches the wallet's network (closes #408)

2026-10-08 07:30:16 +02:00

backgroundStateLintRule.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backNavigation.test.js

fix: Back from Settings never lands on Settings itself (closes #481)

2026-10-07 05:26:06 +02:00

balanceLineEscaping.test.js

chore: re-vendor canonical files from prompts at dd4027b (closes #472)

2026-10-06 15:59:21 +02:00

balanceRefreshCancelled.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

buildForbiddenInputs.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

buildWatch.test.js

fix: make dev rebuilds dist/ on source changes (closes #332)

2026-10-06 03:43:18 +02:00

chainSwitchGate.test.js

fix: switching the network in Settings tells open pages (closes #500)

2026-10-08 09:13:16 +02:00

coldWorkerChainId.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

coldWorkerChainSwitch.test.js

fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

2026-10-19 11:50:39 +02:00

coldWorkerSendTransaction.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

confirmTxFeeBound.test.js

fix: a send the confirmation screen refuses moves nothing on it (closes #583)

2026-10-19 14:45:01 +02:00

confirmTxLateResult.test.js

fix: a recipient warning on the confirmation screen is about the recipient on screen (closes #575)

2026-10-19 12:27:09 +02:00

confirmTxNetworkSwitch.test.js

fix: a send the confirmation screen refuses moves nothing on it (closes #583)

2026-10-19 14:45:01 +02:00

connectedSitesWorkerRestart.test.js

fix: a site allowed without Remember stays connected when the background worker idles (closes #526)

2026-10-18 23:59:24 +02:00

constants.test.js

build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

2026-08-10 16:15:22 +02:00

contractCreation.test.js

harden: drop 'unsafe-inline' from style-src (closes #328)

2026-10-05 15:26:06 +02:00

debugBanner.test.js

chore: keep the internal view id out of the release banner (closes #375)

2026-09-22 00:45:06 +02:00

debugFetch.test.js

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

2026-10-04 21:09:04 +02:00

deleteAddress.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

deleteWalletLostPassword.test.js

fix: the delete wallet screens name the wallet's own key material (closes #529)

2026-10-19 06:12:00 +02:00

dustThreshold.test.js

chore: re-vendor canonical files from prompts at dd4027b (closes #472)

2026-10-06 15:59:21 +02:00

etherscanLabels.test.js

feat: expand confirm-tx warnings — closes #114 (#118)

2026-03-01 19:34:54 +01:00

ethSign.test.js

fix: eth_sign's warning and the README say what it signs (closes #409)

2026-10-14 15:41:22 +02:00

exportPrivkey.test.js

fix: show every password error in its own fixed-height line (closes #493)

2026-10-07 10:59:16 +02:00

extensionId.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

fabricatedDecimals.test.js

fix: the swap summary is shown only for a transaction sent to a Universal Router (closes #520)

2026-10-19 04:40:55 +02:00

firstWalletActiveAddress.test.js

fix: the first wallet's first address is active as soon as it is added (closes #512)

2026-10-16 07:15:29 +02:00

firstWalletRefresh.test.js

test: no timer a popup test started fires after cleanupPopup() (closes #578)

2026-10-19 04:06:24 +02:00

flashLine.test.js

fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

2026-10-19 11:50:39 +02:00

holders.test.js

harden: a holders_count that is not plain digits is unknown, not read in part (closes #251)

2026-10-05 02:59:15 +02:00

htmlEscape.test.js

chore: escape every value the views write as markup, and cut symbols on code points (closes #329)

2026-10-05 10:43:06 +02:00

icons.test.js

chore: draw the toolbar icons in-tree with make icons (closes #378)

2026-10-07 06:43:08 +02:00

inpageErrors.test.js

fix: refuse an unsupported method with EIP-1193 code 4200 (closes #279)

2026-10-04 09:24:41 +02:00

inpageProviderUuid.test.js

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-10-03 16:26:39 +02:00

manifest.test.js

harden: drop 'unsafe-inline' from style-src (closes #328)

2026-10-05 15:26:06 +02:00

nativeCurrency.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

networkEndpoints.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

packaging.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

passwordErrorLines.test.js

fix: show every password error in its own fixed-height line (closes #493)

2026-10-07 10:59:16 +02:00

passwordMessages.test.js

fix: one wording for an empty password field on every screen (closes #265)

2026-08-17 08:59:59 +02:00

persistedEntryFloors.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

persistedFieldContract.test.js

fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

2026-10-19 11:50:39 +02:00

personalSignDisplay.test.js

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

2026-10-04 22:09:07 +02:00

phishingDomains.test.js

fix: a listed site ending in a dot gets the phishing warning (closes #534)

2026-10-14 10:48:41 +02:00

popupBoot.test.js

test: the popup boot in the jest suite sends no request to the internet (closes #559)

2026-10-19 08:46:18 +02:00

popupElementIds.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

proxyMethods.test.js

chore: drop eth_chainId and net_version from PROXY_METHODS (closes #326)

2026-10-06 00:48:45 +02:00

resolveTokenSymbol.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

rpcErrorCodes.test.js

fix: failed requests reach the page with an error code and the node's data (closes #533)

2026-10-18 22:12:10 +02:00

rpcErrorLog.test.js

fix: the recipient warning says what it checked and skips addresses that have received ETH (closes #528)

2026-10-19 02:34:13 +02:00

rpcOrigin.test.js

fix: a request whose origin has no host is refused, not treated as a site (closes #527)

2026-10-16 04:44:49 +02:00

sendAmountRule.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

sendDisplayFloor.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

sendMax.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

sendTokenSelect.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

settingsEndpointCheck.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

settingsUtcTimestamps.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

showPhrase.test.js

fix: Back from Settings never lands on Settings itself (closes #481)

2026-10-07 05:26:06 +02:00

state.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateMerge.test.js

fix: a change made while an earlier save is running is stored (closes #448)

2026-10-05 04:43:06 +02:00

stateRecovery.test.js

fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373)

2026-10-05 00:09:06 +02:00

stateSchema.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateUnusableRpc.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

swapStatusAmount.test.js

fix: a V4 swap action not in the deployed shape is shown as not decoded (closes #358)

2026-10-16 03:00:32 +02:00

symbolSpoof.test.js

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

2026-10-04 21:09:04 +02:00

timestampDisplay.test.js

chore: remove dead exports and share copied view helpers (closes #168)

2026-10-05 09:09:06 +02:00

tokenLookupCancelled.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

tokenLookupTruncation.test.js

fix: a token symbol read off a contract is never stored cut mid-emoji (closes #458)

2026-10-06 23:59:21 +02:00

tokenTransferDetail.test.js

fix: the transaction detail screen decodes a token transfer against the token contract (closes #515)

2026-10-14 16:37:55 +02:00

trackedTokensPerNetwork.test.js

fix: a send the confirmation screen refuses moves nothing on it (closes #583)

2026-10-19 14:45:01 +02:00

transactionListCancelled.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

transactions.test.js

chore: the native token's label follows the network (closes #372)

2026-10-05 01:26:04 +02:00

transferAmount.test.js

fix: Send refuses every amount the confirmation screen would refuse (closes #532)

2026-10-18 22:46:07 +02:00

txStatus.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

txValidation.test.js

fix: Send refuses every amount the confirmation screen would refuse (closes #532)

2026-10-18 22:46:07 +02:00

typedDataPermit.test.js

fix: typed data with a missing field or a bool that is not true or false is refused (closes #552)

2026-10-16 03:33:39 +02:00

uniswap.test.js

fix: a step the router lets fail is marked and sets no minimum (closes #602)

2026-10-19 15:24:13 +02:00

uniswapRecipient.test.js

fix: a balance check of another address sets no swap minimum (closes #600)

2026-10-19 16:27:41 +02:00

uniswapRouterAddress.test.js

fix: the swap summary is shown only for a transaction sent to a Universal Router (closes #520)

2026-10-19 04:40:55 +02:00

uniswapTokenOut.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

uniswapUndeterminedTokenIn.test.js

fix: a balance check of another address sets no swap minimum (closes #600)

2026-10-19 16:27:41 +02:00

uniswapUndeterminedTokenOut.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

uniswapUnknownDecimals.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

unknownScaleDisplay.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

unknownScaleSend.test.js

fix: the confirmation screen reads its balance on the network it is drawn for (closes #558)

2026-10-19 09:54:09 +02:00

vault.test.js

chore: re-vendor canonical files from prompts at dd4027b (closes #472)

2026-10-06 15:59:21 +02:00

vaultBackend.test.js

fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00

version.test.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00

wallet.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

walletDefects.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

walletDelete.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00