diff --git a/README.md b/README.md index f4e8ae7..fe44a1a 100644 --- a/README.md +++ b/README.md @@ -14,14 +14,18 @@ None of the common alternatives work on Firefox. Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform. Everything you need, nothing you don't. We import as few libraries as possible, don't implement any crypto, and don't send user-specific data anywhere but a -(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The -extension contacts three user-configurable services: the configured RPC node for -blockchain interactions, a public CoinDesk API (no API key) for realtime price -information, and a Blockscout block-explorer API for transaction history and -token balances. It also performs best-effort Etherscan address label lookups -during transaction confirmation. A community-maintained phishing domain -blocklist is built into the extension at build time and checked locally; nothing -is fetched for it at runtime. +(user-configurable) Ethereum RPC endpoint (which defaults to a public node) +unless the user turns on one of the two lookups below. Out of the box the +extension contacts the configured RPC node for blockchain interactions and a +public CoinDesk API (no API key) for realtime price information, which is sent +token symbols and nothing else. Two more services are sent none of the user's +data until the user turns them on, on the Welcome screen or in Settings: a +Blockscout block-explorer API for transaction history, the tokens the user has +not tracked and transaction details ("Use Blockscout"), and best-effort +Etherscan address label lookups during transaction confirmation ("Check +recipients on Etherscan"). A community-maintained phishing domain blocklist is +built into the extension at build time and checked locally; nothing is fetched +for it at runtime. In the extension is a hardcoded list of the top ERC20 contract addresses. You can add any ERC20 contract by contract address if you wish, but the hardcoded @@ -422,6 +426,24 @@ It also covers the red banner on the Settings screen: switching the network there to Sepolia must put up the `[TESTNET]` banner, and switching back to mainnet must take it down, both while Settings is still on screen. +It also covers what a new install sends to Blockscout and Etherscan +([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The route handler +records every request the extension makes, from its pages and its background +worker, from when the harness installs it, before the first popup page opens; a +request the background worker makes while it starts up, before then, is not +recorded. Welcome must offer "Use Blockscout" and "Check recipients on +Etherscan" unticked. With neither changed, Home, AddressDetail, AddressToken and +ConfirmTx must show the lines saying what is off; the popup is then closed until +the background has run a balance refresh of its own, and not one recorded +request may have gone to Blockscout or Etherscan. "Use Blockscout" is then +ticked from AddressDetail's gear: on "Back", AddressDetail must ask Blockscout +for its history and no longer say it is off, and Blockscout must then be asked +for the token balances. "Check recipients on Etherscan" is ticked from +ConfirmTx's gear: on "Back", ConfirmTx must ask Etherscan about the recipient +and show the label the stub page gives it. Both stay on for the rest of the run. +TransactionDetail with "Use Blockscout" off is not driven here, since no history +row leads to it then; the unit tests cover it. + It also covers the confirmation screen, for both a native ETH send and an ERC-20 send: Send disabled while the fee estimate is in flight, enabled once it lands, the fee block quoting the expected cost and the reserve separately, the distinct @@ -845,7 +867,8 @@ src/ views/ — one JS module per screen (home, send, approval, etc.) shared/ — modules used by both popup and background alarms.js — recurring background jobs (extension alarms API) - balances.js — ETH and tracked token balances via RPC, others via Blockscout + balances.js — ETH and tracked token balances via RPC, others via + Blockscout while "Use Blockscout" is on constants.js — chain IDs, default RPC endpoint, ERC-20 ABI ens.js — ENS forward/reverse resolution (popup only) holders.js — holder-count parsing and the low-holder rule @@ -1388,23 +1411,28 @@ that token's previous entry, as a failed ETH balance keeps its figure, or takes Blockscout's entry from the same refresh when there is none. Every other token comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so tokens do appear without the user adding them, and they keep their previous -figures while Blockscout fails. A tracked token is shown when its balance is -nonzero, and any other ERC-20 when its balance is nonzero and it is in the -bundled known-token list or has 1,000 or more holders. A token claiming a symbol -from the bundled list from any other contract address is always dropped, tracked -or not, and so is any token claiming a symbol that belongs to the native asset -and therefore has no legitimate contract at all (`"ETH"`, and every network's -`nativeCurrency`, such as `"SepoliaETH"`, on every network). That filter is -unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs -the transaction history and the send-screen token selector, not this list. A -token's holder count is unknown when the explorer reports none, or reports -anything other than a whole number written in digits alone, such as `1,000` or -`1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list does not -take an unknown count as 1,000 or more, so such a token is shown only when it is -on the bundled list or tracked. Every nonzero holding of a token shown is stored -exactly, however small, but a holding below 0.000001 is left out of the balance -lists, the send-screen token selector, the address total and the remove-address -warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and +figures while Blockscout fails. Blockscout is asked only while the user has "Use +Blockscout" on. While it is off, as it is until the user turns it on, a tracked +token's entry has no holder count and no `decimals` of Blockscout's, so its +balance is stated at the scale the bundled list or the tracked token records, +and no other token is listed, those from earlier refreshes included. A tracked +token is shown when its balance is nonzero, and any other ERC-20 when its +balance is nonzero and it is in the bundled known-token list or has 1,000 or +more holders. A token claiming a symbol from the bundled list from any other +contract address is always dropped, tracked or not, and so is any token claiming +a symbol that belongs to the native asset and therefore has no legitimate +contract at all (`"ETH"`, and every network's `nativeCurrency`, such as +`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide +tokens with fewer than 1,000 holders" setting governs the transaction history +and the send-screen token selector, not this list. A token's holder count is +unknown when the explorer reports none, or reports anything other than a whole +number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()` +in `src/shared/holders.js`). This list does not take an unknown count as 1,000 +or more, so such a token is shown only when it is on the bundled list or +tracked. Every nonzero holding of a token shown is stored exactly, however +small, but a holding below 0.000001 is left out of the balance lists, the +send-screen token selector, the address total and the remove-address warning +(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and confirmation screens show it when its token is the one being sent. Tracked tokens with a zero balance are listed as well while "Show tracked tokens with zero balance" is on. @@ -1576,7 +1604,10 @@ renders as it goes, and `viewRouter.js` records every screen that reaches more — rendering it a second time would re-fetch and overwrite what it holds, such as an edit typed into Settings and not yet saved. Home is the one screen "Back" always re-renders, so the wallet list reflects anything that changed -while the user was away from it. +while the user was away from it. Changing "Use Blockscout" or "Check recipients +on Etherscan" in Settings makes every screen but Settings count as not yet +rendered, so "Back" renders the screen it lands on under the new setting; the +stack is left as it is. A network switch leaves every screen on the page showing the previous network. The user makes it in Settings, or approves a site's request and the background @@ -1619,8 +1650,15 @@ view would leave a wallet one click from deletion. screen in that case. - **Elements**: - "Welcome! To get started, add a wallet." text + - A well saying that the wallet sends the user's data only to the Ethereum + RPC endpoint unless one of the two settings in it is turned on, here or + later in Settings: the "Use Blockscout" and "Check recipients on + Etherscan" checkboxes, the same two as in Settings, each with its sentence + on what it sends and to whom. Both are unticked until the user ticks them - "Add wallet" button - **Transitions**: + - Ticking or unticking either checkbox → stores the setting, as Settings + does (no screen change) - "Add wallet" → **AddWallet** #### Home (`main`) @@ -1641,6 +1679,8 @@ view would leave a wallet one click from deletion. holding more than one address); the ENS name, if resolved, is below it; then the full address on a row of its own, followed by the address USD total and a balance line for ETH and for each token shown for that address + - While "Use Blockscout" is off, a line under the wallet list: "Only tracked + tokens are listed, because "Use Blockscout" is off in Settings." - "Recent Transactions": up to 25 transactions merged across every address of every wallet, deduplicated by hash and filtered. Each row is three lines: age and direction, then the counterparty's colour dot (with our own @@ -1648,7 +1688,11 @@ view would leave a wallet one click from deletion. counterparty's full address on a row of its own. A contract creation has no counterparty: its second line is the amount alone and its third line says "This transaction creates a new contract. It has no recipient." The - transaction lists on AddressDetail and AddressToken draw the same rows + transaction lists on AddressDetail and AddressToken draw the same rows. + The history comes from Blockscout. While "Use Blockscout" is off, + Blockscout is not asked, and this list and those two show the one line "No + transaction history is shown, because "Use Blockscout" is off in + Settings." - "Add additional wallet..." link at bottom - **Transitions**: - Tap address row → sets the active address and broadcasts @@ -1716,10 +1760,13 @@ view would leave a wallet one click from deletion. - Full address (color dot, etherscan link, tap to copy) - USD total for address (see [Partial USD totals](#partial-usd-totals)) - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal - places, USD inline). Each balance row is clickable → **AddressToken** + places, USD inline). Each balance row is clickable → **AddressToken**. + While "Use Blockscout" is off, the line Home has under its wallet list + follows it - Send / Receive / + Token buttons and a "···" menu button - "···" dropdown containing a single "Export Private Key" entry - - Transaction list (with ENS resolution for counterparties) + - Transaction list (with ENS resolution for counterparties), or the line + Home's list shows while "Use Blockscout" is off - **Transitions**: - Tap balance row → **AddressToken** (for that token) - "Send" → **Send** (refuses with a flash message on a zero balance) @@ -1788,8 +1835,10 @@ view would leave a wallet one click from deletion. etherscan link) plus name, symbol, decimals, holder count and project website where known. The "Holders:" row is left out, not shown as 0, when the token's balance-list entry has no holder count: the explorer did not - report a readable one, or the token is not in the balance list - - Token-filtered transaction list (only this token's transfers) + report a readable one, "Use Blockscout" is off, or the token is not in the + balance list + - Token-filtered transaction list (only this token's transfers), or the line + Home's list shows while "Use Blockscout" is off - **Transitions**: - "Send" → **Send** (token locked: the dropdown is replaced by a static symbol and contract address) @@ -1875,7 +1924,12 @@ view would leave a wallet one click from deletion. recipient that has never sent a transaction and holds no ETH, recipient is a contract, burn address, and an Etherscan phishing/scam label. An address that has received ETH but never sent a transaction still holds that ETH, - so it gets no warning + so it gets no warning. The Etherscan label check is made only while "Check + recipients on Etherscan" is on. While it is off, the Etherscan box is left + out and a line in its place says "This address was not checked on + Etherscan, because "Check recipients on Etherscan" is off in Settings." + Which of the two is there is known when the screen is drawn, so neither + moves anything later - Errors (an invalid amount), plus five reserved error boxes, so the balance and the fee arriving later move nothing — the amount exceeds the balance (for a token whose scale is unknown it says the token's balance is @@ -1921,8 +1975,8 @@ view would leave a wallet one click from deletion. are that network's, so a testnet transaction shows none, its From, To and token contract links open that network's explorer, the balance read, the fee estimate and the contract and never-sent recipient checks ask that - network's RPC endpoint, and the Etherscan label check asks that network's - explorer + network's RPC endpoint, and the Etherscan label check, when it is made, + asks that network's explorer - "Sign & Send" (correct password) when the gas limit, a fee per gas or the total fee the RPC endpoint fills in at signing is over its bound in `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is @@ -2041,7 +2095,12 @@ view would leave a wallet one click from deletion. AddressToken. The screen describes the transaction on the network it was sent on, whichever network is active: its block, network details, decoded details and raw data are read from that network's Blockscout, the one Settings has for - it, and its etherscan links open that network's explorer. + it, and its etherscan links open that network's explorer. They are read only + while "Use Blockscout" is on. The screen can still be shown with it off, when + the popup reopens onto it after the user turned the setting off; then + Blockscout is not asked, and a line in their place says "No block, decoded + details, network details or raw data are shown, because "Use Blockscout" is + off in Settings." - **Elements** (grouped into logical blocks using light well containers; field labels are self-explanatory so groups have no headings): - "Transaction" heading, "Back" button @@ -2124,8 +2183,18 @@ view would leave a wallet one click from deletion. already active changes nothing and sends nothing - Ethereum RPC: endpoint URL input + "Save" button (validated against `eth_chainId` before being saved) - - Blockscout API: endpoint URL input + "Save" button (validated against - `/stats` before being saved) + - Blockscout API: a "Use Blockscout" checkbox, unticked until the user ticks + it, with a sentence saying it sends the user's addresses, and the hash of + each transaction opened, to the Blockscout API below, for transaction + history, tokens not tracked, and transaction details; then the endpoint + URL input + "Save" button (validated against `/stats` before being saved, + a request the user presses for that carries no user data, made whether or + not the checkbox is ticked) + - Etherscan: a "Check recipients on Etherscan" checkbox, unticked until the + user ticks it, with a sentence saying it sends the address about to be + sent to, to Etherscan, to look for a phishing or scam label on it. Both + checkboxes are one setting each for every network, and Welcome offers the + same two - Token Spam Protection: - "Hide fake tokens impersonating a known symbol" checkbox - "Hide tokens with fewer than 1,000 holders" checkbox @@ -2149,6 +2218,9 @@ view would leave a wallet one click from deletion. - Debug: hidden until revealed, then an "Enable debug mode" checkbox that turns on the red banner and verbose logging - **Transitions**: + - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" → + stores the setting (no screen change). The next balance refresh and every + screen drawn after that follow it - "+ Add wallet" → **AddWallet** - "+ Add token" → **SettingsAddToken** - `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase** @@ -2665,8 +2737,15 @@ view would leave a wallet one click from deletion. ### External Services -AutistMask is not a fully self-contained offline tool. It necessarily -communicates with three external services to function as a wallet: +AutistMask is not a fully self-contained offline tool. By default it sends the +user's data to one service only, the Ethereum RPC endpoint, and asks one more, +the CoinDesk price API, for prices with nothing but token symbols. Two more +services are sent none of the user's data until the user turns on the setting +for each, on the Welcome screen or in Settings: Blockscout ("Use Blockscout") +and Etherscan ("Check recipients on Etherscan"). Both settings are off in a new +profile, and each is one setting for every network. + +Contacted by default: - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among @@ -2687,13 +2766,36 @@ communicates with three external services to function as a wallet: - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No addresses or user-specific data. -- **Blockscout block-explorer API**: Used to fetch transaction history (normal - transactions and ERC-20 token transfers), ERC-20 token balances, and token - holder counts (for spam filtering). The default endpoint is - `https://eth.blockscout.com/api/v2` (configurable by the user in Settings). - - **Data sent**: Ethereum addresses. Blockscout receives the user's - addresses to query their transaction history and token balances. No - private keys, passwords, or signing operations are sent. +Contacted only while the user has turned the setting on: + +- **Blockscout block-explorer API** ("Use Blockscout"): Used to fetch + transaction history (normal transactions and ERC-20 token transfers) for Home, + AddressDetail and AddressToken, the balances of the ERC-20 tokens the user has + not tracked, token holder counts (for spam filtering), and a transaction's + block, network details and calldata for TransactionDetail. The default + endpoint is `https://eth.blockscout.com/api/v2` (configurable by the user in + Settings). While the setting is off, those screens say in a plain line what is + not shown and that this setting turns it on, and only tracked tokens are + listed, their balances read through the RPC endpoint. The endpoint check + Settings makes when the user presses "Save" beside the URL asks only for + `/stats` and carries no user data; it is made whether or not the setting is + on. + - **Data sent**: Ethereum addresses, and the hash of each transaction the + user opens. Blockscout receives the user's addresses to query their + transaction history and token balances. No private keys, passwords, or + signing operations are sent. + +- **Etherscan address labels** ("Check recipients on Etherscan"): When + confirming a transaction, the extension performs a best-effort lookup of the + recipient address on Etherscan to check for phishing/scam labels. This is a + direct page fetch with no API key; the user's browser makes the request. While + the setting is off, ConfirmTx says that no Etherscan check was made. + - **Data sent**: the recipient address. The user's own addresses are not + sent. + +The etherscan links on the screens open a page in the browser when the user +clicks one. They are not requests the wallet makes, and nothing is fetched from +them until then. What the extension does NOT do: @@ -2702,16 +2804,9 @@ What the extension does NOT do: - No Infura/Alchemy dependency (any JSON-RPC endpoint works) - No backend servers operated by the developer -In addition to the three user-configurable services above (RPC endpoint, -CoinDesk price API, and Blockscout API), AutistMask also contacts: - -- **Etherscan address labels**: When confirming a transaction, the extension - performs a best-effort lookup of the recipient address on Etherscan to check - for phishing/scam labels. This is a direct page fetch with no API key; the - user's browser makes the request. - -Users who want maximum privacy can point the RPC and Blockscout URLs at their -own self-hosted instances (price fetching can be disabled in a future version). +Users who want maximum privacy can point the RPC URL at their own node, and, +when they turn Blockscout on, the Blockscout URL at their own instance (price +fetching can be disabled in a future version). ### Dependencies @@ -2893,8 +2988,10 @@ logged. - Add multiple addresses within an HD wallet - Manage multiple wallets simultaneously - View ETH balance per address -- View ERC-20 token balances (tokens on the bundled known-token list, tokens - with 1,000 or more holders, and tokens the user adds by contract address) +- View ERC-20 token balances (tokens the user adds by contract address, and, + while "Use Blockscout" is on, tokens on the bundled known-token list and + tokens with 1,000 or more holders) +- View transaction history and transaction details, while "Use Blockscout" is on - Send ETH to an address - Send ERC-20 tokens to an address - Receive ETH/tokens (display address, copy to clipboard, QR code) diff --git a/docs/README.md b/docs/README.md index 424d7a2..24f6ce3 100644 --- a/docs/README.md +++ b/docs/README.md @@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that. - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard. -- **No third-party token list APIs.** Token balances come from the same block - explorer you configure for transaction history, and the extension ships its - own hardcoded list of top ERC-20 contract addresses for symbol-spoofing - detection. Any token you want tracked across all your addresses, you add - yourself by contract address. +- **No third-party token list APIs.** The balances of the tokens you track are + read from your RPC endpoint; while you have "Use Blockscout" on, the others + come from the same block explorer you configure for transaction history. The + extension ships its own hardcoded list of top ERC-20 contract addresses for + symbol-spoofing detection. Any token you want tracked across all your + addresses, you add yourself by contract address. - **No backend servers operated by the developer.** Nothing is sent to any server run by AutistMask. Every network destination is listed below. @@ -69,8 +70,11 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that. ## How It Works AutistMask is a browser extension that runs entirely in your browser. It does -not have a backend server. It communicates with five external destinations: -three you configure yourself, and two fixed ones used for scam detection. +not have a backend server. Out of the box it sends your data only to the +Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing +but token symbols. Blockscout and Etherscan are sent none of your data until you +turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome +screen or later in Settings. Both are off in a new install. ### External Services @@ -96,16 +100,23 @@ addresses are necessarily visible to the RPC provider when querying balances. **Blockscout API** (default: `eth.blockscout.com/api/v2`; `eth-sepolia.blockscout.com/api/v2` on Sepolia) -Used to fetch token balances and transaction history. Blockscout is an -open-source blockchain explorer. AutistMask queries it for your ERC-20 token -balances (including the holder counts used for spam filtering) and your recent -transactions and token transfers. You can change this in Settings to a -self-hosted Blockscout instance. +Off until you turn on "Use Blockscout". Used to fetch transaction history, the +balances of the tokens you have not tracked, and the details of a transaction +you open. Blockscout is an open-source blockchain explorer. AutistMask queries +it for your ERC-20 token balances (including the holder counts used for spam +filtering), your recent transactions and token transfers, and the block, fees +and calldata of a transaction you open. You can change this in Settings to a +self-hosted Blockscout instance. While it is off, the screens that would show +history say so, and only the tokens you track are listed. -When it is contacted: on every balance refresh, and whenever a screen showing -transaction history is opened. +When it is contacted: only while "Use Blockscout" is on, on every balance +refresh, whenever a screen showing transaction history is opened, and when you +open a transaction. -What gets sent: your Ethereum addresses (to look up balances and transactions). +What gets sent: your Ethereum addresses (to look up balances and transactions) +and the hash of each transaction you open. Pressing "Save" beside the Blockscout +URL in Settings checks that URL by asking it for `/stats`, which sends none of +your data, whether or not the setting is on. **CoinDesk CADLI price API** (`data-api.coindesk.com`) @@ -122,13 +133,16 @@ address. **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia) -When you review a send, AutistMask fetches the recipient's public Etherscan -address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam -warning, and shows a red warning if it finds one. This is a plain page fetch -with no API key, made by your browser. It is best-effort: if it fails, it is -silently ignored. This endpoint is not user-configurable. +Off until you turn on "Check recipients on Etherscan". When you review a send, +AutistMask fetches the recipient's public Etherscan address page and looks for a +"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if +it finds one. This is a plain page fetch with no API key, made by your browser. +It is best-effort: if it fails, it is silently ignored. This endpoint is not +user-configurable. While it is off, the confirmation screen says that no +Etherscan check was made. -When it is contacted: each time you reach the send confirmation screen. +When it is contacted: only while "Check recipients on Etherscan" is on, each +time you reach the send confirmation screen. What gets sent: the recipient address you are about to send to, and your IP address. Your own addresses are not sent. @@ -185,6 +199,9 @@ password. 1. Click the AutistMask icon in your browser toolbar. 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet". + On first use the same screen offers "Use Blockscout" and "Check recipients on + Etherscan", both off; tick either if you want what it does (see External + Services). You can change both later in Settings. 3. On the "From Phrase" tab, click the die button to generate a random 12-word recovery phrase. 4. **Write down the recovery phrase and store it safely.** Anyone with these @@ -220,10 +237,11 @@ always produce the same sequence of addresses. ### Adding ERC-20 Tokens -Tokens you hold show up automatically only if they are in the extension's -bundled list of well-known tokens or have at least 1,000 holders; everything -else is treated as spam and hidden. To track a token explicitly (which also -shows it at zero balance), add it by contract address: +Tokens you hold show up automatically only while "Use Blockscout" is on, and +then only if they are in the extension's bundled list of well-known tokens or +have at least 1,000 holders; everything else is treated as spam and hidden. To +track a token explicitly (which also shows it at zero balance, and shows it +whether or not "Use Blockscout" is on), add it by contract address: 1. Go to an address detail view (click `[info]` on any address). 2. Click "+ Token". @@ -389,8 +407,10 @@ Click the gear icon on the home screen to access settings: that network's defaults if you have not used it before. - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC. You can use your own node for maximum privacy. -- **Blockscout API**: Change the Blockscout instance used for token balances and - transaction history. You can use a self-hosted instance. +- **Blockscout API**: "Use Blockscout", off until you tick it, and the + Blockscout instance used for transaction history, the tokens you have not + tracked and transaction details. You can use a self-hosted instance. +- **Etherscan**: "Check recipients on Etherscan", off until you tick it. - **Token Spam Protection**: Toggle individual scam filters and set the dust transaction threshold. - **Allowed Sites / Denied Sites**: View and manage web3 site permissions. diff --git a/src/background/index.js b/src/background/index.js index f9d6b9d..b3e9dac 100644 --- a/src/background/index.js +++ b/src/background/index.js @@ -1397,6 +1397,7 @@ async function backgroundRefresh() { wallets, s.rpcUrl, s.blockscoutUrl, + s.useBlockscout, s.trackedTokens, s.networkId, ); diff --git a/src/popup/index.html b/src/popup/index.html index b41cf9e..cd261bc 100644 --- a/src/popup/index.html +++ b/src/popup/index.html @@ -43,6 +43,38 @@ + +
+

Etherscan

+ +

+ Sends the address you are about to send to, to + Etherscan, to look for a phishing or scam label on it. +

+
+

Token Spam Protection

@@ -1504,6 +1582,16 @@

+ + +