fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

The balance list gave a tracked token a zero row while "Show tracked
tokens with zero balance" was on, even when the spoof rule refuses the
token. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds
that row.

AddToken and SettingsAddToken now refuse such a token after the contract
lookup, with a flash message that says why. The bundled-list buttons on
SettingsAddToken need no check, because the rule never refuses a bundled
token.

The README and docs/README.md now say that the balance list drops such a
token whatever the settings.

Model: opus-5-5

src/popup/views/addToken.js

@@ -3,6 +3,7 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
 // Counts the times AddToken has opened. A contract lookup started before
@@ -77,6 +78,15 @@ function init(ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked.
+            if (isSpoofedSymbol(info.symbol, contractAddr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                if (addTokenScreenOpenings !== opening) return;
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, contractAddr);
             state.trackedTokens.push({
                 address: contractAddr,

src/popup/views/helpers.js

@@ -33,6 +33,7 @@ const { networkByChainId } = require("../../shared/networks");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { displaySymbol } = require("../../shared/symbolDisplay");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { markViewRendered } = require("../viewRouter");
 
@@ -447,6 +448,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     if (showZero && trackedTokens) {
         for (const t of trackedTokens) {
             if (seen.has(t.address.toLowerCase())) continue;
+            // A token that the spoof rule refuses has no stored balance, and
+            // gets no zero row either.
+            if (isSpoofedSymbol(t.symbol, t.address)) continue;
             html += balanceLine(
                 t.symbol,
                 0,

src/popup/views/settingsAddToken.js

@@ -3,6 +3,7 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
 let ctx;
@@ -155,6 +156,16 @@ function init(_ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked. The rule never refuses
+            // a bundled token, so the "Top tokens:" buttons and the top 100
+            // dropdown need no such check.
+            if (isSpoofedSymbol(info.symbol, addr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, addr);
             state.trackedTokens.push({
                 address: addr,