fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

A tracked token that the spoof rule refuses still got a zero row in the balance list while "Show tracked tokens with zero balance" was on. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds that row. AddToken and SettingsAddToken refuse such a token after the contract lookup, with the flash "Not added: this token fakes a known symbol." The bundled-list buttons on SettingsAddToken need no check: the rule never refuses a bundled token. README.md and docs/README.md now say the balance list drops such a token whatever the settings. Model: opus-5-5
2026-11-02 06:04:07 +01:00
parent 3191577f73
commit 7ababcf69e
6 changed files with 137 additions and 19 deletions
@@ -33,6 +33,7 @@ const { networkByChainId } = require("../../shared/networks");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { displaySymbol } = require("../../shared/symbolDisplay");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { markViewRendered } = require("../viewRouter");

@@ -447,6 +448,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
    if (showZero && trackedTokens) {
        for (const t of trackedTokens) {
            if (seen.has(t.address.toLowerCase())) continue;
+            // A token that the spoof rule refuses has no stored balance, and
+            // gets no zero row either.
+            if (isSpoofedSymbol(t.symbol, t.address)) continue;
            html += balanceLine(
                t.symbol,
                0,