fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

A tracked token that the spoof rule refuses still got a zero row in the balance list while "Show tracked tokens with zero balance" was on. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds that row. AddToken and SettingsAddToken refuse such a token after the contract lookup, with the flash "Not added: this token fakes a known symbol." The bundled-list buttons on SettingsAddToken need no check: the rule never refuses a bundled token. README.md and docs/README.md now say the balance list drops such a token whatever the settings. Model: opus-5-5
2026-11-02 06:04:07 +01:00
parent 3191577f73
commit 7ababcf69e
6 changed files with 137 additions and 19 deletions
@@ -380,10 +380,8 @@ but comes from an unrecognized contract, it is identified as a spoof and hidden.
 In your transaction history this is the "Hide fake tokens impersonating a known
 symbol" setting, which you can switch off; doing so also stops new entries being
 added to the fraud contract blocklist below, since detecting a spoof is what
-fills it. The send token list always applies the check. Your balances apply it
-too, with one exception: a token claiming the symbol "ETH" is not filtered
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
+fills it. The send token list always applies the check. Your balance list always
+applies the check too.

 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your