Job #8 — Audit Fixes + Display + Permit2 + UX (0.5 IMD)

You are fixing 9 issues in the Pons Arb UI. All changes are to the existing codebase. Do not add new dependencies.

Source: https://github.com/identity-md-launches/launch-3068-fix-one-bug-v4 (commit ff2a23a). App is a static JS/HTML bundle.

Context:

• Two modes: All Pairs (multi-token table) and Manual (single pair)
• Protocols: Uniswap V3 and V4 on Robinhood Chain (chainId 4663)
• RPC: Blockmachine (keyless, max 5000 blocks) with dRPC fallback
• Wallet: MetaMask (window.ethereum), one tab per wallet
• Permit2: layer 2 (token→Permit2) is handled by the page. Layer 1 (token→router) for V4 mixed routes is NOT handled — see item 8.

Fixes:

1. Auto mode guard (HIGH) In auto-execute mode, before sending the tx, verify the quoted return amount is strictly greater than the input amount. If return ≤ input, do NOT send. Show a red "ABORTED: return ≤ input" line instead.

2. V4/V4 sell quote floor (MED) When both legs are V4, the sell leg's quote can return 0 (no liquidity in the tick range). Enforce: if the sell quote returns 0, treat the route as invalid (show RED, do not offer as tradeable). Do not send a tx with a zero-quote sell leg. Default min value is 0.

3. REVOKE ALL: loop both tokens (MED) The REVOKE ALL button currently revokes approvals for only one token. Fix: iterate over both Token A and Token B, and revoke all existing approvals (to all known routers: V3 router, V4 pool manager, Permit2) for each token. Show per-token status (✓ revoked / nothing to revoke).

4. Worker: origin + method allow-list (LOW) In the worker proxy (if present in this codebase), restrict:

• Origin header must be loopback only (reject any non-local origin)
• method parameter (for RPC calls) must be in: eth_call, eth_blockNumber, eth_getBalance, eth_estimateGas, eth_getTransactionReceipt, eth_getTransactionByHash, eth_chainId, net_version Reject anything else with 403.

5. 3-LEG spread display (Display bug) The 3-LEG row currently shows a raw price ratio (e.g., "213,484%") which is meaningless. Fix: for 3-LEG rows, hide the % entirely and just show "3-LEG" with a live indicator (green dot = pools exist). The 3-LEG row is a binary indicator only.

6. Token B textarea: prevent address wrapping (UX) The Token B input field wraps long addresses to a second line. Fix: set white-space: nowrap; overflow-x: auto; on the textarea (or switch to a single-line input with horizontal scroll). Address should always be on one line.

7. Quote line: color by return vs input (UX) The quote/return line should be:

• Green if return > input (profit)
• Red if return ≤ input (loss) Apply this color to the numeric value itself.

8. Permit2 layer 1: clear error or auto-approve (New) When a V4 mixed route is attempted with a token that hasn't been approved for Permit2 (layer 1: token→Permit2 contract), the tx reverts with an opaque error. Fix:

• Preferred: Before sending, check allowance(token, permit2Address) for the asset token. If 0, show a clear inline message: "⚠️ Approve [TOKEN] for Permit2 in MetaMask (Contract tab → Permit2 → increaseAllowance) before this route will work." Do not send the tx.
• Fallback: At minimum, catch the revert and display the same message instead of a generic "tx failed."

9. Auto checkbox: restrict click area (UX) The "Auto" label wraps the checkbox and text in a element, making the entire text area clickable. Clicking anywhere near the word "Auto" (not just the 14×14px square) toggles the checkbox. Fix: remove the wrapper. Use a plain for the text and a standalone . Only the checkbox square itself should be clickable.

Constraints:

• No new npm dependencies
• Keep the app as a static JS/HTML bundle (no build step)
• All changes in the existing JS/HTML files
• Do not change the watch/scan logic, pool detection, or RPC fallback
• Preserve the existing UI layout; only fix the listed items
• Test at $0.001 USDG size

Deliverable: Updated files, ready to run. No explanation needed, just the code.