remove phishing domain whitelist support

Remove all whitelist functionality from the phishing domain system.
The blocklist now only checks the blacklist — no whitelist overrides.

- Remove vendoredWhitelist and deltaWhitelist Sets
- Remove whitelist checks in isPhishingDomain()
- Remove whitelist from delta storage persistence
- Remove whitelist from loadConfig() delta computation
- Remove whitelist-specific test cases
- Update README to remove whitelist mention

Closes #114

README.md

@@ -437,25 +437,29 @@ transitions.
 #### TransactionDetail
 
 - **When**: User tapped a transaction row from AddressDetail or AddressToken.
-- **Elements**:
+- **Elements** (grouped into logical blocks using light well containers; field
+  labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
+    - Transaction hash: full hash (tap to copy) + etherscan link
     - Type: transaction classification — one of: Native ETH Transfer, ERC-20
       Token Transfer, Swap, Token Approval, Contract Call, Contract Creation
+    - Status: "Success" or "Failed"
+    - From: blockie + color dot + full address (tap to copy) + etherscan link;
+      ENS name if available
+    - To: blockie + color dot + full address (tap to copy) + etherscan link; ENS
+      name if available
+    - Time: ISO datetime + relative age in parentheses
+    - Block: block number (tap to copy) + etherscan block link
+    - Amount: value + symbol (bold)
+    - Native quantity: raw integer + unit (shown when available)
     - Token contract: shown for ERC-20 transfers — color dot + full contract
       address (tap to copy) + etherscan token link
-    - Status: "Success" or "Failed"
-    - Time: ISO datetime + relative age in parentheses
-    - Amount: value + symbol (bold)
-    - From: blockie + color dot + full address (tap to copy) + etherscan link
-        - ENS name if available
-    - To: blockie + color dot + full address (tap to copy) + etherscan link
-        - ENS name if available
-    - Transaction hash: full hash (tap to copy) + etherscan link
-    - Block: block number (tap to copy) + etherscan block link
-    - Nonce: transaction nonce (tap to copy)
-    - Transaction fee: ETH amount (tap to copy)
-    - Gas price: value in Gwei (tap to copy)
-    - Gas used: integer (tap to copy)
+    - Decoded details (shown for contract calls): action name, decoded
+      parameters, token details, swap steps
+    - Network details (shown when on-chain data is available): nonce, gas price,
+      gas used, transaction fee (all tap to copy)
+    - Raw data (shown when calldata is present): full calldata in monospace
+      dashed border
 - **Transitions**:
     - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
 
@@ -799,8 +803,7 @@ small while ensuring fresh coverage of new phishing domains.
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all
-parent domains (subdomain matching), with whitelist overrides for legitimate
-sites that share a parent domain with a blocklisted entry.
+parent domains (subdomain matching).
 
 #### Transaction Decoding
 

src/popup/index.html

@@ -1101,46 +1101,84 @@
                 <h2 id="tx-detail-heading" class="font-bold mb-2">
                     Transaction
                 </h2>
-                <div id="tx-detail-type-section" class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Type</div>
-                    <div id="tx-detail-type" class="text-xs font-bold"></div>
+
+                <!-- ── Identity ── -->
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <div class="mb-2">
+                        <div class="text-xs text-muted mb-1">
+                            Transaction hash
                         </div>
-                <div class="mb-4">
+                        <div
+                            id="tx-detail-hash"
+                            class="text-xs break-all"
+                        ></div>
+                    </div>
+                    <div id="tx-detail-type-section" class="mb-2 hidden">
+                        <div class="text-xs text-muted mb-1">Type</div>
+                        <div
+                            id="tx-detail-type"
+                            class="text-xs font-bold"
+                        ></div>
+                    </div>
+                    <div class="mb-2">
                         <div class="text-xs text-muted mb-1">Status</div>
                         <div id="tx-detail-status" class="text-xs"></div>
                     </div>
-                <div class="mb-4">
-                    <div class="text-xs text-muted mb-1">Time</div>
-                    <div id="tx-detail-time" class="text-xs"></div>
-                </div>
-                <div class="mb-4">
-                    <div class="text-xs text-muted mb-1">Amount</div>
-                    <div id="tx-detail-value" class="text-xs"></div>
-                </div>
-                <div class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Native quantity</div>
-                    <div id="tx-detail-native" class="text-xs"></div>
-                </div>
-                <div class="mb-4">
+                    <div class="mb-2">
                         <div class="text-xs text-muted mb-1">From</div>
-                    <div id="tx-detail-from" class="text-xs break-all"></div>
+                        <div
+                            id="tx-detail-from"
+                            class="text-xs break-all"
+                        ></div>
                     </div>
-                <div class="mb-4">
+                    <div class="mb-2">
                         <div class="text-xs text-muted mb-1">To</div>
                         <div id="tx-detail-to" class="text-xs break-all"></div>
                     </div>
-                <div id="tx-detail-token-contract-section" class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Token contract</div>
+                </div>
+
+                <!-- ── Timing ── -->
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <div class="mb-2">
+                        <div class="text-xs text-muted mb-1">Time</div>
+                        <div id="tx-detail-time" class="text-xs"></div>
+                    </div>
+                    <div id="tx-detail-block-section" class="mb-2 hidden">
+                        <div class="text-xs text-muted mb-1">Block</div>
+                        <div id="tx-detail-block" class="text-xs"></div>
+                    </div>
+                </div>
+
+                <!-- ── Value ── -->
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <div class="mb-2">
+                        <div class="text-xs text-muted mb-1">Amount</div>
+                        <div id="tx-detail-value" class="text-xs"></div>
+                    </div>
+                    <div class="mb-2 hidden">
+                        <div class="text-xs text-muted mb-1">
+                            Native quantity
+                        </div>
+                        <div id="tx-detail-native" class="text-xs"></div>
+                    </div>
+                    <div
+                        id="tx-detail-token-contract-section"
+                        class="mb-2 hidden"
+                    >
+                        <div class="text-xs text-muted mb-1">
+                            Token contract
+                        </div>
                         <div
                             id="tx-detail-token-contract"
                             class="text-xs break-all"
                         ></div>
                     </div>
-                <div id="tx-detail-calldata-section" class="mb-4 hidden">
-                    <div
-                        id="tx-detail-calldata-well"
-                        class="mb-3 border border-border border-dashed p-2"
-                    >
+                </div>
+
+                <!-- ── Decoded details ── -->
+                <div id="tx-detail-calldata-section" class="hidden">
+                    <div class="bg-well p-3 mx-1 mb-3">
+                        <div id="tx-detail-calldata-well" class="mb-2">
                             <div class="text-xs text-muted mb-1">Action</div>
                             <div
                                 id="tx-detail-calldata-action"
@@ -1152,31 +1190,39 @@
                             ></div>
                         </div>
                     </div>
-                <div class="mb-4">
-                    <div class="text-xs text-muted mb-1">Transaction hash</div>
-                    <div id="tx-detail-hash" class="text-xs break-all"></div>
                 </div>
-                <div id="tx-detail-block-section" class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Block</div>
-                    <div id="tx-detail-block" class="text-xs"></div>
-                </div>
-                <div id="tx-detail-nonce-section" class="mb-4 hidden">
+
+                <!-- ── Network details ── -->
+                <div id="tx-detail-network-section" class="hidden">
+                    <div class="bg-well p-3 mx-1 mb-3">
+                        <div id="tx-detail-nonce-section" class="mb-2 hidden">
                             <div class="text-xs text-muted mb-1">Nonce</div>
                             <div id="tx-detail-nonce" class="text-xs"></div>
                         </div>
-                <div id="tx-detail-fee-section" class="mb-4 hidden">
-                    <div class="text-xs text-muted mb-1">Transaction fee</div>
-                    <div id="tx-detail-fee" class="text-xs"></div>
-                </div>
-                <div id="tx-detail-gasprice-section" class="mb-4 hidden">
+                        <div
+                            id="tx-detail-gasprice-section"
+                            class="mb-2 hidden"
+                        >
                             <div class="text-xs text-muted mb-1">Gas price</div>
                             <div id="tx-detail-gasprice" class="text-xs"></div>
                         </div>
-                <div id="tx-detail-gasused-section" class="mb-4 hidden">
+                        <div id="tx-detail-gasused-section" class="mb-2 hidden">
                             <div class="text-xs text-muted mb-1">Gas used</div>
                             <div id="tx-detail-gasused" class="text-xs"></div>
                         </div>
-                <div id="tx-detail-rawdata-section" class="mb-4 hidden">
+                        <div id="tx-detail-fee-section" class="mb-2 hidden">
+                            <div class="text-xs text-muted mb-1">
+                                Transaction fee
+                            </div>
+                            <div id="tx-detail-fee" class="text-xs"></div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- ── Raw data ── -->
+                <div id="tx-detail-rawdata-section" class="hidden">
+                    <div class="bg-well p-3 mx-1 mb-3">
+                        <div class="mb-2">
                             <div class="text-xs text-muted mb-1">Raw data</div>
                             <div
                                 id="tx-detail-rawdata"
@@ -1184,6 +1230,8 @@
                             ></div>
                         </div>
                     </div>
+                </div>
+            </div>
 
             <!-- ============ TRANSACTION APPROVAL ============ -->
             <div id="view-approve-tx" class="view hidden">

src/popup/views/transactionDetail.js

@@ -197,6 +197,7 @@ function render() {
         "tx-detail-fee-section",
         "tx-detail-gasprice-section",
         "tx-detail-gasused-section",
+        "tx-detail-network-section",
     ]) {
         const el = $(id);
         if (el) el.classList.add("hidden");
@@ -285,6 +286,21 @@ function populateOnChainDetails(txData) {
         );
     }
 
+    // Show the network details wrapper if any child section is visible
+    const networkWrapper = $("tx-detail-network-section");
+    if (networkWrapper) {
+        const hasVisible = [
+            "tx-detail-nonce-section",
+            "tx-detail-fee-section",
+            "tx-detail-gasprice-section",
+            "tx-detail-gasused-section",
+        ].some((id) => {
+            const el = $(id);
+            return el && !el.classList.contains("hidden");
+        });
+        if (hasVisible) networkWrapper.classList.remove("hidden");
+    }
+
     // Bind copy handlers for newly added elements
     for (const id of [
         "tx-detail-block-section",

src/shared/phishingDomains.js

@@ -21,17 +21,13 @@ const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const DELTA_STORAGE_KEY = "phishing-delta";
 const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 
-// Vendored sets — built once from the bundled JSON.
+// Vendored set — built once from the bundled JSON.
 const vendoredBlacklist = new Set(
     (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
 );
-const vendoredWhitelist = new Set(
-    (vendoredConfig.whitelist || []).map((d) => d.toLowerCase()),
-);
 
-// Delta sets — only entries from live list that are NOT in vendored.
+// Delta set — only entries from live list that are NOT in vendored.
 let deltaBlacklist = new Set();
-let deltaWhitelist = new Set();
 let lastFetchTime = 0;
 let fetchPromise = null;
 let refreshTimer = null;
@@ -50,11 +46,6 @@ function loadDeltaFromStorage() {
                 data.blacklist.map((d) => d.toLowerCase()),
             );
         }
-        if (data.whitelist && Array.isArray(data.whitelist)) {
-            deltaWhitelist = new Set(
-                data.whitelist.map((d) => d.toLowerCase()),
-            );
-        }
     } catch {
         // localStorage unavailable or corrupt — start empty
     }
@@ -67,7 +58,6 @@ function saveDeltaToStorage() {
     try {
         const data = {
             blacklist: Array.from(deltaBlacklist),
-            whitelist: Array.from(deltaWhitelist),
         };
         const json = JSON.stringify(data);
         if (json.length < MAX_DELTA_BYTES) {
@@ -85,19 +75,15 @@ function saveDeltaToStorage() {
  * Load a pre-parsed config and compute the delta against the vendored list.
  * Used for both live fetches and testing.
  *
- * @param {{ blacklist?: string[], whitelist?: string[] }} config
+ * @param {{ blacklist?: string[] }} config
  */
 function loadConfig(config) {
     const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
-    const liveWhitelist = (config.whitelist || []).map((d) => d.toLowerCase());
 
     // Delta = entries in the live list that are NOT in the vendored list
     deltaBlacklist = new Set(
         liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
     );
-    deltaWhitelist = new Set(
-        liveWhitelist.filter((d) => !vendoredWhitelist.has(d)),
-    );
 
     lastFetchTime = Date.now();
     saveDeltaToStorage();
@@ -124,7 +110,6 @@ function hostnameVariants(hostname) {
 /**
  * Check if a hostname is on the phishing blocklist.
  * Checks delta first (fresh/recent scam sites), then vendored list.
- * Whitelisted domains (delta + vendored) are never flagged.
  *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
@@ -133,11 +118,6 @@ function isPhishingDomain(hostname) {
     if (!hostname) return false;
     const variants = hostnameVariants(hostname);
 
-    // Whitelist takes priority — check delta whitelist first, then vendored
-    for (const v of variants) {
-        if (deltaWhitelist.has(v) || vendoredWhitelist.has(v)) return false;
-    }
-
     // Check delta blacklist first (fresh/recent scam sites), then vendored
     for (const v of variants) {
         if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
@@ -209,7 +189,6 @@ function getDeltaSize() {
  */
 function _reset() {
     deltaBlacklist = new Set();
-    deltaWhitelist = new Set();
     lastFetchTime = 0;
     fetchPromise = null;
     if (refreshTimer) {
@@ -232,7 +211,5 @@ module.exports = {
     _reset,
     // Exposed for testing only
     _getVendoredBlacklistSize: () => vendoredBlacklist.size,
-    _getVendoredWhitelistSize: () => vendoredWhitelist.size,
     _getDeltaBlacklist: () => deltaBlacklist,
-    _getDeltaWhitelist: () => deltaWhitelist,
 };

tests/phishingDomains.test.js

@@ -23,9 +23,7 @@ const {
     hostnameVariants,
     _reset,
     _getVendoredBlacklistSize,
-    _getVendoredWhitelistSize,
     _getDeltaBlacklist,
-    _getDeltaWhitelist,
 } = require("../src/shared/phishingDomains");
 
 // Reset delta state before each test to avoid cross-test contamination.
@@ -45,21 +43,12 @@ describe("phishingDomains", () => {
             expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
         });
 
-        test("vendored whitelist is loaded from bundled JSON", () => {
-            expect(_getVendoredWhitelistSize()).toBeGreaterThan(0);
-        });
-
         test("detects domains from vendored blacklist", () => {
             // These are well-known phishing domains in the vendored list
             expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
             expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
         });
 
-        test("vendored whitelist overrides vendored blacklist", () => {
-            // opensea.pro is whitelisted in the vendored config
-            expect(isPhishingDomain("opensea.pro")).toBe(false);
-        });
-
         test("getBlocklistSize includes vendored entries", () => {
             expect(getBlocklistSize()).toBeGreaterThan(100000);
         });
@@ -99,7 +88,6 @@ describe("phishingDomains", () => {
                     "brand-new-scam-site-xyz123.com",
                     "hopprotocol.pro", // already in vendored
                 ],
-                whitelist: [],
             });
             // Only the new domain should be in the delta
             expect(
@@ -109,30 +97,14 @@ describe("phishingDomains", () => {
             expect(getDeltaSize()).toBe(1);
         });
 
-        test("delta whitelist entries are computed correctly", () => {
-            loadConfig({
-                blacklist: [],
-                whitelist: [
-                    "new-safe-site-xyz789.com",
-                    "opensea.pro", // already in vendored whitelist
-                ],
-            });
-            expect(_getDeltaWhitelist().has("new-safe-site-xyz789.com")).toBe(
-                true,
-            );
-            expect(_getDeltaWhitelist().has("opensea.pro")).toBe(false);
-        });
-
         test("re-loading config replaces previous delta", () => {
             loadConfig({
                 blacklist: ["first-scam-xyz.com"],
-                whitelist: [],
             });
             expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
 
             loadConfig({
                 blacklist: ["second-scam-xyz.com"],
-                whitelist: [],
             });
             expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
             expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
@@ -142,7 +114,6 @@ describe("phishingDomains", () => {
             const baseSize = getBlocklistSize();
             loadConfig({
                 blacklist: ["delta-only-scam-xyz.com"],
-                whitelist: [],
             });
             expect(getBlocklistSize()).toBe(baseSize + 1);
         });
@@ -152,7 +123,6 @@ describe("phishingDomains", () => {
         test("detects domain from delta blacklist", () => {
             loadConfig({
                 blacklist: ["fresh-scam-xyz.com"],
-                whitelist: [],
             });
             expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
         });
@@ -174,34 +144,13 @@ describe("phishingDomains", () => {
         test("detects subdomain of blacklisted domain (delta)", () => {
             loadConfig({
                 blacklist: ["delta-phish-xyz.com"],
-                whitelist: [],
             });
             expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
         });
 
-        test("delta whitelist overrides vendored blacklist", () => {
-            // hopprotocol.pro is in the vendored blacklist
-            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
-            loadConfig({
-                blacklist: [],
-                whitelist: ["hopprotocol.pro"],
-            });
-            // Now whitelisted via delta — should not be flagged
-            expect(isPhishingDomain("hopprotocol.pro")).toBe(false);
-        });
-
-        test("vendored whitelist overrides delta blacklist", () => {
-            loadConfig({
-                blacklist: ["opensea.pro"], // opensea.pro is vendored-whitelisted
-                whitelist: [],
-            });
-            expect(isPhishingDomain("opensea.pro")).toBe(false);
-        });
-
         test("case-insensitive matching", () => {
             loadConfig({
                 blacklist: ["Delta-Scam-XYZ.COM"],
-                whitelist: [],
             });
             expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
             expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
@@ -212,7 +161,7 @@ describe("phishingDomains", () => {
             expect(isPhishingDomain(null)).toBe(false);
         });
 
-        test("handles config with no blacklist/whitelist keys", () => {
+        test("handles config with no blacklist key", () => {
             loadConfig({});
             expect(getDeltaSize()).toBe(0);
             // Vendored list still works
@@ -224,19 +173,16 @@ describe("phishingDomains", () => {
         test("saveDeltaToStorage persists delta under 256KiB", () => {
             loadConfig({
                 blacklist: ["persisted-scam-xyz.com"],
-                whitelist: ["persisted-safe-xyz.com"],
             });
             const stored = localStorage.getItem("phishing-delta");
             expect(stored).not.toBeNull();
             const data = JSON.parse(stored);
             expect(data.blacklist).toContain("persisted-scam-xyz.com");
-            expect(data.whitelist).toContain("persisted-safe-xyz.com");
         });
 
         test("delta is cleared on _reset", () => {
             loadConfig({
                 blacklist: ["temp-scam-xyz.com"],
-                whitelist: [],
             });
             expect(getDeltaSize()).toBe(1);
             _reset();
@@ -251,7 +197,7 @@ describe("phishingDomains", () => {
             expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
         });
 
-        test("does not flag legitimate whitelisted domains", () => {
+        test("does not flag legitimate domains", () => {
             expect(isPhishingDomain("opensea.io")).toBe(false);
             expect(isPhishingDomain("etherscan.io")).toBe(false);
         });