From d0202fde58fdb91aa351592c25c70346b9690b5a Mon Sep 17 00:00:00 2001 From: clawbot Date: Tue, 11 Aug 2026 13:05:40 +0000 Subject: [PATCH] fix: add a Settings toggle for known-symbol spoof verification (closes #176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README promises all four token-spam filters "default to on but can be individually disabled". Known-symbol spoof verification had no state flag, no checkbox and no consulted setting: filterTransactions() applied it before any filter setting was read, so three of the four documented filters were configurable and the fourth was mandatory. Adds hideSpoofedSymbols, default on, persisted and migrated so a profile written before the setting existed loads it as on rather than undefined. The flag is fail-safe in the pure function too: only an explicit false disables the check, so a caller that omits the key keeps it. Turning the setting off also stops the fraud-contract learning. That learning is fed only by this check, and leaving it on would make the setting a no-op: the contract it recorded would hide the very row the user asked to see, via the fraud-contract rule that is on by default. Scope: the setting governs the transaction history. The same check on the balance list and the send-screen token selector stays unconditional — those decide which tokens the user can act on, not what the history displays. The README's user-configurable paragraph now states what each of the four settings actually reaches, which is not uniform. The two `current behaviour:` tests pinning the filter as undisableable are inverted rather than deleted, and joined by coverage for the bypass, the halted learning, the untouched sibling rules and the storage round-trip. --- README.md | 26 +++++-- TODO.md | 4 + docs/README.md | 6 +- src/popup/index.html | 9 +++ src/popup/views/addressDetail.js | 1 + src/popup/views/addressToken.js | 1 + src/popup/views/home.js | 1 + src/popup/views/settings.js | 6 ++ src/shared/state.js | 8 ++ src/shared/transactions.js | 11 ++- tests/state.test.js | 57 +++++++++++++++ tests/transactions.test.js | 122 ++++++++++++++++++++++++++----- 12 files changed, 224 insertions(+), 28 deletions(-) diff --git a/README.md b/README.md index 956769b..81b4e8c 100644 --- a/README.md +++ b/README.md @@ -720,6 +720,7 @@ screen, including ExportPrivKey, falls back to Home. - Blockscout API: endpoint URL input + "Save" button (validated against `/stats` before being saved) - Token Spam Protection: + - "Hide fake tokens impersonating a known symbol" checkbox - "Hide tokens with fewer than 1,000 holders" checkbox - "Hide transactions from detected fraud contracts" checkbox - "Hide dust transactions below N gwei" checkbox + threshold input @@ -1081,7 +1082,14 @@ indexes it as a real token transfer. a spoof and filtered from display. The fake "Ethereum" token in the attack above used symbol "ETH" from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not match the known - WETH contract — so it would be caught by this check. + WETH contract — so it would be caught by this check. Detecting a spoof is also + what adds a contract to the fraud contract blocklist below; that is the only + thing that populates it. In the transaction history the check is the "Hide + fake tokens impersonating a known symbol" setting, on by default; with it off, + spoofed transfers are shown and no new blocklist entries are learned from + them. The same check on the balance list and on the send-screen token selector + is unconditional, because those decide which tokens the user can act on rather + than what the history displays. - **Low-holder token filtering**: Token transfers from ERC-20 contracts with fewer than 1,000 holders are hidden from transaction history by default. @@ -1110,11 +1118,17 @@ indexes it as a real token transfer. dust while low enough to preserve any transfer a user would plausibly care about. The threshold is user-configurable in Settings. -- **User-configurable**: All of the above filters (known symbol verification, - low-holder threshold, fraud contract blocklist, dust threshold) are settings - that default to on but can be individually disabled by the user. AutistMask is - designed as a sharp tool — users who understand the risks can configure the - wallet to show everything unfiltered, unix-style. +- **User-configurable**: All four filters (known symbol verification, low-holder + threshold, fraud contract blocklist, dust threshold) are settings that default + to on but can be individually disabled by the user. AutistMask is designed as + a sharp tool — users who understand the risks can configure the wallet to show + everything unfiltered, unix-style. All four settings govern the transaction + history; what else each one reaches varies. The known-symbol check also runs + unconditionally on the balance list and on the send-screen token selector, and + the fraud contract blocklist is applied unconditionally on that selector. The + low-holder setting also gates the send selector, while the balance list's own + 1,000-holder floor is unconditional (see Data Model). The dust threshold + applies to the transaction history alone. #### Phishing Domain Protection diff --git a/TODO.md b/TODO.md index 08910e2..a64da1e 100644 --- a/TODO.md +++ b/TODO.md @@ -44,6 +44,10 @@ undefined identifiers, which is how # Completed Steps +- 2026-08-11: Known-symbol spoof verification became a Settings toggle + (`hideSpoofedSymbols`), on by default, governing the transaction-history + filter and the fraud-contract learning it feeds + ([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)). - 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and the Makefile-only targets documented in the README diff --git a/docs/README.md b/docs/README.md index 7244b8e..78ed26d 100644 --- a/docs/README.md +++ b/docs/README.md @@ -323,7 +323,11 @@ by default: **Known token symbol verification.** AutistMask ships a list of roughly 500 legitimate ERC-20 tokens with their contract addresses. If a transaction or balance claims to involve a known symbol (like "ETH" or "USDT") but comes from -an unrecognized contract, it is identified as a spoof and hidden. +an unrecognized contract, it is identified as a spoof and hidden. In your +transaction history this is the "Hide fake tokens impersonating a known symbol" +setting, which you can switch off; doing so also stops new entries being added +to the fraud contract blocklist below, since detecting a spoof is what fills it. +Your balances and the send token list always apply the check. **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden from transaction history and the send token list, and are left out of your diff --git a/src/popup/index.html b/src/popup/index.html index a38e901..454b670 100644 --- a/src/popup/index.html +++ b/src/popup/index.html @@ -948,6 +948,15 @@ transfers and prevent interaction with suspicious tokens.

+