harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

The two per-field ceilings in approvalVerify.js were checked independently,
but the fee a validator is paid is gasLimit × fee per gas: a gas limit and a
fee each under their own ceiling still multiply to thousands of ETH, which a
gas-consuming contract really collects. assertWithinCeilings now also bounds
that product against MAX_TOTAL_FEE (1 ETH), so both callers — populating the
dApp transaction and verifying the signed artifact — refuse it with a full
sentence naming the fee and the limit.

The wallet's own send in confirmTx.js pinned no fee fields, so ethers filled
them from the node with no bound; it now populates the transaction and runs the
same check before signing, showing the same error in the confirmation screen's
reserved errors box so nothing on screen moves.

Model: opus-4-8

src/popup/views/confirmTx.js

@@ -30,6 +30,7 @@ const {
     displayedDecimals,
     transferAmountUnits,
 } = require("../../shared/transferAmount");
+const { assertWithinCeilings } = require("../../shared/approvalVerify");
 const {
     CODES,
     FEE_PENDING,
@@ -394,6 +395,46 @@ async function estimateGas(txInfo) {
     }
 }
 
+// Populate the transaction this send describes, enforce the fee bound against
+// the fees that were actually filled in, then sign and broadcast it. The send
+// pins no fee fields, so ethers fills maxFeePerGas and the gas limit from what
+// the configured RPC node answers, with nothing otherwise bounding what a
+// hostile node can set — the dApp path's ceilings never reached this one.
+// Populating before the check is what makes assertWithinCeilings() see the
+// same numbers that would be signed; it throws an ApprovalMismatchError when
+// the product gasLimit × maxFeePerGas is over the bound, which the caller
+// shows in the reserved error area rather than sending.
+async function populateVerifyAndSend(connectedSigner, tx) {
+    let request;
+    if (tx.token === "ETH") {
+        request = { to: tx.to, value: parseEther(tx.amount) };
+    } else {
+        const contract = new Contract(tx.token, ERC20_ABI, connectedSigner);
+        // The contract's decimals() is read to be COMPARED with the scale the
+        // screen rendered this amount at, not to encode with: encoding from it
+        // signs whatever the contract answers now, which is not what the user
+        // read. A disagreement throws. See transferAmount.js.
+        const amount = transferAmountUnits(
+            tx.amount,
+            tx.tokenDecimals,
+            await contract.decimals(),
+        );
+        request = await contract.transfer.populateTransaction(tx.to, amount);
+    }
+    const populated = await connectedSigner.populateTransaction(request);
+    assertWithinCeilings(populated);
+    return connectedSigner.sendTransaction(populated);
+}
+
+// Show a full-sentence send failure in the reserved errors box, the same
+// element and markup renderValidation() uses for messages carrying the user's
+// own numbers, so it never moves anything on the screen.
+function showSendError(message) {
+    const el = $("confirm-errors");
+    el.innerHTML = `<div class="text-xs">${escapeHtml(message)}</div>`;
+    el.style.visibility = "visible";
+}
+
 async function checkRecipientHistory(txInfo) {
     try {
         const provider = getProvider(state.rpcUrl, state.networkId);
@@ -467,29 +508,7 @@ function init(_ctx) {
             const provider = getProvider(state.rpcUrl, state.networkId);
             const connectedSigner = signer.connect(provider);
 
-            if (pendingTx.token === "ETH") {
-                tx = await connectedSigner.sendTransaction({
-                    to: pendingTx.to,
-                    value: parseEther(pendingTx.amount),
-                });
-            } else {
-                const contract = new Contract(
-                    pendingTx.token,
-                    ERC20_ABI,
-                    connectedSigner,
-                );
-                // The contract's decimals() is read to be COMPARED with the
-                // scale the screen rendered this amount at, not to encode with:
-                // encoding from it signs whatever the contract answers now,
-                // which is not what the user read. A disagreement throws and is
-                // reported on the error screen. See transferAmount.js.
-                const amount = transferAmountUnits(
-                    pendingTx.amount,
-                    pendingTx.tokenDecimals,
-                    await contract.decimals(),
-                );
-                tx = await contract.transfer(pendingTx.to, amount);
-            }
+            tx = await populateVerifyAndSend(connectedSigner, pendingTx);
 
             // Best-effort: clear decrypted secret after use.
             // Note: JS strings are immutable; this nulls the reference but
@@ -498,6 +517,14 @@ function init(_ctx) {
             txStatus.showWait(pendingTx, tx.hash);
         } catch (e) {
             decryptedSecret = null;
+            // A fee over the bound is refused before anything is broadcast, so
+            // there is no transaction that may have reached the network to warn
+            // about: the message stays on the confirmation screen where the
+            // user can go back, rather than routing to the sent/failed screen.
+            if (e && e.approvalMismatch) {
+                showSendError(e.message);
+                return;
+            }
             const hash = tx ? tx.hash : null;
             txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
         } finally {
@@ -511,4 +538,4 @@ function init(_ctx) {
     });
 }
 
-module.exports = { init, show, restore };
+module.exports = { init, show, restore, populateVerifyAndSend };