# sellcross WETH check (#2346 / #2348), ppfeeds, 14 Oct

**Result: the "0 of 43 sell" was a sim bug (wrong route), not proof of a honeypot.** Corrected sim: 22 of 25 distinct H3000 WETH pools (44 of 50 pool/level rows) sell OK at the cap-cross block.

## Why the old sim failed
- sellcross.py sells via UniversalRouter (SWAP_EXACT_IN_SINGLE + SETTLE_ALL). On WETH pools the hook's beforeSwap reverts for sender = UniversalRouter (hook wraps error 0x90bfb865 / 0x6570f956 with the UR address). Works only on the hooks that allow UR (pool 0x56daa3b7, hook 0x102f..: sells OK via UR).
- Real sellers (89k sells in v4tape) do not use UR: they call one of 5 shared operator routers (`0xf4275f24...`, `0x7680ecc6...`, `0xba77de4e...`, `0xbb9cb637...`, `0xd0d39ce0...`), selector 0xb3938887 `(WETH, token, fee 3000, ts 60, hooks, zeroForOne=0, amountIn, minOut, router, deadline)`; the hook accepts only that router as sender.
- The router has a caller whitelist (`require ... "caller is not in whitelist"`, mapping(address=>bool) at storage slot 4). 45 of 45 sampled real buyers are whitelisted (buying through the router seems to whitelist). A fresh wallet that never bought through the router reverts. So: outside wallets can sell IF they bought via the router (assumed, not proven with a real tx; one $1 buy then sell on a fresh wallet would prove it, Ben-only).

## Corrected sim (state at the cross block works, mode hist_at_block)
- Script: /opt/crew/work/ppfeeds/sellrouter.py (router per pool = most common non-UR seller; token balance + allowance + whitelist slot 4 set by state override; from fresh address).
- Output: http://159.223.88.168/hx-c9ois/ppfeeds/sellcross_weth_router.db table r(pool,token,hooks,router,level,cap_usd,amount_in,mode,ok,revert). (out_eth not filled: this router's revert data has no amountOut in the UR format.)
- 3 pools still revert: 0xe245c610..., 0x577deddd... (error 0x486aa307, unknown, probably per-pool limit) and 0x56daa3b7 via router (0x3e500884; but it sells via UR).
- Also checked: a real prior seller as `from` (no whitelist override) -> OK on the same 22 pools at the cross block and at latest.

## Impact
- WETH-quote H3000 pools are sellable by outsiders, but only through the pool's router (the exec buy/sell path must use that router, not UR; buy through the router first so the wallet is whitelisted). Pre-buy rug check should treat "UR sell reverts" as normal for this class.
- Not changed: live sellcross.py service (still reports UR route for WETH). Patch suggestion for analyst1/exec: use sellrouter.py logic for quote=weth.