fix: resolve approval-screen token decimals, and refuse to format an unknown scale (closes #306)

decodeCalldata consulted only the 512-entry bundled list and defaulted to 18
decimals, so a transfer of 5,000 units of a 6-decimal token rendered
"Amount 0.0000" and the user confirmed a drain reading zero. The same
understatement applied to approve, where an unbounded allowance also rendered
0.0000.

Decimals now resolve from the bundled list, then trackedTokens, then the
address's explorer-reported entry, with uint8 validation and a refusal when
sources for one contract disagree. When no source knows the scale, no
formatUnits call is reached at all: the line renders raw base units with an
explicit "decimals unknown" warning, and the same string reaches
pendingTxDetails.amount so the status screens carry no formatted figure either.

Verified failing first two independent ways: restoring the old
`token ? token.decimals : 18` fails 6 of 15 new tests with the unknown case
reporting "0.0000"; making the resolver return 18 rather than null on the
unknown path fails a different 6, spanning resolver and render levels.

src/popup/views/approval.js

@@ -21,6 +21,10 @@ const {
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
+const {
+    resolveTokenDecimals,
+    unknownDecimalsAmount,
+} = require("../../shared/approvalAmount");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
@@ -43,6 +47,23 @@ function formatTxValue(val) {
     return parts[0] + "." + dec;
 }
 
+// The amount line for a decoded ERC-20 call. With a known scale it is the
+// token quantity; with `decimals` null it is the base-unit integer with the
+// unknown scale stated, because formatting it with an assumed scale is what
+// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
+// carry, `display` is what the approval screen shows.
+function tokenAmountText(rawAmount, decimals, symbol) {
+    if (decimals === null) {
+        const unknown = unknownDecimalsAmount(rawAmount);
+        return { raw: unknown, display: unknown };
+    }
+    const formatted = formatTxValue(formatUnits(rawAmount, decimals));
+    return {
+        raw: formatted,
+        display: formatted + (symbol ? " " + symbol : ""),
+    };
+}
+
 function tokenLabel(address) {
     const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
     return t ? t.symbol : null;
@@ -59,7 +80,15 @@ function decodeCalldata(data, toAddress) {
         if (parsed) {
             const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
             const tokenSymbol = token ? token.symbol : null;
-            const tokenDecimals = token ? token.decimals : 18;
+            // null when no source knows this token's scale. It is not
+            // defaulted to 18: an amount formatted with a guessed scale is
+            // the wrong number, and for a token with fewer decimals than the
+            // guess it is the wrong number in the direction that reads as
+            // zero. See tokenAmountText().
+            const tokenDecimals = resolveTokenDecimals(toAddress, {
+                trackedTokens: state.trackedTokens,
+                wallets: state.wallets,
+            });
             const contractLabel = tokenSymbol
                 ? tokenSymbol + " (" + toAddress + ")"
                 : toAddress;
@@ -71,12 +100,11 @@ function decodeCalldata(data, toAddress) {
                     "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                 );
                 const isUnlimited = rawAmount === maxUint;
-                const amountRaw = isUnlimited
-                    ? "Unlimited"
-                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
-                const amountStr = isUnlimited
-                    ? "Unlimited"
-                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
+                // An unbounded allowance needs no scale to describe, so it is
+                // still named rather than refused.
+                const amount = isUnlimited
+                    ? { raw: "Unlimited", display: "Unlimited" }
+                    : tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
 
                 return {
                     name: "Token Approval",
@@ -97,8 +125,8 @@ function decodeCalldata(data, toAddress) {
                         },
                         {
                             label: "Amount",
-                            value: amountStr,
-                            rawValue: amountRaw,
+                            value: amount.display,
+                            rawValue: amount.raw,
                         },
                     ],
                 };
@@ -107,11 +135,11 @@ function decodeCalldata(data, toAddress) {
             if (parsed.name === "transfer") {
                 const to = parsed.args[0];
                 const rawAmount = parsed.args[1];
-                const amountRaw = formatTxValue(
-                    formatUnits(rawAmount, tokenDecimals),
+                const amount = tokenAmountText(
+                    rawAmount,
+                    tokenDecimals,
+                    tokenSymbol,
                 );
-                const amountStr =
-                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Transfer",
@@ -128,8 +156,8 @@ function decodeCalldata(data, toAddress) {
                         { label: "Recipient", value: to, address: to },
                         {
                             label: "Amount",
-                            value: amountStr,
-                            rawValue: amountRaw,
+                            value: amount.display,
+                            rawValue: amount.raw,
                         },
                     ],
                 };

src/shared/approvalAmount.js

@@ -0,0 +1,103 @@
+// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
+// to display when there is no such scale.
+//
+// The approval screen decodes `transfer` and `approve` calldata into a
+// quantity the user confirms against. That quantity is a base-unit integer,
+// and turning it into a number a person can read needs the token's decimals.
+// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
+// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
+// default of 18 it reads `0.0000`, and a user who reads zero signs.
+//
+// So a scale is either found or the amount is not formatted. Decimals are
+// looked for in the bundled token list, then in the tokens the user tracks,
+// then in what the block explorer reported for the contract; where none of
+// them answers, unknownDecimalsAmount() renders the base-unit integer with the
+// unknown scale stated, and no formatUnits() call is reached at all.
+//
+// This is the display counterpart to transferAmount.js, which takes the same
+// stance on the wallet's own send path: an amount whose scale is unknown or
+// disputed is refused rather than guessed at.
+
+// Solidity's decimals() is a uint8, and every source here is ultimately
+// reporting that call's result.
+const { MAX_DECIMALS } = require("./transferAmount");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
+
+// A decimals value as a number, or null if it is not one. The bundled list
+// stores numbers, the explorer's copy arrives as a string, and a token the
+// user added by hand can carry whatever lookupTokenInfo() got back, so the
+// accepted types are enumerated rather than coerced: Number([]) is 0 and
+// Number(true) is 1, so a coercing check would read an empty array as a scale
+// of zero and format the amount as whole tokens.
+function toDecimals(value) {
+    let n;
+    if (typeof value === "number") {
+        n = value;
+    } else if (typeof value === "bigint") {
+        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
+        n = Number(value);
+    } else if (typeof value === "string") {
+        if (!/^[0-9]+$/.test(value)) return null;
+        n = Number(value);
+    } else {
+        return null;
+    }
+    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
+    return n;
+}
+
+// Every decimals the explorer reported for this contract, across all the
+// addresses whose balances have been fetched. They describe one contract, so
+// they should agree; a set that does not agree is a scale in dispute, and this
+// screen has no way to tell which member is the true one.
+function explorerDecimals(lower, wallets) {
+    let found = null;
+    for (const wallet of wallets || []) {
+        for (const addr of wallet.addresses || []) {
+            for (const tb of addr.tokenBalances || []) {
+                if ((tb.address || "").toLowerCase() !== lower) continue;
+                const d = toDecimals(tb.decimals);
+                if (d === null) continue;
+                if (found !== null && found !== d) return null;
+                found = d;
+            }
+        }
+    }
+    return found;
+}
+
+// The decimals to render a token amount with, or null when nothing knows.
+// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
+function resolveTokenDecimals(tokenAddress, sources) {
+    const lower = (tokenAddress || "").toLowerCase();
+    if (!lower) return null;
+
+    const bundled = TOKEN_BY_ADDRESS.get(lower);
+    if (bundled) {
+        const d = toDecimals(bundled.decimals);
+        if (d !== null) return d;
+    }
+
+    const tracked = ((sources && sources.trackedTokens) || []).find(
+        (t) => (t.address || "").toLowerCase() === lower,
+    );
+    if (tracked) {
+        const d = toDecimals(tracked.decimals);
+        if (d !== null) return d;
+    }
+
+    return explorerDecimals(lower, sources && sources.wallets);
+}
+
+// What the amount line reads when the scale is unknown. The base units are
+// exact and the caveat is part of the same string, so the number on the screen
+// cannot be mistaken for a token quantity, and it can never read as zero for a
+// transfer that is not zero.
+function unknownDecimalsAmount(rawAmount) {
+    return String(rawAmount) + " base units (decimals unknown)";
+}
+
+module.exports = {
+    resolveTokenDecimals,
+    unknownDecimalsAmount,
+};