🦄 Open source interfaces for the Uniswap protocol
This report summarizes scanner evidence for Uniswap/interface, a TypeScript project with 5,546 GitHub stars. SynthScan examined 1,476,738 lines of code across 11100 source files, recording 4319 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 3.8 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 4101 finding(s).
Are imports declared and package/API names verified? 63 finding(s).
Are wrappers, guards, and repeated structures necessary? 3491 finding(s).
Which changes need focused human review? 4319 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4319 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | oxlint.config.ts | 278 | export function restrictedImportPatternsForUniversePackage(packageName: string) { | CODE |
| LOW | dangerfile.ts | 56 | function checkGeneralizedHookFiles() { | CODE |
| LOW | config/oxlint-plugins/universe-custom.js | 67 | function getNearestJSXAncestorName(node) { | CODE |
| LOW | config/oxlint-plugins/universe-custom.js | 220 | function isPercentageTemplateLiteral(node) { | CODE |
| LOW | config/oxlint-plugins/universe-custom.js | 962 | function getPhysicalFilenameForBoundary(context) { | CODE |
| LOW | config/oxlint-plugins/universe-custom.js | 988 | function moduleImportSuffixForBoundary(source, boundary) { | CODE |
| LOW | config/oxlint-plugins/universe-custom.js | 1152 | function isDirectViemEthersAllowlisted(physicalPath) { | CODE |
| LOW | scripts/check-podfile-lock.ts | 138 | function readPackageDependencyNames(packageJsonPath: string): string[] { | CODE |
| LOW | scripts/add-icons.ts | 444 | export function removeGeneratedComponents(names: readonly string[], dirs: TargetDirs): string[] { | CODE |
| LOW | packages/uniswap/src/contexts/UniswapContext.tsx | 264 | export function useSignDelegationAuthorization(): SignDelegationAuthorizationFn | undefined { | CODE |
| LOW | …ages/uniswap/src/extension/useIsChromeWindowFocused.ts | 41 | export function useIsChromeWindowFocusedWithTimeout(timeoutInMs: number): boolean { | CODE |
| LOW | …nces/implementations/createDialogPreferencesService.ts | 16 | export function createDialogPreferencesService(ctx: DialogPreferencesServiceContext): DialogPreferencesService { | CODE |
| LOW | packages/uniswap/src/constants/addresses.ts | 14 | export function getWrappedNativeAddressWithThrow(chainId: UniverseChainId): string { | CODE |
| LOW | packages/uniswap/src/features/settings/constants.ts | 26 | export function deviceAccessTimeoutToMinutes(timeout: DeviceAccessTimeout): number | undefined { | CODE |
| LOW | packages/uniswap/src/features/settings/hooks.ts | 12 | export function useHideSmallBalancesSetting(): boolean { | CODE |
| LOW | packages/uniswap/src/features/settings/hooks.ts | 22 | export function useHideReportedActivitySetting(): boolean { | CODE |
| LOW | packages/uniswap/src/features/settings/hooks.ts | 37 | export function useTestnetModeBannerHeight(): number { | CODE |
| LOW | …/settings/balances/PortfolioBalanceSettingsContent.tsx | 18 | export function PortfolioBalanceSettingsContent(): JSX.Element { | CODE |
| LOW | packages/uniswap/src/features/reporting/reports.ts | 115 | export function submitTokenWarningDataReport({ | CODE |
| LOW | packages/uniswap/src/features/reporting/reports.ts | 222 | export function submitPortfolioDataReport({ | CODE |
| LOW | …uniswap/src/features/prices/LowPriceConfidenceIcon.tsx | 10 | export function LowPriceConfidenceTooltip({ children }: { children: ReactNode }): JSX.Element { | CODE |
| LOW | …/features/prices/isRemotePriceServiceSupportedChain.ts | 8 | export function isRemotePriceServiceSupportedChain(chainId: number): boolean { | CODE |
| LOW | …/uniswap/src/features/prices/LowPriceConfidenceTag.tsx | 24 | function LowPriceConfidenceTagWithSheet(): JSX.Element { | CODE |
| LOW | …niswap/src/features/gas/convertGasFeeToDisplayValue.ts | 15 | export function convertGasFeeToDisplayValue({ | CODE |
| LOW | packages/uniswap/src/features/gas/utils.ts | 64 | export function applyNativeTokenPercentageBuffer( | CODE |
| LOW | packages/uniswap/src/features/gas/utils.ts | 95 | function getNativeCurrencyTotalSpend({ | CODE |
| LOW | packages/uniswap/src/features/gas/utils.ts | 117 | export function hasSufficientFundsIncludingGas(params: { | CODE |
| LOW | packages/uniswap/src/features/gas/utils.ts | 268 | export async function estimateGasWithClientSideProvider({ | CODE |
| LOW | packages/uniswap/src/features/gas/shiftedGasToken.ts | 42 | export function hasSufficientFundsIncludingShiftedGasToken({ | CODE |
| LOW | packages/uniswap/src/features/gas/shiftedGasToken.ts | 84 | export function convertShiftedGasFeeForDisplay(gasFeeRaw: string, decimalShift: bigint): string { | CODE |
| LOW | packages/uniswap/src/features/gas/hooks.ts | 104 | export function useUSDCurrencyAmountOfGasFee( | CODE |
| LOW | packages/uniswap/src/features/gas/hooks.ts | 144 | export function useFormattedUniswapXGasFeeInfo( | CODE |
| LOW | packages/uniswap/src/features/gas/hooks.ts | 178 | export function useGasFeeHighRelativeToValue( | CODE |
| LOW | packages/uniswap/src/features/gas/utils/cancel.ts | 33 | export function createClassicCancelRequest(transaction: TransactionDetails): providers.TransactionRequest { | CODE |
| LOW | packages/uniswap/src/features/gas/utils/cancel.ts | 45 | export function calculateCancellationGasFee(params: { | CODE |
| LOW | packages/uniswap/src/features/gas/utils/cancel.ts | 77 | export function calculateClassicCancellationGas( | CODE |
| LOW | packages/uniswap/src/features/gas/utils/cancel.ts | 149 | export function calculateUniswapXCancellationGas( | CODE |
| LOW | packages/uniswap/src/features/gas/utils/cancel.ts | 168 | function getCancellationGasFeeDisplayValue({ | CODE |
| LOW⚡ | …niswap/src/features/gas/tempoFeeToken/tempoFeeToken.ts | 12 | export async function fetchTempoFeeTokenPreference(accountAddress: Address): Promise<Address | null> { | CODE |
| LOW⚡ | …niswap/src/features/gas/tempoFeeToken/tempoFeeToken.ts | 22 | function getTempoFeeTokenPreferenceQueryKey(accountAddress?: Address): TempoFeeTokenPreferenceQueryKey { | CODE |
| LOW⚡ | …niswap/src/features/gas/tempoFeeToken/tempoFeeToken.ts | 29 | export function getTempoFeeTokenPreferenceQueryOptions( | CODE |
| LOW | …eatures/gas/components/CrosschainNotSupportedModal.tsx | 26 | export function CrosschainNotSupportedModal({ isOpen, onClose }: CrosschainNotSupportedModalProps): JSX.Element { | CODE |
| LOW | …omponents/NetworkCostEditor/useRecommendedGasFields.ts | 38 | export function getRecommendedGasFieldsFromQuoteGas(args: { | CODE |
| LOW | …nents/NetworkCostEditor/useGasOverridesWarningState.ts | 37 | export function useGasOverridesWarningState({ | CODE |
| LOW | …ts/NetworkCostEditor/buildGasServiceUrgencyOverride.ts | 25 | export function buildGasServiceUrgencyOverride({ | CODE |
| LOW | …ges/uniswap/src/features/gas/hooks/useChainGasToken.ts | 25 | function isTempoFeeTokenStablecoin(currency: Currency): boolean { | CODE |
| LOW | …ap/src/features/gas/hooks/useCancellationGasFeeInfo.ts | 37 | export function useCancellationGasFeeInfo( | CODE |
| LOW | …/src/features/gas/hooks/useIsCustomGasFlowAvailable.ts | 25 | export function useIsCustomGasFlowAvailable(): boolean { | CODE |
| LOW | …ap/src/features/gas/hooks/useTradingApiGasOverrides.ts | 27 | export function useTradingApiGasOverrides(args: { | CODE |
| LOW | …p/src/features/gas/hooks/useEnableCustomGasFeeEntry.ts | 6 | export function useEnableCustomGasFeeEntry(): boolean { | CODE |
| LOW | …p/src/features/gas/hooks/useEnableCustomGasFeeEntry.ts | 10 | export function useSetEnableCustomGasFeeEntry(): (enabled: boolean) => void { | CODE |
| LOW | …es/uniswap/src/features/gas/hooks/useMaxAmountSpend.ts | 106 | function convertGasFeeToGasTokenUnits({ | CODE |
| LOW | …es/uniswap/src/features/gas/hooks/useMaxAmountSpend.ts | 159 | export function useLowBalanceWarningGasPercentage(): number { | CODE |
| LOW | …rc/features/gas/hooks/usePlanCancellationGasFeeInfo.ts | 28 | export function usePlanCancellationGasFeeInfo( | CODE |
| LOW | packages/uniswap/src/features/dataApi/safety.ts | 30 | export function fromGraphQLProtectionResult(result: GraphQLApi.ProtectionResult | undefined): ProtectionResult { | CODE |
| LOW | packages/uniswap/src/features/dataApi/safety.ts | 78 | export function fromTradingApiSafetyLevel(level: TradingApi.SafetyLevel | undefined): SafetyLevel | undefined { | CODE |
| LOW | packages/uniswap/src/features/dataApi/searchTokens.ts | 18 | export function toMultichainSearchResults({ | CODE |
| LOW | packages/uniswap/src/features/dataApi/searchTokens.ts | 46 | export function useMultichainSearchTokens({ | CODE |
| LOW | packages/uniswap/src/features/dataApi/searchTokens.ts | 82 | export function filterMultichainResultsToChain( | CODE |
| LOW | packages/uniswap/src/features/dataApi/searchAuctions.ts | 42 | function getAuctionAddressFromAuctionId(auctionId: string): string | undefined { | CODE |
| 3276 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/margin/stores/marginFormStore/marginActionKey.test.ts | 10 | // The full contract, one row per reachable (action, equity, leverage) combination. `adjust` stands in | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 12 | // What the leverage control asks for, RELATIVE TO the position's current leverage: | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 14 | // equity and keep my leverage" is expressed, i.e. the leverage control left untouched, | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 32 | // Both ends of a position's life name themselves: an open always sizes off leverage × equity, a | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 64 | // Holding leverage while nothing else moves asks for nothing. | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 73 | // Keeping leverage while equity grows still has to borrow more, so it rides the increase | COMMENT |
| MEDIUM | …tions/margin/stores/marginFormStore/marginActionKey.ts | 88 | // Mirror of the add case: keeping leverage while equity shrinks has to repay debt. | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 35 | // Keys that move leverage and nothing else, so they carry NO wallet-side rail — the only two keys | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 42 | // The keys with no leverage swap, so the leverage-leg tolerance is forbidden. = backend EQUITY_ONLY_KEYS. | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 57 | // Decimal string ('2.5', never a WAD). Required by the keys that move leverage, forbidden on the rest. | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 62 | // two pure leverage moves; carries the pay/receive token, its chain, the equity magnitude, and the | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 169 | // The four equity+leverage composites share the identical { positionId, leverageTarget, amount } shape; | COMMENT |
| MEDIUM | …rgin/stores/marginFormStore/buildMarginQuoteRequest.ts | 192 | // quote disabled), and the single slippage setting fills BOTH configs — the leverage leg's bound and | COMMENT |
| MEDIUM | …stores/marginFormStore/buildMarginQuoteRequest.test.ts | 184 | // Only the two PURE leverage moves carry no wallet rail. `close` pays OUT through a swap, so it names | COMMENT |
| MEDIUM | …stores/marginFormStore/buildMarginQuoteRequest.test.ts | 316 | // close pays out through a swap, so unlike a pure leverage move it DOES carry a wallet rail. | COMMENT |
| MEDIUM | …/src/data/apiClients/tradingApi/useMarginQuoteQuery.ts | 23 | // floor, invalid leverage) whose retry just delays the message. Note isRateLimitFetchError's 412-429 | COMMENT |
| MEDIUM | …/src/data/apiClients/tradingApi/useMarginQuoteQuery.ts | 99 | // keeps a leverage retarget bridging — that is the edit the bridge exists for — at the cost of one | COMMENT |
| MEDIUM | …data/apiClients/tradingApi/useMarginQuoteQuery.test.ts | 178 | // The bridge exists FOR this edit: a leverage retarget re-keys the query on every slider step, and | COMMENT |
| MEDIUM | …data/apiClients/tradingApi/useMarginQuoteQuery.test.ts | 179 | // refusing it would unmount the size/leverage block mid-drag. Comparing the action KEY rather than the | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 23 | // Units on this wire: amounts are raw-unit decimal strings; leverage is a DECIMAL | COMMENT |
| MEDIUM⚡ | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 102 | // The wallet-side pay/receive token and its chain. Present on every key but the two pure leverage | COMMENT |
| MEDIUM⚡ | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 113 | // (size = leverage × equity). | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 134 | // Keys with no leverage swap at all: size is held, so the leverage-leg tolerance | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 158 | // leverage leg — neither tolerance defaults from the other. Flow direction comes | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 189 | // from a leverage number. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 193 | // The leverage moves, and the four composites. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 208 | // a composite action populates two of them. Identity/leverage pins and the | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 310 | // Decimal string, EXPOSURE leverage. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 366 | // Present iff the action moved leverage. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 432 | // Max over the allowlist, decimal leverage. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 697 | // LIVE exposure leverage = size × oraclePrice / equity, NOT the open-time | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 699 | // such a position has no finite leverage — render ∞. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 721 | // Exposure leverage at open, decimal string. | COMMENT |
| MEDIUM | …swap/src/data/apiClients/tradingApi/MarginApiClient.ts | 854 | // and every leverage/equity variant is an ADJUST to this client. Collapse it to the intent vocabulary | COMMENT |
| MEDIUM | packages/ui/src/components/slider/Slider.tsx | 24 | // Cross-platform controlled slider. Web is the only real leg today (margin's leverage slider); the | COMMENT |
| MEDIUM | packages/config-cli/src/lib/lock/lock.test.ts | 62 | // `second` enters the race. Polling on an observable signal is robust to changes in | COMMENT |
| MEDIUM | packages/wallet/src/features/wallet/context.tsx | 49 | // Probably not strictly necessary but more robust than relying on 'organic' re-renders | COMMENT |
| MEDIUM | apps/web/src/constants/margin.ts | 63 | // This venue's server-authored max leverage, decimal. The selector's headline is a max across the | COMMENT |
| MEDIUM | …adApp/Modal/EmbeddedWalletOnboarding/TokenCarousel.tsx | 8 | // Enough tokens that the duplicated strip is always wider than the modal, keeping the loop seamless. | COMMENT |
| MEDIUM | …adApp/Modal/EmbeddedWalletOnboarding/TokenCarousel.tsx | 11 | // The strip is rendered twice, so animating 0 -> -50% scrolls tokens right-to-left in a seamless loop. | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/index.tsx | 169 | // The strip is duplicated only while the marquee runs, purely for the seamless wrap (same | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/LaunchesPage.test.tsx | 476 | // The pill strip is rendered twice for the seamless loop, so each admitted row shows twice. | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/LaunchesPage.test.tsx | 563 | // Each pill in the capped strip renders twice — the strip is doubled for the seamless loop — | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/LaunchesHero.tsx | 44 | // The strip is rendered twice, so animating 0 -> -50% scrolls the pills right-to-left in a seamless | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/LaunchesHero.tsx | 148 | // One pill per distinct token, capped; the strip is duplicated below purely for the seamless loop. | COMMENT |
| MEDIUM | apps/web/src/pages/Launches/useTrendingMarquee.ts | 112 | // Distance between a card and its clone — measured from the DOM so the wrap stays seamless | COMMENT |
| MEDIUM | …ps/web/src/pages/Swap/Margin/marginPriceImpact.test.ts | 116 | // A plain deposit or withdraw with no leverage retarget has no swap leg, so the adjust quote | COMMENT |
| MEDIUM | …/web/src/pages/Swap/Margin/marginAdjustPositionMath.ts | 7 | // Resulting EXPOSURE leverage if debt stays constant and equity moves by deltaCollateral (signed, | COMMENT |
| MEDIUM⚡ | …/web/src/pages/Swap/Margin/marginAdjustPositionMath.ts | 38 | // position — it flips the LTV's sign, which would slip under the `>= 1` test and report a LOW leverage | COMMENT |
| MEDIUM⚡ | …/web/src/pages/Swap/Margin/marginAdjustPositionMath.ts | 47 | // Current EXPOSURE leverage, off the wire (decimal string). Undefined carries TWO claims, and callers | COMMENT |
| MEDIUM⚡ | …/web/src/pages/Swap/Margin/marginAdjustPositionMath.ts | 49 | // - the wire OMITS the field — the position has no finite leverage (equity at or below zero), which | COMMENT |
| MEDIUM⚡ | …/web/src/pages/Swap/Margin/marginAdjustPositionMath.ts | 54 | // `position.leverage === undefined` for the first before falling back. Gate arithmetic that must stay | COMMENT |
| MEDIUM | apps/web/src/pages/Swap/Margin/marginReviewVenuePin.ts | 15 | // Venue selection is amount- and leverage-aware and re-runs on every poll, so the quote under an open | COMMENT |
| MEDIUM | …eb/src/pages/Swap/Margin/marginCompletionToast.test.ts | 124 | // A second leverage value: without it, "interpolates the leverage" and "hardcodes 2x" are | COMMENT |
| MEDIUM | apps/web/src/pages/Swap/Margin/MarginPositionsTable.tsx | 157 | // (direction + leverage) and `trailing` (the liquidation pill) are composed by the caller from the | COMMENT |
| MEDIUM | apps/web/src/pages/Swap/Margin/MarginPositionsTable.tsx | 224 | // Direction + CURRENT leverage, in the direction color. Leverage at open lives in the drawer. | COMMENT |
| MEDIUM | …src/pages/Swap/Margin/marginAdjustPositionGate.test.ts | 21 | // Floors rather than rounds: `locked` holds leverage constant, so the 2-decimal step must never | COMMENT |
| MEDIUM | …src/pages/Swap/Margin/marginAdjustPositionGate.test.ts | 22 | // wire MORE leverage than the position actually holds. | COMMENT |
| MEDIUM | …src/pages/Swap/Margin/marginAdjustPositionGate.test.ts | 40 | // the position reports no leverage). Pinned because the alternative is parseUnits throwing out of | COMMENT |
| MEDIUM | …src/pages/Swap/Margin/marginAdjustPositionGate.test.ts | 283 | // Change leverage opens in drift with no funding, so its first render must be a no-change. | COMMENT |
| 213 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | oxlint.config.ts | 671 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 673 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 675 | // ── Migration files: relax type rules ───────────────────────────── | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 713 | // ── Storybook: allow alerts ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 720 | // ── JavaScript files: allow console ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 728 | // ── Mycelium platform-leg gate (INFRA-3517) ─────────────────────── | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 802 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 804 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | oxlint.config.ts | 806 | // ── apps/cli, config-cli ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 85 | // ── Shared no-restricted-imports definitions ────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 288 | // ── Shared no-restricted-syntax selectors ───────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 346 | // ── Shared override fragments ──────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 385 | // ── complexity ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 403 | // ── correctness ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 468 | // ── security ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 476 | // ── style ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 559 | // ── additional rules ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 577 | // ── suspicious ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 623 | // ── jsPlugin rules (excluded when ENABLE_FAST_LINT=true) ────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 686 | // ── Saga files ────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 697 | // ── Logger, scripts, devtools: allow console ────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 847 | // ── apps/dev-portal ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 880 | // ── apps/unilens ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 910 | // ── apps/extension ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1010 | // ── apps/mission-control ────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1066 | // ── apps/mobile ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1137 | // ── apps/web ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1146 | // ── @universe/embedded-wallet web protocol layer ────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1360 | // ── labs ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1391 | // ── labs/workbench ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1423 | // ── apps/pools-xyz ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1458 | // ── packages/uniswap ────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1481 | // ── packages/wallet ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1504 | // ── packages/ui ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1542 | // ── packages/utilities ──────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1557 | // ── packages/datadog-cloud ──────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1566 | // ── packages/mycelium ───────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1580 | // ── packages/prices ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1598 | // ── @universe/* packages with standard pattern ──────────────────── | COMMENT |
| MEDIUM | oxlint.config.ts | 1631 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | oxlint.config.ts | 1633 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | oxlint.config.ts | 1685 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | oxlint.config.ts | 1688 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 17 | // ── Utilities ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 38 | // ── no-unwrapped-t ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 111 | // ── custom-map-sort ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 159 | // ── no-hex-string-casting ────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 202 | // ── no-transform-percentage-strings ──────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 339 | // ── enforce-query-options-result ──────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 459 | // ── no-redux-modals ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 506 | // ── no-relative-import-paths ─────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 586 | // ── no-nested-component-definitions ────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 720 | // ── jsx-prop-order ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 825 | // ── enum-member-naming ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 852 | // ── no-tolowercase-address-currencyid ────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 907 | // ── no-platform-gate-in-chain-flags ────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 951 | // ── import-boundary (JSON) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 1118 | // ── no-direct-viem-ethers-import ─────────────────────────────────────── | COMMENT |
| MEDIUM | config/oxlint-plugins/universe-custom.js | 1215 | // ── Plugin export ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/check-runtime-versions.sh | 18 | # ============================================ | COMMENT |
| 95 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | i18next-parser.config.js | 61 | input: ['apps/**/*.tsx', 'apps/**/*.ts', 'packages/**/*.ts', 'packages/**/*.tsx'], | COMMENT |
| LOW | bunfig.toml | 1 | # Bun configuration file | COMMENT |
| LOW | oxlint.config.ts | 721 | { | COMMENT |
| LOW | config/oxlint-plugins/no-throwing-stub-imports.test.ts | 361 | COMMENT | |
| LOW | config/oxlint-plugins/mycelium-platform-legs.test.ts | 121 | } | COMMENT |
| LOW | config/oxlint-plugins/no-throwing-stub-imports.js | 21 | // apps/dev-portal, apps/mission-control) | COMMENT |
| LOW | config/oxlint-plugins/prefer-use-is-mounted.js | 1 | /** | COMMENT |
| LOW | scripts/check-runson-config.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/check-env-files.sh | 1 | #!/bin/sh | COMMENT |
| LOW | scripts/silence-deprecation-warnings.js | 1 | // Preloaded via `bun --preload` for the `check:deps:usage` Nx target so that | COMMENT |
| LOW | scripts/required-checks.test.ts | 261 | // hand-written name pairs: the row name in ci.yml's `affected` outputs, the | COMMENT |
| LOW | scripts/check-rn-patch-prebuilt-conflict.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/compute-affected.sh | 101 | exit 0 | COMMENT |
| LOW | scripts/releases/calculate_version.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …ripts/security-gate-feedback/security-gate-feedback.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …ripts/security-gate-feedback/security-gate-feedback.sh | 41 | # SINCE, so this only binds in repos busy enough that the window needs more pages -- backend | COMMENT |
| LOW | …ripts/security-gate-feedback/security-gate-feedback.sh | 121 | skipped=0 | COMMENT |
| LOW | …ripts/security-gate-feedback/security-gate-feedback.sh | 141 | # This does NOT weaken the degraded-read detection below. A total_count of 0 comes from a | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.test.ts | 381 | // stale. workflow_run fires on that workflow completing instead. The name must match the | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.test.ts | 441 | expect(cancelExpression).toContain("!(github.event_name == 'pull_request_review'") | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 41 | # --- review integrity ------------------------------------------------------------------ | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 61 | # | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 81 | # env, re-running any CI run from before the env var existed silently restored the old | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 101 | # N is a count of COUNTED APPROVALS -- the same currency as the baselines below, i.e. humans plus | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 121 | # OWNER_REVIEWS_ENABLED=0 stops the resolution running at all (an outage kill switch). | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 141 | # Written without the [bot] suffix, matched with it stripped, exactly as COUNTING_BOTS is -- one | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 161 | # From github.event.pull_request.draft ("true"/"false"), same sourcing and the same API | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 181 | # The gate's APPROVE therefore does one job: superseding its OWN earlier CHANGES_REQUESTED so | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 201 | # review-integrity, which never depends on the model and still requires its human approvals. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 221 | # do not hold up a medium change. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 241 | # Defined here, above the guard below, which consults it. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 261 | && in_list "$ACTION" "review_requested,review_request_removed" | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 301 | # calling ghapi before its definition is a runtime failure. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 321 | [ -z "$PR_AUTHOR" ] && PR_AUTHOR="$(printf '%s' "$_pr_json" | jq -r '.user.login // empty' 2>/dev/null)" | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 341 | # off. This sits BEFORE the pending sentinels are seeded and before any review or comment, so | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 501 | '{state:$s,context:$c,description:$d} + (if $u == "" then {} else {target_url:$u} end)' >/tmp/st.json | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 521 | # Why it is read unconditionally now: the classifier is sampled, and re-running a | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 681 | printf '%s' "$1" \ | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 701 | # The hidden markers are carried forward UNCHANGED. They are the gate's persisted state (the | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 941 | # the head-independent rule above -- the reason for it (a nit-fix push must not cost a re-review) | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1001 | # --- the gate's own review state ------------------------------------------------------ | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1021 | # read as thirty-two. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1141 | # ONE reader for both trusted prompt files. They are read identically, and the read is the part | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1321 | COMMENT | |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1421 | # enormous. Costs nothing in practice: the largest of 60 recent merged PRs touched 28 files. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1441 | # runs. "none" is recorded explicitly, so a resolved-nothing result is cached too rather than | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1461 | COMMENT | |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1581 | # For each changed path pick the LONGEST CODEOWNERS dir that prefixes it — "the nearest | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1641 | END { m=0; for (k in v) if (v[k] > m) m=v[k]; print m }' "$declfile" -)" | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1941 | # | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 1961 | return 1 | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2061 | fi | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2101 | # after retries, deliberately: a hiccup must not block PRs. | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2141 | else | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2161 | elif [ "$ri_human" -lt "$MIN_HUMAN" ]; then | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2201 | evaluate_review_integrity || exit 1 | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2281 | # the gate's own commit status instead of recomputing it. Re-running would spend a second | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2321 | # Done in the DATA, not in each renderer: severity is printed by render_findings_table, by | COMMENT |
| LOW | scripts/security-gate-check/security-gate-check.sh | 2401 | COMMENT | |
| 241 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/argent-react-native-profiler/SKILL.md | 79 | ### Step 1: Start profiling | COMMENT |
| LOW⚡ | .agents/skills/argent-react-native-profiler/SKILL.md | 93 | ### Step 2: Stop and collect | COMMENT |
| LOW⚡ | .agents/skills/argent-react-native-profiler/SKILL.md | 98 | ### Step 3: Analyze | COMMENT |
| LOW⚡ | .agents/skills/argent-react-native-profiler/SKILL.md | 108 | ### Step 4: Assess results | COMMENT |
| LOW⚡ | .agents/skills/argent-react-native-profiler/SKILL.md | 112 | ### Step 5: Present findings and ask about next steps | COMMENT |
| LOW⚡ | .agents/skills/argent-react-native-profiler/SKILL.md | 116 | ### Step 6: Drill-down investigation (iterative) | COMMENT |
| LOW | .agents/skills/argent-react-native-profiler/SKILL.md | 129 | ### Step 7: Reload a previous session | COMMENT |
| LOW | .agents/skills/argent-react-native-profiler/SKILL.md | 140 | ### Step 8: Apply fix and re-profile | COMMENT |
| LOW | .agents/skills/argent-native-profiler/SKILL.md | 43 | ### Step 0: Ensure the target app is running | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 54 | ### Step 1: Start recording | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 59 | ### Step 2: Stop and export | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 63 | ### Step 3: Analyze | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 67 | ### Step 4: Present findings and ask about next steps | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 71 | ### Step 5: Drill-down investigation | COMMENT |
| LOW⚡ | .agents/skills/argent-native-profiler/SKILL.md | 75 | ### Step 6: Reload previous sessions | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 42 | ## Step 1: understand the view | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 55 | ## Step 2: design the props (the one creative step; reviewed hardest) | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 74 | ## Step 3: move the view | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 84 | ## Step 4: write the adapter (stays in packages/uniswap) | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 97 | ## Step 5: story | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 104 | ## Step 6: test (all of this, every batch) | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 121 | ## Step 7: PR | COMMENT |
| LOW | scripts/swap-ui/EXTRACTION-GUIDE.md | 132 | ## Step 8: Linear | COMMENT |
| LOW⚡ | …ures/favorites/hooks/useToggleFavoriteCallback.test.ts | 141 | // Step 1: simulate the context-menu flow on Arbitrum USDC — selector says "not favorited", | COMMENT |
| LOW⚡ | …ures/favorites/hooks/useToggleFavoriteCallback.test.ts | 151 | // Step 2: given the resulting stored state, the selector must report favorited regardless of | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 52 | // Step 1: Check skip flag | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 57 | // Step 2: Parse the input | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 60 | // Step 3: Validate the data structure | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 67 | // Step 4: Build the quote request from validated input | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 70 | // Step 5: Flatten the result to match the expected return type | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 82 | // Step 1: Prepare trade input | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 85 | // Step 2: Early exit if input is null | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 90 | // Step 3: Build quote request with all params | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 94 | // Step 4: Fetch quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 99 | // Step 5: Transform quote to trade | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 123 | // Step 1: validate indicative quote request | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 129 | // Step 2: build indicative quote request | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 133 | // Step 3: Fetch indicative quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 136 | // Step 4: Validate and transform to IndicativeTrade | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 171 | // Step 1: Early exit if skipped | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 176 | // Step 2: Parse input into structured format | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 179 | // Step 3: Validate all required fields are present | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 53 | // Step 1: Prepare trade input | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 57 | // Step 2: Early exit if quote args are null | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 64 | // Step 3: Build quote request with all params | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 67 | // Step 4: Fetch quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 70 | // Step 5: Transform quote to trade | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 22 | // Step 1: read + parse the local .env file. readDotenvFile treats a missing file | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 31 | // Step 2: build the config client (handles auth + dev overrides). | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 35 | // Step 3: warn the user about migration-only intent and confirm. | COMMENT |
| LOW | packages/config-cli/src/commands/push.ts | 48 | // Step 4: push each entry. Each call is independent on the backend (no transaction) | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 275 | // Step 1: Find proof | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 280 | // Step 2: Verify the proof is valid | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 284 | // Step 3: Check the hash meets difficulty requirement | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 287 | // Step 4: Format for submission | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 61 | // Step 1: EIP-712 PackedUserOperation typed data. NOTE: `formatUserOperation` | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 65 | // Step 2: passkey-backed eth_signTypedData_v4 over the typed data. Privy | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 73 | // Step 3: Calibur wrap — abi.encode(ROOT_KEY_HASH=bytes32(0), sig, hookData='0x'). | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 76 | // Step 4: attach 7702 authorization if one isn't already bundled by the caller. | COMMENT |
| LOW⚡ | …allet/src/features/passkey/embeddedWalletDelegation.ts | 186 | // Step 1: Sign the EIP-7702 authorization | COMMENT |
| 38 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/uniswap/src/contexts/UniswapContext.tsx | 79 | // some wallets don't support UniswapX, so we need to check if it's supported (mismatch account) | COMMENT |
| LOW⚡ | …ures/favorites/hooks/useToggleFavoriteCallback.test.ts | 141 | // Step 1: simulate the context-menu flow on Arbitrum USDC — selector says "not favorited", | COMMENT |
| LOW⚡ | …ures/favorites/hooks/useToggleFavoriteCallback.test.ts | 151 | // Step 2: given the resulting stored state, the selector must report favorited regardless of | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 52 | // Step 1: Check skip flag | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 57 | // Step 2: Parse the input | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 60 | // Step 3: Validate the data structure | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 67 | // Step 4: Build the quote request from validated input | COMMENT |
| LOW⚡ | …tions/swap/hooks/useTrade/createGetQuoteRequestArgs.ts | 70 | // Step 5: Flatten the result to match the expected return type | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 82 | // Step 1: Prepare trade input | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 85 | // Step 2: Early exit if input is null | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 90 | // Step 3: Build quote request with all params | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 94 | // Step 4: Fetch quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 99 | // Step 5: Transform quote to trade | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 123 | // Step 1: validate indicative quote request | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 129 | // Step 2: build indicative quote request | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 133 | // Step 3: Fetch indicative quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 136 | // Step 4: Validate and transform to IndicativeTrade | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 171 | // Step 1: Early exit if skipped | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 176 | // Step 2: Parse input into structured format | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/evmTradeService.ts | 179 | // Step 3: Validate all required fields are present | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 53 | // Step 1: Prepare trade input | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 57 | // Step 2: Early exit if quote args are null | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 64 | // Step 3: Build quote request with all params | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 67 | // Step 4: Fetch quote from API | COMMENT |
| LOW⚡ | …sactions/swap/services/tradeService/svmTradeService.ts | 70 | // Step 5: Transform quote to trade | COMMENT |
| LOW | packages/ui/src/components/buttons/Button/Button.tsx | 42 | // We need to check if the children is a string, a Trans tag, or a custom component that likely renders a Trans tag, i | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 22 | // Step 1: read + parse the local .env file. readDotenvFile treats a missing file | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 31 | // Step 2: build the config client (handles auth + dev overrides). | COMMENT |
| LOW⚡ | packages/config-cli/src/commands/push.ts | 35 | // Step 3: warn the user about migration-only intent and confirm. | COMMENT |
| LOW | packages/config-cli/src/commands/push.ts | 48 | // Step 4: push each entry. Each call is independent on the backend (no transaction) | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 275 | // Step 1: Find proof | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 280 | // Step 2: Verify the proof is valid | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 284 | // Step 3: Check the hash meets difficulty requirement | COMMENT |
| LOW⚡ | …s/sessions/src/challenge-solvers/hashcash/core.test.ts | 287 | // Step 4: Format for submission | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 61 | // Step 1: EIP-712 PackedUserOperation typed data. NOTE: `formatUserOperation` | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 65 | // Step 2: passkey-backed eth_signTypedData_v4 over the typed data. Privy | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 73 | // Step 3: Calibur wrap — abi.encode(ROOT_KEY_HASH=bytes32(0), sig, hookData='0x'). | COMMENT |
| LOW⚡ | …ckages/embedded-wallet/src/connection/userOpSigning.ts | 76 | // Step 4: attach 7702 authorization if one isn't already bundled by the caller. | COMMENT |
| LOW⚡ | …allet/src/features/passkey/embeddedWalletDelegation.ts | 186 | // Step 1: Sign the EIP-7702 authorization | COMMENT |
| LOW⚡ | …allet/src/features/passkey/embeddedWalletDelegation.ts | 194 | // Step 2: Sign the full EIP-7702 transaction (backend handles type-4 signing + serialization) | COMMENT |
| LOW | …allet/src/features/passkey/embeddedWalletDelegation.ts | 259 | // Step 3: Submit the fully signed EIP-7702 transaction | COMMENT |
| LOW⚡ | …/services/TransactionService/transactionServiceImpl.ts | 517 | // Step 1: If we need to request Uniswap gas sponsorship, fill paymaster fields here. | COMMENT |
| LOW⚡ | …/services/TransactionService/transactionServiceImpl.ts | 534 | // Step 2: Sign (EIP-712 + Calibur encoding). The 7702 auth is bundled into the 4337 | COMMENT |
| LOW⚡ | …/services/TransactionService/transactionServiceImpl.ts | 541 | // Step 3: Submit to bundler via UniRPC | COMMENT |
| LOW | …ervices/UserOpSignerService/userOpSignerServiceImpl.ts | 49 | // Step 1: EIP-712 typed data signing over the PackedUserOperation. | COMMENT |
| LOW⚡ | …ervices/UserOpSignerService/userOpSignerServiceImpl.ts | 61 | // Step 2: Calibur signature encoding | COMMENT |
| LOW⚡ | …ervices/UserOpSignerService/userOpSignerServiceImpl.ts | 64 | // Step 3: the 7702 auth is bundled into the 4337 request up front (round-trips on | COMMENT |
| LOW⚡ | …ervices/UserOpSignerService/userOpSignerServiceImpl.ts | 73 | // Step 4: Rebuild the final signed UserOperation (preserving any round-tripped eip7702Auth). | COMMENT |
| LOW⚡ | …sor/implementations/createBaseNotificationProcessor.ts | 47 | // Step 1: Build dependency graph and identify roots using topological analysis | COMMENT |
| LOW⚡ | …sor/implementations/createBaseNotificationProcessor.ts | 50 | // Step 2: Separate primary (roots) and chained (non-roots) notifications | COMMENT |
| LOW | …sor/implementations/createBaseNotificationProcessor.ts | 62 | // Step 3: Filter out notifications that are locally tracked or don't have DISMISS action. | COMMENT |
| LOW⚡ | …sor/implementations/createBaseNotificationProcessor.ts | 97 | // Step 4: Limit the number of primary notifications per content style | COMMENT |
| LOW⚡ | …sor/implementations/createBaseNotificationProcessor.ts | 100 | // Step 5: Convert chained notifications to a Map for fast lookup | COMMENT |
| LOW | …ction/ActivityTimeline/getSupplySchedulePoints.test.ts | 49 | // Step 1: 100 mps × 100 blocks = 10_000 of 50_000 → 20% | COMMENT |
| LOW⚡ | apps/web/src/features/accounts/store/provider.tsx | 353 | // Step 1: Build the store components, deduplicating cross platform data for the same wallet if needed. | COMMENT |
| LOW⚡ | apps/web/src/features/accounts/store/provider.tsx | 356 | // Step 2: Store all connectors + references to active connectors. | COMMENT |
| LOW⚡ | apps/web/src/features/accounts/store/provider.tsx | 370 | // Step 3: Store all accounts. | COMMENT |
| LOW⚡ | apps/web/src/features/accounts/store/provider.tsx | 375 | // Step 4: Store the wallet. | COMMENT |
| LOW⚡ | apps/mobile/.maestro/flows/send/send-eth-to-self.yaml | 19 | # Step 1: Initialize app and recover wallet | COMMENT |
| LOW⚡ | apps/mobile/.maestro/flows/send/send-eth-to-self.yaml | 23 | # Step 2: Copy our wallet address from the Receive QR modal | COMMENT |
| 15 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …p/src/features/transactions/swap/plan/planSagaUtils.ts | 239 | chainIn: swapTxContext.trade.quote.quote.tokenInChainId.toString(), | CODE |
| CRITICAL | …p/src/features/transactions/swap/plan/planSagaUtils.ts | 240 | chainOut: swapTxContext.trade.quote.quote.tokenOutChainId.toString(), | CODE |
| CRITICAL | …niswap/src/features/transactions/swap/plan/planSaga.ts | 654 | inputCurrencyAmountRaw: params.swapTxContext.trade.inputAmount.quotient.toString(), | CODE |
| CRITICAL | …niswap/src/features/transactions/swap/plan/planSaga.ts | 655 | outputCurrencyAmountRaw: params.swapTxContext.trade.outputAmount.quotient.toString(), | CODE |
| CRITICAL | apps/web/src/playwright/wc/walletCounterparty.ts | 196 | client.core.relayer.subscriber.events.removeAllListeners() | CODE |
| CRITICAL | …bile/src/features/walletConnect/walletConnectClient.ts | 59 | const clientId = await wcWeb3Wallet.engine.signClient.core.crypto.getClientId() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/security-gate-check/security-gate-check.test.ts | 142 | elif case "$url" in *api.anthropic.com*) true ;; *) false ;; esac; then | CODE |
| HIGH | scripts/security-gate-check/security-gate-check.test.ts | 174 | elif [ -n "\${FAKE_REQUEST_REVIEW_FAILS:-}" ]; then | CODE |
| HIGH | …iswap/src/features/tokens/warnings/safetyUtils.test.ts | 50 | it('should return None when currencyInfo is fully undefined', () => { | CODE |
| HIGH | …iswap/src/features/tokens/warnings/safetyUtils.test.ts | 163 | it('should return None for default token with no warnings', () => { | CODE |
| HIGH | …iswap/src/features/tokens/warnings/safetyUtils.test.ts | 167 | it('should return None for native currency', () => { | CODE |
| HIGH | …src/components/InlineWarningCard/InlineWarningCard.tsx | 79 | // !WarningIcon for typecheck; should only be null if WarningSeverity == None | COMMENT |
| HIGH | …/src/features/dappRequests/utils/blockaidUtils.test.ts | 96 | it('should return None for undefined classification', () => { | CODE |
| HIGH | …/src/features/dappRequests/utils/blockaidUtils.test.ts | 100 | it('should return None for benign classification', () => { | CODE |
| HIGH | …/src/features/dappRequests/utils/blockaidUtils.test.ts | 127 | it('should return None for undefined validation', () => { | CODE |
| HIGH | …/src/features/dappRequests/utils/blockaidUtils.test.ts | 2291 | it('should return None risk level when simulation is missing and validation is benign', () => { | CODE |
| HIGH | …/src/features/dappRequests/utils/blockaidUtils.test.ts | 2334 | it('should return None risk level when both simulation and validation are missing', () => { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/argent-test-ui-flow/SKILL.md | 50 | 3. paste { text: "user@example.com" } | CODE |
| LOW | packages/ui/src/components/input/Input.web.tsx | 41 | | 'placeholder' | CODE |
| LOW | packages/mycelium/src/compat/color-token-parity.test.ts | 84 | 'placeholder', | CODE |
| LOW | packages/mycelium/src/unicon/address-alias.test.tsx | 49 | expect(resolveUniconInput({ input: 'user@example.com' })).toBe('user@example.com') | CODE |
| LOW | packages/mycelium/src/unicon/derive.test.ts | 41 | { input: 'user@example.com', hash: 10480051118383854456n, colorIndex: 6, iconKey: '60' }, | CODE |
| LOW | packages/mycelium/src/unicon/derive.test.ts | 100 | expect(hashString('user@example.com') > BigInt(Number.MAX_SAFE_INTEGER)).toBe(true) | CODE |
| LOW | packages/mycelium/src/unicon/Unicon.web.tsx | 17 | * <Unicon input="user@example.com" size={32} className="border border-neutral1" /> | COMMENT |
| LOW | packages/mycelium/src/unicon/Unicon.native.test.tsx | 24 | const INPUT = 'user@example.com' | CODE |
| LOW | packages/mycelium/src/input-compat/InputCompat.web.tsx | 49 | | 'placeholder' | CODE |
| LOW | …dded-wallet/src/features/passkey/checkPinReuse.test.ts | 33 | const params = { pin: '4321', email: 'user@example.com', accessToken: 'token', encryptedBlob: 'blob' } | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 115 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 121 | expect(privy.sendEmailCode).toHaveBeenCalledWith('user@example.com') | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 142 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 181 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 223 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 254 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 310 | oauthReturn: { pending: false, provider: 'google', providerEmail: 'user@example.com' }, | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 342 | oauthReturn: { pending: false, provider: 'google', providerEmail: 'user@example.com' }, | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 375 | oauthReturn: { pending: false, provider: 'google', providerEmail: 'user@example.com' }, | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 418 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 491 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 536 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …ed-wallet/src/features/passkey/useRecoveryFlow.test.ts | 579 | act(() => result.current.setEmail('user@example.com')) | CODE |
| LOW | …src/features/passkey/checkRecoveryAvailability.test.ts | 13 | const identifier = 'user@example.com' | CODE |
| LOW | …ded-wallet/src/features/passkey/recoveryRotate.test.ts | 36 | email: 'user@example.com', | CODE |
| LOW | …ded-wallet/src/features/passkey/recoveryRotate.test.ts | 67 | expect.objectContaining({ pin: '4321', email: 'user@example.com', rotate: true, retainPrivateKey: true }), | CODE |
| LOW | …ded-wallet/src/features/passkey/recoveryRotate.test.ts | 99 | authMethodIdentifier: 'user@example.com', | CODE |
| LOW | …embedded-wallet/src/features/passkey/pinCrypto.test.ts | 38 | const hashLower = hashAuthMethodId('user@example.com') | CODE |
| LOW | …tionSignerService/transactionSignerServiceImpl.test.ts | 202 | name: 'John Doe', | CODE |
| LOW | …src/components/dappRequests/types/Permit2Types.test.ts | 12 | const TYPE_DEF = [{ name: 'placeholder', type: 'address' }] | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 45 | await client.fetchSetupRecovery(params, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 48 | headers: { Authorization: 'Bearer fake-token' }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 59 | await client.fetchOprfEvaluate({ blindedElement: 'blinded', authMethodId: 'amid' }, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 63 | { headers: { Authorization: 'Bearer fake-token' } }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 83 | await client.fetchCheckRecoveryAvailability({ authMethodId: 'amid' }, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 87 | { headers: { Authorization: 'Bearer fake-token' } }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 107 | await client.fetchGetRecoveryConfig({ authMethodId: 'amid' }, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 111 | { headers: { Authorization: 'Bearer fake-token' } }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 131 | await client.fetchReportDecryptionResult({ success: false, authMethodId: 'amid' }, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 135 | { headers: { Authorization: 'Bearer fake-token' } }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 163 | await client.fetchExecuteRecovery(params, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 166 | headers: { Authorization: 'Bearer fake-token' }, | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 183 | await client.fetchExportSeedPhraseWithRecovery(params, 'fake-token') | CODE |
| LOW | …s/embeddedWallet/createEmbeddedWalletApiClient.test.ts | 186 | headers: { Authorization: 'Bearer fake-token' }, | CODE |
| LOW | …mponents/AccountDrawer/MiniPortfolio/Activity/hooks.ts | 87 | id: 'placeholder', | CODE |
| LOW | apps/mobile/src/app/mobileMigrationTests.ts | 1335 | const androidCloudBackupEmail = 'test@test.com' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/uniswap/src/i18n/locales/source/en-US.json | 1351 | "hook.description.generatedByAi": "Description generated by AI", | CODE |
| HIGH | …s/web/src/features/Liquidity/HookDetailsModal.test.tsx | 87 | expect(screen.getByText('Description generated by AI')).toBeTruthy() | CODE |
| HIGH | …s/web/src/features/Liquidity/HookDetailsModal.test.tsx | 97 | expect(screen.queryByText('Description generated by AI')).toBeNull() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lefthook.yml | 64 | # Check if any staged TS/TSX files exist that might contain i18n strings | COMMENT |
| LOW | lefthook.yml | 73 | # Check if the i18n source file was modified | COMMENT |
| LOW⚡ | scripts/check-runtime-versions.sh | 12 | # Check if running in Vercel environment | COMMENT |
| LOW | scripts/lint-composite-action-inputs.sh | 8 | # Check if the file contains an 'inputs:' section | COMMENT |
| LOW | scripts/lint-composite-action-inputs.sh | 10 | # Check if the file contains a step that uses the validate-action-inputs.cjs script | COMMENT |
| LOW | …ps/mobile/.maestro/scripts/performance/submit-local.sh | 15 | # Check if Datadog API key is set | COMMENT |
| LOW | …ps/mobile/.maestro/scripts/performance/submit-local.sh | 27 | # Check if metrics file already exists (extracted by e2e:local:extract-metrics) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/config-cli/src/lib/devEnv.test.ts | 5 | const HEADER = `# This file contains the minimal dev-env configs required to run this app. | CODE |
| MEDIUM | …s/Toucan/utils/quickLaunchProtectionDecoupling.test.ts | 15 | * ## This file is NOT the guarantee — `AuctionHeader.test.tsx` is | COMMENT |
| MEDIUM | apps/mobile/ios/sourcemaps-datadog.sh | 19 | # Create a temporary file for capturing output. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/security-gate-check/security-gate-check.sh | 1139 | # Capped, because an unbounded file would push the diff out of the context window — the effect | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ckages/utilities/src/device/keyboard/useKeyDown.web.ts | 38 | // Example usage: | COMMENT |
| LOW | apps/mobile/scripts/runAndroidLocal.sh | 31 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | apps/mobile/scripts/populate_svgs.py | 29 | CODE | |
| LOW | apps/mobile/scripts/populate_svgs.py | 91 | CODE |