2026-02-15 - 2026-08-15
Overview
1 Release published by 1 user
Published
v0.1.0
100 Pull requests merged by 2 users
Merged
#272 fix: render the view "Back" lands on after the popup is reopened (closes #268)
Merged
#278 fix: carry EIP-1193 error codes through to the page (closes #274)
Merged
#277 fix: a shared ticker no longer hides one of its two real tokens (closes #276)
Merged
#273 test: drive the EIP-1193 dApp approval round trips in the browser (closes #183)
Merged
#270 fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)
Merged
#256 test: containerized Firefox end-to-end harness (closes #184)
Merged
#269 harden: verify the signed transaction against what the popup displayed (closes #216)
Merged
#266 fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224)
Merged
#264 fix: one wording for a rejected password on every screen (closes #172)
Merged
#267 test: close the empty-array hole in the e2e unstubbed-request guard (closes #187)
Merged
#258 test: drive ConfirmTx in the e2e suite, gate assertion included (closes #238)
Merged
#243 fix: explain a rejected dust threshold instead of snapping back silently (closes #233)
Merged
#205 harden: verify all approval fields and make failed signing retryable (closes #174)
Merged
#240 feat: remove an address from an HD wallet, behind a confirmation (closes #162)
Merged
#257 fix: filter a fake ETH token from the balance list too (closes #235)
Merged
#249 test: cover every verify-build failure mode from make check (closes #227)
Merged
#201 fix: WaitTx timeout no longer overwrites a rendered success screen (closes #155)
Merged
#248 fix: wipe the exported private key from the DOM on leaving the screen (closes #221)
Merged
#247 fix: explain a stored non-master xprv wallet instead of throwing at signing time (closes #234)
Merged
#244 fix: treat an unreported holders_count as unknown, not as zero holders (closes #230)
Merged
#206 fix: run libsodium on WebAssembly under the extension CSP (closes #182)
Merged
#241 docs: describe the bundled token list by selection criterion, not count (closes #239)
Merged
#197 fix: count the network fee in the confirm-screen balance check (closes #154)
Merged
#208 fix: drive background refresh and phishing update from alarms (closes #158)
Merged
#226 fix: add a Settings toggle for known-symbol spoof verification (closes #176)
Merged
#214 fix: move the UTC Timestamps checkbox into the Display well (closes #212)
Merged
#232 fix: enforce the base58 checksum and reject non-master extended keys (closes #210)
Merged
#225 fix: NUL-delimit verify-build's dist walk so no path escapes the check (closes #223)
Merged
#215 feat: password-gated recovery phrase display for HD wallets (closes #161)
Merged
#228 fix: honour a dust threshold of 0 and compare addresses case-insensitively (closes #179)
Merged
#209 test: known-answer coverage for HD derivation and the vault (closes #159)
Merged
#204 chore: repo policy compliance sweep — test rerun, npx, frozen lockfile, docs (closes #166)
Merged
#196 fix: one transaction history row per value movement (closes #177)
Merged
#203 fix: correct verify-build diagnostics and close its vacuous passes (closes #180)
Merged
#200 fix: derive hasWallet from the wallet list on load (closes #195)
Merged
#217 docs: correct three README claims contradicted by the code (closes #213)
Merged
#202 docs: rebuild the README Screen Map from the code (closes #164)
Merged
#199 docs: correct docs/README.md external services and remove competitor names (closes #163)
Merged
#194 fix: repair wallet state on delete (closes #156)
Merged
#192 docs: rewrite TODO.md workflow for the branch-per-issue model on next
Merged
#178 build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)
Merged
#171 security: decrypt and sign dApp approvals in the popup (closes #157)
Merged
#175 test: cover the address-poisoning filters in transactions.js (closes #160)
Merged
#185 test: containerized Chrome end-to-end harness that drives the real popup (closes #181)
Merged
#169 security: make DEBUG a build-time flag defaulting to off (closes #149)
Merged
#145 feat: add About well to settings with build info and debug easter egg
Merged
#148 scripts-to-rule-them-all
Merged
#147 TODO
Merged
#146 fix: implement proper view navigation stack
Merged
#143 feat: show debug banner on testnet or debug mode, add TESTNET tag
Merged
#129 fix: unify address display with shared renderAddressHtml utility
Merged
#142 fix: suppress USD display on testnet networks
Merged
#141 feat: show estimated USD value for ETH in approve-tx view
Merged
#136 fix: etherscan link on address-token page goes to token-specific URL
Merged
#137 feat: add Sepolia testnet support
Merged
#118 feat: expand confirm-tx warnings — closes #114
Merged
#133 Reorder transaction detail view: txid first, logical grouping
Merged
#128 fix: correct swap display — output token, min received, from address, and amount
Merged
#130 feat: add Type field and on-chain details to transaction detail view
Merged
#120 fix: include timezone offset in all displayed timestamps (closes #116)
Merged
#126 feat: add theme setting (Light/Dark/System) with dark mode — closes #125
Merged
#124 fix: reserve space for all error/status messages — closes #123
Merged
#121 feat: speed up copy-flash timing by ~25% — follow-up to #113
Merged
#115 fix: cross-wallet-type duplicate detection — closes #111
Merged
#113 feat: add copy-flash visual feedback — closes #100
Merged
#98 feat: show red warning when sending to address with zero tx history
Merged
#53 feat: add xprv wallet import support
Merged
#102 feat: add etherscan link and click-to-copy on block number in success-tx view
Merged
#94 fix: make success-tx addresses clickable, fix USDT ETH bug, nest decoded details (closes #80)
Merged
#83 fix: replace confirm-tx password modal with inline field (closes #78)
Merged
#89 fix: disable export-privkey and delete-wallet buttons during async processing
Merged
#79 persist confirm-tx view across popup close/reopen (closes #77)
Merged
#92 fix: approve-tx/approve-sign error divs consistency with confirm-tx
Merged
#91 fix: clear password field and error in showTxApproval
Merged
#68 fix: validate destination address on send view (closes #67)
Merged
#73 fix: make token contract display on confirm-tx consistent with other views
Merged
#76 fix: show token transaction history on address-token view (closes #72)
Merged
#31 feat: add export private key from address detail view
Merged
#69 fix: use formatAddressHtml in receive view for display consistency
Merged
#52 fix: resolve token symbols from multiple sources (closes #51)
Merged
#66 fix: consistent transaction view title (closes #65)
Merged
#64 fix: show decoded swap details on success-tx view (closes #63)
Merged
#62 fix: enforce UI policies on transaction detail view (closes #59)
Merged
#61 fix: persist tx decoding across popup close/reopen (closes #60)
Merged
#57 fix: show own labelled address for swap transactions (closes #55)
Merged
#54 fix: fall back to known token list for symbol/name/decimals
Merged
#25 fix: add reverse ENS lookups for all displayed addresses (closes #22)
Merged
#24 fix: preserve ENS names on lookup failure, add debug logging (closes #22)
Merged
#30 fix: show wallet/address titles across all views (closes #26, closes #27, closes #28, closes #29)
Merged
#23 fix: show wallet name for own addresses on approve-tx view (closes #21)
Merged
#8 fix: low-severity security findings L3, L4, L5 (closes #6)
Merged
#17 fix: add fallback popup window for tx/sign approval requests (closes #4)
Merged
#10 fix: display swaps and contract calls correctly in tx history (closes #3)
Merged
#14 feat: add wallet deletion from settings (closes #13)
Merged
#15 fix: use grey well for contract address in address-token view (closes #9)
Merged
#18 fix: pass UUID approval ID as string, not parseInt (closes #4)
Merged
#11 fix: show ERC-20 contract details in address-token view (closes #9)
Merged
#7 security: fix high-severity findings from audit (closes #6)
Merged
#2 Fix all RULES.md divergences
Merged
#5 add tracked token list management to settings
8 Pull requests proposed by 1 user
Proposed
#190 milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverage
Proposed
#281 refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)
Proposed
#282 fix: answer the page when a background handler throws (closes #280)
Proposed
#284 fix: one transaction approval at a time, and honest copy for a nonce collision (closes #271)
Proposed
#286 build: add ESLint to script/lint and containerize linting (closes #152)
Proposed
#288 test: assert the #150 and #151 items the harness did not cover (closes #188)
Proposed
#289 fix: settle a site approval on the port that carries its teardown (closes #275)
Proposed
#291 build: run the browser e2e suites in CI (closes #259)
98 Issues closed from 2 users
Closed
#268 fix: Back after reopening the popup lands on a blank screen, because goBack() never re-renders
Closed
#274 fix: EIP-1193 error codes never reach the page — a dApp cannot detect a user rejection
Closed
#276 fix: seven bundled tokens are filtered as spoofs of their own duplicate symbol
Closed
#220 blocked: no Actions runner is picking up jobs — every CI run sits queued forever
Closed
#183 test: drive the EIP-1193 dApp approval round trips in the browser harness
Closed
#260 fix: a whitespace-padded symbol bypasses the spoof filter but still displays as the real one
Closed
#184 test: containerized Firefox end-to-end harness (geckodriver, MV2 temporary add-on)
Closed
#216 harden: approval verification compares against the dApp's request, not against what the popup displayed
Closed
#224 fix: the restored viewStack can contain views the popup may not reopen onto, giving a dead-end screen
Closed
#172 fix: "Wrong password." is a sentence fragment and diverges from the other password prompts
Closed
#187 test: an empty-array POST body escapes the e2e unstubbed-request guard
Closed
#238 test: ConfirmTx has no automated coverage at all — the screen that decides what gets signed
Closed
#233 fix: the dust threshold field rejects input silently, snapping back with no explanation
Closed
#174 harden: approvalVerify does not compare chainId, nonce or fee fields; failed signing leaves an unretryable button
Closed
#162 feat: delete an address from an HD wallet (with confirmation)
Closed
#235 fix: a fake token impersonating ETH is filtered from history and send, but still shows in the balance list
Closed
#227 test: verify-build's failure modes are only ever proven by hand — make the battery a committed target
Closed
#155 fix: WaitTx 60s timeout overwrites an already-rendered success screen
Closed
#221 fix: leaving the private-key export screen leaves the private key in the DOM for the life of the popup
Closed
#234 fix: an already-imported non-master xprv wallet will throw at signing time with no explanation
Closed
#230 fix: an omitted holders_count is coerced to 0, so a legitimate token gets filtered as spam
Closed
#182 fix: libsodium WASM is refused by the extension CSP on every popup load, silently falling back to asm.js
Closed
#239 docs: the bundled token list is described as "top 250" in four places and "roughly 500" in another; it is 512
Closed
#154 fix: gas fee is excluded from the insufficient-balance check, so max-value ETH sends fail at broadcast
Closed
#158 fix: MV3 service worker termination kills the background refresh and the 24h phishing list update
Closed
#176 fix: known-symbol spoof verification has no off switch, contradicting the README's user-configurable promise
Closed
#212 fix: the UTC Timestamps checkbox sits inside the Token Spam Protection well
Closed
#210 fix: isValidXprv accepts a mistyped extended key and silently imports a different wallet
Closed
#223 fix: verify-build's dist walk is line-delimited, so a path with trailing whitespace escapes the unlisted-bundle check
Closed
#161 feat: show wallet's recovery phrase (requires password)
Closed
#179 fix: a dust threshold of 0 silently becomes 100,000 gwei, and isSpoofedSymbol is case-sensitive on the contract address
Closed
#159 test: cover wallet.js key derivation and vault.js encryption — currently zero tests on the crypto core
Closed
#166 chore: repo policy compliance sweep — test rerun pattern, yarn/npx, frozen lockfile, undocumented targets
Closed
#177 fix: every plain ERC-20 transfer produces two rows in transaction history
Closed
#180 fix: verify-build diagnostic overstates the failure, and two robustness gaps in the same script
Closed
#195 fix: loadState reads hasWallet from storage without reconciling it against wallets.length
Closed
#213 docs: three README.md claims are contradicted by the shipped code
Closed
#164 docs: README Screen Map omits three shipped screens and misdescribes four flows
Closed
#163 docs: docs/README.md names competitors and contradicts the code on external services
Closed
#156 fix: deleting the last wallet leaves hasWallet true, resets selection unconditionally, and skips the active-address broadcast
Closed
#189 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Closed
#170 build: assert DEBUG is off in every emitted bundle as a post-build check
Closed
#157 security: the user's plaintext password crosses the extension messaging boundary during dApp approvals
Closed
#160 test: the entire address-poisoning defense in transactions.js is untested
Closed
#181 test: containerized Chrome end-to-end harness that drives the real popup
Closed
#151 fix: TransactionDetail crashes for every ERC-20 transfer — ReferenceError: addressDotHtml is not defined
Closed
#150 fix: AddToken screen is unreachable — ReferenceError: showView is not defined
Closed
#149 security: DEBUG hardcoded on — every generated recovery phrase is the public test phrase
Closed
#144 add a new well to the bottom of settings that includes application information
Closed
#134 view stack pop bug
Closed
#140 make red debug banner conditional display
Closed
#97 approve-tx view doesn't display addresses consistently
Closed
#139 usd display is still happening on main even when using testnet
Closed
#138 approve-tx transferring out ETH doesn't show the estimated value of the ETH amount
Closed
#135 special case: clicking on the etherscan link for our address on address-token should go to etherscan address-token page
Closed
#110 we need to support the sepolia testnet
Closed
#114 expand on the work in #98 to show more types of warnings in that reserved space warning element
Closed
#131 improve transaction view
Closed
#127 decoding or display error in transaction view
Closed
#95 on 'transaction' view, an erc20 transfer never actually says 'ERC20 Transfer'
Closed
#116 ISO timestamps shown do not include timezone
Closed
#125 feat: add theme setting (Light/Dark/System) with dark mode
Closed
#123 clicking "sign and send" with empty/wrong pw field violates layout shift policy
Closed
#111 adding wallet by private key doesn't check to see if the public address is already part of one of the other wallets
Closed
#100 flash messages are insufficient feedback alone on click-to-copy
Closed
#82 on 'confirm-tx', show a red warning if about to send to an address with ZERO transaction history
Closed
#20 importing existing wallet using xprv instead of mnemonic
Closed
#99 the block number on 'success-tx' should have an external link to uniswap, and should be click-to-copyable
Closed
#80 'success-tx' address display inconsistent
Closed
#87 consistency: three different error display patterns used for password validation
Closed
#78 'confirm-tx' view uses modal for password input
Closed
#86 consistency: export-privkey and delete-wallet buttons not disabled during async processing
Closed
#77 'confirm-tx' view disappears on popup close/reopen (returns to 'main')
Closed
#84 consistency: approve-tx and approve-sign password error divs missing min-height (layout shift)
Closed
#85 consistency: approve-tx password field not cleared when view is shown
Closed
#67 no validation is done on destination address when sending
Closed
#70 token contract display on 'confirm-tx' page is inconsistent with token contract display elsewhere
Closed
#72 tx history for token is missing on 'address-token' view
Closed
#19 a method of viewing an address's private key
Closed
#58 'receive' view violates address display consistency policy
Closed
#65 'transaction' view has inconsistent title
Closed
#63 for swaps, the 'success-tx' view should have a lot more data on it.
Closed
#59 on 'transaction' view, several UI policies are violated:
Closed
#60 closing and reopening popup while on 'transaction' view causes raw data and action decoding to disappear
Closed
#55 in the transaction history lists, "swap" items show un-useful address
Closed
#51 balance list on address-token for USDC shows ? for symbol
Closed
#22 reverse ens lookups don't seem to be working anymore
Closed
#28 home view: tx list counterparties don't show wallet/address titles
Closed
#27 txStatus view: To address does not show wallet/address title
Closed
#26 send view: From address does not show wallet/address title
Closed
#29 addressDetail/addressToken: tx list counterparties don't show wallet/address titles
Closed
#21 address display inconsistency on approve-tx view
Closed
#3 swaps show up as sends
Closed
#13 need a way to delete a wallet. propose options.
Closed
#9 address-token view should show contract address and ERC20 details
Closed
#4 no confirmation popup when doing a uniswap
Closed
#6 security review
Closed
#1 non-compliance with rules
140 Issues created by 1 user
Opened
#1 non-compliance with rules
Opened
#3 swaps show up as sends
Opened
#4 no confirmation popup when doing a uniswap
Opened
#6 security review
Opened
#9 address-token view should show contract address and ERC20 details
Opened
#13 need a way to delete a wallet. propose options.
Opened
#19 a method of viewing an address's private key
Opened
#20 importing existing wallet using xprv instead of mnemonic
Opened
#21 address display inconsistency on approve-tx view
Opened
#22 reverse ens lookups don't seem to be working anymore
Opened
#26 send view: From address does not show wallet/address title
Opened
#27 txStatus view: To address does not show wallet/address title
Opened
#28 home view: tx list counterparties don't show wallet/address titles
Opened
#29 addressDetail/addressToken: tx list counterparties don't show wallet/address titles
Opened
#51 balance list on address-token for USDC shows ? for symbol
Opened
#55 in the transaction history lists, "swap" items show un-useful address
Opened
#58 'receive' view violates address display consistency policy
Opened
#59 on 'transaction' view, several UI policies are violated:
Opened
#60 closing and reopening popup while on 'transaction' view causes raw data and action decoding to disappear
Opened
#63 for swaps, the 'success-tx' view should have a lot more data on it.
Opened
#65 'transaction' view has inconsistent title
Opened
#67 no validation is done on destination address when sending
Opened
#70 token contract display on 'confirm-tx' page is inconsistent with token contract display elsewhere
Opened
#72 tx history for token is missing on 'address-token' view
Opened
#77 'confirm-tx' view disappears on popup close/reopen (returns to 'main')
Opened
#78 'confirm-tx' view uses modal for password input
Opened
#80 'success-tx' address display inconsistent
Opened
#82 on 'confirm-tx', show a red warning if about to send to an address with ZERO transaction history
Opened
#84 consistency: approve-tx and approve-sign password error divs missing min-height (layout shift)
Opened
#85 consistency: approve-tx password field not cleared when view is shown
Opened
#86 consistency: export-privkey and delete-wallet buttons not disabled during async processing
Opened
#87 consistency: three different error display patterns used for password validation
Opened
#95 on 'transaction' view, an erc20 transfer never actually says 'ERC20 Transfer'
Opened
#97 approve-tx view doesn't display addresses consistently
Opened
#99 the block number on 'success-tx' should have an external link to uniswap, and should be click-to-copyable
Opened
#100 flash messages are insufficient feedback alone on click-to-copy
Opened
#110 we need to support the sepolia testnet
Opened
#111 adding wallet by private key doesn't check to see if the public address is already part of one of the other wallets
Opened
#114 expand on the work in #98 to show more types of warnings in that reserved space warning element
Opened
#116 ISO timestamps shown do not include timezone
Opened
#123 clicking "sign and send" with empty/wrong pw field violates layout shift policy
Opened
#125 feat: add theme setting (Light/Dark/System) with dark mode
Opened
#127 decoding or display error in transaction view
Opened
#131 improve transaction view
Opened
#134 view stack pop bug
Opened
#135 special case: clicking on the etherscan link for our address on address-token should go to etherscan address-token page
Opened
#138 approve-tx transferring out ETH doesn't show the estimated value of the ETH amount
Opened
#139 usd display is still happening on main even when using testnet
Opened
#140 make red debug banner conditional display
Opened
#144 add a new well to the bottom of settings that includes application information
Opened
#149 security: DEBUG hardcoded on — every generated recovery phrase is the public test phrase
Opened
#150 fix: AddToken screen is unreachable — ReferenceError: showView is not defined
Opened
#151 fix: TransactionDetail crashes for every ERC-20 transfer — ReferenceError: addressDotHtml is not defined
Opened
#152 build: add ESLint to script/lint — make check cannot currently catch undefined identifiers
Opened
#153 fix: Firefox target is non-functional — Chrome callback APIs used against the promise-only browser namespace
Opened
#154 fix: gas fee is excluded from the insufficient-balance check, so max-value ETH sends fail at broadcast
Opened
#155 fix: WaitTx 60s timeout overwrites an already-rendered success screen
Opened
#156 fix: deleting the last wallet leaves hasWallet true, resets selection unconditionally, and skips the active-address broadcast
Opened
#157 security: the user's plaintext password crosses the extension messaging boundary during dApp approvals
Opened
#158 fix: MV3 service worker termination kills the background refresh and the 24h phishing list update
Opened
#159 test: cover wallet.js key derivation and vault.js encryption — currently zero tests on the crypto core
Opened
#160 test: the entire address-poisoning defense in transactions.js is untested
Opened
#161 feat: show wallet's recovery phrase (requires password)
Opened
#162 feat: delete an address from an HD wallet (with confirmation)
Opened
#163 docs: docs/README.md names competitors and contradicts the code on external services
Opened
#164 docs: README Screen Map omits three shipped screens and misdescribes four flows
Opened
#165 decision: Sepolia support contradicts "Non-Goals for 1.0", and isMetaMask names a competitor in shipped code
Opened
#166 chore: repo policy compliance sweep — test rerun pattern, yarn/npx, frozen lockfile, undocumented targets
Opened
#167 chore: prune 24 stale remote feature branches
Opened
#168 chore: remove dead exports and de-duplicate copy-pasted view helpers
Opened
#170 build: assert DEBUG is off in every emitted bundle as a post-build check
Opened
#172 fix: "Wrong password." is a sentence fragment and diverges from the other password prompts
Opened
#173 decision: no browser in the agent environment, so several 1.0.0 items cannot have their DoD verified
Opened
#174 harden: approvalVerify does not compare chainId, nonce or fee fields; failed signing leaves an unretryable button
Opened
#176 fix: known-symbol spoof verification has no off switch, contradicting the README's user-configurable promise
Opened
#177 fix: every plain ERC-20 transfer produces two rows in transaction history
Opened
#179 fix: a dust threshold of 0 silently becomes 100,000 gwei, and isSpoofedSymbol is case-sensitive on the contract address
Opened
#180 fix: verify-build diagnostic overstates the failure, and two robustness gaps in the same script
Opened
#181 test: containerized Chrome end-to-end harness that drives the real popup
Opened
#182 fix: libsodium WASM is refused by the extension CSP on every popup load, silently falling back to asm.js
Opened
#183 test: drive the EIP-1193 dApp approval round trips in the browser harness
Opened
#184 test: containerized Firefox end-to-end harness (geckodriver, MV2 temporary add-on)
Opened
#186 decision: agent commits are landing under three different author identities, including yours
Opened
#187 test: an empty-array POST body escapes the e2e unstubbed-request guard
Opened
#188 test: assert the DoD items from #150 and #151 that the harness does not yet cover
Opened
#189 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Opened
#191 docs: TODO.md describes the old branch-from-main workflow and its Status/Next Step are stale
Opened
#193 decision: RULES.md "Build & Workflow" still says merge to main, contradicting the branch-per-issue-onto-next model
Opened
#195 fix: loadState reads hasWallet from storage without reconciling it against wallets.length
Opened
#198 feat: "send max" affordance — emptying an ETH account now requires manual arithmetic
Opened
#207 decision: a dApp-supplied gas limit is silently dropped, so the popup always re-estimates
Opened
#210 fix: isValidXprv accepts a mistyped extended key and silently imports a different wallet
Opened
#211 decision: RULES.md states three things the code contradicts
Opened
#212 fix: the UTC Timestamps checkbox sits inside the Token Spam Protection well
Opened
#213 docs: three README.md claims are contradicted by the shipped code
Opened
#216 harden: approval verification compares against the dApp's request, not against what the popup displayed
Opened
#218 test: popup reload mid-refresh can fail the e2e run with "loadHomeTxs failed: Failed to fetch"
Opened
#219 decision: the phishing blocklist URL embeds a competitor's org name, and its documented upstream no longer exists
Opened
#220 blocked: no Actions runner is picking up jobs — every CI run sits queued forever
Opened
#221 fix: leaving the private-key export screen leaves the private key in the DOM for the life of the popup
Opened
#222 decision: the per-unit TODO.md entry makes every merge invalidate every open PR
Opened
#223 fix: verify-build's dist walk is line-delimited, so a path with trailing whitespace escapes the unlisted-bundle check
Opened
#224 fix: the restored viewStack can contain views the popup may not reopen onto, giving a dead-end screen
Opened
#227 test: verify-build's failure modes are only ever proven by hand — make the battery a committed target
Opened
#229 test: the Settings view has no browser coverage, so a wrong element id takes the whole screen down undetected
Opened
#230 fix: an omitted holders_count is coerced to 0, so a legitimate token gets filtered as spam
Opened
#231 decision: what should the confirm screen quote as the network fee — estimate, reserve, or both?
Opened
#233 fix: the dust threshold field rejects input silently, snapping back with no explanation
Opened
#234 fix: an already-imported non-master xprv wallet will throw at signing time with no explanation
Opened
#235 fix: a fake token impersonating ETH is filtered from history and send, but still shows in the balance list
Opened
#236 harden: an oversized phishing delta erases the previously stored one, dropping to vendored-only coverage for up to 24h
Opened
#237 chore: script/test-e2e emits DEP0205 module.register() deprecation warning
Opened
#238 test: ConfirmTx has no automated coverage at all — the screen that decides what gets signed
Opened
#239 docs: the bundled token list is described as "top 250" in four places and "roughly 500" in another; it is 512
Opened
#242 tokenList.js header comment says "511 tokens"; the array has 512
Opened
#245 harden: connectedSites is never cleared for a removed address or wallet
Opened
#246 harden: decimals || "18" collapses absent and zero if a backend ever sends numeric 0
Opened
#250 fix: a contract deployment shows a blank recipient on the wait and approval screens
Opened
#251 harden: parseHoldersCount partial-parses a malformed count into a reported low count, hiding the token
Opened
#252 fix: flash messages longer than one line wrap and shift the layout, defeating the reserved-space policy
Opened
#253 test: the private-key export screen has no e2e coverage, unlike the recovery-phrase screen
Opened
#254 test: the defective-wallet UI gates have no coverage — all six can be deleted with the suite still green
Opened
#255 decision: a defective xprv wallet is told to use other software, but we hold the only key and will not export it
Opened
#259 build: nothing automatic ever runs the e2e suites, so every browser-level guarantee is manual-only
Opened
#260 fix: a whitespace-padded symbol bypasses the spoof filter but still displays as the real one
Opened
#261 fix: an address holding only unpriced tokens reports its total as $0.00
Opened
#262 fix: an approval claimed when its window closes is orphaned, leaving the dApp promise unsettled forever
Opened
#263 chore: script/bootstrap can report success while leaving playwright-core unlinked
Opened
#265 fix: the empty-password message diverges on the private key export screen
Opened
#268 fix: Back after reopening the popup lands on a blank screen, because goBack() never re-renders
Opened
#271 fix: two concurrent dApp transactions are populated with the same nonce, and the second fails terminally
Opened
#274 fix: EIP-1193 error codes never reach the page — a dApp cannot detect a user rejection
Opened
#275 fix: approving a site connection races the popup teardown and can be recorded as a rejection
Opened
#276 fix: seven bundled tokens are filtered as spoofs of their own duplicate symbol
Opened
#279 fix: an unsupported method is reported to the page with no EIP-1193 code (4200)
Opened
#280 fix: a throw inside handleRpc hangs the dApp's promise forever with no error
Opened
#283 Uniswap V2_SWAP_EXACT_OUT (command 0x09) is decoded by a function nothing calls
Opened
#285 docs: README still documents the EIP-1193 code loss that #274 fixed
Opened
#287 flake: the Chrome e2e dApp signing prompt loses its page about one run in three under load
Opened
#290 test: make test-e2e is flaky under host load — "the extension opened no approval window within 30000ms"