diff --git a/README.md b/README.md
index f4e8ae7..4ecb7d5 100644
--- a/README.md
+++ b/README.md
@@ -14,14 +14,18 @@ None of the common alternatives work on Firefox.
Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
Everything you need, nothing you don't. We import as few libraries as possible,
don't implement any crypto, and don't send user-specific data anywhere but a
-(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
-extension contacts three user-configurable services: the configured RPC node for
-blockchain interactions, a public CoinDesk API (no API key) for realtime price
-information, and a Blockscout block-explorer API for transaction history and
-token balances. It also performs best-effort Etherscan address label lookups
-during transaction confirmation. A community-maintained phishing domain
-blocklist is built into the extension at build time and checked locally; nothing
-is fetched for it at runtime.
+(user-configurable) Ethereum RPC endpoint (which defaults to a public node)
+unless the user turns on one of the two lookups below. Out of the box the
+extension contacts the configured RPC node for blockchain interactions and a
+public CoinDesk API (no API key) for realtime price information, which is sent
+token symbols and nothing else. Two more services are sent none of the user's
+data until the user turns them on, on the Welcome screen or in Settings: a
+Blockscout block-explorer API for transaction history, the tokens the user has
+not tracked and transaction details ("Use Blockscout"), and best-effort
+Etherscan address label lookups during transaction confirmation ("Check
+recipients on Etherscan"). A community-maintained phishing domain blocklist is
+built into the extension at build time and checked locally; nothing is fetched
+for it at runtime.
In the extension is a hardcoded list of the top ERC20 contract addresses. You
can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -422,6 +426,24 @@ It also covers the red banner on the Settings screen: switching the network
there to Sepolia must put up the `[TESTNET]` banner, and switching back to
mainnet must take it down, both while Settings is still on screen.
+It also covers what a new install sends to Blockscout and Etherscan
+([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The route handler
+records every request the extension makes, from its pages and its background
+worker, from when the harness installs it, before the first popup page opens; a
+request the background worker makes while it starts up, before then, is not
+recorded. Welcome must offer "Use Blockscout" and "Check recipients on
+Etherscan" unticked. With neither changed, Home, AddressDetail, AddressToken and
+ConfirmTx must show the lines saying what is off; the popup is then closed until
+the background has run a balance refresh of its own, and not one recorded
+request may have gone to Blockscout or Etherscan. "Use Blockscout" is then
+ticked from AddressDetail's gear: on "Back", AddressDetail must ask Blockscout
+for its history and no longer say it is off, and Blockscout must then be asked
+for the token balances. "Check recipients on Etherscan" is ticked from
+ConfirmTx's gear: on "Back", ConfirmTx must ask Etherscan about the recipient
+and show the label the stub page gives it. Both stay on for the rest of the run.
+TransactionDetail with "Use Blockscout" off is not driven here, since no history
+row leads to it then; the unit tests cover it.
+
It also covers the confirmation screen, for both a native ETH send and an ERC-20
send: Send disabled while the fee estimate is in flight, enabled once it lands,
the fee block quoting the expected cost and the reserve separately, the distinct
@@ -845,7 +867,8 @@ src/
views/ — one JS module per screen (home, send, approval, etc.)
shared/ — modules used by both popup and background
alarms.js — recurring background jobs (extension alarms API)
- balances.js — ETH and tracked token balances via RPC, others via Blockscout
+ balances.js — ETH and tracked token balances via RPC, others via
+ Blockscout while "Use Blockscout" is on
constants.js — chain IDs, default RPC endpoint, ERC-20 ABI
ens.js — ENS forward/reverse resolution (popup only)
holders.js — holder-count parsing and the low-holder rule
@@ -1388,23 +1411,28 @@ that token's previous entry, as a failed ETH balance keeps its figure, or takes
Blockscout's entry from the same refresh when there is none. Every other token
comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
tokens do appear without the user adding them, and they keep their previous
-figures while Blockscout fails. A tracked token is shown when its balance is
-nonzero, and any other ERC-20 when its balance is nonzero and it is in the
-bundled known-token list or has 1,000 or more holders. A token claiming a symbol
-from the bundled list from any other contract address is always dropped, tracked
-or not, and so is any token claiming a symbol that belongs to the native asset
-and therefore has no legitimate contract at all (`"ETH"`, and every network's
-`nativeCurrency`, such as `"SepoliaETH"`, on every network). That filter is
-unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
-the transaction history and the send-screen token selector, not this list. A
-token's holder count is unknown when the explorer reports none, or reports
-anything other than a whole number written in digits alone, such as `1,000` or
-`1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list does not
-take an unknown count as 1,000 or more, so such a token is shown only when it is
-on the bundled list or tracked. Every nonzero holding of a token shown is stored
-exactly, however small, but a holding below 0.000001 is left out of the balance
-lists, the send-screen token selector, the address total and the remove-address
-warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
+figures while Blockscout fails. The refresh asks Blockscout only while the user
+has "Use Blockscout" on. While it is off, as it is until the user turns it on, a
+tracked token's entry has no holder count and no `decimals` of Blockscout's, so
+its balance is stated at the scale the bundled list or the tracked token
+records, and no other token is listed, those from earlier refreshes included. A
+tracked token is shown when its balance is nonzero, and any other ERC-20 when
+its balance is nonzero and it is in the bundled known-token list or has 1,000 or
+more holders. A token claiming a symbol from the bundled list from any other
+contract address is always dropped, tracked or not, and so is any token claiming
+a symbol that belongs to the native asset and therefore has no legitimate
+contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens with fewer than 1,000 holders" setting governs the transaction history
+and the send-screen token selector, not this list. A token's holder count is
+unknown when the explorer reports none, or reports anything other than a whole
+number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+or more, so such a token is shown only when it is on the bundled list or
+tracked. Every nonzero holding of a token shown is stored exactly, however
+small, but a holding below 0.000001 is left out of the balance lists, the
+send-screen token selector, the address total and the remove-address warning
+(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
confirmation screens show it when its token is the one being sent. Tracked
tokens with a zero balance are listed as well while "Show tracked tokens with
zero balance" is on.
@@ -1576,7 +1604,10 @@ renders as it goes, and `viewRouter.js` records every screen that reaches
more — rendering it a second time would re-fetch and overwrite what it holds,
such as an edit typed into Settings and not yet saved. Home is the one screen
"Back" always re-renders, so the wallet list reflects anything that changed
-while the user was away from it.
+while the user was away from it. Changing "Use Blockscout" or "Check recipients
+on Etherscan" in Settings makes every screen but Settings count as not yet
+rendered, so "Back" renders the screen it lands on under the new setting; the
+stack is left as it is.
A network switch leaves every screen on the page showing the previous network.
The user makes it in Settings, or approves a site's request and the background
@@ -1619,8 +1650,15 @@ view would leave a wallet one click from deletion.
screen in that case.
- **Elements**:
- "Welcome! To get started, add a wallet." text
+ - A well saying that the wallet sends the user's data only to the Ethereum
+ RPC endpoint unless one of the two settings in it is turned on, here or
+ later in Settings: the "Use Blockscout" and "Check recipients on
+ Etherscan" checkboxes, the same two as in Settings, each with its sentence
+ on what it sends and to whom. Both are unticked until the user ticks them
- "Add wallet" button
- **Transitions**:
+ - Ticking or unticking either checkbox → stores the setting, as Settings
+ does (no screen change)
- "Add wallet" → **AddWallet**
#### Home (`main`)
@@ -1641,6 +1679,8 @@ view would leave a wallet one click from deletion.
holding more than one address); the ENS name, if resolved, is below it;
then the full address on a row of its own, followed by the address USD
total and a balance line for ETH and for each token shown for that address
+ - While "Use Blockscout" is off, a line under the wallet list: "Only tracked
+ tokens are listed, because "Use Blockscout" is off in Settings."
- "Recent Transactions": up to 25 transactions merged across every address
of every wallet, deduplicated by hash and filtered. Each row is three
lines: age and direction, then the counterparty's colour dot (with our own
@@ -1648,7 +1688,11 @@ view would leave a wallet one click from deletion.
counterparty's full address on a row of its own. A contract creation has
no counterparty: its second line is the amount alone and its third line
says "This transaction creates a new contract. It has no recipient." The
- transaction lists on AddressDetail and AddressToken draw the same rows
+ transaction lists on AddressDetail and AddressToken draw the same rows.
+ The history comes from Blockscout. While "Use Blockscout" is off,
+ Blockscout is not asked, and this list and those two show the one line "No
+ transaction history is shown, because "Use Blockscout" is off in
+ Settings."
- "Add additional wallet..." link at bottom
- **Transitions**:
- Tap address row → sets the active address and broadcasts
@@ -1716,10 +1760,13 @@ view would leave a wallet one click from deletion.
- Full address (color dot, etherscan link, tap to copy)
- USD total for address (see [Partial USD totals](#partial-usd-totals))
- Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
- places, USD inline). Each balance row is clickable → **AddressToken**
+ places, USD inline). Each balance row is clickable → **AddressToken**.
+ While "Use Blockscout" is off, the line Home has under its wallet list
+ follows it
- Send / Receive / + Token buttons and a "···" menu button
- "···" dropdown containing a single "Export Private Key" entry
- - Transaction list (with ENS resolution for counterparties)
+ - Transaction list (with ENS resolution for counterparties), or the line
+ Home's list shows while "Use Blockscout" is off
- **Transitions**:
- Tap balance row → **AddressToken** (for that token)
- "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1788,8 +1835,10 @@ view would leave a wallet one click from deletion.
etherscan link) plus name, symbol, decimals, holder count and project
website where known. The "Holders:" row is left out, not shown as 0, when
the token's balance-list entry has no holder count: the explorer did not
- report a readable one, or the token is not in the balance list
- - Token-filtered transaction list (only this token's transfers)
+ report a readable one, "Use Blockscout" is off, or the token is not in the
+ balance list
+ - Token-filtered transaction list (only this token's transfers), or the line
+ Home's list shows while "Use Blockscout" is off
- **Transitions**:
- "Send" → **Send** (token locked: the dropdown is replaced by a static
symbol and contract address)
@@ -1875,7 +1924,12 @@ view would leave a wallet one click from deletion.
recipient that has never sent a transaction and holds no ETH, recipient is
a contract, burn address, and an Etherscan phishing/scam label. An address
that has received ETH but never sent a transaction still holds that ETH,
- so it gets no warning
+ so it gets no warning. The Etherscan label check is made only while "Check
+ recipients on Etherscan" is on. While it is off, the Etherscan box is left
+ out and a line in its place says "This address was not checked on
+ Etherscan, because "Check recipients on Etherscan" is off in Settings."
+ Which of the two is there is known when the screen is drawn, so neither
+ moves anything later
- Errors (an invalid amount), plus five reserved error boxes, so the balance
and the fee arriving later move nothing — the amount exceeds the balance
(for a token whose scale is unknown it says the token's balance is
@@ -1921,8 +1975,8 @@ view would leave a wallet one click from deletion.
are that network's, so a testnet transaction shows none, its From, To and
token contract links open that network's explorer, the balance read, the
fee estimate and the contract and never-sent recipient checks ask that
- network's RPC endpoint, and the Etherscan label check asks that network's
- explorer
+ network's RPC endpoint, and the Etherscan label check, when it is made,
+ asks that network's explorer
- "Sign & Send" (correct password) when the gas limit, a fee per gas or the
total fee the RPC endpoint fills in at signing is over its bound in
`assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
@@ -2041,7 +2095,12 @@ view would leave a wallet one click from deletion.
AddressToken. The screen describes the transaction on the network it was sent
on, whichever network is active: its block, network details, decoded details
and raw data are read from that network's Blockscout, the one Settings has for
- it, and its etherscan links open that network's explorer.
+ it, and its etherscan links open that network's explorer. They are read only
+ while "Use Blockscout" is on. The screen can still be shown with it off, when
+ the user opens Settings from it, turns the setting off and presses Back; then
+ Blockscout is not asked, and a line in their place says "No block, decoded
+ details, network details or raw data are shown, because "Use Blockscout" is
+ off in Settings."
- **Elements** (grouped into logical blocks using light well containers; field
labels are self-explanatory so groups have no headings):
- "Transaction" heading, "Back" button
@@ -2124,8 +2183,18 @@ view would leave a wallet one click from deletion.
already active changes nothing and sends nothing
- Ethereum RPC: endpoint URL input + "Save" button (validated against
`eth_chainId` before being saved)
- - Blockscout API: endpoint URL input + "Save" button (validated against
- `/stats` before being saved)
+ - Blockscout API: a "Use Blockscout" checkbox, unticked until the user ticks
+ it, with a sentence saying it sends the user's addresses, and the hash of
+ each transaction opened, to the Blockscout API below, for transaction
+ history, tokens not tracked, and transaction details; then the endpoint
+ URL input + "Save" button (validated against `/stats` before being saved,
+ a request the user presses for that carries no user data, made whether or
+ not the checkbox is ticked)
+ - Etherscan: a "Check recipients on Etherscan" checkbox, unticked until the
+ user ticks it, with a sentence saying it sends the address about to be
+ sent to, to Etherscan, to look for a phishing or scam label on it. Both
+ checkboxes are one setting each for every network, and Welcome offers the
+ same two
- Token Spam Protection:
- "Hide fake tokens impersonating a known symbol" checkbox
- "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2149,6 +2218,9 @@ view would leave a wallet one click from deletion.
- Debug: hidden until revealed, then an "Enable debug mode" checkbox that
turns on the red banner and verbose logging
- **Transitions**:
+ - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
+ stores the setting (no screen change). The next balance refresh and every
+ screen drawn after that follow it
- "+ Add wallet" → **AddWallet**
- "+ Add token" → **SettingsAddToken**
- `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2665,17 +2737,27 @@ view would leave a wallet one click from deletion.
### External Services
-AutistMask is not a fully self-contained offline tool. It necessarily
-communicates with three external services to function as a wallet:
+AutistMask is not a fully self-contained offline tool. By default it sends the
+user's data to one service only, the Ethereum RPC endpoint, and asks one more,
+the CoinDesk price API, for prices with nothing but token symbols. Two more
+services are sent none of the user's data until the user turns on the setting
+for each, on the Welcome screen or in Settings: Blockscout ("Use Blockscout")
+and Etherscan ("Check recipients on Etherscan"). Both settings are off in a new
+profile, and each is one setting for every network.
+
+Contacted by default:
- **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
them the balance of every tracked token at every address (`balanceOf`),
estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
broadcast transactions (`eth_sendRawTransaction`), and check transaction
- receipts. The default endpoint is a public RPC (configurable by the user to
- any endpoint they prefer, including a local node). By default the extension
- talks to `https://ethereum-rpc.publicnode.com`.
+ receipts. ENS lookups, of a name typed into Send and of the names shown for
+ the user's addresses, are made through it alone, so a name whose resolver says
+ it is resolved off-chain does not resolve. The default endpoint is a public
+ RPC (configurable by the user to any endpoint they prefer, including a local
+ node). By default the extension talks to
+ `https://ethereum-rpc.publicnode.com`.
- **Data sent**: Ethereum addresses, transaction data, contract call
parameters. The RPC endpoint can see all on-chain queries and submitted
transactions.
@@ -2687,13 +2769,36 @@ communicates with three external services to function as a wallet:
- **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
addresses or user-specific data.
-- **Blockscout block-explorer API**: Used to fetch transaction history (normal
- transactions and ERC-20 token transfers), ERC-20 token balances, and token
- holder counts (for spam filtering). The default endpoint is
- `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
- - **Data sent**: Ethereum addresses. Blockscout receives the user's
- addresses to query their transaction history and token balances. No
- private keys, passwords, or signing operations are sent.
+Sent the user's data only while the user has turned the setting on:
+
+- **Blockscout block-explorer API** ("Use Blockscout"): Used to fetch
+ transaction history (normal transactions and ERC-20 token transfers) for Home,
+ AddressDetail and AddressToken, the balances of the ERC-20 tokens the user has
+ not tracked, token holder counts (for spam filtering), and a transaction's
+ block, network details and calldata for TransactionDetail. The default
+ endpoint is `https://eth.blockscout.com/api/v2` (configurable by the user in
+ Settings). While the setting is off, those screens say in a plain line what is
+ not shown and that this setting turns it on, and only tracked tokens are
+ listed, their balances read through the RPC endpoint. The endpoint check
+ Settings makes when the user presses "Save" beside the URL asks only for
+ `/stats` and carries no user data; it is made whether or not the setting is
+ on.
+ - **Data sent**: Ethereum addresses, and the hash of each transaction the
+ user opens. Blockscout receives the user's addresses to query their
+ transaction history and token balances. No private keys, passwords, or
+ signing operations are sent.
+
+- **Etherscan address labels** ("Check recipients on Etherscan"): When
+ confirming a transaction, the extension performs a best-effort lookup of the
+ recipient address on Etherscan to check for phishing/scam labels. This is a
+ direct page fetch with no API key; the user's browser makes the request. While
+ the setting is off, ConfirmTx says that no Etherscan check was made.
+ - **Data sent**: the recipient address. The user's own addresses are not
+ sent.
+
+The etherscan links on the screens open a page in the browser when the user
+clicks one. They are not requests the wallet makes, and nothing is fetched from
+them until then.
What the extension does NOT do:
@@ -2702,16 +2807,9 @@ What the extension does NOT do:
- No Infura/Alchemy dependency (any JSON-RPC endpoint works)
- No backend servers operated by the developer
-In addition to the three user-configurable services above (RPC endpoint,
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
-
-- **Etherscan address labels**: When confirming a transaction, the extension
- performs a best-effort lookup of the recipient address on Etherscan to check
- for phishing/scam labels. This is a direct page fetch with no API key; the
- user's browser makes the request.
-
-Users who want maximum privacy can point the RPC and Blockscout URLs at their
-own self-hosted instances (price fetching can be disabled in a future version).
+Users who want maximum privacy can point the RPC URL at their own node, and,
+when they turn Blockscout on, the Blockscout URL at their own instance (price
+fetching can be disabled in a future version).
### Dependencies
@@ -2893,8 +2991,10 @@ logged.
- Add multiple addresses within an HD wallet
- Manage multiple wallets simultaneously
- View ETH balance per address
-- View ERC-20 token balances (tokens on the bundled known-token list, tokens
- with 1,000 or more holders, and tokens the user adds by contract address)
+- View ERC-20 token balances (tokens the user adds by contract address, and,
+ while "Use Blockscout" is on, tokens on the bundled known-token list and
+ tokens with 1,000 or more holders)
+- View transaction history and transaction details, while "Use Blockscout" is on
- Send ETH to an address
- Send ERC-20 tokens to an address
- Receive ETH/tokens (display address, copy to clipboard, QR code)
diff --git a/docs/README.md b/docs/README.md
index 424d7a2..c5d093c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
- **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
-- **No third-party token list APIs.** Token balances come from the same block
- explorer you configure for transaction history, and the extension ships its
- own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
- detection. Any token you want tracked across all your addresses, you add
- yourself by contract address.
+- **No third-party token list APIs.** The balances of the tokens you track are
+ read from your RPC endpoint; while you have "Use Blockscout" on, the others
+ come from the same block explorer you configure for transaction history. The
+ extension ships its own hardcoded list of top ERC-20 contract addresses for
+ symbol-spoofing detection. Any token you want tracked across all your
+ addresses, you add yourself by contract address.
- **No backend servers operated by the developer.** Nothing is sent to any
server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,11 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
## How It Works
AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
-three you configure yourself, and two fixed ones used for scam detection.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing
+but token symbols. Blockscout and Etherscan are sent none of your data until you
+turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome
+screen or later in Settings. Both are off in a new install.
### External Services
@@ -96,16 +100,23 @@ addresses are necessarily visible to the RPC provider when querying balances.
**Blockscout API** (default: `eth.blockscout.com/api/v2`;
`eth-sepolia.blockscout.com/api/v2` on Sepolia)
-Used to fetch token balances and transaction history. Blockscout is an
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
-transactions and token transfers. You can change this in Settings to a
-self-hosted Blockscout instance.
+Off until you turn on "Use Blockscout". Used to fetch transaction history, the
+balances of the tokens you have not tracked, and the details of a transaction
+you open. Blockscout is an open-source blockchain explorer. AutistMask queries
+it for your ERC-20 token balances (including the holder counts used for spam
+filtering), your recent transactions and token transfers, and the block, fees
+and calldata of a transaction you open. You can change this in Settings to a
+self-hosted Blockscout instance. While it is off, the screens that would show
+history say so, and only the tokens you track are listed.
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
+When it is contacted: while "Use Blockscout" is on, on every balance refresh,
+whenever a screen showing transaction history is opened, and when you open a
+transaction. The one exception, whether or not the setting is on, is pressing
+"Save" beside the Blockscout URL in Settings, which checks that URL by asking it
+for `/stats` and sends none of your data.
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+What gets sent: your Ethereum addresses (to look up balances and transactions)
+and the hash of each transaction you open.
**CoinDesk CADLI price API** (`data-api.coindesk.com`)
@@ -122,13 +133,16 @@ address.
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
+Off until you turn on "Check recipients on Etherscan". When you review a send,
+AutistMask fetches the recipient's public Etherscan address page and looks for a
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
+it finds one. This is a plain page fetch with no API key, made by your browser.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
+user-configurable. While it is off, the confirmation screen says that no
+Etherscan check was made.
-When it is contacted: each time you reach the send confirmation screen.
+When it is contacted: only while "Check recipients on Etherscan" is on, each
+time you reach the send confirmation screen.
What gets sent: the recipient address you are about to send to, and your IP
address. Your own addresses are not sent.
@@ -185,6 +199,9 @@ password.
1. Click the AutistMask icon in your browser toolbar.
2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+ On first use the same screen offers "Use Blockscout" and "Check recipients on
+ Etherscan", both off; tick either if you want what it does (see External
+ Services). You can change both later in Settings.
3. On the "From Phrase" tab, click the die button to generate a random 12-word
recovery phrase.
4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +237,11 @@ always produce the same sequence of addresses.
### Adding ERC-20 Tokens
-Tokens you hold show up automatically only if they are in the extension's
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
+Tokens you hold show up automatically only while "Use Blockscout" is on, and
+then only if they are in the extension's bundled list of well-known tokens or
+have at least 1,000 holders; everything else is treated as spam and hidden. To
+track a token explicitly (which also shows it at zero balance, and shows it
+whether or not "Use Blockscout" is on), add it by contract address:
1. Go to an address detail view (click `[info]` on any address).
2. Click "+ Token".
@@ -389,8 +407,10 @@ Click the gear icon on the home screen to access settings:
that network's defaults if you have not used it before.
- **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
You can use your own node for maximum privacy.
-- **Blockscout API**: Change the Blockscout instance used for token balances and
- transaction history. You can use a self-hosted instance.
+- **Blockscout API**: "Use Blockscout", off until you tick it, and the
+ Blockscout instance used for transaction history, the tokens you have not
+ tracked and transaction details. You can use a self-hosted instance.
+- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
- **Token Spam Protection**: Toggle individual scam filters and set the dust
transaction threshold.
- **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
diff --git a/src/background/index.js b/src/background/index.js
index f9d6b9d..b3e9dac 100644
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -1397,6 +1397,7 @@ async function backgroundRefresh() {
wallets,
s.rpcUrl,
s.blockscoutUrl,
+ s.useBlockscout,
s.trackedTokens,
s.networkId,
);
diff --git a/src/popup/index.html b/src/popup/index.html
index b41cf9e..cd261bc 100644
--- a/src/popup/index.html
+++ b/src/popup/index.html
@@ -43,6 +43,38 @@
Welcome! To get started, add a wallet.
+
+
+ This wallet sends your data only to the Ethereum RPC
+ endpoint, unless you turn on either of these, here or
+ later in Settings.
+
+
+
+ Sends your addresses, and the hash of each transaction
+ you open, to the Blockscout API, for transaction
+ history, tokens you have not tracked, and transaction
+ details.
+
+
+
+ Sends the address you are about to send to, to
+ Etherscan, to look for a phishing or scam label on it.
+
+
+
+ This address was not checked on Etherscan, because "Check
+ recipients on Etherscan" is off in Settings.
+
Blockscout API
+
+
+ Sends your addresses, and the hash of each transaction
+ you open, to the Blockscout API below, for transaction
+ history, tokens you have not tracked, and transaction
+ details.
+
- Used to fetch token balances and transaction history.
Change this if you run your own Blockscout instance.
+
+
Etherscan
+
+
+ Sends the address you are about to send to, to
+ Etherscan, to look for a phishing or scam label on it.
+
+
+
Token Spam Protection
@@ -1504,6 +1582,16 @@
+
+
+ No block, decoded details, network details or raw data are
+ shown, because "Use Blockscout" is off in Settings.
+
+
diff --git a/src/popup/index.js b/src/popup/index.js
index f05a031..035ee69 100644
--- a/src/popup/index.js
+++ b/src/popup/index.js
@@ -94,6 +94,7 @@ async function doRefreshAndRender() {
wallets,
state.rpcUrl,
state.blockscoutUrl,
+ state.useBlockscout,
state.trackedTokens,
networkId,
pageClosed.signal,
@@ -397,7 +398,7 @@ async function init() {
followNetworkSwitch();
if (!state.hasWallet) {
- showView("welcome");
+ welcome.show();
} else {
renderWalletList();
restoreView();
diff --git a/src/popup/viewRouter.js b/src/popup/viewRouter.js
index f0bf051..7f5e19b 100644
--- a/src/popup/viewRouter.js
+++ b/src/popup/viewRouter.js
@@ -40,9 +40,11 @@ function markViewRendered(view) {
// Begin a fresh page-load scope. The popup gets one by being loaded, and
// asks for one after a network switch, because every screen then on the page
-// shows the previous network (showNewNetwork() in views/settings.js); the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one too.
+// shows the previous network (showNewNetwork() in views/settings.js), and
+// after "Use Blockscout" or "Check recipients on Etherscan" changes in
+// Settings, because every screen then on the page was drawn under the old
+// setting; the unit tests, which simulate several page loads against one
+// module instance, ask for one too.
function resetRenderedViews() {
renderedViews.clear();
}
diff --git a/src/popup/views/addressDetail.js b/src/popup/views/addressDetail.js
index fa6646e..ef13e86 100644
--- a/src/popup/views/addressDetail.js
+++ b/src/popup/views/addressDetail.js
@@ -4,6 +4,7 @@ const {
showFlash,
balanceLinesForAddress,
txCounterpartyHtml,
+ HISTORY_OFF_TEXT,
addressTitle,
escapeHtml,
displaySymbol,
@@ -83,6 +84,8 @@ function show() {
ctx.showAddressToken();
});
});
+ // Tokens the user has not tracked are Blockscout's to report.
+ $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
renderSendTokenSelect(addr);
$("tx-list").innerHTML =
'
Loading...
';
@@ -99,6 +102,7 @@ async function loadTransactions(address) {
const rawTxs = await fetchRecentTransactions(
address,
state.blockscoutUrl,
+ state.useBlockscout,
currentNetwork().chainId,
);
const result = filterTransactions(rawTxs, {
@@ -155,6 +159,10 @@ async function loadTransactions(address) {
function renderTransactions(txs) {
const list = $("tx-list");
+ if (!state.useBlockscout) {
+ list.innerHTML = `
';
diff --git a/src/popup/views/confirmTx.js b/src/popup/views/confirmTx.js
index 42a4ca8..66c1b47 100644
--- a/src/popup/views/confirmTx.js
+++ b/src/popup/views/confirmTx.js
@@ -334,6 +334,11 @@ function show(txInfo) {
$("confirm-contract-warning").style.visibility = "hidden";
$("confirm-burn-warning").style.visibility = "hidden";
$("confirm-etherscan-warning").style.visibility = "hidden";
+ // While "Check recipients on Etherscan" is off there is no Etherscan
+ // warning to reserve space for, and a line in its place says so.
+ const etherscanOn = !!state.checkRecipientsOnEtherscan;
+ $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
+ $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
// Show burn warning via reserved element (in addition to inline warning)
if (isBurnAddress(txInfo.to)) {
@@ -612,6 +617,7 @@ async function checkRecipientHistory(txInfo) {
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
fromAddress: txInfo.from,
chainId: txInfo.chainId,
+ checkRecipientsOnEtherscan: state.checkRecipientsOnEtherscan,
});
// The user may have left this transaction while the checks were in
// flight; its warnings must not reach another recipient's screen.
diff --git a/src/popup/views/deleteWallet.js b/src/popup/views/deleteWallet.js
index 384224f..b0a31e4 100644
--- a/src/popup/views/deleteWallet.js
+++ b/src/popup/views/deleteWallet.js
@@ -16,6 +16,7 @@ const {
broadcastActiveChanged,
} = require("../../shared/walletDelete");
const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
+const welcome = require("./welcome");
let deleteWalletIndex = null;
let lostPasswordIndex = null;
@@ -135,7 +136,7 @@ async function finishDelete(walletIdx) {
// Save before broadcasting: the background reads the active
// address back out of storage to build accountsChanged.
if (activeAddressChanged) broadcastActiveChanged();
- showView("welcome");
+ welcome.show();
return;
}
diff --git a/src/popup/views/helpers.js b/src/popup/views/helpers.js
index cd9fa8d..125b6a9 100644
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -534,6 +534,11 @@ function addressTitle(address, wallets) {
const CONTRACT_CREATION_TEXT =
"This transaction creates a new contract. It has no recipient.";
+// What the transaction lists on Home, AddressDetail and AddressToken say while
+// the user has "Use Blockscout" off: the history comes from Blockscout alone.
+const HISTORY_OFF_TEXT =
+ 'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
// The last two lines of a transaction history row: the counterparty's colour
// dot and name beside the amount, then its full address. A contract creation
// the user sent has no counterparty (its `to` is ""), so its row has the
@@ -799,6 +804,7 @@ module.exports = {
displaySymbol,
addressTitle,
CONTRACT_CREATION_TEXT,
+ HISTORY_OFF_TEXT,
txCounterpartyHtml,
formatAddressHtml,
renderAddressHtml,
diff --git a/src/popup/views/home.js b/src/popup/views/home.js
index dc542bc..01bc906 100644
--- a/src/popup/views/home.js
+++ b/src/popup/views/home.js
@@ -7,6 +7,7 @@ const {
timeAgo,
addressDotHtml,
txCounterpartyHtml,
+ HISTORY_OFF_TEXT,
addressTitle,
escapeHtml,
displaySymbol,
@@ -100,6 +101,10 @@ let homeTxs = [];
function renderHomeTxList(ctx) {
const list = $("home-tx-list");
if (!list) return;
+ if (!state.useBlockscout) {
+ list.innerHTML = `