fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

src/shared/balances.js

@@ -12,6 +12,7 @@ const { ERC20_ABI } = require("./constants");
 const { log, debugFetch } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
 const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -70,10 +71,20 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
             if (bal === "0.0") continue;
 
             const tokenAddr = (item.token.address_hash || "").toLowerCase();
-            const holders = parseInt(item.token.holders_count || "0", 10);
+            // null means the explorer reported no count, which is not the
+            // same as a count of zero.  This gate is not the low-holder
+            // display filter: it has no user-facing off switch and governs
+            // the whole balance list, so it stays strict and admits a token
+            // only on a reported count — an unreported one is no evidence.
+            // A legitimate token still reaches the list through the known
+            // token list or by the user tracking it, and the null is carried
+            // through to the views, where the two low-holder filters treat
+            // an unknown count as "do not judge" rather than as zero.
+            const holders = parseHoldersCount(item.token.holders_count);
             const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
-            const hasEnoughHolders = holders >= 1000;
+            const hasEnoughHolders =
+                holders !== null && holders >= LOW_HOLDER_THRESHOLD;
 
             // Skip spam tokens the user never asked to see
             if (!isKnown && !isTracked && !hasEnoughHolders) continue;
@@ -278,6 +289,7 @@ async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
 }
 
 module.exports = {
+    fetchTokenBalances,
     refreshBalances,
     lookupTokenInfo,
     getProvider,