fix(pancakeswap-v3): human-readable outputs + safe balance check (v1.0.2)#210
Conversation
…0.2) Problems fixed: 1. add-liquidity: balance check rejected dust shortfalls (e.g. 0.19% gap between WETH desired vs wallet balance). Replaced hard bail with a cap-down pattern: shortfall ≤1% → adjust silently, >1% → bail with human-readable amounts instead of raw minimal units. 2. All three commands showed raw minimal-unit values (e.g. 4288000000000000) instead of human-readable amounts. Fixed across: - add-liquidity: Expected deposit / Balance check OK lines - remove-liquidity: Expected out, Min out, Owed fees, amount0/1Min lines - positions (on-chain path): Owed fees line Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
quote |
Get swap quotes without executing transactions |
swap |
Execute token swaps via SmartRouter |
pools |
List all pools for a token pair across fee tiers |
positions |
View LP positions for a wallet address |
add-liquidity |
Mint new concentrated liquidity positions |
remove-liquidity |
Remove liquidity and collect tokens from positions |
Triggers
Activate this skill when users mention PancakeSwap operations like token swapping, liquidity management, or pool queries, especially when they reference "pancakeswap", "swap on pancake", "add liquidity", or "PancakeSwap V3" on supported networks.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/pancakeswap-v3-plugin"
CACHE_MAX=3600
LOCAL_VER="1.0.2"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/pancakeswap-v3-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: pancakeswap-v3-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill pancakeswap-v3-plugin --yes --global 2>/dev/null || true
echo "Updated pancakeswap-v3-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall pancakeswap-v3-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/pancakeswap-v3-plugin" "$HOME/.local/bin/.pancakeswap-v3-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/pancakeswap-v3-plugin@1.0.2/pancakeswap-v3-plugin-${TARGET}${EXT}" -o ~/.local/bin/.pancakeswap-v3-plugin-core${EXT}
chmod +x ~/.local/bin/.pancakeswap-v3-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/pancakeswap-v3-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "1.0.2" > "$HOME/.plugin-store/managed/pancakeswap-v3-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/pancakeswap-v3-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"pancakeswap-v3-plugin","version":"1.0.2"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"pancakeswap-v3-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin provides PancakeSwap V3 DEX interaction capabilities on Ethereum, BNB Chain, Base, Arbitrum, and Linea. It supports token swaps via SmartRouter, concentrated liquidity management (add/remove liquidity), pool queries, position viewing, and swap quoting. All write operations are executed through onchainos wallet contract-call. Target Users: DeFi users who want to swap tokens or manage concentrated liquidity positions on PancakeSwap V3 across multiple EVM chains. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnEthereum (1), BNB Chain (56), Base (8453), Arbitrum (42161), Linea (59144) Overall Permission SummaryThis plugin performs high-risk on-chain operations: ERC-20 token approvals, DEX swaps via SmartRouter, LP position minting, liquidity removal, and fee collection. All write operations are correctly delegated to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations are routed through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. H05 (direct-financial) is triggered but:
Prompt Injection Scan
Result: ✅ Clean Dangerous Operations CheckThe plugin involves:
Confirmation steps:
Result: ✅ Safe Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskMedium risk due to the inherent nature of DeFi write operations (swaps, approvals, liquidity management). The plugin implements appropriate safeguards (confirmation gates, balance checks, slippage protection, receipt verification). 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies:
No suspicious, unmaintained, or known-vulnerable dependencies detected. All dependencies are from well-established Rust ecosystem crates. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes. The SKILL.md accurately describes:
Minor discrepancy: SKILL.md mentions The source code behavior for Verdict: ✅ Source Safe7. Code ReviewQuality Score: 82/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-implemented PancakeSwap V3 plugin with proper onchainos delegation, good security practices (exact approvals, confirmation gates, receipt verification), but missing pre-swap token security scanning. Merge recommendation: Items to address:
Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
4288000000000000) instead of human-readable amounts. Fixed acrossadd-liquidity,remove-liquidity, andpositions(on-chain path).Affected commands
add-liquidityremove-liquiditypositionsTest plan
pancakeswap add-liquidity --dry-run— amounts show as0.001234 WETHnot1234000000000000pancakeswap remove-liquidity --dry-run— expected out / min out / owed fees human-readablepancakeswap positions— owed fees human-readable in on-chain path🤖 Generated with Claude Code