fix: show balances and fees below 0.000001 as nonzero on the send screens (closes #343)

The stored ETH and token balances and the send-confirm screen's fee were each
cut to six decimal places, and a token holding cut to zero was dropped, so a
value below 0.000001 read as zero. Balances are now stored exactly, whatever
decimals a token declares, and every nonzero token holding is kept; the balance
check reads a token balance to its first 18 places. The balance lists, the
send-screen token selector, the address total and the remove-address warning
leave out a holding below 0.000001 themselves, through isBelowOneMillionth().
The send and send-confirm screens' balances, reserve and insufficient-balance
messages go through truncateAmountNeverZero(). The send-confirm and approval
screens both render the fee through formatFee(), which prices the exact fee in
USD.

Model: opus-5-5

src/popup/views/approval.js

@@ -8,6 +8,7 @@ const {
     renderAddressHtml,
     attachCopyHandlers,
     onViewLeave,
+    formatFee,
 } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { networkByChainId } = require("../../shared/networks");
@@ -207,7 +208,7 @@ function showPhishingWarning(elementId, isPhishing) {
 // and the nonce. The background compares every one of them against the signed
 // artifact, so every one of them has to be on the screen — a number that is
 // verified but never displayed is verified against nothing the user agreed to.
-function showTxFee(approvedTx, ethPrice) {
+function showTxFee(approvedTx) {
     const network = networkByChainId(approvedTx.chainId);
     $("approve-tx-network").textContent = network
         ? network.name
@@ -215,12 +216,9 @@ function showTxFee(approvedTx, ethPrice) {
 
     const gasLimit = BigInt(approvedTx.gasLimit);
     const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
-    const maxFeeEth = formatTxValue(formatEther(gasLimit * feePerGas));
-    const usdStr = formatUsd(
-        ethPrice ? parseFloat(maxFeeEth) * ethPrice : null,
-    );
-    $("approve-tx-fee").textContent =
-        maxFeeEth + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
+    // Through formatFee(), as the confirmation screen's fee is, so the same
+    // fee reads the same on both.
+    $("approve-tx-fee").textContent = formatFee(gasLimit * feePerGas);
 
     let detail =
         gasLimit.toString() +
@@ -332,7 +330,7 @@ function showTxApproval(details) {
     $("approve-tx-value").textContent =
         ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
 
-    showTxFee(approvedTx, ethPrice);
+    showTxFee(approvedTx);
 
     // Decode calldata (reuse decoded from above)
     const decodedEl = $("approve-tx-decoded");

src/popup/views/confirmTx.js

@@ -15,6 +15,7 @@ const {
     attachCopyHandlers,
     goBack,
     onViewLeave,
+    formatFee,
 } = require("./helpers");
 const { state } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
@@ -31,6 +32,9 @@ const {
     transferAmountUnits,
 } = require("../../shared/transferAmount");
 const { assertWithinCeilings } = require("../../shared/approvalVerify");
+// The balance lines, the fee reserve and the insufficient-balance messages go
+// through it, as the approval screen's amounts do.
+const { truncateAmountNeverZero } = require("../../shared/amountDisplay");
 const {
     CODES,
     FEE_PENDING,
@@ -150,11 +154,17 @@ function show(txInfo) {
         $("confirm-balance").textContent =
             bal == null
                 ? "unknown (" + symbol + ")"
-                : valueWithUsd(bal + " " + symbol, balUsd);
+                : valueWithUsd(
+                      truncateAmountNeverZero(bal) + " " + symbol,
+                      balUsd,
+                  );
     } else {
         const bal = txInfo.balance || "0";
         const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
-        $("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
+        $("confirm-balance").textContent = valueWithUsd(
+            truncateAmountNeverZero(bal) + " ETH",
+            balUsd,
+        );
     }
 
     // Check for warnings (synchronous local checks)
@@ -249,7 +259,7 @@ function renderValidation(txInfo) {
                 : "Insufficient " +
                       symbol +
                       " balance. You have " +
-                      txInfo.tokenBalance +
+                      truncateAmountNeverZero(txInfo.tokenBalance) +
                       " " +
                       symbol +
                       " but are trying to send " +
@@ -262,7 +272,7 @@ function renderValidation(txInfo) {
     if (codes.includes(CODES.INSUFFICIENT_ETH)) {
         messages.push(
             "Insufficient balance. You have " +
-                txInfo.balance +
+                truncateAmountNeverZero(txInfo.balance || "0") +
                 " ETH but are trying to send " +
                 txInfo.amount +
                 " ETH.",
@@ -305,14 +315,6 @@ function setVisible(id, visible) {
     $(id).style.visibility = visible ? "visible" : "hidden";
 }
 
-// A fee in wei as an ETH string, truncated to 6 decimal places.
-function formatFeeEth(wei) {
-    const parts = formatEther(wei).split(".");
-    const dec =
-        parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
-    return parts[0] + "." + dec + " ETH";
-}
-
 async function estimateGas(txInfo) {
     try {
         const provider = getProvider(state.rpcUrl, state.networkId);
@@ -359,26 +361,20 @@ async function estimateGas(txInfo) {
         // flight; a stale fee must not reach the screen or the balance check.
         if (pendingTx !== txInfo) return;
 
-        const ethPrice = getPrice("ETH");
-        const usd = (wei) =>
-            ethPrice ? parseFloat(formatEther(wei)) * ethPrice : null;
-
+        // The fee line goes through formatFee(), as the approval screen's
+        // does, so the same fee reads the same on both.
         if (estimateWei !== null && estimateWei < gasCostWei) {
-            $("confirm-fee-amount").textContent = valueWithUsd(
-                "~" + formatFeeEth(estimateWei),
-                usd(estimateWei),
-            );
+            $("confirm-fee-amount").textContent = "~" + formatFee(estimateWei);
             $("confirm-fee-reserve").textContent =
-                "up to " + formatFeeEth(gasCostWei) + " reserved";
+                "up to " +
+                truncateAmountNeverZero(formatEther(gasCostWei)) +
+                " ETH reserved";
             setVisible("confirm-fee-reserve", true);
         } else {
             // No spread to report: either there is no estimate, or the node
             // quotes a gas price at or above maxFeePerGas, so the expected
             // cost is not below the reserve. Show the reserve alone.
-            $("confirm-fee-amount").textContent = valueWithUsd(
-                formatFeeEth(gasCostWei),
-                usd(gasCostWei),
-            );
+            $("confirm-fee-amount").textContent = formatFee(gasCostWei);
             setVisible("confirm-fee-reserve", false);
         }
         feeStatus = FEE_KNOWN;

src/popup/views/deleteAddress.js

@@ -87,7 +87,8 @@ function recoveryPathText(wallet) {
 // AddressDetail, followed by the USD total when there is one to give — no
 // total line at all on testnet or before the first price fetch, and no figure
 // when every holding here is one with no price, since "$0.00" directly under
-// "This address holds a balance." is a contradiction.
+// "This address holds a balance." is a contradiction. A token holding below
+// 0.000001 does not count, as the lines below leave it out.
 function balanceWarningHtml(addr) {
     if (!addressHoldsFunds(addr)) return " ";
     const line = formatAddressTotal(getAddressValue(addr));

src/popup/views/helpers.js

@@ -12,6 +12,11 @@
 // escapeHtml lives in src/shared/html.js, where the escape and the
 // reasoning behind it are; it is re-exported below so views keep importing
 // it from here.
+const { formatEther } = require("ethers");
+const {
+    truncateAmountNeverZero,
+    isBelowOneMillionth,
+} = require("../../shared/amountDisplay");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
@@ -247,6 +252,19 @@ function unknownableAmount(balance) {
     return Number.isFinite(n) ? n : null;
 }
 
+// A network fee in wei as the confirmation and approval screens both show it:
+// the ETH figure through truncateAmountNeverZero(), then its USD value when the
+// ETH price is known. The USD value is of the exact fee, not of the truncated
+// figure.
+function formatFee(wei) {
+    const eth = formatEther(wei);
+    const ethPrice = getPrice("ETH");
+    const usd = ethPrice ? formatUsd(parseFloat(eth) * ethPrice) : "";
+    return (
+        truncateAmountNeverZero(eth) + " ETH" + (usd ? " (" + usd + ")" : "")
+    );
+}
+
 // One row of the balance list: symbol, quantity, fiat value.
 //
 // `symbol` is the ERC-20's own symbol() as the block explorer reported it,
@@ -292,6 +310,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     );
     const seen = new Set();
     for (const t of addr.tokenBalances || []) {
+        // A holding below 0.000001 is not listed, tracked or not. A tracked
+        // token then gets the zero row below while showZero is on.
+        if (isBelowOneMillionth(t.balance)) continue;
         // A null balance is a holding of an unstatable amount, not a holding
         // of zero, so the show-zero setting has no say over it: hiding it
         // would be asserting the zero nobody established. Anything that does
@@ -322,14 +343,16 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
 }
 
 // Whether an address holds anything at all: ETH or any ERC-20 the wallet
-// knows about. Deliberately unrounded — the rendered lines round to four
-// decimals, so a dust balance displays as 0.0000 while still being real
-// money at a real address. Callers that warn about holdings must ask this,
-// not the rendered figure.
+// knows about, except a token holding below 0.000001, which the balance list
+// under the remove-address warning leaves out too. Deliberately unrounded —
+// the rendered lines round to four decimals, so a dust balance displays as
+// 0.0000 while still being real money at a real address. Callers that warn
+// about holdings must ask this, not the rendered figure.
 function addressHoldsFunds(addr) {
     if (!addr) return false;
     if (parseFloat(addr.balance || "0") > 0) return true;
     for (const t of addr.tokenBalances || []) {
+        if (isBelowOneMillionth(t.balance)) continue;
         // A null balance is a holding whose amount could not be stated —
         // balances.js drops a row of zero base units before the scale is
         // consulted, so a row that survived with no quantity is holding
@@ -614,6 +637,7 @@ module.exports = {
     balanceLinesForAddress,
     addressHoldsFunds,
     unknownableAmount,
+    formatFee,
     addressColor,
     addressDotHtml,
     escapeHtml,

src/popup/views/send.js

@@ -16,6 +16,10 @@ const { resolveTokenDecimals } = require("../../shared/approvalAmount");
 const { resolveSymbol } = require("../../shared/tokenList");
 const { isLowHolderCount } = require("../../shared/holders");
 const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
+const {
+    truncateAmountNeverZero,
+    isBelowOneMillionth,
+} = require("../../shared/amountDisplay");
 const { getAddress } = require("ethers");
 
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
@@ -125,6 +129,10 @@ function renderSendTokenSelect(addr) {
         (state.fraudContracts || []).map((a) => a.toLowerCase()),
     );
     for (const t of addr.tokenBalances || []) {
+        // A holding below 0.000001 is left out, as the balance lists leave it
+        // out. Its token's own screen can still send it: there
+        // state.selectedToken picks the token, not this list.
+        if (isBelowOneMillionth(t.balance)) continue;
         if (isSpoofedSymbol(t.symbol, t.address)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
         // An unknown holder count does not withhold a token the user holds:
@@ -150,7 +158,9 @@ function updateSendBalance() {
     const token = state.selectedToken || $("send-token").value;
     if (token === "ETH") {
         $("send-balance").textContent =
-            "Current balance: " + (addr.balance || "0") + " ETH";
+            "Current balance: " +
+            truncateAmountNeverZero(addr.balance || "0") +
+            " ETH";
     } else {
         const tb = (addr.tokenBalances || []).find(
             (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -167,7 +177,10 @@ function updateSendBalance() {
         $("send-balance").textContent =
             bal == null
                 ? "Current balance: unknown (" + symbol + ")"
-                : "Current balance: " + bal + " " + symbol;
+                : "Current balance: " +
+                  truncateAmountNeverZero(bal) +
+                  " " +
+                  symbol;
     }
 }
 

src/shared/amountDisplay.js

@@ -6,10 +6,10 @@
 // (`src/shared/uniswap.js`) — and a fix applied to one of them left the other
 // two showing a different number for the same value.
 //
-// The two functions below are the two policies, not two implementations of
-// one: summary lists truncate, and the screens that state what is being
-// authorized truncate with a floor. Keeping them adjacent is the point, so a
-// change to the rule cannot reach one screen and miss another.
+// The two truncation functions below are the two policies, not two
+// implementations of one: summary lists truncate, and the screens that state
+// what is being authorized truncate with a floor. Keeping them adjacent is the
+// point, so a change to the rule cannot reach one screen and miss another.
 
 // Truncate to exactly four decimal places. Truncation, never rounding: an
 // amount must never be displayed as larger than it is, so 0.99999 stays
@@ -43,4 +43,18 @@ function truncateAmountNeverZero(val) {
     return parts[0] + "." + parts[1].slice(0, sig + 1);
 }
 
-module.exports = { truncateAmount, truncateAmountNeverZero };
+// Whether a stored token balance is a holding below 0.000001. The balance
+// lists, the send-screen token selector, the address total and the
+// remove-address warning leave such a holding out; the Send and confirmation
+// screens show it when its token is the one being sent. Exact, because
+// src/shared/balances.js stores plain decimal digits: below 0.000001 the
+// balance reads "0.000000" and then more digits.
+function isBelowOneMillionth(balance) {
+    return typeof balance === "string" && balance.startsWith("0.000000");
+}
+
+module.exports = {
+    truncateAmount,
+    truncateAmountNeverZero,
+    isBelowOneMillionth,
+};

src/shared/balances.js

@@ -52,19 +52,16 @@ function requireNetworkId(networkId) {
     return net;
 }
 
-function formatBalance(wei) {
-    const eth = formatEther(wei);
-    const parts = eth.split(".");
-    if (parts.length === 1) return eth + ".0";
-    const dec = parts[1].slice(0, 6).replace(/0+$/, "") || "0";
-    return parts[0] + "." + dec;
-}
-
+// A token balance as an exact decimal string, never cut: a cut stores a small
+// nonzero holding as zero. fetchTokenBalances() stores every nonzero holding of
+// a token it admits, however small; the screens that leave out one below
+// 0.000001 decide that themselves, through isBelowOneMillionth() in
+// src/shared/amountDisplay.js.
 function formatTokenBalance(raw, decimals) {
     const val = formatUnits(raw, decimals);
     const parts = val.split(".");
     if (parts.length === 1) return val + ".0";
-    const dec = parts[1].slice(0, 6).replace(/0+$/, "") || "0";
+    const dec = parts[1].replace(/0+$/, "") || "0";
     return parts[0] + "." + dec;
 }
 
@@ -149,11 +146,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
             const scale = known !== null ? known : decimals;
             // null is a holding of an amount that cannot be stated, which is
             // not the same as a holding of zero, and must never render as one.
-            // With a scale, the display filter proper applies: a balance that
-            // rounds to zero at six places is dust and is not listed. Without
-            // one there is no such judgement to make, and the row is kept.
             const bal = scale === null ? null : formatTokenBalance(raw, scale);
-            if (bal === "0.0") continue;
             // null means the explorer reported no count, which is not the
             // same as a count of zero.  This gate is not the low-holder
             // display filter: it has no user-facing off switch and governs
@@ -221,7 +214,9 @@ async function refreshBalances(
                 provider
                     .getBalance(addr.address)
                     .then((bal) => {
-                        addr.balance = formatBalance(bal);
+                        // Exact, never cut: a cut here stores a small nonzero
+                        // balance as zero.
+                        addr.balance = formatEther(bal);
                         log.debugf("ETH balance", addr.address, addr.balance);
                     })
                     .catch((e) => {

src/shared/prices.js

@@ -1,6 +1,7 @@
 // Price fetching with 5-minute cache, USD formatting, value aggregation.
 
 const { getTopTokenPrices } = require("./tokenList");
+const { isBelowOneMillionth } = require("./amountDisplay");
 
 const PRICE_CACHE_TTL = 300000; // 5 minutes
 
@@ -78,6 +79,9 @@ function getAddressValue(addr) {
     let usd = parseFloat(addr.balance || "0") * prices.ETH;
     let partial = false;
     for (const token of addr.tokenBalances || []) {
+        // A holding below 0.000001 is left out, as the balance lists leave it
+        // out, so the total never counts a holding the list does not show.
+        if (isBelowOneMillionth(token.balance)) continue;
         // A null balance is a holding whose scale nothing knows, so it has no
         // quantity to price — but it is still a holding, and a total that
         // silently omits it would read as complete. That is exactly what

src/shared/txValidation.js

@@ -139,7 +139,15 @@ function validateTransfer({
     const feeFp = known ? feeWei : null;
 
     if (isErc20) {
-        const tokenFp = toFixedPoint(tokenBalance) ?? 0n;
+        // A token can declare more than 18 decimals, and its balance is
+        // stored with all of them. Only the first 18 places (SCALE_DECIMALS)
+        // are read: an amount with more was refused above, so the places
+        // after them cannot decide whether the amount fits.
+        const tokenText =
+            typeof tokenBalance === "string"
+                ? tokenBalance.replace(/(\.\d{18})\d+$/, "$1")
+                : tokenBalance;
+        const tokenFp = toFixedPoint(tokenText) ?? 0n;
         if (amountFp > tokenFp) codes.push(CODES.INSUFFICIENT_TOKEN);
         if (feeFp !== null && feeFp > ethFp) {
             codes.push(CODES.INSUFFICIENT_ETH_FOR_FEE);