Initial commit

Author: nikita-kryvoruk-rd

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -0,0 +1,2 @@
+# Active network: mainnet | sepolia
+VITE_CHAIN=mainnet

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      - name: Test
+        run: npm test
+
+      - name: Production dependency audit
+        run: npm run audit:prod
+
+      - name: Build
+        run: npm run build

.gitignore

@@ -0,0 +1,15 @@
+node_modules/
+dist/
+coverage/
+.wrangler/
+
+.env
+.env.*
+!.env.example
+
+.DS_Store
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*

CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing
+
+Thanks for helping improve ERC20 Multisend Template.
+
+## Local Setup
+
+```bash
+npm ci
+cp .env.example .env
+npm run dev
+```
+
+## Checks
+
+Run these before opening a pull request:
+
+```bash
+npm test
+npm run build
+npm run audit:prod
+```
+
+## Pull Requests
+
+- Keep changes focused and easy to review.
+- Include a short explanation of user-visible behavior changes.
+- Do not commit secrets, private keys, `.env` files, build output, or `node_modules`.
+- For Permit2, token approval, CSV parsing, or transaction-flow changes, include a manual test note.
+
+## Security-Sensitive Changes
+
+This app handles token approvals and token transfers. Please be conservative with
+changes to signing, spender addresses, allowance checks, and calldata generation.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RedDuck Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,126 @@
+# ERC20 Multisend Template
+
+A browser-only React + Vite template for sending one ERC20 token to many
+recipients with Uniswap Permit2.
+
+The app lets a sender choose any ERC20 token on the configured network, approve
+Permit2 once for that token, paste or upload recipient rows, and send the batch
+with one Permit2 signature plus one transaction.
+
+## Features
+
+- Any ERC20 token address can be entered in the UI.
+- Recipient rows use a strict `address,amount` format with no header row.
+- Duplicate recipients are detected before sending.
+- Balance, allowance, gas, and block-limit checks run before broadcast.
+- No backend, no server-held keys, and no token-specific config.
+- Ready for Vercel or Cloudflare Workers static-assets deployment.
+
+## Important Security Note
+
+This template is not audited. It is useful starter code, but you should review
+and test it before using valuable tokens. The setup step grants Permit2 a high
+allowance for the selected token. Users can revoke that allowance later with a
+wallet or allowance management tool.
+
+## How It Works
+
+1. Connect an injected wallet such as MetaMask.
+2. Enter an ERC20 token contract address on the selected network.
+3. The app reads token metadata, balance, and the wallet's Permit2 allowance.
+4. Approve Permit2 once with standard ERC20 `approve`.
+5. Paste or upload recipient rows.
+6. Sign the Permit2 batch transfer and submit one transaction.
+
+Private keys stay in the wallet. The app runs fully in the browser.
+
+## Recipient Format
+
+Use one recipient per line with two comma-separated values: recipient address,
+then token amount.
+
+```csv
+0x0000000000000000000000000000000000000000,100
+0x1111111111111111111111111111111111111111,250.5
+```
+
+Do not include a header row. Every non-empty row is parsed as a recipient row.
+
+## Permit2 Flow
+
+The template uses the canonical Uniswap Permit2 contract:
+
+```text
+0x000000000022D473030F116dDEE9F6B43aC78BA3
+```
+
+Generic ERC20 tokens cannot be assumed to support EIP-2612 `permit`, so setup
+uses a normal ERC20 `approve(Permit2, max)` transaction. The actual multisend
+uses Permit2 `permitTransferFrom`: the sender signs typed data for the batch,
+then submits one transaction that transfers every row.
+
+## Local Development
+
+```bash
+npm ci
+cp .env.example .env
+npm run dev
+```
+
+The default app runs on Ethereum Mainnet. Change `VITE_CHAIN` in `.env` to use
+another configured network.
+
+## Configuration
+
+`src/config.js` defines supported networks. The template currently includes:
+
+- `mainnet`
+- `sepolia`
+
+To add another EVM network, add a chain entry with:
+
+- `key`
+- `chainId`
+- `hexChainId`
+- `name`
+- `native`
+- `explorer`
+
+## Checks
+
+```bash
+npm test
+npm run build
+npm run audit:prod
+```
+
+`npm run audit:prod` audits production dependencies only. Development tooling
+may report transitive audit warnings depending on the npm registry state.
+
+## Deployment
+
+Vercel works with the included `vercel.json`.
+
+For Cloudflare Workers static assets:
+
+```bash
+npm run build
+npm run deploy
+```
+
+Set `VITE_CHAIN` in your hosting provider's environment variables if you do not
+want the default `mainnet` setting.
+
+## Repository Hygiene
+
+Do not commit:
+
+- `.env` files
+- private keys or API secrets
+- `node_modules`
+- `dist`
+- `.wrangler`
+
+## License
+
+MIT

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues privately through GitHub Security Advisories when
+the repository is hosted on GitHub. If advisories are not enabled yet, contact
+the maintainers privately before publishing details.
+
+## Scope
+
+Security-sensitive areas include:
+
+- Permit2 spender and typed-data signing flow.
+- ERC20 approval behavior.
+- Token and recipient parsing.
+- Transaction simulation and gas-limit checks.
+- Anything that could redirect funds or approvals.
+
+## Important Notes
+
+This template is not audited. Review and test it carefully before using it with
+valuable tokens. The default approval flow grants Permit2 a high allowance for
+the selected ERC20 token, which users can revoke later with a wallet or allowance
+management tool.

index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>ERC20 Multisend</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.jsx"></script>
+  </body>
+</html>