From 9b7e18063c5c81918ed3c800f7eb631ba20210ef Mon Sep 17 00:00:00 2001 From: clawbot Date: Tue, 11 Aug 2026 13:05:40 +0000 Subject: [PATCH] fix: add a Settings toggle for known-symbol spoof verification (closes #176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README promises all four token-spam filters "default to on but can be individually disabled". Known-symbol spoof verification had no state flag, no checkbox and no consulted setting: filterTransactions() applied it before any filter setting was read, so three of the four documented filters were configurable and the fourth was mandatory. Adds hideSpoofedSymbols, default on, persisted and migrated so a profile written before the setting existed loads it as on rather than undefined. The flag is fail-safe in the pure function too: only an explicit false disables the check, so a caller that omits the key keeps it. Turning the setting off also stops the fraud-contract learning. That learning is fed only by this check, and leaving it on would make the setting a no-op: the contract it recorded would hide the very row the user asked to see, via the fraud-contract rule that is on by default. Scope: the setting governs the transaction history. The same check on the balance list and the send-screen token selector stays unconditional — those decide which tokens the user can act on, not what the history displays. The README's user-configurable paragraph now states what each of the four settings actually reaches, which is not uniform. The two `current behaviour:` tests pinning the filter as undisableable are inverted rather than deleted, and joined by coverage for the bypass, the halted learning, the untouched sibling rules and the storage round-trip. --- README.md | 33 +++++++-- TODO.md | 4 + docs/README.md | 9 ++- src/popup/index.html | 9 +++ src/popup/views/addressDetail.js | 1 + src/popup/views/addressToken.js | 1 + src/popup/views/home.js | 1 + src/popup/views/settings.js | 6 ++ src/shared/state.js | 8 ++ src/shared/transactions.js | 11 ++- tests/state.test.js | 57 +++++++++++++++ tests/transactions.test.js | 122 ++++++++++++++++++++++++++----- 12 files changed, 234 insertions(+), 28 deletions(-) diff --git a/README.md b/README.md index 5a2d7a7..c2c6972 100644 --- a/README.md +++ b/README.md @@ -720,6 +720,7 @@ screen, including ExportPrivKey, falls back to Home. - Blockscout API: endpoint URL input + "Save" button (validated against `/stats` before being saved) - Token Spam Protection: + - "Hide fake tokens impersonating a known symbol" checkbox - "Hide tokens with fewer than 1,000 holders" checkbox - "Hide transactions from detected fraud contracts" checkbox - "Hide dust transactions below N gwei" checkbox + threshold input @@ -1081,7 +1082,19 @@ indexes it as a real token transfer. a spoof and filtered from display. The fake "Ethereum" token in the attack above used symbol "ETH" from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not match the known - WETH contract — so it would be caught by this check. + WETH contract — so it would be caught by this check. Detecting a spoof is also + what adds a contract to the fraud contract blocklist below; that is the only + thing that populates it. In the transaction history the check is the "Hide + fake tokens impersonating a known symbol" setting, on by default; with it off, + spoofed transfers are shown and no new blocklist entries are learned from + them. The send-screen token selector applies the same check unconditionally, + because it decides which tokens the user can act on rather than what the + history displays. The balance list applies it unconditionally too, but not + identically: it exempts symbols that `KNOWN_SYMBOLS` maps to `null`, and + `"ETH"` is the only one. So the fake "Ethereum" token above is filtered from + the transaction history and from the send selector, but a fake-`ETH` ERC-20 + that clears the balance list's own 1,000-holder floor — or that the user + tracked manually — is still shown in the balance list. - **Low-holder token filtering**: Token transfers from ERC-20 contracts with fewer than 1,000 holders are hidden from transaction history by default. @@ -1111,11 +1124,19 @@ indexes it as a real token transfer. about. The threshold is user-configurable in Settings; a threshold of `0` hides nothing, exactly as clearing the checkbox does. -- **User-configurable**: All of the above filters (known symbol verification, - low-holder threshold, fraud contract blocklist, dust threshold) are settings - that default to on but can be individually disabled by the user. AutistMask is - designed as a sharp tool — users who understand the risks can configure the - wallet to show everything unfiltered, unix-style. +- **User-configurable**: All four filters (known symbol verification, low-holder + threshold, fraud contract blocklist, dust threshold) are settings that default + to on but can be individually disabled by the user. AutistMask is designed as + a sharp tool — users who understand the risks can configure the wallet to show + everything unfiltered, unix-style. All four settings govern the transaction + history; what else each one reaches varies. The known-symbol check also runs + unconditionally on the send-screen token selector, and on the balance list + except for symbols mapped to `null` (`"ETH"` alone), which the balance list + does not filter. The fraud contract blocklist is applied unconditionally on + that selector and is not consulted by the balance list at all. The low-holder + setting also gates the send selector, while the balance list's own + 1,000-holder floor is unconditional (see Data Model). The dust threshold + applies to the transaction history alone. #### Phishing Domain Protection diff --git a/TODO.md b/TODO.md index 6e39305..f4091a6 100644 --- a/TODO.md +++ b/TODO.md @@ -44,6 +44,10 @@ undefined identifiers, which is how # Completed Steps +- 2026-08-11: Known-symbol spoof verification became a Settings toggle + (`hideSpoofedSymbols`), on by default, governing the transaction-history + filter and the fraud-contract learning it feeds + ([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)). - 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of falling back to the 100,000 gwei default, and every address comparison in `src/shared/transactions.js` goes through one case-normalising helper so a diff --git a/docs/README.md b/docs/README.md index 7244b8e..9ef5272 100644 --- a/docs/README.md +++ b/docs/README.md @@ -323,7 +323,14 @@ by default: **Known token symbol verification.** AutistMask ships a list of roughly 500 legitimate ERC-20 tokens with their contract addresses. If a transaction or balance claims to involve a known symbol (like "ETH" or "USDT") but comes from -an unrecognized contract, it is identified as a spoof and hidden. +an unrecognized contract, it is identified as a spoof and hidden. In your +transaction history this is the "Hide fake tokens impersonating a known symbol" +setting, which you can switch off; doing so also stops new entries being added +to the fraud contract blocklist below, since detecting a spoof is what fills it. +The send token list always applies the check. Your balances apply it too, with +one exception: a token claiming the symbol "ETH" is not filtered there, so a +fake "ETH" token can still show up in your balance list even though it is hidden +from your transaction history and from the send token list. **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden from transaction history and the send token list, and are left out of your diff --git a/src/popup/index.html b/src/popup/index.html index a38e901..454b670 100644 --- a/src/popup/index.html +++ b/src/popup/index.html @@ -948,6 +948,15 @@ transfers and prevent interaction with suspicious tokens.

+