sneak
ee2e3f6dfd
Sign & Send wrote its two refusals, a network changed since review and a fee over the bound, into the errors box above the password field. That box reserves one empty line, so a refusal grew it and pushed the password field and Sign & Send down. Each refusal now has its own box with its sentence fixed in index.html, holding its space from the first paint and only made visible, as #558 did for the balance messages. The fee refusal no longer quotes the fee; its full reason is logged. A Chrome test raises the stub node's fee only at signing and checks the password field and Sign & Send stay where they were. Model: opus-5-5
101 lines
3.9 KiB
JavaScript
101 lines
3.9 KiB
JavaScript
// The wallet's OWN send path enforces the same combined fee bound the dApp
|
|
// path does (https://git.eeqj.de/sneak/AutistMask/issues/399).
|
|
//
|
|
// The send in src/popup/views/confirmTx.js pins no fee fields, so ethers fills
|
|
// maxFeePerGas and the gas limit from whatever the configured RPC node
|
|
// answers. Nothing bounded that: a hostile node could report a fee whose
|
|
// product with the gas limit is thousands of ETH, and it would be both
|
|
// displayed and signed. populateVerifyAndSend() populates the transaction and
|
|
// runs assertWithinCeilings() on the populated fees before signing, so an
|
|
// over-bound send is refused before anything is broadcast.
|
|
//
|
|
// The check is driven here with a fake connected signer rather than a real
|
|
// one: populateTransaction() returns the fees the node would have produced,
|
|
// and sendTransaction() records whether the send actually happened. The real
|
|
// DOM path around it — the refusal shown in the box reserved for it — is
|
|
// covered by the Chrome e2e suite.
|
|
|
|
globalThis.chrome = {
|
|
storage: { local: { get: async () => ({}), set: async () => {} } },
|
|
};
|
|
|
|
global.fetch = jest.fn(() => {
|
|
throw new Error("tests must not perform network requests");
|
|
});
|
|
|
|
const { populateVerifyAndSend } = require("../src/popup/views/confirmTx");
|
|
const {
|
|
MAX_FEE_PER_GAS,
|
|
MAX_TOTAL_FEE,
|
|
} = require("../src/shared/approvalVerify");
|
|
|
|
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
|
|
|
// A signer whose populateTransaction() fills in the fees a node quoted and
|
|
// whose sendTransaction() records the call, so a test can assert whether the
|
|
// send was reached at all.
|
|
function fakeSigner(fees) {
|
|
const sent = [];
|
|
return {
|
|
sent,
|
|
populateTransaction: async (request) => ({
|
|
...request,
|
|
from: RECIPIENT,
|
|
nonce: 0,
|
|
type: 2,
|
|
chainId: 1n,
|
|
gasLimit: fees.gasLimit,
|
|
maxFeePerGas: fees.maxFeePerGas,
|
|
maxPriorityFeePerGas: 1000000000n,
|
|
}),
|
|
sendTransaction: async (tx) => {
|
|
sent.push(tx);
|
|
return { hash: "0xabc" };
|
|
},
|
|
};
|
|
}
|
|
|
|
const ETH_SEND = { token: "ETH", to: RECIPIENT, amount: "1.0" };
|
|
|
|
describe("populateVerifyAndSend enforces the combined fee bound", () => {
|
|
// A gas limit and a fee that are each under their own field ceiling, but
|
|
// multiply to about 3,000 ETH — the combination the per-field ceilings
|
|
// cannot see.
|
|
const OVER = { gasLimit: 30000000n, maxFeePerGas: MAX_FEE_PER_GAS };
|
|
|
|
test("each field is under its ceiling but the product is over the bound", () => {
|
|
expect(OVER.maxFeePerGas).toBeLessThanOrEqual(MAX_FEE_PER_GAS);
|
|
expect(OVER.gasLimit * OVER.maxFeePerGas).toBeGreaterThan(
|
|
MAX_TOTAL_FEE,
|
|
);
|
|
});
|
|
|
|
test("refuses an over-bound send without broadcasting it", async () => {
|
|
const signer = fakeSigner(OVER);
|
|
let thrown;
|
|
try {
|
|
await populateVerifyAndSend(signer, ETH_SEND);
|
|
} catch (e) {
|
|
thrown = e;
|
|
}
|
|
expect(thrown).toBeDefined();
|
|
expect(thrown.approvalMismatch).toBe(true);
|
|
expect(thrown.message).toMatch(/^[A-Z].*\.$/);
|
|
expect(thrown.message).toContain("3000.0 ETH");
|
|
expect(thrown.message).toContain("1.0 ETH");
|
|
// The one guarantee that matters: nothing was signed or sent.
|
|
expect(signer.sent).toHaveLength(0);
|
|
});
|
|
|
|
test("broadcasts a send whose product is just under the bound", async () => {
|
|
// 21,000 gas at 40 gwei is 0.00084 ETH — an ordinary send.
|
|
const under = { gasLimit: 21000n, maxFeePerGas: 40000000000n };
|
|
expect(under.gasLimit * under.maxFeePerGas).toBeLessThan(MAX_TOTAL_FEE);
|
|
const signer = fakeSigner(under);
|
|
const tx = await populateVerifyAndSend(signer, ETH_SEND);
|
|
expect(tx.hash).toBe("0xabc");
|
|
expect(signer.sent).toHaveLength(1);
|
|
expect(signer.sent[0].gasLimit).toBe(under.gasLimit);
|
|
});
|
|
});
|