fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Twenty existing tests and four shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

src/shared/balances.js

@@ -17,7 +17,7 @@ const { ERC20_ABI } = require("./constants");
 const { NETWORKS } = require("./networks");
 const { log, debugFetch, urlOrigin } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
+const { bundledToken } = require("./tokenList");
 const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
@@ -106,6 +106,9 @@ function rawUnits(value) {
 // balance is read through the RPC endpoint instead, and its row here gives that
 // entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
+// `chainId` is the chain id of the network `blockscoutUrl` serves. The known
+// token list is used only when that network is Ethereum Mainnet.
+//
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
 // upstream of every screen that displays a token amount, so a value invented
@@ -117,6 +120,7 @@ async function fetchTokenBalances(
     address,
     blockscoutUrl,
     trackedTokens,
+    chainId,
     signal,
 ) {
     if (!(await storedSettingIsOn("useBlockscout"))) return [];
@@ -175,7 +179,10 @@ async function fetchTokenBalances(
             // either way: copying another source into it would make
             // explorerDecimals()'s disagreement check compare something other
             // than explorer values.
-            const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
+            const known = resolveTokenDecimals(tokenAddr, {
+                chainId,
+                trackedTokens,
+            });
             const scale = known !== null ? known : decimals;
             // null is a holding of an amount that cannot be stated, which is
             // not the same as a holding of zero, and must never render as one.
@@ -191,7 +198,7 @@ async function fetchTokenBalances(
             // through to the views, where the two low-holder filters treat
             // an unknown count as "do not judge" rather than as zero.
             const holders = parseHoldersCount(item.token.holders_count);
-            const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
+            const isKnown = bundledToken(tokenAddr, chainId) !== null;
             const isTracked = trackedSet.has(tokenAddr);
             const hasEnoughHolders = holders >= LOW_HOLDER_THRESHOLD;
 
@@ -202,7 +209,9 @@ async function fetchTokenBalances(
             // Every row here is an ERC-20 the explorer reported, so it has a
             // contract address; the native ETH balance is fetched over RPC in
             // refreshBalances and never passes through this loop.
-            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
+            if (isSpoofedSymbol(item.token.symbol, tokenAddr, chainId)) {
+                continue;
+            }
 
             balances.push({
                 address: item.token.address_hash,
@@ -253,17 +262,18 @@ async function fetchTokenBalances(
 // balance was not read, as lowercased contract addresses. A token is unread
 // when the spoof rule refuses it or its balanceOf fails.
 //
-// `signal` is as for fetchTokenBalances().
+// `chainId` and `signal` are as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
     provider,
     address,
     trackedTokens,
     previous,
     explorerRequest,
+    chainId,
     signal,
 ) {
     const listed = trackedTokens.filter(
-        (token) => !isSpoofedSymbol(token.symbol, token.address),
+        (token) => !isSpoofedSymbol(token.symbol, token.address, chainId),
     );
     // Each token's balanceOf answer, or null where it failed.
     const balances = await Promise.all(
@@ -309,7 +319,7 @@ async function fetchTrackedTokenBalances(
         if (raw === 0n) return;
         const entry = entryIn(reported);
         const decimals = entry ? entry.decimals : null;
-        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const known = resolveTokenDecimals(lower, { chainId, trackedTokens });
         const scale = known !== null ? known : decimals;
         rows.push({
             address: token.address,
@@ -341,6 +351,7 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
+    const { chainId } = requireNetworkId(networkId);
     const tracked = trackedTokens || [];
     const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     // The tracked tokens whose balance was not read at some address.
@@ -406,6 +417,7 @@ async function refreshBalances(
                 addr.address,
                 blockscoutUrl,
                 tracked,
+                chainId,
                 signal,
             );
             updates.push(
@@ -416,6 +428,7 @@ async function refreshBalances(
                         tracked,
                         previous,
                         explorerRequest,
+                        chainId,
                         signal,
                     ),
                     explorerRequest,