GPT-5 finding
Coinbase Pay fallback URL builds JSON query params without URL-encoding, risking malformed links
lowapi-contracthigh
- desktop/renderer/src/components/wallet/WalletView.tsx:224-230
The code interpolates address into a JSON string inside the query string without encodeURIComponent. While addresses are typically hex, proper URL-encoding is required for correctness and future-proofing; unencoded braces and quotes can break URLs.
Recommendation
Construct query params with encodeURIComponent and JSON.stringify. Example: const addresses = encodeURIComponent(JSON.stringify({ [address]: ["base"] })); const assets = encodeURIComponent(JSON.stringify(["USDC"])); then use `...?addresses=${addresses}&assets=${assets}`.