155 Commits

Include renames

Author	SHA1	Message	Date
sneak	2b2137716c	Add transaction confirmation screen and password modal ... New send flow: Send → Confirm → Password → Broadcast. Send view: collects To (with ENS resolution), Amount, Token. "Review" button advances to confirmation. No password field. Confirm Transaction view: shows From, To (with ENS name), Amount (with USD value), and runs pre-send checks: - Scam address warning (checked against local blocklist) - Self-send warning - Insufficient balance error (disables Send button) Password modal: full-screen overlay, appears only after user clicks Send on the confirmation screen. Decrypts the wallet secret, signs and broadcasts the transaction. Wrong password is caught inline. scamlist.js: hardcoded set of known scam/fraud addresses (Tornado Cash sanctioned, drainer contracts, address poisoning). Checked locally, no external API.	2026-02-25 18:55:42 +07:00
sneak	f50a2a0389	Refactor popup into shared modules, wire up real ERC-20 tokens ... Split popup/index.js (784 lines) into focused modules: - shared/state.js: state management, storage persistence - shared/wallet.js: mnemonic gen, HD derivation, signing - shared/prices.js: price cache (5min TTL), USD formatting, value aggregation (address → wallet → total) - shared/balances.js: ETH + ERC-20 balance cache (60s TTL), ENS lookup, token contract metadata lookup - shared/vault.js: unchanged (libsodium encryption) - shared/tokens.js: unchanged (token list + CoinDesk client) - popup/index.js: view switching and event wiring only Token tracking is now app-wide: trackedTokens stored in state, balances fetched for all tracked tokens across all addresses. Add Token now calls the real contract to read name/symbol/decimals. Total portfolio value shown in 2x type on Home screen.	2026-02-25 18:48:44 +07:00
sneak	f2e22cadf2	Encrypt secrets with libsodium, password required to send ... vault.js: Argon2id key derivation + XSalsa20-Poly1305 encryption via libsodium-wrappers-sumo. No raw crypto primitives. Wallet creation now requires a password. The mnemonic or private key is encrypted before storage — only the ciphertext blob (salt, nonce, ciphertext) is persisted. The plaintext secret is never stored. Sending requires the password to decrypt the secret, derive the signing key, and construct the transaction. Wrong password is caught and reported.	2026-02-25 18:23:09 +07:00
sneak	097f90d7f8	Add token list module with CoinDesk price client ... tokens.js: ~150 ERC-20 tokens ordered by market cap with getTopTokenSymbols(n) and getTopTokenPrices(n) (errors if n>30). Price fetching uses CoinDesk CADLI API. Popup now shows USD values next to ETH balances in wallet list and address detail. Prices and balances fetched in parallel on popup open.	2026-02-25 17:35:27 +07:00
sneak	065f0eaa81	Add project scaffolding ... Makefile, Dockerfile, CI workflow, prettier config, manifests for Chrome (MV3) and Firefox (MV2), source directory structure, and minimal test suite. All checks pass.	2026-02-24 09:48:21 +07:00