Opus
Fund wallet URL contains unencoded JSON breaking Coinbase Pay link
mediumbughigh
- desktop/renderer/src/components/wallet/WalletView.tsx:197-201
The Coinbase Pay fallback URL is constructed by interpolating the address directly into a JSON object in the query string without URL-encoding the braces, quotes, and brackets. Coinbase Pay's documented onramp link requires the `addresses` and `assets` query parameters to be URL-encoded JSON (e.g. encodeURIComponent). When passed raw, browsers may pass the characters through to Coinbase, but the JSON contains unescaped double quotes inside a JS template literal embedded into a URL — meaning the final URL contains literal `{`, `"`, `[`, `]` which many user agents will percent-encode inconsistently (or which Coinbase Pay's parser rejects). At minimum the link is non-conformant to the documented contract and may fail at Coinbase's side; the address is also not encoded so a non-hex address would break parsing.
Recommendation
Use URLSearchParams and encodeURIComponent: `const params = new URLSearchParams({ addresses: JSON.stringify({ [address]: ['base'] }), assets: JSON.stringify(['USDC']) }); window.open(`https://pay.coinbase.com/buy?${params}`, '_blank');`