fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Twenty existing tests and four shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

src/popup/views/addToken.js

@@ -87,7 +87,7 @@ function init(ctx) {
             }
             // The balance list never shows a token that the spoof rule
             // refuses, so such a token is not tracked.
-            if (isSpoofedSymbol(info.symbol, contractAddr)) {
+            if (isSpoofedSymbol(info.symbol, contractAddr, chainId)) {
                 showFlash("Not added: this token fakes a known symbol.");
                 if (addTokenScreenOpenings !== opening) return;
                 infoEl.textContent = "";

src/popup/views/addressToken.js

@@ -22,7 +22,7 @@ const {
     timeAgo,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
+const { bundledToken, resolveSymbol } = require("../../shared/tokenList");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -50,11 +50,17 @@ function show() {
     const addr = wallet.addresses[state.selectedAddress];
     const ai = state.selectedAddress;
     const tokenId = state.selectedToken;
-    const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
+    const chainId = currentNetwork().chainId;
+    const knownToken = bundledToken(tokenId, chainId);
     currentSymbol =
         tokenId === "ETH"
             ? nativeCurrency()
-            : resolveSymbol(tokenId, addr.tokenBalances, state.trackedTokens);
+            : resolveSymbol(
+                  tokenId,
+                  addr.tokenBalances,
+                  state.trackedTokens,
+                  chainId,
+              );
 
     $("address-token-title").textContent =
         wallet.name +

src/popup/views/helpers.js

@@ -314,14 +314,17 @@ function nativeCurrency() {
 // The wallets' balances hold what Blockscout reported for each token. So the
 // wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
-    const net = chainId ? networkByChainId(chainId) : currentNetwork();
+    const chainIdOrActive = chainId || currentNetwork().chainId;
+    const net = networkByChainId(chainIdOrActive);
     if (net && net.id === state.networkId) {
         return {
+            chainId: chainIdOrActive,
             trackedTokens: state.trackedTokens,
             wallets: state.useBlockscout ? state.wallets : [],
         };
     }
     return {
+        chainId: chainIdOrActive,
         trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
         wallets: [],
     };
@@ -352,7 +355,7 @@ function blockscoutOffTokenNoteHtml(token, chainId) {
 
 // The symbol shown for a token line, from these sources in order:
 //
-// - the bundled list
+// - the bundled list, for a token on Ethereum Mainnet
 // - the tokens the user tracks
 // - the explorer's report, while "Use Blockscout" is on
 //
@@ -459,7 +462,11 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
             if (seen.has(t.address.toLowerCase())) continue;
             // A token that the spoof rule refuses has no stored balance, and
             // gets no zero row either.
-            if (isSpoofedSymbol(t.symbol, t.address)) continue;
+            if (
+                isSpoofedSymbol(t.symbol, t.address, currentNetwork().chainId)
+            ) {
+                continue;
+            }
             html += balanceLine(
                 t.symbol,
                 t.balanceNotFetched ? null : 0,

src/popup/views/send.js

@@ -12,7 +12,7 @@ const {
     goBack,
     tokenSourcesByChainId,
 } = require("./helpers");
-const { state, currentAddress } = require("../../shared/state");
+const { state, currentAddress, currentNetwork } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
 const { resolveTokenDecimals } = require("../../shared/approvalAmount");
@@ -154,7 +154,9 @@ function renderSendTokenSelect(addr) {
         // out. Its token's own screen can still send it: there
         // state.selectedToken picks the token, not this list.
         if (isBelowOneMillionth(t.balance)) continue;
-        if (isSpoofedSymbol(t.symbol, t.address)) continue;
+        if (isSpoofedSymbol(t.symbol, t.address, currentNetwork().chainId)) {
+            continue;
+        }
         if (fraudSet.has(t.address.toLowerCase())) continue;
         // An unknown holder count does not withhold a token the user holds:
         // only a count the explorer actually reported as below the threshold
@@ -238,6 +240,7 @@ function updateSendBalance() {
             token,
             addr.tokenBalances,
             state.trackedTokens,
+            currentNetwork().chainId,
         );
         // A null balance is a holding whose scale is unknown. Saying a figure
         // for it would be a claim about the amount, so it reads as the
@@ -393,6 +396,7 @@ function init(_ctx) {
                 token,
                 addr.tokenBalances,
                 state.trackedTokens,
+                currentNetwork().chainId,
             );
             ({ tokenDecimals } = tokenBalanceAndDecimals(addr, token));
         }

src/popup/views/settingsAddToken.js

@@ -167,7 +167,7 @@ function init(_ctx) {
             // refuses, so such a token is not tracked. The rule never refuses
             // a bundled token, so the "Top tokens:" buttons and the top 100
             // dropdown need no such check.
-            if (isSpoofedSymbol(info.symbol, addr)) {
+            if (isSpoofedSymbol(info.symbol, addr, chainId)) {
                 showFlash("Not added: this token fakes a known symbol.");
                 infoEl.textContent = "";
                 infoEl.style.visibility = "hidden";