fix: filter a fake ETH token from the balance list too (closes #235)

src/shared/transactions.js

@@ -8,8 +8,9 @@
 
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
-const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { parseHoldersCount, isLowHolderCount } = require("./holders");
+const { isSpoofedSymbol } = require("./symbolSpoof");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -245,18 +246,6 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     return result;
 }
 
-// Check if a token transfer is spoofing a known symbol.
-// Returns true if the symbol matches a known token but the contract
-// address doesn't match the legitimate one.
-function isSpoofedSymbol(tx) {
-    if (!tx.contractAddress) return false;
-    const symbol = (tx.symbol || "").toUpperCase();
-    if (!KNOWN_SYMBOLS.has(symbol)) return false;
-    const legit = KNOWN_SYMBOLS.get(symbol);
-    if (legit === null) return true; // "ETH" as ERC-20 is always fake
-    return normalizeAddress(tx.contractAddress) !== normalizeAddress(legit);
-}
-
 // Pure filter function. Takes raw transactions and filter settings,
 // returns { transactions, newFraudContracts }.
 function filterTransactions(txs, filters = {}) {
@@ -283,7 +272,7 @@ function filterTransactions(txs, filters = {}) {
         const contract = normalizeAddress(tx.contractAddress);
 
         // Filter spoofed known symbols and record the fraud contract
-        if (hideSpoofed && isSpoofedSymbol(tx)) {
+        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
             if (contract && !fraudSet.has(contract)) {
                 fraudSet.add(contract);
                 newFraud.push(contract);