fix: any token a swap leaves in the router keeps it from reading as received (closes #606)

The decoder checked only the swap's output for being left in the router.
It now records every token a step pays the router, the WETH of a
WRAP_ETH and the rest of a V4 SETTLE taken to the router among them, and
any token still there after the last step gets a Paid to line naming it,
so the minimum reads Min. paid out. A swap step or V4 SETTLE that spends
all the router holds of a token, a WRAP_ETH of all its ETH, and swap
steps from the router that together spend what a WRAP_ETH stated count
as spending it. A SETTLE of OPEN_DELTA from the router counts only as
its step's one SETTLE of that token, after every swap action, with none
buying it.

Model: opus-5-5

README.md

@@ -430,6 +430,11 @@ reserve while sitting on the same side of the estimate, so swapping the two in
 what [#154](https://git.eeqj.de/sneak/AutistMask/issues/154) was, and it was
 previously correct by reading only.
 
+It also covers a send that Sign & Send refuses for its network fee: the stub
+node quotes an ordinary fee while the confirmation screen is drawn and one over
+the bound when Sign & Send asks again, and the refusal must broadcast nothing
+and leave the password field and Sign & Send where they were.
+
 It also covers both ways the wait for a sent transaction's receipt ends on the
 error screen: lookups that still find no receipt 60 seconds after the broadcast,
 and six lookups in a row that fail. Each must show its own message, and Done
@@ -1013,10 +1018,12 @@ rendered differently on two screens.
 
 The native token's label is a network's `nativeCurrency` in
 `src/shared/networks.js`: `ETH` on mainnet, `SepoliaETH` on Sepolia. The
-wallet's balances and the Send and confirmation screens, which send on the
-active network, use the active network's. A transaction's figures use the one of
-the network its chain id names, whichever network is active: the value and fee
-on the approval screen, the amount on the wait, success and error screens, the
+wallet's balances and the Send screen, which sends on the active network, use
+the active network's. The confirmation screen uses the one of the network its
+transaction was reviewed on, the network active when Send showed it, even after
+the network is switched in Settings. A transaction's figures use the one of the
+network its chain id names, whichever network is active: the value and fee on
+the approval screen, the amount on the wait, success and error screens, the
 transaction history and the transaction detail screen, and the refusal of a fee
 above 1 ETH. A chain id that names no network reads `ETH`. Wherever this
 document shows ETH as the label of a native balance, value or fee, in a "Native
@@ -1075,23 +1082,29 @@ The rule and its exception live in `src/shared/amountDisplay.js` as
 confirmation screens display goes through the floored one — the ERC-20 amount,
 the ETH value and max fee (`src/popup/views/approval.js`), the swap's `Amount`
 and `Min. received` lines (`src/shared/uniswap.js`), the Send screen's
-`Current balance` (`src/popup/views/send.js`), and the balance and network fee
-on the confirmation screen for the wallet's own send
-(`src/popup/views/confirmTx.js`). Both screens render a network fee through
-`formatFee()` in `src/popup/views/helpers.js`, which prices the exact fee in USD
-rather than its truncated figure, so the same fee reads the same on both, USD
-value included. Balances are stored exactly (`src/shared/balances.js`), whatever
-decimals a token declares, so a balance below the floor reaches these screens as
-it is. The history list (`src/shared/transactions.js`) uses the unfloored one:
-the transaction detail view is the authoritative record and already shows exact
-precision. The balance lists use neither: they round to four places with
-`toFixed(4)` (`balanceLine()` in `src/popup/views/helpers.js`). The 4-decimal
-rule is unchanged everywhere else, including for amounts at or above the floor
-on the approval screens.
+`Current balance` (`src/popup/views/send.js`), and the amount, balance and
+network fee on the confirmation screen for the wallet's own send
+(`src/popup/views/confirmTx.js`), which hands the wait, success and error
+screens the amount as it showed it. The transaction is still signed for the
+exact amount, and its USD value is priced from it. Both screens render a network
+fee through `formatFee()` in `src/popup/views/helpers.js`, which prices the
+exact fee in USD rather than its truncated figure, so the same fee reads the
+same on both, USD value included. Balances are stored exactly
+(`src/shared/balances.js`), whatever decimals a token declares, so a balance
+below the floor reaches these screens as it is. The history list
+(`src/shared/transactions.js`) uses the unfloored one: the transaction detail
+view is the authoritative record and already shows exact precision. The balance
+lists use neither: they round to four places with `toFixed(4)` (`balanceLine()`
+in `src/popup/views/helpers.js`). The 4-decimal rule is unchanged everywhere
+else, including for amounts at or above the floor on the approval screens.
 
-The floor applies only where the token's scale is known. Where it is not, the
-approval screen states base units instead of a quantity — see Unknown token
-scale below — and no truncation happens at all.
+On the approval screen and the wait, success and error screens that carry its
+amount forward, the floor applies only where the token's scale is known. Where
+it is not, they state base units instead of a quantity — see Unknown token scale
+below — and no truncation happens at all. On ConfirmTx and the wait, success and
+error screens that follow it, the amount of a token whose scale is unknown,
+which cannot be sent, is the text from Send's amount field cut to four decimals
+with the same floor (`.5` reads `.5000`).
 
 **Specific Exception — unknown token scale:** Calldata carries base units and no
 scale, so every amount on the dApp approval screen needs the token's `decimals`.
@@ -1142,8 +1155,9 @@ fetched, without that cross-address check, and shows the row's figure.
 
 **Decoded amount lines on the transaction approval screen:** the `Amount` line
 of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
-decoded swap (see TxApproval below), do not always read as a number. They can
-read:
+decoded swap (see TxApproval below; `Min. received` reads `Min. paid out` unless
+only the user is paid, see Transaction Decoding), do not always read as a
+number. They can read:
 
 - A formatted quantity, e.g. `17.1900 USDT`, when the token's scale is known:
   truncated to four decimals, with the floor and the zero cases described above.
@@ -1190,14 +1204,21 @@ read:
   guarantees nothing: it sets `Token Out` and `Min. received` only when the
   output side holds no minimum, not even a zero one, at the point the check is
   reached, and otherwise leaves the current token and figure in place. A nonzero
-  `minBalance` sets both lines, as a swap step does.
+  `minBalance` sets both lines, as a swap step does. Only a check of the
+  transaction's sender's own balance sets either line; a check of any other
+  address sets neither (see Transaction Decoding). A `BALANCE_CHECK_ERC20` step
+  that the router lets fail without reverting the transaction (see Transaction
+  Decoding) guarantees nothing either, whatever its `minBalance`, and is read as
+  one whose `minBalance` is zero. A minimum stated by a V4 swap step the router
+  lets fail is likewise read as zero.
 
 The swap's `Token In` and `Token Out` lines name a currency, not an amount; each
 reads `Unknown (not named in the calldata)` when the decoder found no token for
 that side, or `Unknown (could not be decoded)` instead when a V4 swap action in
-the transaction could not be read (see Transaction Decoding below). A V4 step
-with a swap action always sets the output side, and sets the input side only
-when no earlier step set it. It finds each side by three rules:
+the transaction could not be read or the transaction has an `EXECUTE_SUB_PLAN`
+step, which leaves both sides unknown (see Transaction Decoding below). A V4
+step with a swap action always sets the output side, and sets the input side
+only when no earlier step set it. It finds each side by three rules:
 
 1. Its input side is the currency its `SETTLE` or `SETTLE_ALL` names, or else
    the one currency that some swap action in the step spends and none buys. Its
@@ -1497,8 +1518,12 @@ while the user was away from it.
 A network switch in Settings leaves every screen beneath Settings showing the
 previous network, so after it "Back" behaves as in a reopened popup: every
 screen on the stack counts as not yet rendered, and the stack is cut at the
-first screen that cannot be rendered from saved state, such as Send or AddToken.
-"Back" then renders the screen it lands on for the new network, and anything
+first screen that cannot be rendered from saved state, such as Send or AddToken,
+or at AddressToken for any token but the native one, because that token was
+picked on the previous network. The cut stack is saved with the switch, so a
+popup closed straight after it and reopened onto Settings lands in the same
+place. "Back" then renders the screen it lands on for the new network, except
+ConfirmTx, which keeps the network its transaction was reviewed on, and anything
 typed there and not saved, which belonged to the previous network, is dropped.
 Without a wallet the stack is not cut, because it starts at Welcome, which shows
 nothing from a network.
@@ -1744,42 +1769,58 @@ view would leave a wallet one click from deletion.
     - Token contract: full address + etherscan link (ERC-20 only)
     - From: blockie + color dot + full address + etherscan link + wallet title
     - To: blockie + color dot + full address + etherscan link + ENS name
-    - Amount: value + symbol (USD in parentheses). An ETH amount Send's "Max"
-      filled in is worked out again from this screen's own fee estimate when it
-      arrives, as the balance minus the reserve, and the transaction is signed
-      with that estimate's fee fields, so a fee fetched again at signing cannot
-      exceed what the amount leaves behind. The address keeps whatever part of
-      the reserve the transaction does not use. If the balance no longer covers
-      the fee, the amount is left as it was and the amount-plus-fee error below
-      blocks the send
-    - Your balance: value + symbol (USD in parentheses), or `unknown (SYMBOL)`
-      for a token whose scale is unknown
+    - Amount: value + symbol (USD in parentheses), the value to four decimal
+      places with the nonzero floor, as on TxApproval (see Display Consistency),
+      however Send's amount field wrote it (`.5` and `0.5` both read `0.5000`).
+      For a token whose scale is unknown, which cannot be sent, the value is the
+      text from Send's amount field cut the same way (`.5` reads `.5000`). An
+      ETH amount Send's "Max" filled in is worked out again from this screen's
+      own fee estimate when it arrives, as the balance minus the reserve, and
+      the transaction is signed with that estimate's fee fields, so a fee
+      fetched again at signing cannot exceed what the amount leaves behind. The
+      address keeps whatever part of the reserve the transaction does not use.
+      If the balance could not be read or no longer covers the fee, the amount
+      is left as it was and one of the errors below blocks the send
+    - Your balance: the From address's balance on the network its transaction
+      was reviewed on, read from that network's RPC endpoint each time the
+      screen is shown, so a screen the popup reopens onto states and checks that
+      network's balance as it is then, whichever network is active. "Loading..."
+      until the read returns, then value + symbol (USD in parentheses), or
+      `unknown (SYMBOL)` for a token whose scale is unknown or when the read
+      failed. The amount check uses the same balances: the ETH balance, and for
+      a token transfer the token balance as well
     - Network fee: "Estimating..." then two lines, or "Unable to estimate",
-      fetched async. The first line is what the transfer is expected to cost,
-      `gasLimit * gasPrice` (USD in parentheses); the second is the
-      `gasLimit * maxFeePerGas` reserve the node requires, which is what the
-      balance check gates on. The second line is omitted on a network with no
-      type-2 pricing, where the two are the same number, but its space is
-      reserved either way
+      fetched async once the balance is read. The first line is what the
+      transfer is expected to cost, `gasLimit * gasPrice` (USD in parentheses);
+      the second is the `gasLimit * maxFeePerGas` reserve the node requires,
+      which is what the balance check gates on. The second line is omitted on a
+      network with no type-2 pricing, where the two are the same number, but its
+      space is reserved either way
     - Warnings: inline warnings from the local checks (scam address, self-send)
       plus four reserved warning boxes made visible by the async checks —
       recipient that has never sent a transaction and holds no ETH, recipient is
       a contract, burn address, and an Etherscan phishing/scam label. An address
       that has received ETH but never sent a transaction still holds that ETH,
       so it gets no warning
-    - Errors (insufficient balance), plus three reserved error boxes — the
-      amount plus the fee exceeds the balance (ETH transfers), not enough ETH to
-      pay the fee for the transfer (ERC-20 transfers), and the fee could not be
-      estimated. The first two are mutually exclusive per transfer type, so only
-      the applicable one holds space. The last names its cause: for a token
-      whose scale is unknown the fee can never be estimated, and it says the
-      wallet does not know how many decimal places the token uses and that the
-      transaction cannot be sent; for any other failure it asks the user to go
-      back and try again
+    - Errors (an invalid amount), plus five reserved error boxes, so the balance
+      and the fee arriving later move nothing — the amount exceeds the balance
+      (for a token whose scale is unknown it says the token's balance is
+      unknown), the balance could not be read (it asks the user to go back and
+      try again), the amount plus the fee exceeds the balance (ETH transfers),
+      not enough ETH to pay the fee for the transfer (ERC-20 transfers), and the
+      fee could not be estimated. The third and fourth are mutually exclusive
+      per transfer type, so only the applicable one holds space. The last names
+      its cause: for a token whose scale is unknown the fee can never be
+      estimated, and it says the wallet does not know how many decimal places
+      the token uses and that the transaction cannot be sent; for any other
+      failure it asks the user to go back and try again
+    - Two more reserved error boxes, made visible when "Sign & Send" refuses a
+      send because the active network changed or because of its gas limit or fee
+      (see Transitions), so the refusal moves nothing
     - Password: an inline field on this screen, not a modal, with its own error
       line
-    - "Sign & Send" button (disabled if errors, and while the network fee
-      estimate is pending or unavailable)
+    - "Sign & Send" button (disabled if errors, while the balance is being read,
+      and while the network fee estimate is pending or unavailable)
 - **Transitions**:
     - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
     - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
@@ -1790,12 +1831,30 @@ view would leave a wallet one click from deletion.
       the contract's own answer is read at signing time only to be compared with
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
-    - "Sign & Send" after the active network was switched in Settings while this
-      screen was open → nothing is signed; "The active network changed after
-      this transaction was reviewed, so it was not sent. Please go back and
-      review it again." in the errors box, no screen change. The transaction
-      carries the chain id of the network the screen was shown for, so it cannot
-      be signed for another
+    - "Sign & Send" after the active network was switched in Settings since this
+      transaction was reviewed → nothing is signed; "The active network changed
+      after this transaction was reviewed, so it was not sent. Please go back
+      and review it again." in its own box, no screen change. After a switch,
+      "Back" from Settings draws this screen again from the saved transaction,
+      as a popup reopened onto it does; when Send is beneath it on the stack, as
+      when Send showed it in the same popup, "Back" lands below Send instead
+      (see the top of Screen Map). The transaction carries the chain id of the
+      network active when Send showed this screen, and keeps it when the screen
+      is drawn again from the saved transaction, so it cannot be signed for
+      another. The screen describes it on that network, whichever network is
+      active: its amounts are in that network's native currency, its USD values
+      are that network's, so a testnet transaction shows none, its From, To and
+      token contract links open that network's explorer, the balance read, the
+      fee estimate and the contract and never-sent recipient checks ask that
+      network's RPC endpoint, and the Etherscan label check asks that network's
+      explorer
+    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
+      total fee the RPC endpoint fills in at signing is over its bound in
+      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
+      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
+      is more than this wallet will sign for, so it was not sent. Please go back
+      and try again." in its own box, the same sentence for all three, no screen
+      change
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
@@ -1941,6 +2000,10 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
+    - "Add", then a network switch in Settings before the contract lookup
+      answers → nothing is tracked; "The active network changed before the
+      lookup finished, so the token was not added." flash message, no screen
+      change
     - "Back" → previous screen (AddressDetail)
 
 #### Settings (`settings`)
@@ -2050,7 +2113,9 @@ view would leave a wallet one click from deletion.
 - **Elements**:
     - "Back" button, "Delete Wallet" heading
     - Warning naming the wallet and stating that deletion is permanent and any
-      funds are unrecoverable without the recovery phrase
+      funds are unrecoverable without the recovery phrase, the private key or
+      the extended private key, according to the wallet's kind
+      (`keyMaterialName()` in `src/popup/views/helpers.js`)
     - Password input
     - Error line
     - "Confirm Delete" button
@@ -2091,9 +2156,10 @@ view would leave a wallet one click from deletion.
       cannot be unlocked again, and that no password is needed to delete it
     - What deletion does and does not do: it erases the copy of the key stored
       on this device; nothing on chain changes and no money is moved
-    - The route back — adding the wallet again with the recovery phrase and a
-      new password — and, in bold, that without that phrase written down the
-      deletion loses everything the wallet holds, forever
+    - The route back — adding the wallet again, with a new password, from a kept
+      copy of its recovery phrase, private key or extended private key (named as
+      on DeleteWallet) — and, in bold, that without that copy the deletion loses
+      everything the wallet holds, forever
     - That the other wallets are not touched
     - The wallet's name, and a text input asking for it to be typed back. A name
       that shows nothing at all (only spaces, or only characters that paint
@@ -2151,8 +2217,9 @@ view would leave a wallet one click from deletion.
       the address **only if it has on-chain activity**. An address that was
       never used is not found by that scan. The text is written by
       `recoveryPathText()` rather than sitting in `index.html`, so it can name
-      the wallet's own kind of key material: an xprv wallet has no recovery
-      phrase to re-import.
+      the wallet's own kind of key material through `keyMaterialName()`, as
+      DeleteWallet and DeleteWalletLostPassword do: an xprv wallet has no
+      recovery phrase to re-import.
     - A warning when the address holds anything, ETH or any tracked ERC-20,
       followed by the holdings themselves via `balanceLinesForAddress()` and the
       USD total via `formatAddressTotal()` (see
@@ -2207,6 +2274,10 @@ view would leave a wallet one click from deletion.
       "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
+    - "Add" by contract address, then a network switch in Settings before the
+      lookup answers → nothing is tracked; "The active network changed before
+      the lookup finished, so the token was not added." flash message, no screen
+      change
     - "Back" → previous screen (Settings)
 
 #### SiteApproval (`approve-site`)
@@ -2283,13 +2354,17 @@ view would leave a wallet one click from deletion.
     - Site origin (bold, scheme and port included) + "wants to send a
       transaction"
     - Decoded action (if calldata is recognized): action name, token details,
-      amounts, steps, deadline (see Transaction Decoding)
+      amounts, steps, deadline, and unless a swap pays only the From address, a
+      `Paid to` line for each other address it pays, or saying that a token
+      stays in the router or who it pays is unknown (see Transaction Decoding)
     - From: color dot + full address + etherscan link
     - Contract: color dot + full address + etherscan link, token symbol label if
       known; for a contract creation, the same sentence as on WaitTx
-    - Value: amount in ETH (4 decimal places, USD in parentheses)
-    - Network fee (max): gas limit × fee per gas in ETH (4 decimal places, USD
-      in parentheses), with the gas limit and the fee per gas in gwei below it
+    - Value: amount in ETH (4 decimal places with the nonzero floor, USD in
+      parentheses)
+    - Network fee (max): gas limit × fee per gas in ETH (4 decimal places with
+      the nonzero floor, USD in parentheses), with the gas limit and the fee per
+      gas in gwei below it
     - Network and nonce
     - Raw data: full calldata displayed inline (shown if present)
     - Password input and an error line
@@ -2900,11 +2975,138 @@ Currently supported:
   or recipient, and amount.
 - **Uniswap Universal Router**: `execute()` calls — shows swap direction (e.g.
   "Swap USDT → ETH"), token addresses, amounts, execution steps, and deadline.
-  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap
-  action is read only in the parameter shape deployed on mainnet and Sepolia,
-  not in the newer one on `v4-periphery` `main`, which adds a `minHopPriceX36`
-  field. An action in any other shape is not read, and its step is listed as
-  `V4 Swap (could not be decoded)`.
+  The swap summary is shown only for a transaction sent to one of the Universal
+  Router addresses Uniswap publishes for the network: on TxApproval the network
+  the transaction is for, on TransactionDetail the active network. The same
+  calldata sent to any other address is shown as raw data. Decodes Permit2,
+  V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap action is read only
+  in the parameter shape deployed on mainnet and Sepolia, not in the newer one
+  on `v4-periphery` `main`, which adds a `minHopPriceX36` field. An action in
+  any other shape is not read, and its step is listed as
+  `V4 Swap (could not be decoded)`. Each step is named and read as the command
+  that the release of the router at that address runs for its command type, as
+  that release's `contracts/libraries/Commands.sol` names it. The decoder reads
+  the type from the command byte with the mask that router uses: `0x1f` for
+  `UniversalRouterV1`, `0x3f` for `UniversalRouterV1_2_V2Support` and
+  `UniversalRouterV2`, and `0x7f` for `UniversalRouterV2_1_1` and
+  `UniversalRouterV2_1_2`. The allow-revert flag (`0x80`) therefore does not
+  change the command a step is read as. Releases run different commands for some
+  types: on `UniversalRouterV1` and `UniversalRouterV1_2_V2Support`, `0x10` to
+  `0x13` are NFT commands, where the later routers run `V4_SWAP`,
+  `V3_POSITION_MANAGER_PERMIT`, `V3_POSITION_MANAGER_CALL` and
+  `V4_INITIALIZE_POOL`. The decoder does not read those routers' NFT commands,
+  and lists each by its name there, for example `Seaport` for `SEAPORT` (`0x10`
+  on `UniversalRouterV1`). A type a release names no command for is listed by
+  its number, for example `Command 0x0e` on `UniversalRouterV1`, which has no
+  `BALANCE_CHECK_ERC20` and reverts on it. The router reverts the whole
+  transaction when a step fails, unless the step's command byte has that flag
+  set and its command is one the router lets fail, as each release's
+  `contracts/base/Dispatcher.sol` shows: on `UniversalRouterV2`,
+  `UniversalRouterV2_1_1` and `UniversalRouterV2_1_2`, `PERMIT2_PERMIT`,
+  `PERMIT2_PERMIT_BATCH`, `BALANCE_CHECK_ERC20`, `V3_POSITION_MANAGER_PERMIT`,
+  `V3_POSITION_MANAGER_CALL`, `V4_INITIALIZE_POOL`, `V4_POSITION_MANAGER_CALL`
+  and `EXECUTE_SUB_PLAN`; on `UniversalRouterV1_2_V2Support`,
+  `BALANCE_CHECK_ERC20`, `EXECUTE_SUB_PLAN` and its NFT market calls and NFT
+  owner checks; on `UniversalRouterV1`, its NFT market calls and NFT owner
+  checks. Such a step may then fail while the transaction goes on to the next
+  step, and it is listed with ` (allowed to fail)` after its name, for example
+  `Balance Check (allowed to fail)`. On every other command, among them each V2,
+  V3 and V4 swap and each payment of ETH or an ERC-20 token, the flag has no
+  effect: the step succeeds or the whole transaction reverts, so the step reads
+  as it does without the flag. A `BALANCE_CHECK_ERC20` the router lets fail
+  guarantees nothing, so it is read as one whose `minBalance` is zero. Only the
+  routers with the `0x7f` mask have `PAY_PORTION_FULL_PRECISION` (`0x07`),
+  listed as `Pay Portion (Full Precision)`, and `ACROSS_V4_DEPOSIT_V3` (`0x40`),
+  listed as `Across Bridge Deposit`; the other routers revert on `0x07`, and it
+  is listed there as `Command 0x07`. The decoder does not read the commands
+  inside an `EXECUTE_SUB_PLAN` (`0x21`) step, and wherever that step stands they
+  may spend the user's tokens or pay the user. That step is listed as
+  `Execute Sub-Plan (its steps are not shown)`, and whatever the other steps
+  state, the summary names no swap direction, `Token In` and `Token Out` read
+  `Unknown (could not be decoded)`, and there is no `Amount` or `Min. received`
+  line. Each swap step, `SWEEP`, `WRAP_ETH`, `UNWRAP_WETH`, `TRANSFER`,
+  `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `PERMIT2_TRANSFER_FROM` (which
+  moves the user's own tokens) and V4 `TAKE` and `TAKE_PORTION` names the
+  address it pays, and `TAKE_ALL` pays the transaction's sender. The router
+  reads `address(1)` as the transaction's sender, and `address(2)` as the router
+  itself, which holds what it is paid until a later step pays it out; a payment
+  to the router, as `address(2)` or by its own address, is not counted as paid
+  out. `UniversalRouterV1` alone pays a `PERMIT2_TRANSFER_FROM` to `address(1)`
+  or `address(2)` as those addresses, and the decoder names them. A
+  `PERMIT2_TRANSFER_FROM` into the router is named with the amount it moves,
+  because the decoder does not check that later steps spend all of it.
+  `ACROSS_V4_DEPOSIT_V3` pays the bridge, which pays the deposit's recipient on
+  another network and refunds a deposit nobody fills to its depositor; the
+  router passes both on as written, so `address(1)` and `address(2)` there are
+  addresses, and each that is not the transaction's sender is named. A
+  `BALANCE_CHECK_ERC20` pays nobody: the router checks that its owner holds at
+  least `minBalance` of its token, and reads the owner as written, so
+  `address(1)` and `address(2)` there are addresses too. A check of any address
+  but the transaction's sender's says nothing about what the user receives: it
+  sets neither `Token Out` nor the minimum, and it is listed as
+  `Balance Check (of another address)`. A check whose input does not decode,
+  such as one whose owner word has a nonzero top byte (the router reads the
+  owner from the word's last 20 bytes), likewise sets neither, and it is listed
+  as `Balance Check (could not be decoded)`. When a swap step, `TAKE` or
+  `TAKE_PORTION` pays the router any token, the swap's output or another, a
+  `WRAP_ETH` pays it WETH, or an `UNWRAP_WETH` into the router turns WETH a step
+  paid it into ETH, that token stays in the router unless a later step pays out
+  or spends all the router holds of it: a `SWEEP` of that token to anyone but
+  the router, an `UNWRAP_WETH` when it is WETH, a `WRAP_ETH` of
+  `CONTRACT_BALANCE` when it is ETH, a `TRANSFER` of `CONTRACT_BALANCE`, a
+  `PAY_PORTION` of 10,000 bips or a `PAY_PORTION_FULL_PRECISION` of 1e18 of that
+  token to anyone but the router, an `ACROSS_V4_DEPOSIT_V3` of
+  `CONTRACT_BALANCE` of that token, or of ETH when it sets `useNative`, or a V2
+  or V3 exact-in swap step or V4 `SETTLE` that pays `CONTRACT_BALANCE` of that
+  token from the router (`payerIsUser` false). Such steps also spend all the
+  WETH a `WRAP_ETH` paid the router once together they spend the amount the
+  `WRAP_ETH` states, as a swap paid in ETH does; a `SETTLE` of `OPEN_DELTA`
+  (zero) from the router counts as spending what its step's swap spends only
+  when it is the step's only `SETTLE` or `SETTLE_ALL` of that token, comes after
+  every swap action in the step, and no swap action in the step buys that token,
+  because the router pays only what the step still owes of that token when the
+  `SETTLE` runs; otherwise it counts as spending nothing. So the rest of a V4
+  `SETTLE` of more than its swap spends, taken to the router, the WETH of a
+  `WRAP_ETH`, and a token a swap pays the router on the way to the output, each
+  stays in the router when later steps do not spend all of it, where anyone can
+  take it in a later transaction. The router sends ETH as written, so a
+  `TRANSFER` of `CONTRACT_BALANCE` of ETH always reverts and pays out nothing. A
+  step paying a token to the V2 pair that the very next step spends, as a V2
+  exact-in of that token whose `amountIn` is `ALREADY_PAID` (zero) or
+  `CONTRACT_BALANCE`, is a hop, not a payout: Uniswap's mixed routes pay the
+  next V2 pair directly, and the router enforces that swap's own minimum. The
+  decoder checks that the address paid is that pair, deriving it from the V2
+  factory and pair init code hash the network's routers were deployed with and
+  the first two tokens of that step's path; a payment to any other address is
+  named. (Sepolia's `UniversalRouterV1_2_V2Support` was deployed with
+  placeholders for both values, so no V2 swap step can succeed on that router.)
+  Every other payment counts, in whichever step and of whatever token, a share
+  of the output included: an interface fee paid to another address by
+  `PAY_PORTION`, `TRANSFER` or `TAKE_PORTION` is named, and the minimum reads
+  `Min. paid out`, because the swap's minimum includes the fee. The minimum
+  reads `Min. received` only when some step pays the transaction's sender (the
+  From address on TxApproval, the sender the explorer reports on
+  TransactionDetail) and no `Paid to` line is shown. `Paid to` lines after
+  `Token Out` name each other address paid; one reads
+  `The bridge, which pays the deposit's recipient on another network` for a
+  bridge deposit; one reads, for example,
+  `The router, 2000.0000 USDT from the sender (later steps may not spend all of it)`
+  for each move into the router, followed by a `Token moved into the router`
+  line that gives the moved token's address as the `Token In` line does; one
+  reads `The router, where it stays (no later step pays it out)` for each token
+  that stays in the router, followed, for any token but the output, by a
+  `Token moved into the router` line giving that token in the same way (ETH by
+  name); and one more reads `Unknown (could not be decoded)` when a step that
+  may pay an address went unread. When no step pays anyone, a single line reads
+  `Unknown (not named in the calldata)`. Wherever there is a `Paid to` line, the
+  minimum reads `Min. paid out`. A step goes unread when its recipient does not
+  decode as an address, or when it is a command the decoder does not read: every
+  command other than `PERMIT2_PERMIT`, `PERMIT2_TRANSFER_FROM`,
+  `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`, `V3_SWAP_EXACT_IN`, `V4_SWAP`,
+  `SWEEP`, `TRANSFER`, `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`,
+  `ACROSS_V4_DEPOSIT_V3`, `WRAP_ETH`, `UNWRAP_WETH` and `BALANCE_CHECK_ERC20`
+  (`V3_SWAP_EXACT_OUT`, `PERMIT2_TRANSFER_FROM_BATCH`, `EXECUTE_SUB_PLAN` and
+  the NFT commands among them), or a type its release names no command for.
 
 ### Non-Goals Forever
 

docs/README.md

@@ -306,7 +306,14 @@ enter your password and click "Confirm" to authorize it. Message and typed-data
 signature requests work the same way, with a "Sign" button, and also require
 your password.
 
-If the requesting site's domain is on the phishing blocklist, all three approval
+A connected site can also ask to switch the wallet's network. A popup shows the
+site's origin, the current network and the requested network. Nothing changes
+unless you click "Switch"; clicking "Reject" or closing the popup leaves
+everything as it was. Switching works exactly as it does in Settings, and
+changes the network for the whole wallet and for every site, not only for the
+one that asked.
+
+If the requesting site's domain is on the phishing blocklist, all four approval
 screens show a red phishing warning before you decide.
 
 You can manage site permissions in Settings. Allowed and denied sites can be
@@ -378,7 +385,8 @@ Click the gear icon on the home screen to access settings:
 - **Display**: Toggle whether tracked tokens with zero balance are shown, switch
   timestamps to UTC, and choose the theme (System, Light, or Dark).
 - **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
-  resets the RPC and Blockscout endpoints to that network's defaults.
+  restores the RPC and Blockscout endpoints you last used on that network, or
+  that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and

src/popup/index.html

@@ -664,6 +664,20 @@
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
                 ></div>
+                <!-- Its sentence names the token, or why the token's balance
+                is unknown, so show() in confirmTx.js sets it. -->
+                <div
+                    id="confirm-balance-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                ></div>
+                <div
+                    id="confirm-balance-read-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                >
+                    Your balance could not be read from the network, so this
+                    transaction cannot be checked against it. Please go back and
+                    try again.
+                </div>
                 <div
                     id="confirm-amount-fee-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
@@ -683,6 +697,25 @@
                     id="confirm-fee-unknown-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
                 ></div>
+                <!-- Shown when Sign & Send refuses a send for its network, or
+                for its gas limit or fee. Each holds its space from the first
+                paint, so the refusal moves nothing. -->
+                <div
+                    id="confirm-network-changed-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                >
+                    The active network changed after this transaction was
+                    reviewed, so it was not sent. Please go back and review it
+                    again.
+                </div>
+                <div
+                    id="confirm-fee-bound-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                >
+                    The gas limit or fee the RPC endpoint quoted for this
+                    transaction is more than this wallet will sign for, so it
+                    was not sent. Please go back and try again.
+                </div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
                     <input
@@ -924,9 +957,9 @@
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Network</h3>
                     <p class="text-xs text-muted mb-1">
-                        Select the Ethereum network. Switching networks will
-                        update the RPC and Blockscout endpoints to their
-                        defaults.
+                        Select the Ethereum network. Switching restores the RPC
+                        and Blockscout endpoints last used on that network, or
+                        that network's defaults if it has none.
                     </p>
                     <div class="text-xs flex items-center gap-1">
                         <select
@@ -1123,7 +1156,8 @@
                 <p class="text-xs mb-3">
                     Deleting
                     <strong id="delete-wallet-name"></strong> is permanent. Any
-                    funds will be unrecoverable without your recovery phrase.
+                    funds will be unrecoverable without your
+                    <span id="delete-wallet-key-material"></span>.
                 </p>
                 <div class="mb-2">
                     <label class="block mb-1">Password</label>
@@ -1174,13 +1208,13 @@
                     money at its addresses is not moved or destroyed.
                 </p>
                 <p class="text-xs mb-2">
-                    If you have the recovery phrase for this wallet written
-                    down, add the wallet again afterwards with a new password
-                    and you will have it back.
+                    If you have kept a copy of this wallet's
+                    <span id="delete-wallet-lost-key-material"></span>, add the
+                    wallet again afterwards with a new password and you will
+                    have it back.
                     <strong
-                        >If you do not have it written down, deleting this
-                        wallet means losing everything it holds,
-                        forever.</strong
+                        >If you have not, deleting this wallet means losing
+                        everything it holds, forever.</strong
                     >
                 </p>
                 <p class="text-xs mb-3">Your other wallets are not touched.</p>

src/popup/viewRouter.js

@@ -13,6 +13,7 @@
 // cannot be required outside a browser.
 
 const { RESTORABLE_VIEWS } = require("../shared/restorableViews");
+const { SUPPORTED_CHAIN_IDS } = require("../shared/networks");
 
 // The views this page load has rendered.
 //
@@ -126,14 +127,19 @@ function isRenderableDecoded(value) {
 }
 
 // The pending transaction confirmTx.show() renders: `token` reaches
-// renderAddressHtml() when it is not "ETH", and `from`/`to` reach
-// addressTitle(), makeBlockie() and getLocalWarnings().
+// renderAddressHtml() when it is not "ETH", `from`/`to` reach
+// addressTitle(), makeBlockie() and getLocalWarnings(), and `amount` reaches
+// truncateAmountNeverZero(), which splits it. `chainId`, which show() fills in
+// when it is absent, picks the network whose explorer the address links open,
+// so it has to name one.
 function isRenderablePendingTx(value) {
     return (
         isRecord(value) &&
         isText(value.token) &&
         isAddressText(value.from) &&
-        isAddressText(value.to)
+        isAddressText(value.to) &&
+        isText(value.amount) &&
+        (!value.chainId || SUPPORTED_CHAIN_IDS.has(value.chainId))
     );
 }
 

src/popup/views/addToken.js

@@ -1,6 +1,6 @@
 const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
-const { state, saveState } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
 const { log } = require("../../shared/log");
@@ -52,6 +52,9 @@ function init(ctx) {
         infoEl.textContent = "Looking up token...";
         infoEl.style.visibility = "visible";
         log.debugf("Looking up token contract", contractAddr);
+        // The network the lookup asks, which Settings may switch away from
+        // before it answers, as for a transaction in confirmTx.js.
+        const chainId = currentNetwork().chainId;
         try {
             const info = await lookupTokenInfo(
                 contractAddr,
@@ -59,6 +62,15 @@ function init(ctx) {
                 state.networkId,
                 ctx.pageClosed,
             );
+            // A contract address names a token on one network only, so an
+            // answer after a switch is not added to the new network's list.
+            if (currentNetwork().chainId !== chainId) {
+                showFlash(
+                    "The active network changed before the lookup finished," +
+                        " so the token was not added.",
+                );
+                return;
+            }
             log.infof("Adding token", info.symbol, contractAddr);
             state.trackedTokens.push({
                 address: contractAddr,

src/popup/views/approval.js

@@ -79,9 +79,10 @@ function tokenAmountText(rawAmount, decimals, symbol) {
     };
 }
 
-// Try to decode calldata using known ABIs.
+// Try to decode calldata sent from `fromAddress` to `toAddress` on the network
+// with chain id `chainId`, using known ABIs.
 // Returns { name, description, details } or null.
-function decodeCalldata(data, toAddress) {
+function decodeCalldata(data, toAddress, chainId, fromAddress) {
     if (!data || data === "0x" || data.length < 10) return null;
 
     // Where a token's scale is looked for, for every decoder below: the ERC-20
@@ -185,7 +186,13 @@ function decodeCalldata(data, toAddress) {
     }
 
     // Try Uniswap Universal Router
-    const routerResult = uniswap.decode(data, toAddress, decimalsSources);
+    const routerResult = uniswap.decode(
+        data,
+        toAddress,
+        chainId,
+        decimalsSources,
+        fromAddress,
+    );
     if (routerResult) return routerResult;
 
     return null;
@@ -269,8 +276,15 @@ function showTxApproval(details) {
         chainId: approvedTx.chainId,
     };
 
-    // If this is an ERC-20 call, try to extract the real recipient and amount
-    const decoded = decodeCalldata(approvedTx.data, toAddr || "");
+    // If this is an ERC-20 call, try to extract the real recipient and amount.
+    // Decoded for the network the transaction is for, which the Network line
+    // names, and the address the From line names.
+    const decoded = decodeCalldata(
+        approvedTx.data,
+        toAddr || "",
+        approvedTx.chainId,
+        details.approvedFrom,
+    );
     if (decoded && decoded.details) {
         // The asset the status summary is counted in: an ERC-20 call's Token
         // contract, or a swap's input token. Its symbol is resolved from the

src/popup/views/confirmTx.js

@@ -2,7 +2,13 @@
 // Shows transaction details, warnings, errors. On Sign & Send,
 // reads inline password, decrypts secret, signs and broadcasts.
 
-const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
+const {
+    parseEther,
+    parseUnits,
+    formatEther,
+    formatUnits,
+    Contract,
+} = require("ethers");
 const {
     $,
     showError,
@@ -11,7 +17,6 @@ const {
     addressTitle,
     escapeHtml,
     displaySymbol,
-    nativeCurrency,
     renderAddressHtml,
     blockieHtml,
     attachCopyHandlers,
@@ -20,6 +25,10 @@ const {
     formatFee,
 } = require("./helpers");
 const { state, currentNetwork } = require("../../shared/state");
+const {
+    networkByChainId,
+    nativeCurrencyByChainId,
+} = require("../../shared/networks");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
 const { decryptWithPassword } = require("../../shared/vault");
@@ -32,11 +41,12 @@ const {
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
 const {
     displayedDecimals,
+    toDecimals,
     transferAmountUnits,
 } = require("../../shared/transferAmount");
 const { assertWithinCeilings } = require("../../shared/approvalVerify");
-// The balance lines, the fee reserve and the insufficient-balance messages go
-// through it, as the approval screen's amounts do.
+// The amount, the balance line and the fee reserve go through it, as the
+// approval screen's amounts do.
 const { truncateAmountNeverZero } = require("../../shared/amountDisplay");
 const {
     CODES,
@@ -60,6 +70,13 @@ let feeWei = null;
 // amount was derived from. Null for any other send, which ethers prices from
 // the node at signing time.
 let maxSendFees = null;
+// The From address's balances on the network this screen is drawn for, read
+// from that network's node by readBalances() each time the screen is shown,
+// so a screen the popup reopens onto states them as they are then, not as
+// Send knew them. Null until the read returns; then `eth` and `token` are
+// decimal strings, `token` null for an ETH send or a token whose scale is
+// unknown, and both null if the read failed.
+let balances = null;
 
 function restore() {
     const d = state.viewData;
@@ -68,11 +85,11 @@ function restore() {
     }
 }
 
-function confirmAddressHtml(address, ensName, title) {
+function confirmAddressHtml(address, ensName, title, chainId) {
     const blockie = blockieHtml(address);
     return (
         `<div class="mb-1">${blockie}</div>` +
-        renderAddressHtml(address, { title, ensName })
+        renderAddressHtml(address, { title, ensName, chainId })
     );
 }
 
@@ -83,34 +100,96 @@ function valueWithUsd(text, usdAmount) {
     return text;
 }
 
-// The Amount line, with its USD value. A max ETH send's line is drawn again
-// once its amount is re-derived from the fee estimate.
+// The amount as this screen and the wait, success and error screens show it,
+// written as the approval screen writes a site's amount: the amount being
+// signed, parsed at the scale it is encoded with and written back as plain
+// decimal text, then cut to four decimals with the nonzero floor. So `.5` and
+// `00.5` read `0.5000`, as `0.5` does, except for a token whose scale is
+// unknown, which cannot be sent: its amount is cut as typed, so `.5` reads
+// `.5000`. txInfo.amount, which is what gets signed, is left as it is.
+function shownAmount(txInfo) {
+    let exact = txInfo.amount;
+    try {
+        if (txInfo.token === "ETH") {
+            exact = formatEther(parseEther(txInfo.amount));
+        } else {
+            const decimals = displayedDecimals(txInfo.tokenDecimals);
+            exact = formatUnits(parseUnits(txInfo.amount, decimals), decimals);
+        }
+    } catch {
+        // A token whose scale is unknown, which is never signed, or an amount
+        // the amount check refuses: cut as Send's amount field held it.
+    }
+    return truncateAmountNeverZero(exact);
+}
+
+// The Amount line, with its USD value, which is priced from the exact amount.
+// A max ETH send's line is drawn again once its amount is re-derived from the
+// fee estimate.
 function renderAmount(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : nativeCurrency();
-    const price = isErc20 ? getPrice(rawSymbol) : getPrice("ETH");
+    const rawSymbol = isErc20
+        ? txInfo.tokenSymbol || "?"
+        : nativeCurrencyByChainId(txInfo.chainId);
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const amountUsd = price ? parseFloat(txInfo.amount) * price : null;
     $("confirm-amount").textContent = valueWithUsd(
-        txInfo.amount + " " + displaySymbol(rawSymbol),
+        shownAmount(txInfo) + " " + displaySymbol(rawSymbol),
         amountUsd,
     );
 }
 
+// The balance line, with its USD value: "Loading..." until readBalances()
+// returns, then the balance it read.
+function renderBalance(txInfo) {
+    const isErc20 = txInfo.token !== "ETH";
+    const rawSymbol = isErc20
+        ? txInfo.tokenSymbol || "?"
+        : nativeCurrencyByChainId(txInfo.chainId);
+    const symbol = displaySymbol(rawSymbol);
+    if (balances === null) {
+        $("confirm-balance").textContent = "Loading...";
+        return;
+    }
+    // A null balance is one nobody established, for a token whose scale is
+    // unknown or after a read that failed, and is stated as unknown, never as
+    // zero (https://git.eeqj.de/sneak/AutistMask/issues/349).
+    const bal = isErc20 ? balances.token : balances.eth;
+    if (bal === null) {
+        $("confirm-balance").textContent = "unknown (" + symbol + ")";
+        return;
+    }
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
+    const balUsd = price ? parseFloat(bal) * price : null;
+    $("confirm-balance").textContent = valueWithUsd(
+        truncateAmountNeverZero(bal) + " " + symbol,
+        balUsd,
+    );
+}
+
 function show(txInfo) {
     pendingTx = txInfo;
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
-    // The network this screen is drawn for, and the only one it sends on:
-    // Settings can switch the active network while the screen is open. The
-    // wait, success and error screens label the amount by it too.
-    txInfo.chainId = currentNetwork().chainId;
+    balances = null;
+    // The network this screen is drawn for, and the only one it sends on: the
+    // one active when Send handed the transaction over. Drawn again from the
+    // saved transaction, as when the popup reopens onto this screen, it keeps
+    // that network, so Sign & Send refuses once Settings has switched to
+    // another. Everything this screen shows is that network's: native
+    // currency, USD values, explorer links, the balance, and the node and
+    // explorer its checks ask. The wait, success and error screens label
+    // amounts by it.
+    if (!txInfo.chainId) txInfo.chainId = currentNetwork().chainId;
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
     // screen says. Truncating before the lookup would silently drop the
     // price of any token whose symbol is long enough to be capped.
-    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : nativeCurrency();
+    const rawSymbol = isErc20
+        ? txInfo.tokenSymbol || "?"
+        : nativeCurrencyByChainId(txInfo.chainId);
     const symbol = displaySymbol(rawSymbol);
 
     // Transaction type
@@ -126,7 +205,7 @@ function show(txInfo) {
     if (isErc20) {
         $("confirm-token-contract").innerHTML = renderAddressHtml(
             txInfo.token,
-            {},
+            { chainId: txInfo.chainId },
         );
         tokenSection.classList.remove("hidden");
         attachCopyHandlers(tokenSection);
@@ -140,6 +219,7 @@ function show(txInfo) {
         txInfo.from,
         null,
         fromTitle,
+        txInfo.chainId,
     );
 
     // To (with blockie)
@@ -148,37 +228,12 @@ function show(txInfo) {
         txInfo.to,
         txInfo.ensName,
         toTitle,
+        txInfo.chainId,
     );
     $("confirm-to-ens").classList.add("hidden");
 
     renderAmount(txInfo);
-
-    // Balance (with inline USD)
-    const ethPrice = getPrice("ETH");
-    const tokenPrice = getPrice(rawSymbol);
-    if (isErc20) {
-        // null is a balance whose scale nothing knows, not a balance of zero
-        // (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
-        // refused at encode time for the same missing scale; what this line
-        // must not do is state a quantity nobody established.
-        const bal = txInfo.tokenBalance;
-        const balUsd =
-            tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
-        $("confirm-balance").textContent =
-            bal == null
-                ? "unknown (" + symbol + ")"
-                : valueWithUsd(
-                      truncateAmountNeverZero(bal) + " " + symbol,
-                      balUsd,
-                  );
-    } else {
-        const bal = txInfo.balance || "0";
-        const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
-        $("confirm-balance").textContent = valueWithUsd(
-            truncateAmountNeverZero(bal) + " " + symbol,
-            balUsd,
-        );
-    }
+    renderBalance(txInfo);
 
     // Check for warnings (synchronous local checks)
     const localWarnings = getLocalWarnings(txInfo.to, {
@@ -212,9 +267,9 @@ function show(txInfo) {
     $("confirm-gas-error").classList.toggle("hidden", !isErc20);
     $("confirm-gas-error").textContent =
         "You do not have enough " +
-        nativeCurrency() +
+        nativeCurrencyByChainId(txInfo.chainId) +
         " to pay the network fee for this transfer. Please add " +
-        nativeCurrency() +
+        nativeCurrencyByChainId(txInfo.chainId) +
         " to this address and try again.";
 
     // Both shown later, by checkRecipientHistory(). The first sentence says
@@ -222,12 +277,12 @@ function show(txInfo) {
     $("confirm-recipient-warning").textContent =
         "WARNING: The recipient address has never sent a transaction and" +
         " holds no " +
-        nativeCurrency() +
+        nativeCurrencyByChainId(txInfo.chainId) +
         ". This may indicate a fresh or unused address. Double-check the" +
         " address before sending.";
     $("confirm-contract-warning").textContent =
         "WARNING: The recipient is a smart contract. Sending " +
-        nativeCurrency() +
+        nativeCurrencyByChainId(txInfo.chainId) +
         " or tokens directly to a contract may result in permanent loss of" +
         " funds.";
 
@@ -244,11 +299,28 @@ function show(txInfo) {
               " cannot be checked against your balance. Please go back and" +
               " try again.";
 
+    // So does the message for an amount the balance does not cover. It is
+    // set here, before the first paint, so the balance read returning only
+    // makes it visible and moves nothing, which is why it quotes no balance.
+    // Without the token's scale readBalances() reads no token balance.
+    $("confirm-balance-error").textContent =
+        isErc20 && toDecimals(txInfo.tokenDecimals) === null
+            ? "This token's balance is unknown, because nothing this wallet" +
+              " can consult reports how many decimal places it uses, so the" +
+              " amount you are trying to send cannot be checked against it."
+            : "Your " +
+              symbol +
+              " balance does not cover this amount. Please go back and send" +
+              " a smaller amount.";
+
     renderValidation(txInfo);
 
-    // Reset password field and error
+    // Reset password field and error, and any refusal of an earlier Sign &
+    // Send.
     $("confirm-tx-password").value = "";
     hideError("confirm-tx-password-error");
+    setVisible("confirm-network-changed-error", false);
+    setVisible("confirm-fee-bound-error", false);
 
     // Gas estimate — show placeholder then fetch async
     $("confirm-fee").style.visibility = "visible";
@@ -269,69 +341,78 @@ function show(txInfo) {
         $("confirm-burn-warning").style.visibility = "visible";
     }
 
-    estimateGas(txInfo);
+    // The fee is estimated once the balances are read, because a max ETH
+    // send's amount is the ETH balance minus the estimate's reserve.
+    readBalances(txInfo).then(() => estimateGas(txInfo));
     checkRecipientHistory(txInfo);
 }
 
+// Read the From address's balances from the node of the network this
+// transaction was reviewed for: ETH, and for a token send the token, at the
+// scale the screen renders the amount with. A token whose scale is unknown has
+// no balance to read. Never rejects.
+async function readBalances(txInfo) {
+    let read;
+    try {
+        const provider = reviewedNetworkProvider(txInfo);
+        const decimals = toDecimals(txInfo.tokenDecimals);
+        const readToken = txInfo.token !== "ETH" && decimals !== null;
+        const [ethWei, tokenUnits] = await Promise.all([
+            provider.getBalance(txInfo.from),
+            readToken
+                ? new Contract(txInfo.token, ERC20_ABI, provider).balanceOf(
+                      txInfo.from,
+                  )
+                : null,
+        ]);
+        read = {
+            eth: formatEther(ethWei),
+            token: readToken ? formatUnits(tokenUnits, decimals) : null,
+        };
+    } catch (e) {
+        log.errorf("balance read failed:", e.shortMessage || e.message);
+        read = { eth: null, token: null };
+    }
+    // The user may have left this transaction while the read was in flight.
+    if (pendingTx !== txInfo) return;
+    balances = read;
+    renderBalance(txInfo);
+    renderValidation(txInfo);
+}
+
 // Render the balance check for the transaction on screen. Called once during
-// show() and again when the fee estimate resolves or fails. Every element it
-// touches already occupies its space, so re-running it never moves anything.
+// show(), again when the balances are read, and again when the fee estimate
+// resolves or fails. Every element it touches already occupies its space, so
+// re-running it never moves anything.
 function renderValidation(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-    const symbol = isErc20
-        ? displaySymbol(txInfo.tokenSymbol || "?")
-        : nativeCurrency();
+
+    // Null while the balances are being read and after a read that failed.
+    // validateTransfer() takes a missing balance as nothing to spend from, so
+    // sending stays blocked either way, and the only message shown for it is
+    // the one saying the read failed.
+    const ethBalance = balances ? balances.eth : null;
+    const tokenBalance = balances ? balances.token : null;
+    const balanceRead = ethBalance !== null;
 
     const { canSend, codes } = validateTransfer({
         isErc20,
         amount: txInfo.amount,
         tokenDecimals: txInfo.tokenDecimals,
-        ethBalance: txInfo.balance,
-        tokenBalance: txInfo.tokenBalance,
+        ethBalance,
+        tokenBalance,
         feeStatus,
         feeWei,
     });
 
-    // Messages carrying the user's own numbers are built here; the fixed
-    // sentences live in the reserved elements in index.html, except the
-    // gas and fee-unknown ones, which show() sets.
+    // An invalid amount is known before the first paint, so its message is
+    // written here. Every message a later result brings has a reserved
+    // element, its sentence fixed in index.html or set by show(), and is only
+    // made visible below, so nothing moves when the result arrives.
     const messages = [];
     if (codes.includes(CODES.AMOUNT_INVALID)) {
         messages.push("Please enter a valid amount to send.");
     }
-    if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
-        messages.push(
-            txInfo.tokenBalance == null
-                ? "This token's balance is unknown, because nothing this" +
-                      " wallet can consult reports how many decimal places it" +
-                      " uses, so the amount you are trying to send cannot be" +
-                      " checked against it."
-                : "Insufficient " +
-                      symbol +
-                      " balance. You have " +
-                      truncateAmountNeverZero(txInfo.tokenBalance) +
-                      " " +
-                      symbol +
-                      " but are trying to send " +
-                      txInfo.amount +
-                      " " +
-                      symbol +
-                      ".",
-        );
-    }
-    if (codes.includes(CODES.INSUFFICIENT_ETH)) {
-        messages.push(
-            "Insufficient balance. You have " +
-                truncateAmountNeverZero(txInfo.balance || "0") +
-                " " +
-                symbol +
-                " but are trying to send " +
-                txInfo.amount +
-                " " +
-                symbol +
-                ".",
-        );
-    }
 
     const errorsEl = $("confirm-errors");
     if (messages.length > 0) {
@@ -344,13 +425,20 @@ function renderValidation(txInfo) {
         errorsEl.style.visibility = "hidden";
     }
 
+    setVisible("confirm-balance-read-error", balances !== null && !balanceRead);
+    setVisible(
+        "confirm-balance-error",
+        balanceRead &&
+            (codes.includes(CODES.INSUFFICIENT_TOKEN) ||
+                codes.includes(CODES.INSUFFICIENT_ETH)),
+    );
     setVisible(
         "confirm-amount-fee-error",
-        codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
+        balanceRead && codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
     );
     setVisible(
         "confirm-gas-error",
-        codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
+        balanceRead && codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
     );
     setVisible(
         "confirm-fee-unknown-error",
@@ -369,9 +457,23 @@ function setVisible(id, visible) {
     $(id).style.visibility = visible ? "visible" : "hidden";
 }
 
+// The node of the network this transaction was reviewed for, which need not be
+// the active one: the popup can reopen onto this screen after Settings switched
+// the network. Its RPC URL is the one Settings has for that network: the
+// active network's is state.rpcUrl, any other's the one remembered for it (see
+// applyChainSwitchFields()).
+function reviewedNetworkProvider(txInfo) {
+    const net = networkByChainId(txInfo.chainId);
+    if (net.id === state.networkId) {
+        return getProvider(state.rpcUrl, net.id);
+    }
+    const remembered = state.networkEndpoints[net.id] || {};
+    return getProvider(remembered.rpcUrl || net.defaultRpcUrl, net.id);
+}
+
 async function estimateGas(txInfo) {
     try {
-        const provider = getProvider(state.rpcUrl, state.networkId);
+        const provider = reviewedNetworkProvider(txInfo);
         const feeData = await provider.getFeeData();
         let gasLimit;
 
@@ -419,12 +521,17 @@ async function estimateGas(txInfo) {
         // does, so the same fee reads the same on both.
         if (estimateWei !== null && estimateWei < gasCostWei) {
             $("confirm-fee-amount").textContent =
-                "~" + formatFee(estimateWei, nativeCurrency());
+                "~" +
+                formatFee(
+                    estimateWei,
+                    nativeCurrencyByChainId(txInfo.chainId),
+                    txInfo.chainId,
+                );
             $("confirm-fee-reserve").textContent =
                 "up to " +
                 truncateAmountNeverZero(formatEther(gasCostWei)) +
                 " " +
-                nativeCurrency() +
+                nativeCurrencyByChainId(txInfo.chainId) +
                 " reserved";
             setVisible("confirm-fee-reserve", true);
         } else {
@@ -433,20 +540,21 @@ async function estimateGas(txInfo) {
             // cost is not below the reserve. Show the reserve alone.
             $("confirm-fee-amount").textContent = formatFee(
                 gasCostWei,
-                nativeCurrency(),
+                nativeCurrencyByChainId(txInfo.chainId),
+                txInfo.chainId,
             );
             setVisible("confirm-fee-reserve", false);
         }
         feeStatus = FEE_KNOWN;
         feeWei = gasCostWei;
-        // A max ETH send is the balance minus this estimate's reserve, not the
-        // Send screen's, and is signed with this estimate's fee fields: fees
-        // fetched again at signing could exceed the reserve it leaves, and the
-        // node would refuse it for want of funds. Where the balance no longer
-        // covers the fee, the amount is left as it is and the balance check
-        // below says so.
+        // A max ETH send is the balance readBalances() read minus this
+        // estimate's reserve, not the Send screen's, and is signed with this
+        // estimate's fee fields: fees fetched again at signing could exceed
+        // the reserve it leaves, and the node would refuse it for want of
+        // funds. Where the balance is unknown or no longer covers the fee, the
+        // amount is left as it is and the balance check below says so.
         if (txInfo.max && txInfo.token === "ETH") {
-            const amount = maxEthAmount(txInfo.balance, gasCostWei);
+            const amount = maxEthAmount(balances?.eth, gasCostWei);
             if (amount !== null) {
                 txInfo.amount = amount;
                 renderAmount(txInfo);
@@ -475,16 +583,17 @@ async function estimateGas(txInfo) {
     }
 }
 
-// Populate the transaction this send describes, enforce the fee bound against
-// the fees that were actually filled in, then sign and broadcast it. Apart
-// from a max ETH send, which passes its estimate's fee fields as `fees`, the
-// send pins no fee fields, so ethers fills maxFeePerGas and the gas limit from
-// what the configured RPC node answers, with nothing otherwise bounding what a
-// hostile node can set — the dApp path's ceilings never reached this one.
-// Populating before the check is what makes assertWithinCeilings() see the
-// same numbers that would be signed; it throws an ApprovalMismatchError when
-// the product gasLimit × maxFeePerGas is over the bound, which the caller
-// shows in the reserved error area rather than sending.
+// Populate the transaction this send describes, enforce the bounds against the
+// gas limit and fees that were actually filled in, then sign and broadcast it.
+// Apart from a max ETH send, which passes its estimate's fee fields as `fees`,
+// the send pins no fee fields, so ethers fills maxFeePerGas and the gas limit
+// from what the configured RPC node answers, with nothing otherwise bounding
+// what a hostile node can set — the dApp path's ceilings never reached this
+// one. Populating before the check is what makes assertWithinCeilings() see
+// the same numbers that would be signed; it throws an ApprovalMismatchError
+// when the gas limit, a fee per gas, or the product gasLimit × maxFeePerGas is
+// over its bound, and the caller then shows the one refusal reserved for all
+// three rather than sending.
 async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
     let request;
     if (tx.token === "ETH") {
@@ -512,21 +621,16 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
     return connectedSigner.sendTransaction(populated);
 }
 
-// Show a full-sentence send failure in the reserved errors box, the same
-// element and markup renderValidation() uses for messages carrying the user's
-// own numbers, so it never moves anything on the screen.
-function showSendError(message) {
-    const el = $("confirm-errors");
-    el.innerHTML = `<div class="text-xs">${escapeHtml(message)}</div>`;
-    el.style.visibility = "visible";
-}
-
 async function checkRecipientHistory(txInfo) {
     try {
-        const provider = getProvider(state.rpcUrl, state.networkId);
+        const provider = reviewedNetworkProvider(txInfo);
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
+            chainId: txInfo.chainId,
         });
+        // The user may have left this transaction while the checks were in
+        // flight; its warnings must not reach another recipient's screen.
+        if (pendingTx !== txInfo) return;
         for (const w of asyncWarnings) {
             if (w.type === "contract") {
                 $("confirm-contract-warning").style.visibility = "visible";
@@ -555,6 +659,10 @@ function init(_ctx) {
     onViewLeave("confirm-tx", clearPassword);
 
     $("btn-confirm-send").addEventListener("click", async () => {
+        // A press shows only its own refusal, if any.
+        setVisible("confirm-network-changed-error", false);
+        setVisible("confirm-fee-bound-error", false);
+
         const wallet = state.wallets[state.selectedWallet];
         // Every Send button refuses a defective wallet before this screen,
         // but the popup also reopens onto it from a saved view.
@@ -564,14 +672,12 @@ function init(_ctx) {
             return;
         }
 
-        // Back from Settings only unhides this screen, still drawn for the
-        // network that was active when it was shown.
+        // The screen describes the network the transaction was reviewed for,
+        // which Settings may have switched away from since: "Back" from
+        // Settings after a switch draws this screen again from the saved
+        // transaction, as a popup reopened onto it does.
         if (currentNetwork().chainId !== pendingTx.chainId) {
-            showSendError(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
+            setVisible("confirm-network-changed-error", true);
             return;
         }
 
@@ -616,6 +722,10 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
+        // The wait, success and error screens show the amount as this screen
+        // does, so they are handed a copy carrying that text. pendingTx keeps
+        // the exact amount, which is the one signed.
+        const shownTx = { ...pendingTx, amount: shownAmount(pendingTx) };
         let tx;
         try {
             const signer = getSignerForAddress(wallet, addr, decryptedSecret);
@@ -632,19 +742,23 @@ function init(_ctx) {
             // Note: JS strings are immutable; this nulls the reference but
             // the original string may persist in memory until GC.
             decryptedSecret = null;
-            txStatus.showWait(pendingTx, tx.hash);
+            txStatus.showWait(shownTx, tx.hash);
         } catch (e) {
             decryptedSecret = null;
-            // A fee over the bound is refused before anything is broadcast, so
-            // there is no transaction that may have reached the network to warn
-            // about: the message stays on the confirmation screen where the
-            // user can go back, rather than routing to the sent/failed screen.
+            // A gas limit or fee over its bound is refused before anything is
+            // broadcast, so there is no transaction that may have reached the
+            // network to warn about: the refusal stays on the confirmation
+            // screen where the user can go back, rather than routing to the
+            // sent/failed screen. Its sentence is fixed in index.html, so that
+            // its box can hold its space from the first paint; the reason in
+            // full, naming the bound, is logged.
             if (e && e.approvalMismatch) {
-                showSendError(e.message);
+                log.errorf("send refused:", e.message);
+                setVisible("confirm-fee-bound-error", true);
                 return;
             }
             const hash = tx ? tx.hash : null;
-            txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
+            txStatus.showError(shownTx, hash, e.shortMessage || e.message);
         } finally {
             $("btn-confirm-send").disabled = false;
             $("btn-confirm-send").classList.remove("text-muted");

src/popup/views/deleteAddress.js

@@ -17,9 +17,9 @@ const {
     attachCopyHandlers,
     addressHoldsFunds,
     balanceLinesForAddress,
+    keyMaterialName,
 } = require("./helpers");
 const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
-const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { state, saveState } = require("../../shared/state");
 const {
     canRemoveAddress,
@@ -54,9 +54,7 @@ function setFlash(msg) {
 // The noun follows the wallet: an xprv wallet holds no recovery phrase, and
 // this screen is offered on xprv wallets too.
 function recoveryPathText(wallet) {
-    const secret = walletHasRecoveryPhrase(wallet)
-        ? "recovery phrase"
-        : "extended private key";
+    const secret = keyMaterialName(wallet);
     return (
         "Getting the address back into this list is not easy, so be sure. " +
         "Adding an address derives the next unused one, not this one, and " +

src/popup/views/deleteWallet.js

@@ -7,6 +7,7 @@ const {
     goBack,
     clearViewStack,
     onViewLeave,
+    keyMaterialName,
 } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
@@ -75,6 +76,9 @@ function show(walletIdx) {
     clear();
     deleteWalletIndex = walletIdx;
     $("delete-wallet-name").textContent = displayName(walletIdx);
+    $("delete-wallet-key-material").textContent = keyMaterialName(
+        state.wallets[walletIdx],
+    );
     showView("delete-wallet-confirm");
 }
 
@@ -94,6 +98,9 @@ function showLostPassword() {
     clearLostPassword();
     $("delete-wallet-lost-name").textContent = name;
     $("delete-wallet-lost-name-echo").textContent = name;
+    $("delete-wallet-lost-key-material").textContent = keyMaterialName(
+        state.wallets[walletIdx],
+    );
     // showView() runs the leave hook of delete-wallet-confirm, which nulls
     // deleteWalletIndex, so this screen's own selection is recorded after
     // it and not before.

src/popup/views/helpers.js

@@ -22,9 +22,11 @@ const { resolveTokenSymbol } = require("../../shared/approvalAmount");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
+const { networkByChainId } = require("../../shared/networks");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { displaySymbol } = require("../../shared/symbolDisplay");
+const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
@@ -283,11 +285,12 @@ function unknownableAmount(balance) {
 
 // The active network's native token symbol, `ETH` on mainnet and `SepoliaETH`
 // on Sepolia, as src/shared/networks.js names it. The wallet's balances and
-// the Send and confirmation screens, which send on the active network, label a
-// native amount with this; a transaction already made or requested is labelled
-// by its own chain id, through nativeCurrencyByChainId() in networks.js. The
-// "ETH" that state.selectedToken and txInfo.token hold is the native token's
-// id, not its label, and stays "ETH" on every network.
+// the Send screen, which sends on the active network, label a native amount
+// with this; the confirmation screen, and a transaction already made or
+// requested, label it by the transaction's own chain id, through
+// nativeCurrencyByChainId() in networks.js. The "ETH" that state.selectedToken
+// and txInfo.token hold is the native token's id, not its label, and stays
+// "ETH" on every network.
 function nativeCurrency() {
     return currentNetwork().nativeCurrency;
 }
@@ -306,11 +309,12 @@ function tokenLabel(address) {
 // A network fee in wei as the confirmation and approval screens both show it:
 // the ETH figure through truncateAmountNeverZero() and labelled `symbol`, the
 // native currency of the network the fee is paid on, then its USD value when
-// the ETH price is known. The USD value is of the exact fee, not of the
-// truncated figure.
-function formatFee(wei, symbol) {
+// the ETH price is known on the network with `chainId`, or on the active
+// network when no chain id is given. The USD value is of the exact fee, not of
+// the truncated figure.
+function formatFee(wei, symbol, chainId) {
     const eth = formatEther(wei);
-    const ethPrice = getPrice("ETH");
+    const ethPrice = getPrice("ETH", chainId);
     const usd = ethPrice ? formatUsd(parseFloat(eth) * ethPrice) : "";
     return (
         truncateAmountNeverZero(eth) +
@@ -418,6 +422,16 @@ function addressHoldsFunds(addr) {
     return false;
 }
 
+// The name of a wallet's key material, which is also its only backup: the
+// recovery phrase of an HD wallet, the private key of a key wallet, the
+// extended private key of an xprv wallet. DeleteWallet,
+// DeleteWalletLostPassword and DeleteAddress name the backup with it.
+function keyMaterialName(wallet) {
+    if (walletHasRecoveryPhrase(wallet)) return "recovery phrase";
+    if (wallet.type === "key") return "private key";
+    return "extended private key";
+}
+
 // The fewest characters of an address any caller may ask to display. The
 // 10-character cap inside truncateMiddle() is the other half of the same
 // guarantee; this is the half that used to be spelled out at each call
@@ -593,17 +607,19 @@ const EXT_ICON =
     `</svg></span>`;
 
 // Block-explorer URLs. The origin is a per-network constant from
-// src/shared/networks.js; only the path segment is data, and it comes out
-// of explorer JSON (a transaction's from/to, a token's address_hash), which
-// nothing upstream validates as hex. percent-encoding it keeps a segment
-// that contains a slash, a query or a fragment from re-pointing the link
-// somewhere else in the explorer.
-function explorerUrl(kind, value) {
-    return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
+// src/shared/networks.js, the explorer of the network with `chainId`, or of
+// the active network when no chain id is given; only the path segment is
+// data, and it comes out of explorer JSON (a transaction's from/to, a token's
+// address_hash), which nothing upstream validates as hex. percent-encoding it
+// keeps a segment that contains a slash, a query or a fragment from
+// re-pointing the link somewhere else in the explorer.
+function explorerUrl(kind, value, chainId) {
+    const network = chainId ? networkByChainId(chainId) : currentNetwork();
+    return `${network.explorerUrl}/${kind}/${encodeURIComponent(value)}`;
 }
 
-function etherscanAddressUrl(address) {
-    return explorerUrl("address", address);
+function etherscanAddressUrl(address, chainId) {
+    return explorerUrl("address", address, chainId);
 }
 
 // The URL still has to be escaped on the way into href="...": encoding
@@ -669,16 +685,18 @@ function attachCopyHandlers(container) {
 //              with them, and the "at least 32 characters" guarantee has
 //              to survive having no current callers to be a guarantee.
 //   noLink   — if true, omit etherscan link
+//   chainId  — the network whose explorer the link opens; the active
+//              network's when absent
 //
 // After inserting the returned HTML into the DOM, call
 // attachCopyHandlers() on the parent to wire up click-to-copy.
 function renderAddressHtml(address, opts) {
-    const { title, ensName, maxLen, noLink } = opts || {};
+    const { title, ensName, maxLen, noLink, chainId } = opts || {};
     const dot = addressDotHtml(address);
     const displayAddr = maxLen
         ? truncateMiddle(address, Math.max(ADDRESS_MIN_DISPLAY_LEN, maxLen))
         : address;
-    const link = etherscanAddressUrl(address);
+    const link = etherscanAddressUrl(address, chainId);
     const extLink = noLink ? "" : etherscanLinkHtml(link);
 
     let html = "";
@@ -725,6 +743,7 @@ module.exports = {
     balanceLine,
     balanceLinesForAddress,
     addressHoldsFunds,
+    keyMaterialName,
     unknownableAmount,
     nativeCurrency,
     tokenLabel,

src/popup/views/send.js

@@ -164,8 +164,9 @@ function renderSendTokenSelect(addr) {
     }
 }
 
-// The token balance and scale the Send screen states and hands the
-// confirmation screen, so the two screens describe the holding the same way.
+// The token balance the Send screen states, and the scale it hands the
+// confirmation screen, which reads the balance itself from the network it is
+// drawn for.
 //
 // The scale is resolved the same way balances.js resolved the scale it
 // DISPLAYED this token's balance at: bundled list, then the user's tracked
@@ -188,13 +189,11 @@ function renderSendTokenSelect(addr) {
 //
 // The two resolutions can therefore differ, and where they do, the stored
 // `balance` is a quantity computed at a scale this screen has just declined to
-// stand behind. Stating it would leave validateTransfer() checking the amount
-// against a number the wallet does not vouch for, so it is withdrawn: unknown
-// scale means unknown balance. It is null rather than "0": both screens state
-// an unknown balance as unknown, and validateTransfer() treats it as no balance
-// to spend from, which is the fail-closed side of an amount nobody can check.
-// Only a stored quantity is withdrawn: the "0" for a token that has no row at
-// all is an absence of holdings, which is true at every scale.
+// stand behind, so it is withdrawn: unknown scale means unknown balance. It is
+// null rather than "0": this screen states it as unknown, as the confirmation
+// screen does, and Max fills nothing in for it. Only a stored quantity is
+// withdrawn: the "0" for a token that has no row at all is an absence of
+// holdings, which is true at every scale.
 function tokenBalanceAndDecimals(addr, token) {
     const tb = (addr.tokenBalances || []).find(
         (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -378,7 +377,6 @@ function init(_ctx) {
         const addr = currentAddress();
 
         let tokenSymbol = null;
-        let tokenBalance = null;
         let tokenDecimals = null;
         if (token !== "ETH") {
             tokenSymbol = resolveSymbol(
@@ -386,10 +384,7 @@ function init(_ctx) {
                 addr.tokenBalances,
                 state.trackedTokens,
             );
-            ({ tokenBalance, tokenDecimals } = tokenBalanceAndDecimals(
-                addr,
-                token,
-            ));
+            ({ tokenDecimals } = tokenBalanceAndDecimals(addr, token));
         }
 
         // The confirmation screen's own amount check, so it is never shown
@@ -424,9 +419,7 @@ function init(_ctx) {
             ensName: ensName,
             amount: amount,
             token: token,
-            balance: addr.balance,
             tokenSymbol: tokenSymbol,
-            tokenBalance: tokenBalance,
             tokenDecimals: tokenDecimals,
             max: amountIsMax,
         });

src/popup/views/settings.js

@@ -321,19 +321,27 @@ function init(ctx) {
     networkSelect.addEventListener("change", async () => {
         const newId = networkSelect.value;
         if (newId === state.networkId) return;
+        // The screens beneath Settings show the previous network, so Back
+        // finds them as it does in a reopened popup: each is rendered again
+        // when Back lands on it, and the stack is cut at the first one that
+        // cannot be rendered from saved state, such as Send or AddToken. It
+        // is cut at AddressToken too, unless that shows the native token: any
+        // other token there was picked on the previous network. Without a
+        // wallet the stack starts at Welcome, which that cut would drop, and
+        // Welcome shows nothing from a network. The cut comes before the
+        // switch so that the switch's save keeps it for a popup closed
+        // straight after.
+        if (state.hasWallet) {
+            const tokenView = state.viewStack.indexOf("address-token");
+            if (tokenView !== -1 && state.selectedToken !== "ETH") {
+                state.viewStack = state.viewStack.slice(0, tokenView);
+            }
+            state.viewStack = restorableStack(state.viewStack, "settings");
+        }
         const net = await onChainSwitch(newId);
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        // The screens beneath Settings show the previous network, so Back
-        // finds them as it does in a reopened popup: each is rendered again
-        // when Back lands on it, and the stack is cut at the first one that
-        // cannot be rendered from saved state, such as Send or AddToken.
-        // Without a wallet the stack starts at Welcome, which that cut would
-        // drop, and Welcome shows nothing from a network.
-        if (state.hasWallet) {
-            state.viewStack = restorableStack(state.viewStack, "settings");
-        }
         resetRenderedViews();
         // Settings itself is brought up to date for the new network here.
         markViewRendered("settings");

src/popup/views/settingsAddToken.js

@@ -1,6 +1,6 @@
 const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
-const { state, saveState } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
 const { log } = require("../../shared/log");
@@ -136,6 +136,9 @@ function init(_ctx) {
         infoEl.textContent = "Looking up token...";
         infoEl.style.visibility = "visible";
         log.debugf("Looking up token contract", addr);
+        // The network the lookup asks, which Settings may switch away from
+        // before it answers, as for a transaction in confirmTx.js.
+        const chainId = currentNetwork().chainId;
         try {
             const info = await lookupTokenInfo(
                 addr,
@@ -143,6 +146,15 @@ function init(_ctx) {
                 state.networkId,
                 ctx.pageClosed,
             );
+            // A contract address names a token on one network only, so an
+            // answer after a switch is not added to the new network's list.
+            if (currentNetwork().chainId !== chainId) {
+                showFlash(
+                    "The active network changed before the lookup finished," +
+                        " so the token was not added.",
+                );
+                return;
+            }
             log.infof("Adding token", info.symbol, addr);
             state.trackedTokens.push({
                 address: addr,

src/popup/views/transactionDetail.js

@@ -21,7 +21,7 @@ const {
     displaySymbol,
     goBack,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("../../shared/log");
@@ -316,7 +316,14 @@ async function loadFullTxDetails(txHash, chainId) {
         // Decoded against the address the transaction was sent to, as the
         // explorer reports it, not the history entry's `to`: for a token
         // transfer that is the transfer's recipient, not the token contract.
-        const decoded = decodeCalldata(inputData, txData.to?.hash || "");
+        // On the active network, the one whose explorer was just asked, and
+        // from the sender it reports.
+        const decoded = decodeCalldata(
+            inputData,
+            txData.to?.hash || "",
+            currentNetwork().chainId,
+            txData.from?.hash || "",
+        );
         if (decoded) {
             // Render decoded calldata matching approval view style
             actionEl.textContent = decoded.name;

src/shared/addressWarnings.js

@@ -58,6 +58,8 @@ function getLocalWarnings(address, options = {}) {
  * @param {object} provider - An ethers.js provider instance.
  * @param {object} [options] - Optional context.
  * @param {string} [options.fromAddress] - Sender address (for self-send check).
+ * @param {string} [options.chainId] - Chain id of the network whose explorer
+ *   the Etherscan label check asks; the active network's when omitted.
  * @returns {Promise<Array<{type: string, message: string, severity: string}>>}
  */
 async function getFullWarnings(address, provider, options = {}) {
@@ -110,7 +112,10 @@ async function getFullWarnings(address, provider, options = {}) {
     // Runs for ALL addresses including contracts, since many dangerous
     // flagged addresses on Etherscan (drainers, phishing contracts) are contracts.
     try {
-        const etherscanWarning = await checkEtherscanLabel(address);
+        const etherscanWarning = await checkEtherscanLabel(
+            address,
+            options.chainId,
+        );
         if (etherscanWarning) {
             warnings.push(etherscanWarning);
         }

src/shared/etherscanLabels.js

@@ -2,6 +2,8 @@
 // Extension users make the requests directly to Etherscan — no proxy needed.
 // This is a best-effort enrichment: network failures return null silently.
 
+const { networkByChainId } = require("./networks");
+
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
 const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
@@ -72,18 +74,21 @@ function parseEtherscanPage(html) {
  * Returns a warning object if the address is flagged, or null.
  * Network failures return null silently (best-effort check).
  *
- * Uses the current network's explorer URL so the lookup works on both
- * mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
+ * Uses the explorer of the network with `chainId`, or of the active network
+ * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
+ * Sepolia.
  *
  * @param {string} address - Ethereum address to check.
+ * @param {string} [chainId] - Chain id of the network to look it up on.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
-async function checkEtherscanLabel(address) {
+async function checkEtherscanLabel(address, chainId) {
     try {
         // Lazy require to avoid pulling in chrome.storage at module scope
         // (which breaks unit tests that only exercise parseEtherscanPage).
         const { currentNetwork } = require("./state");
-        const etherscanBase = currentNetwork().explorerUrl + "/address/";
+        const network = chainId ? networkByChainId(chainId) : currentNetwork();
+        const etherscanBase = network.explorerUrl + "/address/";
         const resp = await fetch(etherscanBase + address, {
             headers: { Accept: "text/html" },
         });

src/shared/prices.js

@@ -2,6 +2,7 @@
 
 const { getTopTokenPrices } = require("./tokenList");
 const { isBelowOneMillionth } = require("./amountDisplay");
+const { networkByChainId } = require("./networks");
 
 const PRICE_CACHE_TTL = 300000; // 5 minutes
 
@@ -36,10 +37,12 @@ function clearPrices() {
     lastFetchedAt = 0;
 }
 
-// Return the USD price for a symbol, or null on testnet / unknown.
-function getPrice(symbol) {
+// Return the USD price for a symbol on the network with `chainId`, or on the
+// active network when no chain id is given; null on testnet / unknown.
+function getPrice(symbol, chainId) {
     const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
+    const network = chainId ? networkByChainId(chainId) : currentNetwork();
+    if (network.isTestnet) return null;
     return prices[symbol] || null;
 }
 

src/shared/transferAmount.js

@@ -2,11 +2,11 @@
 // encoded with.
 //
 // A token amount is a decimal string plus a scale, and the two come from
-// different places. The confirmation screen renders the amount, the balance and
-// the symbol from the block explorer's cached metadata (see
-// fetchTokenBalances() in balances.js); the transfer used to be encoded from
-// decimals() read off the contract at signing time, and nothing compared the
-// two. A token whose on-chain scale differs from the cached one — an
+// different places. The confirmation screen renders the amount, the symbol and
+// the balance it reads from the node with the block explorer's cached metadata
+// (see fetchTokenBalances() in balances.js); the transfer used to be encoded
+// from decimals() read off the contract at signing time, and nothing compared
+// the two. A token whose on-chain scale differs from the cached one — an
 // upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
 // entry — therefore signed an amount that was never displayed, off by a power
 // of ten for every decimal place of disagreement.

src/shared/txValidation.js

@@ -111,8 +111,8 @@ function isValidAmount(amount, tokenDecimals = null) {
 
 // The most ETH a send can carry: the exact balance minus the fee reserve from
 // feeReserveWei(), as a decimal string, so validateTransfer() passes it with
-// exactly that reserve left behind. `ethBalance` is the exact decimal string
-// balances.js stores, never a rounded one. Null when the balance does not
+// exactly that reserve left behind. `ethBalance` is an exact decimal string as
+// formatEther() writes it, never a rounded one. Null when the balance does not
 // leave anything to send once the fee is paid, or when either input is
 // unusable.
 function maxEthAmount(ethBalance, feeWei) {

tests/addressKey.test.js

@@ -291,7 +291,6 @@ async function confirmSend(from, selected) {
         to: RECIPIENT,
         amount: "0.5",
         token: "ETH",
-        balance: "1.0",
     });
     await settle();
     node("confirm-tx-password").value = PASSWORD;

tests/approvalDisplayFloor.test.js

@@ -68,7 +68,14 @@ function swapData(amountIn, amountOutMin) {
 }
 
 function swapDetail(amountIn, amountOutMin, label) {
-    const decoded = uniswap.decode(swapData(amountIn, amountOutMin), ROUTER);
+    // Sent by the address the swap pays, so the output is the user's.
+    const decoded = uniswap.decode(
+        swapData(amountIn, amountOutMin),
+        ROUTER,
+        "0x1",
+        {},
+        RECIPIENT,
+    );
     return decoded.details.find((d) => d.label === label);
 }
 

tests/confirmTxAmount.test.js

@@ -0,0 +1,415 @@
+// The amount of the wallet's own send on the confirmation, wait, success and
+// error screens (https://git.eeqj.de/sneak/AutistMask/issues/522).
+//
+// These screens printed the text from Send's amount field as it was typed or
+// filled in: `0.5 ETH`, or `1.234147890123456789 ETH` after Max, where the
+// approval screen shows a site's send as `0.5000 ETH`. They now show it to four
+// decimal places with the nonzero floor, as the approval screen does, and the
+// transaction is still signed for the exact amount.
+//
+// Driven through the real Send screen, confirmation screen, Sign & Send and
+// wait screen, with only the node, the explorer and the DOM stubbed.
+
+"use strict";
+
+// What the stub node answers, and the signed transactions it was handed. The
+// token's own decimals() answers 6, as the explorer does.
+const mockNode = {
+    balanceWei: 0n,
+    tokenUnits: 0n,
+    tokenDecimals: 6n,
+    broadcast: [],
+    broadcastError: null,
+    receipt: null,
+};
+
+// The token rows the stub explorer reports for the address.
+const mockExplorer = { items: [] };
+
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    // The selector of decimals(); every other contract call is balanceOf().
+    const DECIMALS = "0x313ce567";
+    class StubProvider {
+        async getBalance() {
+            return mockNode.balanceWei;
+        }
+        async call(tx) {
+            return actual.AbiCoder.defaultAbiCoder().encode(
+                ["uint256"],
+                [
+                    tx.data.startsWith(DECIMALS)
+                        ? mockNode.tokenDecimals
+                        : mockNode.tokenUnits,
+                ],
+            );
+        }
+        async lookupAddress() {
+            return null;
+        }
+        // 20 gwei reserved per gas.
+        async getFeeData() {
+            return {
+                maxFeePerGas: 20000000000n,
+                maxPriorityFeePerGas: 1000000000n,
+                gasPrice: 10000000000n,
+            };
+        }
+        async estimateGas() {
+            return 21000n;
+        }
+        async getCode() {
+            return "0x";
+        }
+        async getTransactionCount() {
+            return 1;
+        }
+        async getNetwork() {
+            return { chainId: 1n };
+        }
+        async broadcastTransaction(signed) {
+            if (mockNode.broadcastError) throw mockNode.broadcastError;
+            mockNode.broadcast.push(signed);
+            return { hash: "0x" + "ab".repeat(32) };
+        }
+        async getTransactionReceipt() {
+            return mockNode.receipt;
+        }
+    }
+    return {
+        ...actual,
+        JsonRpcProvider: StubProvider,
+        Network: { from: () => ({}) },
+    };
+});
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    // The explorer's token list, which refreshBalances() also fetches.
+    debugFetch: jest.fn(async () => ({
+        ok: true,
+        status: 200,
+        json: async () => mockExplorer.items,
+    })),
+    urlOrigin: () => "",
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+// The confirmation screen's Etherscan label lookup is the only fetch() these
+// screens make; it fails, as it does offline.
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+
+// A stub DOM: every id resolves to a recording element.
+const elements = new Map();
+
+function makeEl(id) {
+    const handlers = new Map();
+    return {
+        id,
+        textContent: "",
+        innerHTML: "",
+        value: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add() {},
+            remove() {},
+            toggle() {},
+            contains: () => false,
+        },
+        handlers,
+        children: [],
+        addEventListener(name, fn) {
+            handlers.set(name, fn);
+        },
+        appendChild(child) {
+            this.children.push(child);
+            return child;
+        },
+        querySelectorAll: () => [],
+        querySelector: () => null,
+        remove() {},
+        focus() {},
+        // The success screen hides whole sections through .parentElement.
+        get parentElement() {
+            return global.document.getElementById(id + "-parent");
+        },
+    };
+}
+
+global.document = {
+    getElementById(id) {
+        if (!elements.has(id)) elements.set(id, makeEl(id));
+        return elements.get(id);
+    },
+    createElement: (tag) => makeEl(tag),
+    body: { prepend() {}, appendChild() {} },
+    addEventListener() {},
+};
+global.navigator = { clipboard: { writeText() {} } };
+
+const {
+    Interface,
+    Transaction,
+    Wallet,
+    getAddress,
+    parseEther,
+} = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+const { encryptWithPassword } = require("../src/shared/vault");
+const { state } = require("../src/shared/state");
+const { clearPrices } = require("../src/shared/prices");
+const send = require("../src/popup/views/send");
+const confirmTx = require("../src/popup/views/confirmTx");
+const txStatus = require("../src/popup/views/txStatus");
+
+const PRIVATE_KEY = "0x" + "11".repeat(32);
+const HOLDER = new Wallet(PRIVATE_KEY).address;
+const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const PASSWORD = "correct horse battery staple";
+
+const GWEI = 1000000000n;
+// 1.234567890123456789 ETH.
+const BALANCE_WEI = 1234567890123456789n;
+
+// A token the bundled list does not know, with enough holders to be listed,
+// at 6 decimal places.
+const TOKEN = "0x" + "d".repeat(40);
+
+const transferIface = new Interface([
+    "function transfer(address to, uint256 amount)",
+]);
+
+let encryptedSecret;
+
+// The confirmation screen Review leads to, once shown.
+let confirmed = null;
+
+function el(id) {
+    return global.document.getElementById(id);
+}
+
+function text(id) {
+    return el(id).textContent;
+}
+
+// show() reads the balance and then estimates the fee without awaiting
+// either; this lets both settle.
+async function settle() {
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+// The address holds BALANCE_WEI and, when `tokenUnits` is given, that many
+// base units of TOKEN, fetched and stored where the popup stores them. Send
+// is then open for `token` ("ETH" or TOKEN) with the recipient entered.
+async function openSend(token, tokenUnits = null) {
+    mockNode.balanceWei = BALANCE_WEI;
+    mockNode.tokenUnits = tokenUnits ?? 0n;
+    mockExplorer.items =
+        tokenUnits === null
+            ? []
+            : [
+                  {
+                      value: String(tokenUnits),
+                      token: {
+                          type: "ERC-20",
+                          address_hash: TOKEN,
+                          symbol: "TOK",
+                          name: "Token",
+                          decimals: "6",
+                          holders_count: "50000",
+                      },
+                  },
+              ];
+    state.wallets = [
+        {
+            type: "key",
+            name: "Wallet 1",
+            encryptedSecret,
+            addresses: [{ address: HOLDER }],
+        },
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    await refreshBalances(
+        state.wallets,
+        "https://rpc.example.invalid",
+        "https://blockscout.example/api/v2",
+        state.trackedTokens,
+        "mainnet",
+    );
+    send.init({
+        showConfirmTx: (info) => (confirmed = info),
+        pageClosed: new AbortController().signal,
+    });
+    confirmTx.init({});
+    send.resetSendValidation();
+    state.currentView = "send";
+    state.selectedToken = token;
+    el("send-to").value = RECIPIENT;
+    el("send-amount").value = "";
+}
+
+// Press Review and show the confirmation screen with its fee estimate settled.
+async function review() {
+    await el("btn-send-review").handlers.get("click")();
+    confirmTx.show(confirmed);
+    await settle();
+}
+
+async function signAndSend() {
+    el("confirm-tx-password").value = PASSWORD;
+    await el("btn-confirm-send").handlers.get("click")();
+}
+
+// The one transaction the stub node was handed.
+function broadcastTx() {
+    expect(mockNode.broadcast).toHaveLength(1);
+    return Transaction.from(mockNode.broadcast[0]);
+}
+
+beforeAll(async () => {
+    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
+});
+
+beforeEach(() => {
+    elements.clear();
+    clearPrices();
+    confirmed = null;
+    state.selectedToken = null;
+    state.trackedTokens = [];
+    state.fraudContracts = [];
+    state.currentView = null;
+    mockNode.broadcast = [];
+    mockNode.broadcastError = null;
+    mockNode.receipt = null;
+    txStatus.init({
+        doRefreshAndRender() {},
+        pageClosed: new AbortController().signal,
+    });
+});
+
+afterEach(() => {
+    txStatus.endWait();
+});
+
+describe("the wallet's own send shows its amount to four decimal places", () => {
+    test("for a short amount", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.5"));
+    });
+
+    // Send accepts both. The approval screen writes the same value `0.5000`.
+    test.each([".5", "00.5"])("for an amount typed as %s", async (typed) => {
+        await openSend("ETH");
+        el("send-amount").value = typed;
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.5"));
+    });
+
+    test("for a token amount typed as .5", async () => {
+        // 100 TOK.
+        await openSend(TOKEN, 100000000n);
+        el("send-amount").value = ".5";
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 TOK");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 TOK");
+        const [, amount] = transferIface.decodeFunctionData(
+            "transfer",
+            broadcastTx().data,
+        );
+        expect(amount).toBe(500000n);
+    });
+
+    test("for a Max amount with many decimals", async () => {
+        await openSend("ETH");
+        await el("btn-send-max").handlers.get("click")();
+        // The balance minus 21000 gas at 20 gwei.
+        expect(el("send-amount").value).toBe("1.234147890123456789");
+        await review();
+        expect(text("confirm-amount")).toBe("1.2341 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("1.2341 ETH");
+        expect(broadcastTx().value).toBe(BALANCE_WEI - 21000n * 20n * GWEI);
+    });
+
+    // Cut to four decimals it would read 0.0000, so it is shown to its first
+    // significant digit instead, and signed in full.
+    test("for a tiny nonzero amount", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.000012345";
+        await review();
+        expect(text("confirm-amount")).toBe("0.00001 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.00001 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.000012345"));
+    });
+
+    test("for a token amount", async () => {
+        // 100 TOK.
+        await openSend(TOKEN, 100000000n);
+        el("send-amount").value = "12.345678";
+        await review();
+        expect(text("confirm-amount")).toBe("12.3456 TOK");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("12.3456 TOK");
+        const tx = broadcastTx();
+        expect(tx.to).toBe(getAddress(TOKEN));
+        const [to, amount] = transferIface.decodeFunctionData(
+            "transfer",
+            tx.data,
+        );
+        expect(to).toBe(RECIPIENT);
+        expect(amount).toBe(12345678n);
+    });
+
+    test("on the success screen", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        await signAndSend();
+        // A popup opened later resumes the wait, and the receipt is there.
+        mockNode.receipt = { blockNumber: 21000000 };
+        txStatus.restoreWait();
+        await settle();
+        expect(state.currentView).toBe("success-tx");
+        expect(text("success-tx-summary")).toBe("0.5000 ETH");
+    });
+
+    test("on the error screen", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        mockNode.broadcastError = new Error("the node refused it");
+        await signAndSend();
+        expect(state.currentView).toBe("error-tx");
+        expect(text("error-tx-summary")).toBe("0.5000 ETH");
+    });
+});

tests/confirmTxFeeBound.test.js

@@ -11,20 +11,115 @@
 //
 // The check is driven here with a fake connected signer rather than a real
 // one: populateTransaction() returns the fees the node would have produced,
-// and sendTransaction() records whether the send actually happened. The real
-// DOM path around it — reading the fee error into the reserved errors box — is
-// covered by the Chrome e2e suite.
+// and sendTransaction() records whether the send actually happened.
+//
+// The last test drives the real confirmation screen instead, with only the
+// node and the DOM stubbed: a gas limit over its own bound at an ordinary fee
+// is refused in the same box as a fee over the bound
+// (https://git.eeqj.de/sneak/AutistMask/issues/583). That the box moves
+// nothing on the screen is checked by the Chrome e2e suite.
 
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+// What the stub node quotes for that test: a gas limit of 150,000,000 at a
+// maximum fee of 2 gwei per gas, 0.3 ETH in all. And the signed transactions
+// it was handed.
+const mockNode = {
+    gasLimit: 150000000n,
+    maxFeePerGas: 2000000000n,
+    broadcast: [],
 };
 
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    class StubProvider {
+        constructor(url, network) {
+            this.network = network;
+        }
+        async getNetwork() {
+            return this.network;
+        }
+        async getBalance() {
+            return actual.parseEther("5");
+        }
+        async getCode() {
+            return "0x";
+        }
+        async getTransactionCount() {
+            return 1;
+        }
+        async getFeeData() {
+            return {
+                maxFeePerGas: mockNode.maxFeePerGas,
+                maxPriorityFeePerGas: 1000000000n,
+                gasPrice: 1000000000n,
+            };
+        }
+        async estimateGas() {
+            return mockNode.gasLimit;
+        }
+        async broadcastTransaction(signed) {
+            mockNode.broadcast.push(signed);
+            return { hash: "0x" + "ab".repeat(32) };
+        }
+    }
+    return { ...actual, JsonRpcProvider: StubProvider };
+});
+
+// The screens a send that was not refused goes on to.
+jest.mock("../src/popup/views/txStatus", () => ({
+    showWait: jest.fn(),
+    showError: jest.fn(),
+}));
+
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
-const { populateVerifyAndSend } = require("../src/popup/views/confirmTx");
+// A stub DOM: every id resolves to a recording element.
+const elements = new Map();
+
+function makeEl(id) {
+    const handlers = new Map();
+    return {
+        id,
+        textContent: "",
+        innerHTML: "",
+        value: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add() {},
+            remove() {},
+            toggle() {},
+            contains: () => false,
+        },
+        handlers,
+        addEventListener(name, fn) {
+            handlers.set(name, fn);
+        },
+        querySelectorAll: () => [],
+        remove() {},
+    };
+}
+
+global.document = {
+    getElementById(id) {
+        if (!elements.has(id)) elements.set(id, makeEl(id));
+        return elements.get(id);
+    },
+};
+
+const { Wallet } = require("ethers");
+const { encryptWithPassword } = require("../src/shared/vault");
+const { state, loadState } = require("../src/shared/state");
+const txStatus = require("../src/popup/views/txStatus");
+const confirmTx = require("../src/popup/views/confirmTx");
+const { populateVerifyAndSend } = confirmTx;
 const {
+    MAX_GAS_LIMIT,
     MAX_FEE_PER_GAS,
     MAX_TOTAL_FEE,
 } = require("../src/shared/approvalVerify");
@@ -98,3 +193,69 @@ describe("populateVerifyAndSend enforces the combined fee bound", () => {
         expect(signer.sent[0].gasLimit).toBe(under.gasLimit);
     });
 });
+
+describe("Sign & Send on the confirmation screen", () => {
+    const PRIVATE_KEY = "0x" + "11".repeat(32);
+    const PASSWORD = "correct horse battery staple";
+    let encryptedSecret;
+
+    beforeAll(async () => {
+        await loadState();
+        encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
+    });
+
+    function el(id) {
+        return global.document.getElementById(id);
+    }
+
+    function shown(id) {
+        return el(id).style.visibility === "visible";
+    }
+
+    // show() reads the balance and estimates the fee without awaiting
+    // either; this lets both finish.
+    async function settle() {
+        for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    }
+
+    test("refuses a gas limit over its bound at an ordinary fee in the box for a refused gas limit or fee, and sends nothing", async () => {
+        expect(mockNode.gasLimit).toBeGreaterThan(MAX_GAS_LIMIT);
+        expect(mockNode.gasLimit * mockNode.maxFeePerGas).toBeLessThan(
+            MAX_TOTAL_FEE,
+        );
+
+        const from = new Wallet(PRIVATE_KEY).address;
+        state.wallets = [
+            {
+                type: "key",
+                name: "Wallet 1",
+                encryptedSecret,
+                addresses: [{ address: from }],
+            },
+        ];
+        state.selectedWallet = 0;
+        state.selectedAddress = 0;
+        confirmTx.init({});
+        confirmTx.show({
+            from,
+            to: RECIPIENT,
+            ensName: null,
+            amount: "1",
+            token: "ETH",
+            tokenSymbol: null,
+            tokenDecimals: null,
+            max: false,
+        });
+        await settle();
+        expect(el("btn-confirm-send").disabled).toBe(false);
+        expect(shown("confirm-fee-bound-error")).toBe(false);
+
+        el("confirm-tx-password").value = PASSWORD;
+        await el("btn-confirm-send").handlers.get("click")();
+
+        expect(shown("confirm-fee-bound-error")).toBe(true);
+        expect(mockNode.broadcast).toEqual([]);
+        expect(txStatus.showWait).not.toHaveBeenCalled();
+        expect(txStatus.showError).not.toHaveBeenCalled();
+    });
+});

tests/confirmTxLateResult.test.js

@@ -0,0 +1,221 @@
+// A late answer for a confirmation screen the user has left changes nothing on
+// the screen shown since (https://git.eeqj.de/sneak/AutistMask/issues/575).
+//
+// The confirmation screen asks the node and the explorer about its transaction
+// without waiting for the answers: the recipient checks, which can show three
+// warning boxes, the balance read and the fee estimate. Back, a new recipient
+// and Review again show the screen for another transaction while those
+// questions may still be open. The recipient checks showed their boxes
+// whenever they answered, so a box about the first recipient could appear on
+// the second recipient's screen.
+//
+// Driven through the real confirmation screen, with only the node, the
+// explorer and the DOM stubbed. Each test holds back the first screen's answer
+// to one question, and gives it once the screen it tests is shown.
+
+"use strict";
+
+// The From address of every transaction here. The jest.mock() factory below
+// may only name outside variables whose names start with "mock".
+const mockFrom = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    // Every answer is a mock, so a test can hold one back. Every address has
+    // sent one transaction and has no code, and only the From address holds
+    // anything: 5 ETH.
+    class StubProvider {}
+    Object.assign(StubProvider.prototype, {
+        getBalance: jest.fn(async (address) =>
+            address === mockFrom ? actual.parseEther("5") : 0n,
+        ),
+        getCode: jest.fn(async () => "0x"),
+        getTransactionCount: jest.fn(async () => 1),
+        // 10 gwei expected, 20 gwei reserved per gas.
+        getFeeData: jest.fn(async () => ({
+            maxFeePerGas: 20000000000n,
+            maxPriorityFeePerGas: 1000000000n,
+            gasPrice: 10000000000n,
+        })),
+        estimateGas: jest.fn(async () => 21000n),
+    });
+    return { ...actual, JsonRpcProvider: StubProvider };
+});
+
+// An explorer address page whose title is `title`.
+function explorerPage(title) {
+    return { ok: true, text: async () => "<title>" + title + "</title>" };
+}
+
+// The explorer labels no address.
+global.fetch = jest.fn(async () => explorerPage("Etherscan"));
+
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+
+// A stub DOM: every id resolves to a recording element.
+const elements = new Map();
+
+function makeEl(id) {
+    return {
+        id,
+        textContent: "",
+        innerHTML: "",
+        value: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add() {},
+            remove() {},
+            toggle() {},
+            contains: () => false,
+        },
+        addEventListener() {},
+        querySelectorAll: () => [],
+        remove() {},
+    };
+}
+
+global.document = {
+    getElementById(id) {
+        if (!elements.has(id)) elements.set(id, makeEl(id));
+        return elements.get(id);
+    },
+};
+
+const { JsonRpcProvider, parseEther } = require("ethers");
+const { loadState } = require("../src/shared/state");
+const confirmTx = require("../src/popup/views/confirmTx");
+
+const node = JsonRpcProvider.prototype;
+const FIRST = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const SECOND = "0xE2E0000000000000000000000000000000000E2e";
+
+function el(id) {
+    return global.document.getElementById(id);
+}
+
+function shown(id) {
+    return el(id).style.visibility === "visible";
+}
+
+// Show the confirmation screen for 1 ETH to `to` on mainnet, as Review on the
+// Send screen does.
+function review(to) {
+    confirmTx.show({
+        from: mockFrom,
+        to,
+        ensName: null,
+        amount: "1",
+        token: "ETH",
+        tokenSymbol: null,
+        tokenDecimals: null,
+        max: false,
+    });
+}
+
+// show() does not wait for its questions; this lets every answer not held
+// back arrive.
+async function settle() {
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+// Hold back the next answer `question` gives. Returns the function that gives
+// it.
+function holdNextAnswer(question) {
+    let give;
+    question.mockImplementationOnce(() => new Promise((r) => (give = r)));
+    return (answer) => give(answer);
+}
+
+beforeAll(async () => {
+    await loadState();
+});
+
+beforeEach(() => {
+    elements.clear();
+});
+
+// The three boxes the recipient checks show, each with the question whose
+// answer shows it for FIRST, and that answer. FIRST holds no ETH, so the
+// answer that it has sent no transaction is what shows the box saying so.
+describe.each([
+    {
+        box: "confirm-contract-warning",
+        question: node.getCode,
+        answer: "0x6080604052",
+    },
+    {
+        box: "confirm-recipient-warning",
+        question: node.getTransactionCount,
+        answer: 0,
+    },
+    {
+        box: "confirm-etherscan-warning",
+        question: global.fetch,
+        answer: explorerPage(
+            "Fake_Phishing1 | Address: " + FIRST + " | Etherscan",
+        ),
+    },
+])("the $box box", ({ box, question, answer }) => {
+    test("is shown when the answer about the recipient arrives while its screen is shown", async () => {
+        const give = holdNextAnswer(question);
+        review(FIRST);
+        await settle();
+        expect(shown(box)).toBe(false);
+
+        give(answer);
+        await settle();
+        expect(shown(box)).toBe(true);
+    });
+
+    test("is not shown on the next recipient's screen when the answer about the first arrives after that screen is shown", async () => {
+        const give = holdNextAnswer(question);
+        review(FIRST);
+        await settle();
+        review(SECOND);
+        await settle();
+        expect(shown(box)).toBe(false);
+
+        give(answer);
+        await settle();
+        expect(shown(box)).toBe(false);
+    });
+});
+
+test("a balance read answered after the next screen is shown leaves that screen's balance and balance check as they are", async () => {
+    const give = holdNextAnswer(node.getBalance);
+    review(FIRST);
+    await settle();
+    review(SECOND);
+    await settle();
+    expect(el("confirm-balance").textContent).toBe("5.0000 ETH");
+
+    give(parseEther("0.5"));
+    await settle();
+    expect(el("confirm-balance").textContent).toBe("5.0000 ETH");
+    expect(shown("confirm-balance-error")).toBe(false);
+    expect(el("btn-confirm-send").disabled).toBe(false);
+});
+
+test("a fee estimate answered after the next screen is shown leaves that screen's fee as it is", async () => {
+    const give = holdNextAnswer(node.getFeeData);
+    review(FIRST);
+    await settle();
+    review(SECOND);
+    await settle();
+    expect(el("confirm-fee-amount").textContent).toBe("~0.0002 ETH");
+
+    // 100 times the fee the second screen was quoted.
+    give({
+        maxFeePerGas: 2000000000000n,
+        maxPriorityFeePerGas: 100000000000n,
+        gasPrice: 1000000000000n,
+    });
+    await settle();
+    expect(el("confirm-fee-amount").textContent).toBe("~0.0002 ETH");
+    expect(el("confirm-fee-reserve").textContent).toBe(
+        "up to 0.0004 ETH reserved",
+    );
+});

tests/confirmTxNetworkSwitch.test.js

@@ -7,25 +7,85 @@
 // reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
 // Settings in between.
 //
+// The same holds when the popup was closed after the switch and reopened, and
+// Back drew the screen again from the transaction it saved
+// (https://git.eeqj.de/sneak/AutistMask/issues/586): the screen was drawn for
+// the new network, and Sign & Send sent the reviewed transfer there. Drawn
+// again, the screen describes the transaction entirely on the network it was
+// reviewed for, because choosing that network again in Settings and pressing
+// Back only unhides it, and Sign & Send then sends from it.
+//
+// Its balance line and balance check are that network's balance, read from
+// that network's node each time the screen is drawn
+// (https://git.eeqj.de/sneak/AutistMask/issues/558), not the balance Send
+// handed over. The fee estimate after the read stays on that network when
+// the network is switched while the read runs.
+//
 // Driven through the real confirmation screen, signer and chain switch, with
-// only the node and the DOM stubbed. The stub node is on the network its
-// provider was built for, so a broadcast records the network it went to.
+// only the node, fetch and the DOM stubbed. The stub node is on the network
+// its provider was built for, so a broadcast records the network it went to,
+// and a balance read answers with that network's balance.
 
 "use strict";
 
-// The signed transactions the stub node was handed, with its network's chain id.
-const mockNode = { broadcast: [] };
+// The questions the stub node was asked for the balance, the fee and the
+// recipient checks, by method, network name and RPC URL, in order. The
+// balances it reports on each network, by network name: ETH in wei and the
+// token in its base units. The signed transactions it was handed, with its
+// network's chain id and RPC URL. And whether it quotes fees as a network
+// with no type-2 pricing does.
+const mockNode = {
+    asked: [],
+    balanceWei: {},
+    tokenUnits: {},
+    broadcast: [],
+    legacyFees: false,
+};
 
 jest.mock("ethers", () => {
     const actual = jest.requireActual("ethers");
+    // The selector of balanceOf(address).
+    const BALANCE_OF = "0x70a08231";
     class StubProvider {
         constructor(url, network) {
+            this.url = url;
             this.network = network;
         }
+        record(method) {
+            mockNode.asked.push({
+                method,
+                network: this.network.name,
+                url: this.url,
+            });
+        }
         async getNetwork() {
             return this.network;
         }
+        async getBalance() {
+            this.record("getBalance");
+            return mockNode.balanceWei[this.network.name];
+        }
+        // balanceOf() is the one contract call the screen makes before Sign
+        // & Send.
+        async call(tx) {
+            if (!tx.data.startsWith(BALANCE_OF)) {
+                throw new Error("the stub node answers only balanceOf()");
+            }
+            this.record("balanceOf");
+            return actual.AbiCoder.defaultAbiCoder().encode(
+                ["uint256"],
+                [mockNode.tokenUnits[this.network.name]],
+            );
+        }
         async getFeeData() {
+            this.record("getFeeData");
+            if (mockNode.legacyFees) {
+                return {
+                    maxFeePerGas: null,
+                    maxPriorityFeePerGas: null,
+                    gasPrice: 10000000000n,
+                };
+            }
             return {
                 maxFeePerGas: 20000000000n,
                 maxPriorityFeePerGas: 1000000000n,
@@ -36,16 +96,22 @@ jest.mock("ethers", () => {
             return 21000n;
         }
         async getCode() {
+            this.record("getCode");
             return "0x";
         }
         async getTransactionCount() {
+            this.record("getTransactionCount");
             return 1;
         }
         async lookupAddress() {
             return null;
         }
         async broadcastTransaction(signed) {
-            mockNode.broadcast.push({ chainId: this.network.chainId, signed });
+            mockNode.broadcast.push({
+                chainId: this.network.chainId,
+                url: this.url,
+                signed,
+            });
             return { hash: "0x" + "ab".repeat(32) };
         }
     }
@@ -75,6 +141,8 @@ jest.mock("../src/popup/views/txStatus", () => ({
     showError: jest.fn(),
 }));
 
+// The Etherscan label check is its only caller here: the explorer pages it
+// asks for are recorded, and nothing is fetched.
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
@@ -123,17 +191,35 @@ global.document = {
 };
 global.navigator = { clipboard: { writeText() {} } };
 
-const { BaseWallet, Transaction, Wallet } = require("ethers");
+const {
+    BaseWallet,
+    JsonRpcProvider,
+    Transaction,
+    Wallet,
+    parseEther,
+} = require("ethers");
 const { encryptWithPassword } = require("../src/shared/vault");
-const { state, loadState } = require("../src/shared/state");
+const { state, loadState, saveState } = require("../src/shared/state");
 const { onChainSwitch } = require("../src/shared/chainSwitch");
 const { NETWORKS } = require("../src/shared/networks");
+const { prices } = require("../src/shared/prices");
+const {
+    goBack,
+    pushCurrentView,
+    setBackRenderer,
+    showView,
+} = require("../src/popup/views/helpers");
+const {
+    makeBackRenderer,
+    resetRenderedViews,
+} = require("../src/popup/viewRouter");
 const txStatus = require("../src/popup/views/txStatus");
 const confirmTx = require("../src/popup/views/confirmTx");
 
 const PRIVATE_KEY = "0x" + "11".repeat(32);
 const HOLDER = new Wallet(PRIVATE_KEY).address;
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const TOKEN = "0x7070707070707070707070707070707070707070";
 const PASSWORD = "correct horse battery staple";
 
 function el(id) {
@@ -150,7 +236,15 @@ beforeAll(async () => {
 
 beforeEach(() => {
     elements.clear();
+    mockNode.asked = [];
+    mockNode.balanceWei = {
+        mainnet: parseEther("5"),
+        sepolia: parseEther("5"),
+    };
+    mockNode.tokenUnits = { mainnet: 0n, sepolia: 0n };
     mockNode.broadcast = [];
+    mockNode.legacyFees = false;
+    global.fetch.mockClear();
     txStatus.showWait.mockClear();
     txStatus.showError.mockClear();
     signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
@@ -160,16 +254,22 @@ afterEach(() => {
     signTransaction.mockRestore();
 });
 
-// Show the confirmation screen for 1 of the native token on `networkId`, as
-// Review on the Send screen does, with its fee estimate settled.
-async function review(networkId) {
+// Show the confirmation screen for 1 of the native token on `networkId`, or
+// for the transfer `changes` makes of it, as Review on the Send screen does,
+// with its balance read and its fee estimate settled.
+async function review(networkId, changes = {}) {
     await onChainSwitch(networkId);
+    await reviewOnActiveNetwork(changes);
+}
+
+// review() on the network already active, without switching to it again.
+async function reviewOnActiveNetwork(changes = {}) {
     state.wallets = [
         {
             type: "key",
             name: "Wallet 1",
             encryptedSecret,
-            addresses: [{ address: HOLDER, balance: "5.0" }],
+            addresses: [{ address: HOLDER }],
         },
     ];
     state.selectedWallet = 0;
@@ -181,15 +281,108 @@ async function review(networkId) {
         ensName: null,
         amount: "1",
         token: "ETH",
-        balance: "5.0",
         tokenSymbol: null,
-        tokenBalance: null,
         tokenDecimals: null,
         max: false,
+        ...changes,
     });
+    await settle();
+}
+
+// The user's own node for a network, set in Settings.
+function ownNode(networkId) {
+    return "https://" + networkId + ".node.example.invalid";
+}
+
+// After review() on `reviewedOn`: the user's own node set for it, the Settings
+// gear, `switchedTo` chosen there, the popup closed and reopened onto
+// Settings, and Back, which draws the confirmation screen again from the
+// transaction it saved. The reopened page holds an ETH price of $2,000 and a
+// USDC price of $1 whichever network is active, so each USD value shows which
+// network it was priced for.
+async function switchReopenAndGoBack(reviewedOn, switchedTo) {
+    state.rpcUrl = ownNode(reviewedOn);
+    pushCurrentView();
+    showView("settings");
+    await onChainSwitch(switchedTo);
+
+    await loadState();
+    elements.clear();
+    resetRenderedViews();
+    setBackRenderer(makeBackRenderer(state, { confirmTx }));
+    confirmTx.init({});
+    prices.ETH = 2000;
+    prices.USDC = 1;
+    mockNode.asked = [];
+    global.fetch.mockClear();
+    goBack();
+    await settle();
+}
+
+// The USD value `text` as the screen appends it for `networkId`: nothing on a
+// testnet, which has no USD values.
+function usdOn(networkId, text) {
+    return NETWORKS[networkId].isTestnet ? "" : " (" + text + ")";
+}
+
+// The screen for the transfer review() shows by default, described on
+// `networkId`: in its native currency, priced by it, linking to its explorer.
+function expectNativeTransferOn(networkId) {
+    const { nativeCurrency: symbol, explorerUrl } = NETWORKS[networkId];
+    expect(el("confirm-type").textContent).toBe(
+        "Native " + symbol + " transfer",
+    );
+    expect(el("confirm-amount").textContent).toBe(
+        "1.0000 " + symbol + usdOn(networkId, "$2,000.00"),
+    );
+    expect(el("confirm-balance").textContent).toBe(
+        "5.0000 " + symbol + usdOn(networkId, "$10,000.00"),
+    );
+    expect(el("confirm-fee-amount").textContent).toBe(
+        "~0.0002 " + symbol + usdOn(networkId, "$0.42"),
+    );
+    expect(el("confirm-fee-reserve").textContent).toBe(
+        "up to 0.0004 " + symbol + " reserved",
+    );
+    expect(el("confirm-gas-error").textContent).toBe(
+        "You do not have enough " +
+            symbol +
+            " to pay the network fee for this transfer. Please add " +
+            symbol +
+            " to this address and try again.",
+    );
+    expect(el("confirm-recipient-warning").textContent).toContain(
+        " holds no " + symbol + ". ",
+    );
+    expect(el("confirm-contract-warning").textContent).toContain(
+        " Sending " + symbol + " or tokens ",
+    );
+    expect(el("confirm-from").innerHTML).toContain(
+        `href="${explorerUrl}/address/${HOLDER}"`,
+    );
+    expect(el("confirm-to").innerHTML).toContain(
+        `href="${explorerUrl}/address/${RECIPIENT}"`,
+    );
+}
+
+// show() reads the balance and then estimates the fee, and checks the
+// recipient, without awaiting any of them; this lets all of them finish.
+async function settle() {
     for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
+function errors() {
+    return el("confirm-errors").innerHTML;
+}
+
+function shown(id) {
+    return el(id).style.visibility === "visible";
+}
+
+function sendDisabled() {
+    return el("btn-confirm-send").disabled;
+}
+
 async function signAndSend() {
     el("confirm-tx-password").value = PASSWORD;
     await el("btn-confirm-send").handlers.get("click")();
@@ -208,6 +401,25 @@ test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () =>
     expect(txStatus.showWait).toHaveBeenCalledTimes(1);
 });
 
+// Saving an RPC endpoint in Settings (src/popup/views/settings.js) sets only
+// state.rpcUrl: the endpoint remembered for the active network keeps its old
+// value until the next switch away from it.
+test("a transfer reviewed after the active network's RPC endpoint was changed in Settings asks the new endpoint", async () => {
+    const newNode = "https://new.node.example.invalid";
+    await onChainSwitch("sepolia");
+    state.rpcUrl = newNode;
+    await saveState();
+
+    await reviewOnActiveNetwork();
+
+    expect(mockNode.asked).toEqual([
+        { method: "getBalance", network: "sepolia", url: newNode },
+        { method: "getCode", network: "sepolia", url: newNode },
+        { method: "getTransactionCount", network: "sepolia", url: newNode },
+        { method: "getFeeData", network: "sepolia", url: newNode },
+    ]);
+});
+
 describe.each([
     ["sepolia", "mainnet", "SepoliaETH"],
     ["mainnet", "sepolia", "ETH"],
@@ -228,11 +440,219 @@ describe.each([
             expect(mockNode.broadcast).toEqual([]);
             expect(txStatus.showWait).not.toHaveBeenCalled();
             expect(txStatus.showError).not.toHaveBeenCalled();
-            expect(el("confirm-errors").style.visibility).toBe("visible");
-            expect(el("confirm-errors").innerHTML).toContain(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
+            expect(shown("confirm-network-changed-error")).toBe(true);
+            expect(shown("confirm-fee-bound-error")).toBe(false);
+        });
+    },
+);
+
+describe.each([
+    ["sepolia", "mainnet"],
+    ["mainnet", "sepolia"],
+])(
+    "a transfer reviewed on %s, with %s chosen in Settings, the popup reopened and Back pressed",
+    (reviewedOn, switchedTo) => {
+        const { nativeCurrency: symbol, explorerUrl } = NETWORKS[reviewedOn];
+
+        test("is described on the network it was reviewed for, and neither signed nor sent", async () => {
+            await review(reviewedOn);
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(state.currentView).toBe("confirm-tx");
+            expectNativeTransferOn(reviewedOn);
+            expect(mockNode.asked).toEqual([
+                {
+                    method: "getBalance",
+                    network: reviewedOn,
+                    url: ownNode(reviewedOn),
+                },
+                {
+                    method: "getCode",
+                    network: reviewedOn,
+                    url: ownNode(reviewedOn),
+                },
+                {
+                    method: "getTransactionCount",
+                    network: reviewedOn,
+                    url: ownNode(reviewedOn),
+                },
+                {
+                    method: "getFeeData",
+                    network: reviewedOn,
+                    url: ownNode(reviewedOn),
+                },
+            ]);
+            expect(global.fetch.mock.calls.map(([url]) => url)).toEqual([
+                explorerUrl + "/address/" + RECIPIENT,
+            ]);
+            expect(el("btn-confirm-send").disabled).toBe(false);
+
+            await signAndSend();
+
+            expect(signTransaction).not.toHaveBeenCalled();
+            expect(mockNode.broadcast).toEqual([]);
+            expect(txStatus.showWait).not.toHaveBeenCalled();
+            expect(txStatus.showError).not.toHaveBeenCalled();
+            expect(shown("confirm-network-changed-error")).toBe(true);
+        });
+
+        test("is sent on that network, as described, once it is chosen in Settings again and Back pressed", async () => {
+            await review(reviewedOn);
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+            // The Settings gear, the reviewed network chosen, and Back, which
+            // only unhides the screen as it was drawn.
+            pushCurrentView();
+            showView("settings");
+            await onChainSwitch(reviewedOn);
+            goBack();
+
+            expect(state.currentView).toBe("confirm-tx");
+            expectNativeTransferOn(reviewedOn);
+
+            await signAndSend();
+
+            const chainId = BigInt(NETWORKS[reviewedOn].chainId);
+            expect(mockNode.broadcast).toHaveLength(1);
+            expect(mockNode.broadcast[0].chainId).toBe(chainId);
+            expect(mockNode.broadcast[0].url).toBe(ownNode(reviewedOn));
+            expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
+                chainId,
+            );
+            expect(txStatus.showWait).toHaveBeenCalledTimes(1);
+        });
+
+        test("for more than the balance, says so in that network's native currency", async () => {
+            await review(reviewedOn, { amount: "10" });
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(shown("confirm-balance-error")).toBe(true);
+            expect(el("confirm-balance-error").textContent).toBe(
+                "Your " +
+                    symbol +
+                    " balance does not cover this amount. Please go back and" +
+                    " send a smaller amount.",
+            );
+        });
+
+        test("states and checks that network's balance as it is then, which no longer covers the send", async () => {
+            await review(reviewedOn);
+            expect(sendDisabled()).toBe(false);
+            mockNode.balanceWei = {
+                [reviewedOn]: parseEther("0.5"),
+                [switchedTo]: parseEther("5"),
+            };
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-balance").textContent).toBe(
+                "0.5000 " + symbol + usdOn(reviewedOn, "$1,000.00"),
+            );
+            expect(shown("confirm-balance-error")).toBe(true);
+            expect(sendDisabled()).toBe(true);
+        });
+
+        test("states and checks that network's balance as it is then, which now covers the send, and refuses to send it", async () => {
+            mockNode.balanceWei[reviewedOn] = parseEther("0.5");
+            await review(reviewedOn);
+            expect(sendDisabled()).toBe(true);
+            mockNode.balanceWei = {
+                [reviewedOn]: parseEther("5"),
+                [switchedTo]: parseEther("0.5"),
+            };
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-balance").textContent).toBe(
+                "5.0000 " + symbol + usdOn(reviewedOn, "$10,000.00"),
+            );
+            expect(errors()).toBe("");
+            expect(shown("confirm-balance-error")).toBe(false);
+            expect(shown("confirm-amount-fee-error")).toBe(false);
+            expect(sendDisabled()).toBe(false);
+
+            await signAndSend();
+
+            expect(signTransaction).not.toHaveBeenCalled();
+            expect(mockNode.broadcast).toEqual([]);
+            expect(shown("confirm-network-changed-error")).toBe(true);
+        });
+
+        const tokenSend = {
+            token: TOKEN,
+            tokenSymbol: "TOK",
+            tokenDecimals: 6,
+        };
+
+        test("of a token, states and checks that network's token balance as it is then, which no longer covers the send", async () => {
+            mockNode.tokenUnits[reviewedOn] = 10000000n;
+            await review(reviewedOn, tokenSend);
+            expect(sendDisabled()).toBe(false);
+            mockNode.tokenUnits = {
+                [reviewedOn]: 500000n,
+                [switchedTo]: 10000000n,
+            };
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-balance").textContent).toBe("0.5000 TOK");
+            expect(shown("confirm-balance-error")).toBe(true);
+            expect(el("confirm-balance-error").textContent).toBe(
+                "Your TOK balance does not cover this amount. Please go back" +
+                    " and send a smaller amount.",
+            );
+            expect(sendDisabled()).toBe(true);
+        });
+
+        test("of a token, states and checks that network's token balance as it is then, which now covers the send, and refuses to send it", async () => {
+            await review(reviewedOn, tokenSend);
+            expect(sendDisabled()).toBe(true);
+            mockNode.tokenUnits = {
+                [reviewedOn]: 10000000n,
+                [switchedTo]: 0n,
+            };
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-balance").textContent).toBe("10.0000 TOK");
+            expect(errors()).toBe("");
+            expect(shown("confirm-balance-error")).toBe(false);
+            expect(shown("confirm-gas-error")).toBe(false);
+            expect(sendDisabled()).toBe(false);
+
+            await signAndSend();
+
+            expect(signTransaction).not.toHaveBeenCalled();
+            expect(mockNode.broadcast).toEqual([]);
+            expect(shown("confirm-network-changed-error")).toBe(true);
+        });
+
+        test("with a fee quoted by a node with no type-2 pricing, shows the fee in that network's native currency and price", async () => {
+            await review(reviewedOn);
+            mockNode.legacyFees = true;
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-fee-amount").textContent).toBe(
+                "0.0002 " + symbol + usdOn(reviewedOn, "$0.42"),
+            );
+        });
+
+        test("of an ERC-20 token, links the token contract to that network's explorer and prices the token by that network", async () => {
+            mockNode.tokenUnits[reviewedOn] = 50000000n;
+            await review(reviewedOn, {
+                token: TOKEN,
+                tokenSymbol: "USDC",
+                tokenDecimals: 6,
+                amount: "10",
+            });
+            await switchReopenAndGoBack(reviewedOn, switchedTo);
+
+            expect(el("confirm-type").textContent).toBe(
+                "ERC-20 token transfer (USDC)",
+            );
+            expect(el("confirm-token-contract").innerHTML).toContain(
+                `href="${explorerUrl}/address/${TOKEN}"`,
+            );
+            expect(el("confirm-amount").textContent).toBe(
+                "10.0000 USDC" + usdOn(reviewedOn, "$10.00"),
+            );
+            expect(el("confirm-balance").textContent).toBe(
+                "50.0000 USDC" + usdOn(reviewedOn, "$50.00"),
             );
         });
     },
@@ -257,3 +677,101 @@ test("the send is refused by a signer on another network's node", async () => {
     expect(signTransaction).not.toHaveBeenCalled();
     expect(mockNode.broadcast).toEqual([]);
 });
+
+describe("the balance read", () => {
+    test("leaves the balance line Loading... and Sign & Send disabled until it returns", async () => {
+        let answer;
+        const getBalance = jest
+            .spyOn(JsonRpcProvider.prototype, "getBalance")
+            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
+        try {
+            await review("sepolia");
+        } finally {
+            getBalance.mockRestore();
+        }
+        expect(el("confirm-balance").textContent).toBe("Loading...");
+        expect(el("confirm-fee-amount").textContent).toBe("Estimating...");
+        expect(el("confirm-errors").style.visibility).toBe("hidden");
+        expect(shown("confirm-balance-error")).toBe(false);
+        expect(shown("confirm-balance-read-error")).toBe(false);
+        expect(sendDisabled()).toBe(true);
+
+        answer(parseEther("5"));
+        await settle();
+        expect(el("confirm-balance").textContent).toBe("5.0000 SepoliaETH");
+        expect(sendDisabled()).toBe(false);
+    });
+
+    // The Chrome suite measures that nothing moves; this checks the message
+    // is already written, only hidden, before the read returns.
+    test("that finds the amount not covered only makes a message written before it visible", async () => {
+        let answer;
+        const getBalance = jest
+            .spyOn(JsonRpcProvider.prototype, "getBalance")
+            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
+        try {
+            await review("sepolia");
+        } finally {
+            getBalance.mockRestore();
+        }
+        const message =
+            "Your SepoliaETH balance does not cover this amount. Please go" +
+            " back and send a smaller amount.";
+        expect(el("confirm-balance-error").textContent).toBe(message);
+        expect(shown("confirm-balance-error")).toBe(false);
+
+        answer(parseEther("0.5"));
+        await settle();
+        expect(el("confirm-balance-error").textContent).toBe(message);
+        expect(shown("confirm-balance-error")).toBe(true);
+        expect(errors()).toBe("");
+        expect(sendDisabled()).toBe(true);
+    });
+
+    // The fee is estimated once the read returns, after the switch, and still
+    // asks the node of the network the screen was drawn for.
+    test("still in flight when Sepolia is chosen in Settings leaves the balance and the fee on mainnet", async () => {
+        let answer;
+        const getBalance = jest
+            .spyOn(JsonRpcProvider.prototype, "getBalance")
+            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
+        try {
+            await review("mainnet");
+        } finally {
+            getBalance.mockRestore();
+        }
+        const feeAskedOn = () =>
+            mockNode.asked
+                .filter((q) => q.method === "getFeeData")
+                .map((q) => q.network);
+        expect(feeAskedOn()).toEqual([]);
+
+        await onChainSwitch("sepolia");
+        answer(parseEther("5"));
+        await settle();
+
+        expect(feeAskedOn()).toEqual(["mainnet"]);
+        expect(el("confirm-balance").textContent).toBe("5.0000 ETH");
+        // 21000 gas at 10 gwei expected, at 20 gwei reserved.
+        expect(el("confirm-fee-amount").textContent).toBe("~0.0002 ETH");
+        expect(el("confirm-fee-reserve").textContent).toBe(
+            "up to 0.0004 ETH reserved",
+        );
+    });
+
+    test("that fails states the balance as unknown, not zero, and blocks sending", async () => {
+        const getBalance = jest
+            .spyOn(JsonRpcProvider.prototype, "getBalance")
+            .mockRejectedValueOnce(new Error("the node did not answer"));
+        try {
+            await review("sepolia");
+        } finally {
+            getBalance.mockRestore();
+        }
+        expect(el("confirm-balance").textContent).toBe("unknown (SepoliaETH)");
+        expect(shown("confirm-balance-read-error")).toBe(true);
+        expect(shown("confirm-balance-error")).toBe(false);
+        expect(errors()).toBe("");
+        expect(sendDisabled()).toBe(true);
+    });
+});

tests/deleteWalletLostPassword.test.js

@@ -259,6 +259,36 @@ describe("reaching the screen", () => {
     });
 });
 
+// Both screens tell the user what they need to get the wallet back, and a
+// key or xprv wallet has no recovery phrase: telling its owner to rely on
+// one sends them looking for words that do not exist
+// (https://git.eeqj.de/sneak/AutistMask/issues/529).
+describe("what the screens say the wallet's backup is", () => {
+    test.each([
+        ["hd", "recovery phrase"],
+        ["key", "private key"],
+        ["xprv", "extended private key"],
+    ])(
+        "a wallet of type %s is told about its %s",
+        async (type, keyMaterial) => {
+            const { deleteWallet, state } = load();
+            state.wallets[1].type = type;
+
+            deleteWallet.show(1);
+            expect(state.currentView).toBe("delete-wallet-confirm");
+            expect(node("delete-wallet-key-material").textContent).toBe(
+                keyMaterial,
+            );
+
+            await click("btn-delete-wallet-lost-password");
+            expect(state.currentView).toBe(VIEW);
+            expect(node("delete-wallet-lost-key-material").textContent).toBe(
+                keyMaterial,
+            );
+        },
+    );
+});
+
 describe("the typed confirmation", () => {
     test("a name that is not the wallet's deletes nothing", async () => {
         const { deleteWallet, state, storage } = load();

tests/e2e/network.js

@@ -226,8 +226,9 @@ const RPC_RESULTS = {
 // The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
 // to derive maxFeePerGas. Without it every fee is a legacy gasPrice, the
 // reserve and the estimate collapse to the same number, and the gate tests
-// stop being able to distinguish them.
-function latestBlock() {
+// stop being able to distinguish them. opts.baseFeeWei replaces its base fee,
+// read at request time like every other fixture switch.
+function latestBlock(opts) {
     return {
         hash: "0x" + "11".repeat(32),
         parentHash: "0x" + "22".repeat(32),
@@ -239,21 +240,26 @@ function latestBlock() {
         gasUsed: "0xf4240",
         miner: STUB_COUNTERPARTY,
         extraData: "0x",
-        baseFeePerGas: hex(BASE_FEE_WEI),
+        baseFeePerGas: opts.baseFeeWei || hex(BASE_FEE_WEI),
         transactions: [],
     };
 }
 
-// keccak("decimals()")[0:4], and the same for symbol() and name().
+// keccak("decimals()")[0:4], and the same for symbol(), name() and
+// balanceOf(address).
 const SELECTOR_DECIMALS = "0x313ce567";
 const SELECTOR_SYMBOL = "0x95d89b41";
 const SELECTOR_NAME = "0x06fdde03";
+const SELECTOR_BALANCE_OF = "0x70a08231";
 
-// Every eth_call still answers with a zero word except decimals(), symbol()
-// and name() on the stub token. The wallet reads decimals() back at signing
-// time to compare with the scale the confirmation screen rendered (issue
-// #305). Adding the token by its contract address reads all three (issue
-// #295); symbol() and name() answer what the explorer reports for it.
+// Every eth_call still answers with a zero word except decimals(), symbol(),
+// name() and balanceOf() on the stub token. The wallet reads decimals() back
+// at signing time to compare with the scale the confirmation screen rendered
+// (issue #305). Adding the token by its contract address reads the first three
+// (issue #295); symbol() and name() answer what the explorer reports for it.
+// The confirmation screen reads balanceOf()
+// (https://git.eeqj.de/sneak/AutistMask/issues/558), which answers the holding
+// the explorer reports, or zero when no holding is seeded.
 //
 // opts.tokenDecimalsOverride is the lying contract: set it and decimals()
 // answers something other than the value this same fixture reports through
@@ -278,6 +284,9 @@ function ethCallResult(req, opts) {
     if (data.startsWith(SELECTOR_NAME)) {
         return abi.encode(["string"], [tokenObject(opts).name]);
     }
+    if (data.startsWith(SELECTOR_BALANCE_OF) && opts.seedTokenBalance) {
+        return word(tokenBalanceItems(opts)[0].value);
+    }
     return ZERO_WORD;
 }
 
@@ -420,9 +429,10 @@ const HOLD_MAX_MS = 30000;
 
 // Hold a reply open for as long as the test asks: until opts[name] is false.
 //
-// The switch (holdGasEstimate, holdTransactionCount or holdBlockscout) is read
-// here rather than captured, so a test flips it on the same options object the
-// route was registered with — the same pattern as seedTokenTransfer. This is
+// The switch (holdBalance, holdGasEstimate, holdTransactionCount or
+// holdBlockscout) is read here rather than captured, so a test flips it on the
+// same options object the route was registered with — the same pattern as
+// seedTokenTransfer. This is
 // the only way to observe a screen while its request is genuinely in flight;
 // sampling the screen and hoping to win a race against the network would
 // assert nothing on a slow machine.
@@ -472,7 +482,7 @@ function rpcReply(req, opts, report) {
         });
     }
     if (req.method === "eth_getBlockByNumber") {
-        return Object.assign(envelope, { result: latestBlock() });
+        return Object.assign(envelope, { result: latestBlock(opts) });
     }
     // The end of the dApp transaction round trip: the raw signed transaction
     // the background hands to the node. It is recorded verbatim so a test can
@@ -557,6 +567,9 @@ async function handleRpc(route, postData, opts, report) {
         report("unstubbed request: POST " + route.request().url());
         return route.abort();
     }
+    if (batch.some((req) => req.method === "eth_getBalance")) {
+        await awaitRelease(opts, "holdBalance", report);
+    }
     if (batch.some((req) => req.method === "eth_estimateGas")) {
         await awaitRelease(opts, "holdGasEstimate", report);
     }
@@ -613,8 +626,12 @@ function traceEnabled(raw) {
  * @param {string} [opts.ethBalanceWei]  hex wei answered to eth_getBalance;
  *   defaults to zero, which is what every test that predates the funded
  *   fixture expects.
+ * @param {string} [opts.baseFeeWei]  hex wei answered as the latest block's
+ *   baseFeePerGas; defaults to BASE_FEE_WEI. Read at request time.
  * @param {boolean} [opts.failGasEstimate]  answer eth_estimateGas with a
  *   node-side refusal.
+ * @param {boolean} [opts.holdBalance]  hold every batch containing an
+ *   eth_getBalance until this is cleared again.
  * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
  *   eth_estimateGas until this is cleared again.
  * @param {boolean} [opts.holdTransactionCount]  hold every batch containing an

tests/e2e/run.js

@@ -2232,7 +2232,8 @@ function feeEth(wei) {
 
 // What the confirmation screen is showing right now, read out of the DOM in
 // one pass: whether sending is allowed, which reason it is giving, what the
-// fee block says, and how tall the whole view is.
+// fee block says, how tall the whole view is, and where the password field and
+// Sign & Send sit in it.
 async function confirmState(page) {
     return page.evaluate(() => {
         const el = (id) => document.getElementById(id);
@@ -2245,6 +2246,12 @@ async function confirmState(page) {
         };
         return {
             height: el("view-confirm-tx").getBoundingClientRect().height,
+            passwordTop:
+                el("confirm-tx-password").getBoundingClientRect().top -
+                el("view-confirm-tx").getBoundingClientRect().top,
+            sendTop:
+                el("btn-confirm-send").getBoundingClientRect().top -
+                el("view-confirm-tx").getBoundingClientRect().top,
             type: el("confirm-type").textContent.trim(),
             balance: el("confirm-balance").textContent.trim(),
             fee: el("confirm-fee-amount").textContent.trim(),
@@ -2253,9 +2260,18 @@ async function confirmState(page) {
             errors: shown("confirm-errors")
                 ? el("confirm-errors").textContent.trim()
                 : "",
+            balanceError: shown("confirm-balance-error")
+                ? el("confirm-balance-error").textContent.trim()
+                : "",
             amountFeeError: shown("confirm-amount-fee-error"),
             gasError: shown("confirm-gas-error"),
             feeUnknownError: shown("confirm-fee-unknown-error"),
+            // Its sentence is wrapped across lines in index.html.
+            feeBoundError: shown("confirm-fee-bound-error")
+                ? el("confirm-fee-bound-error")
+                      .textContent.replace(/\s+/g, " ")
+                      .trim()
+                : "",
             sendDisabled: el("btn-confirm-send").disabled,
         };
     });
@@ -2271,6 +2287,16 @@ async function waitForEstimate(page) {
     );
 }
 
+async function waitForBalance(page) {
+    await page.waitForFunction(
+        () =>
+            document.getElementById("confirm-balance").textContent.trim() !==
+            "Loading...",
+        null,
+        { timeout: 60000 },
+    );
+}
+
 async function backToAddress(page) {
     if (await page.isVisible("#view-confirm-tx")) {
         await page.click("#btn-confirm-back");
@@ -2282,13 +2308,14 @@ async function backToAddress(page) {
     await openAddressDetail(page);
 }
 
-// Drive the popup to the confirmation screen for one send.
+// Drive the popup to the confirmation screen for one send, and return as soon
+// as the screen is shown, its balance read still in flight.
 //
 // It waits for the send screen to be showing `balance`, the fixture's balance
 // as that screen displays it, before filling anything in. Waiting for it —
 // rather than for a refresh to have probably landed — is what keeps every
 // assertion below deterministic after a fixture change.
-async function goToConfirm(page, { token, balance, amount }) {
+async function openConfirm(page, { token, balance, amount }) {
     await backToAddress(page);
     await page.click("#btn-send");
     await visible(page, "#view-send");
@@ -2303,6 +2330,14 @@ async function goToConfirm(page, { token, balance, amount }) {
     await page.fill("#send-amount", amount);
     await page.click("#btn-send-review");
     await visible(page, "#view-confirm-tx");
+}
+
+// The same, returning once the screen has read the balance. It reads it
+// before it estimates the fee, so every state below is read with the balance
+// in place, the pending fee included.
+async function goToConfirm(page, send) {
+    await openConfirm(page, send);
+    await waitForBalance(page);
     await assertAddressesFit(page, "the confirmation screen");
 }
 
@@ -2378,7 +2413,10 @@ test("ConfirmTx blocks sending while the fee estimate is pending (#238)", async
         "the estimate-failed message is shown for an estimate that is merely pending",
     );
     assert(
-        !st.amountFeeError && !st.gasError && st.errors === "",
+        !st.amountFeeError &&
+            !st.gasError &&
+            st.errors === "" &&
+            st.balanceError === "",
         "a balance message is shown before the fee is known",
     );
 });
@@ -2409,6 +2447,7 @@ test("ConfirmTx enables Send once the estimate lands, quoting both numbers (#238
     );
     assert(
         st.errors === "" &&
+            st.balanceError === "" &&
             !st.amountFeeError &&
             !st.gasError &&
             !st.feeUnknownError,
@@ -2475,30 +2514,54 @@ test("ConfirmTx gates on the fee RESERVE, not the displayed estimate (#238)", as
     );
 });
 
-test("ConfirmTx refuses a send that exceeds the balance outright (#238)", async (env) => {
-    await goToConfirm(env.page, {
-        token: "ETH",
-        balance: FUNDED_ETH_TEXT + " ETH",
-        amount: OVER_BALANCE_AMOUNT,
-    });
+// The screen is first measured with its balance read held, so the message the
+// read brings must already hold its space when the read returns (#558).
+test("ConfirmTx refuses a send that exceeds the balance outright, and nothing moves when the balance arrives (#238)", async (env) => {
+    env.routeOpts.holdBalance = true;
+    let reading;
+    try {
+        await openConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: OVER_BALANCE_AMOUNT,
+        });
+        reading = await confirmState(env.page);
+    } finally {
+        env.routeOpts.holdBalance = false;
+    }
+    assert(
+        reading.balance === "Loading...",
+        "the balance read was not held: " + JSON.stringify(reading.balance),
+    );
+    await waitForBalance(env.page);
     await waitForEstimate(env.page);
 
     const st = await confirmState(env.page);
-    const want =
-        "Insufficient balance. You have " +
-        FUNDED_ETH_TEXT +
-        " ETH but are trying to send " +
-        OVER_BALANCE_AMOUNT +
-        " ETH.";
     assert(
-        st.errors === want,
-        "wrong over-balance message: " + JSON.stringify(st.errors),
+        st.balance === FUNDED_ETH_TEXT + " ETH",
+        "the confirmation screen shows the wrong balance: " +
+            JSON.stringify(st.balance),
+    );
+    const want =
+        "Your ETH balance does not cover this amount. Please go back and" +
+        " send a smaller amount.";
+    assert(
+        st.balanceError === want,
+        "wrong over-balance message: " + JSON.stringify(st.balanceError),
     );
     assert(st.sendDisabled, "Send is enabled for a send that exceeds balance");
     assert(
         !st.amountFeeError,
         "the amount-plus-fee message is shown for an amount that alone exceeds the balance",
     );
+    assert(
+        st.sendTop === reading.sendTop,
+        "Sign & Send moved when the balance read returned: " +
+            reading.sendTop +
+            "px -> " +
+            st.sendTop +
+            "px",
+    );
 });
 
 test("ConfirmTx refuses to send when the fee estimate fails, with its own message (#238)", async (env) => {
@@ -2542,7 +2605,10 @@ test("ConfirmTx refuses to send when the fee estimate fails, with its own messag
             "the estimate-failed message is not shown after a failed estimate",
         );
         assert(
-            !st.amountFeeError && !st.gasError && st.errors === "",
+            !st.amountFeeError &&
+                !st.gasError &&
+                st.errors === "" &&
+                st.balanceError === "",
             "a balance message is shown for an estimate that simply failed",
         );
         assert(
@@ -2633,21 +2699,19 @@ test("ConfirmTx refuses an ERC-20 send that exceeds the token balance (#238)", a
     await waitForEstimate(env.page);
 
     const st = await confirmState(env.page);
-    const want =
-        "Insufficient " +
-        STUB_TOKEN.symbol +
-        " balance. You have " +
-        TOKEN_BALANCE_TEXT +
-        " " +
-        STUB_TOKEN.symbol +
-        " but are trying to send " +
-        OVER_TOKEN_AMOUNT +
-        " " +
-        STUB_TOKEN.symbol +
-        ".";
     assert(
-        st.errors === want,
-        "wrong over-token-balance message: " + JSON.stringify(st.errors),
+        st.balance === TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
+        "the confirmation screen shows the wrong token balance: " +
+            JSON.stringify(st.balance),
+    );
+    const want =
+        "Your " +
+        STUB_TOKEN.symbol +
+        " balance does not cover this amount. Please go back and send a" +
+        " smaller amount.";
+    assert(
+        st.balanceError === want,
+        "wrong over-token-balance message: " + JSON.stringify(st.balanceError),
     );
     assert(
         st.sendDisabled,
@@ -2703,9 +2767,9 @@ test("ConfirmTx gates the ERC-20 fee on the RESERVE, with the ERC-20 message (#2
         "the native-ETH over-budget message is shown on an ERC-20 transfer",
     );
     assert(
-        st.errors === "",
+        st.errors === "" && st.balanceError === "",
         "a token-balance message is shown for a transfer the token balance covers: " +
-            JSON.stringify(st.errors),
+            JSON.stringify(st.errors + st.balanceError),
     );
     assert(
         st.height === env.erc20PendingHeight,
@@ -2851,9 +2915,10 @@ async function goToTokenConfirm(env) {
         amount: TOKEN_AMOUNT,
     });
     await waitForEstimate(env.page);
+    // TOKEN_AMOUNT to four decimal places (README.md, Display Consistency).
     const shown = await shownAmount(env.page);
     assert(
-        shown === TOKEN_AMOUNT + " " + STUB_TOKEN.symbol,
+        shown === "0.2500 " + STUB_TOKEN.symbol,
         "the confirmation screen is not showing the amount that was entered: " +
             JSON.stringify(shown),
     );
@@ -3003,6 +3068,91 @@ test("a token that lies about decimals() at signing time broadcasts nothing (#30
     }
 });
 
+// ------------------------- a send Sign & Send refuses moves nothing (#583)
+//
+// README, No Layout Shift. Sign & Send refuses a send on the confirmation
+// screen when the active network changed since review and when its gas limit
+// or fee is over its bound, and each refusal's sentence sits in a box that held
+// its space from the first paint. This drives the total fee refusal, the longer
+// of the two sentences.
+
+// The base fee the stub node quotes once Sign & Send is pressed. ethers asks
+// twice it plus the 1 gwei priority fee per gas, 50,001 gwei, so the 21,000-gas
+// send would allow a fee of about 1.05 ETH, over the 1 ETH this wallet signs
+// for (MAX_TOTAL_FEE in src/shared/approvalVerify.js).
+const OVER_BOUND_BASE_FEE_WEI = 25000n * 10n ** 9n;
+
+test("a send refused for its fee leaves the password field and Sign & Send where they were (#583)", async (env) => {
+    env.errors.expect("confirmTx logging the refused send", /send refused/);
+    try {
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await waitForEstimate(env.page);
+        const before = await confirmState(env.page);
+        assert(
+            !before.sendDisabled && before.feeBoundError === "",
+            "the screen is not ready to send: " + JSON.stringify(before),
+        );
+
+        // Only now, with the screen drawn and its fee estimated, does the
+        // node quote a fee over the bound.
+        env.routeOpts.baseFeeWei = toHexWei(OVER_BOUND_BASE_FEE_WEI);
+        const sent = env.routeOpts.broadcastTransactions.length;
+        await fillPasswordAndSend(env.page);
+        await env.page.waitForFunction(
+            () =>
+                getComputedStyle(
+                    document.getElementById("confirm-fee-bound-error"),
+                ).visibility === "visible",
+            null,
+            { timeout: 60000 },
+        );
+        const after = await confirmState(env.page);
+
+        // Printed pass or fail, as the dust threshold test does.
+        console.log(
+            "# refused send: password field top " +
+                before.passwordTop +
+                " -> " +
+                after.passwordTop +
+                "px, Sign & Send top " +
+                before.sendTop +
+                " -> " +
+                after.sendTop +
+                "px",
+        );
+        assert(
+            env.routeOpts.broadcastTransactions.length === sent,
+            "a send over the fee bound reached the RPC",
+        );
+        assert(
+            after.feeBoundError ===
+                "The gas limit or fee the RPC endpoint quoted for this" +
+                    " transaction is more than this wallet will sign for, so" +
+                    " it was not sent. Please go back and try again.",
+            "wrong fee refusal: " + JSON.stringify(after.feeBoundError),
+        );
+        assert(
+            after.passwordTop === before.passwordTop,
+            "the password field moved " +
+                (after.passwordTop - before.passwordTop) +
+                "px when the send was refused",
+        );
+        assert(
+            after.sendTop === before.sendTop,
+            "Sign & Send moved " +
+                (after.sendTop - before.sendTop) +
+                "px when the send was refused",
+        );
+    } finally {
+        env.routeOpts.baseFeeWei = undefined;
+        await backToAddress(env.page);
+    }
+});
+
 // ------------------------------ the wait for a receipt ending in error (#315)
 //
 // README.md (WaitTx) documents two ways the wait ends on the error screen: a
@@ -4859,6 +5009,9 @@ async function main() {
         seedTokenBalance: false,
         ethBalanceWei: null,
         failGasEstimate: false,
+        // Whether a JSON-RPC batch asking for a balance is held unanswered:
+        // the confirmation screen's own balance read (#558).
+        holdBalance: false,
         holdGasEstimate: false,
         // Whether a JSON-RPC batch asking for a transaction count is held
         // unanswered: the address scan after creating a wallet (#475).

tests/fabricatedDecimals.test.js

@@ -136,7 +136,7 @@ function erc20AmountLine(data, tokenAddress) {
 }
 
 function swapAmountLine(data) {
-    return decodeCalldata(data, ROUTER).details.find(
+    return decodeCalldata(data, ROUTER, "0x1").details.find(
         (d) => d.label === "Amount",
     ).value;
 }

tests/firstWalletRefresh.test.js

@@ -61,16 +61,12 @@ async function importOn(page, { tab, field, secret }) {
     await page.click("btn-add-wallet-confirm");
 }
 
-// Fake timers hold the timer of the flash message an import ends with, which
-// would otherwise fire after cleanupPopup() has removed the page and throw.
 beforeEach(() => {
-    jest.useFakeTimers();
     chainBalance = "0.0";
 });
 
 afterEach(() => {
     cleanupPopup();
-    jest.useRealTimers();
 });
 
 describe("a popup that opened on Welcome", () => {

tests/flashLine.test.js

@@ -80,6 +80,7 @@ describe.each([
         jest.doMock("../src/shared/state", () => ({
             state: { trackedTokens: [] },
             saveState,
+            currentNetwork: () => ({ chainId: 1 }),
         }));
         jest.doMock("../src/popup/views/helpers", () => ({
             $: element,

tests/nativeCurrency.test.js

@@ -17,6 +17,10 @@ jest.mock("ethers", () => {
         async lookupAddress() {
             return null;
         }
+        // The 1.5 of the native token the address holds on either network.
+        async getBalance() {
+            return 1500000000000000000n;
+        }
         // 10 gwei expected, 20 gwei reserved per gas.
         async getFeeData() {
             return { maxFeePerGas: 20000000000n, gasPrice: 10000000000n };
@@ -241,7 +245,7 @@ describe.each([
     test("the value", async () => {
         await confirmSend("0.1");
         expect(text("confirm-type")).toBe("Native " + symbol + " transfer");
-        expect(text("confirm-amount")).toBe("0.1 " + symbol);
+        expect(text("confirm-amount")).toBe("0.1000 " + symbol);
         await approveTx(NETWORKS[networkId].chainId);
         expect(text("approve-tx-value")).toBe("0.0100 " + symbol);
     });
@@ -339,14 +343,11 @@ describe.each([
 
     test("the insufficient-balance error", async () => {
         await confirmSend("2");
-        expect(
-            global.document.getElementById("confirm-errors").innerHTML,
-        ).toContain(
-            "You have 1.5000 " +
+        expect(text("confirm-balance-error")).toBe(
+            "Your " +
                 symbol +
-                " but are trying to send 2 " +
-                symbol +
-                ".",
+                " balance does not cover this amount. Please go back and send" +
+                " a smaller amount.",
         );
     });
 });
@@ -428,10 +429,10 @@ describe.each([
             await global.document
                 .getElementById("btn-confirm-send")
                 .handlers.get("click")();
-            expect(text("wait-tx-summary")).toBe("0.1 " + symbol);
+            expect(text("wait-tx-summary")).toBe("0.1000 " + symbol);
             state.networkId = activeNetworkId;
             txStatus.restoreWait();
-            expect(text("wait-tx-summary")).toBe("0.1 " + symbol);
+            expect(text("wait-tx-summary")).toBe("0.1000 " + symbol);
         });
 
         test("the transaction detail screen's type line and fee", async () => {

tests/persistedFieldContract.test.js

@@ -477,6 +477,33 @@ const CONTRACT = [
                 views: ["confirm-tx"],
                 restored: false,
             },
+            // The amount line splits the amount to cut it to four decimals.
+            {
+                value: {
+                    pendingTx: {
+                        token: "ETH",
+                        from: ADDRESS,
+                        to: ADDRESS,
+                        amount: 42,
+                    },
+                },
+                views: ["confirm-tx"],
+                restored: false,
+            },
+            // A chain id naming no network has no explorer to link to.
+            {
+                value: {
+                    pendingTx: {
+                        token: "ETH",
+                        from: ADDRESS,
+                        to: ADDRESS,
+                        amount: "1",
+                        chainId: "0x5",
+                    },
+                },
+                views: ["confirm-tx"],
+                restored: false,
+            },
             // wait-tx passes on `pendingWait.hash`; restoreWait() has checked
             // the fields below it since it was written, and this is the
             // regression guard.
@@ -791,7 +818,6 @@ const WELL_FORMED_DATA = {
         from: ADDRESS,
         to: ADDRESS,
         amount: "1",
-        balance: "2",
     },
     pendingWait: {
         hash: "0x1",

tests/popupBoot.test.js

@@ -0,0 +1,87 @@
+// A timer the popup started and that fires after cleanupPopup() has removed
+// the page throws "document is not defined", and the throw fails whatever test
+// the jest worker is running by then, in this file or another
+// (https://git.eeqj.de/sneak/AutistMask/issues/578). The flash message's
+// timer is the one that did it. A throw from a timer during a test fails that
+// test, so each test here passes only if nothing throws.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    ADDRESS,
+} = require("./support/popupBoot");
+
+const FLASH_MS = 10;
+
+function wait(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+test("a flash message clears while the page is up", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    const { showFlash } = require("../src/popup/views/helpers");
+    showFlash("Copied.", FLASH_MS);
+    expect(page.text("flash-msg")).toBe("Copied.");
+
+    await wait(FLASH_MS * 5);
+
+    expect(page.text("flash-msg")).toBe("");
+});
+
+test("a flash message's timer does not fire after cleanupPopup()", async () => {
+    await bootPopup(unversionedValidProfile());
+    const { showFlash } = require("../src/popup/views/helpers");
+    showFlash("Copied.", FLASH_MS);
+    cleanupPopup();
+
+    await wait(FLASH_MS * 5);
+});
+
+// A boot onto a screen that sends a request no mocked module answers: that
+// request reaches the boot's fetch() stub, never the internet
+// (https://git.eeqj.de/sneak/AutistMask/issues/559).
+function restoringOnto(view, viewData) {
+    return unversionedValidProfile({
+        currentView: view,
+        selectedWallet: 0,
+        selectedAddress: 0,
+        viewStack: ["main"],
+        viewData,
+    });
+}
+
+test("the transaction screen's Blockscout request reaches the stub", async () => {
+    const page = await bootPopup(
+        restoringOnto("transaction", {
+            tx: { hash: "0x1", from: ADDRESS, to: ADDRESS },
+        }),
+    );
+
+    expect(page.visibleViews()).toEqual(["transaction"]);
+    expect(globalThis.fetch.mock.calls.map((call) => call[0])).toEqual([
+        "https://eth.blockscout.com/api/v2/transactions/0x1",
+    ]);
+});
+
+test("the confirmation screen's Etherscan lookup reaches the stub", async () => {
+    const page = await bootPopup(
+        restoringOnto("confirm-tx", {
+            pendingTx: {
+                token: "ETH",
+                from: ADDRESS,
+                to: ADDRESS,
+                amount: "1",
+            },
+        }),
+    );
+
+    expect(page.visibleViews()).toEqual(["confirm-tx"]);
+    expect(globalThis.fetch.mock.calls.map((call) => call[0])).toEqual([
+        "https://etherscan.io/address/" + ADDRESS,
+    ]);
+});

tests/sendAmountRule.test.js

@@ -23,7 +23,10 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
-// What the confirmation screen asks the node for.
+const { AbiCoder } = require("ethers");
+
+// What the confirmation screen asks the node for. The address holds the 1 ETH
+// and 250 TOK the wallet below records.
 const mockProvider = {
     getFeeData: async () => ({
         maxFeePerGas: 2000000000n,
@@ -32,7 +35,11 @@ const mockProvider = {
     estimateGas: async () => 21000n,
     getCode: async () => "0x",
     getTransactionCount: async () => 1,
-    getBalance: async () => 0n,
+    getBalance: async () => 1000000000000000000n,
+    // The one contract call the screen makes, balanceOf(), answered at the
+    // token's 6 decimal places.
+    call: async () =>
+        AbiCoder.defaultAbiCoder().encode(["uint256"], [250000000n]),
 };
 
 jest.mock("../src/shared/balances", () => {

tests/sendDisplayFloor.test.js

@@ -18,6 +18,7 @@
 // What the stub node answers. Each test sets what it needs.
 const mockNode = {
     balanceWei: 0n,
+    tokenUnits: 0n,
     feeData: { maxFeePerGas: 1n, gasPrice: 1n },
 };
 
@@ -30,6 +31,13 @@ jest.mock("ethers", () => {
         async getBalance() {
             return mockNode.balanceWei;
         }
+        // balanceOf(), the one contract call these screens make.
+        async call() {
+            return actual.AbiCoder.defaultAbiCoder().encode(
+                ["uint256"],
+                [mockNode.tokenUnits],
+            );
+        }
         async lookupAddress() {
             return null;
         }
@@ -195,10 +203,19 @@ function errors() {
     return global.document.getElementById("confirm-errors").innerHTML;
 }
 
+// The message for an amount the balance does not cover, while it is shown.
+function balanceError() {
+    const box = global.document.getElementById("confirm-balance-error");
+    return box.style.visibility === "visible" ? box.textContent : "";
+}
+
 // The ETH balance the node reports and the token rows the explorer reports,
-// fetched and stored exactly where the popup stores them.
+// fetched and stored exactly where the popup stores them. The node reports the
+// token holding the explorer does.
 async function refreshWith(balanceWei, tokenItems = []) {
     mockNode.balanceWei = balanceWei;
+    mockNode.tokenUnits =
+        tokenItems.length > 0 ? BigInt(tokenItems[0].value) : 0n;
     mockExplorer.items = tokenItems;
     state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
     state.selectedWallet = 0;
@@ -300,9 +317,10 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         await confirmSend("0.0000005", TOKEN);
         expect(text("confirm-balance")).toBe("0.0000005 TOK");
         expect(errors()).toBe("");
+        expect(balanceError()).toBe("");
         await confirmSend("0.0000006", TOKEN);
-        expect(errors()).toContain(
-            "You have 0.0000005 TOK but are trying to send 0.0000006 TOK.",
+        expect(balanceError()).toContain(
+            "Your TOK balance does not cover this amount.",
         );
     });
 
@@ -316,6 +334,7 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         await confirmSend("1.5", TOKEN);
         expect(text("confirm-balance")).toBe("1.5000 TOK");
         expect(errors()).toBe("");
+        expect(balanceError()).toBe("");
     });
 
     test("with more than 18 decimals and a holding below 10^-18", async () => {
@@ -329,9 +348,8 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         );
         await confirmSend("0.000000000000000001", TOKEN);
         expect(text("confirm-balance")).toBe("0.000000000000000000000001 TOK");
-        expect(errors()).toContain(
-            "You have 0.000000000000000000000001 TOK but are trying to send" +
-                " 0.000000000000000001 TOK.",
+        expect(balanceError()).toContain(
+            "Your TOK balance does not cover this amount.",
         );
     });
 });
@@ -356,9 +374,10 @@ describe("an untracked token holding below 0.000001 never renders as zero", () =
         await confirmSend("0.0000005", TOKEN);
         expect(text("confirm-balance")).toBe("0.0000005 TOK");
         expect(errors()).toBe("");
+        expect(balanceError()).toBe("");
         await confirmSend("0.0000006", TOKEN);
-        expect(errors()).toContain(
-            "You have 0.0000005 TOK but are trying to send 0.0000006 TOK.",
+        expect(balanceError()).toContain(
+            "Your TOK balance does not cover this amount.",
         );
     });
 });

tests/sendMax.test.js

@@ -17,6 +17,7 @@
 // What the stub node answers, and the signed transactions it was handed.
 const mockNode = {
     balanceWei: 0n,
+    tokenUnits: 0n,
     feeData: null,
     broadcast: [],
 };
@@ -30,6 +31,14 @@ jest.mock("ethers", () => {
         async getBalance() {
             return mockNode.balanceWei;
         }
+        // balanceOf(), the one contract call these screens make before Sign
+        // & Send.
+        async call() {
+            return actual.AbiCoder.defaultAbiCoder().encode(
+                ["uint256"],
+                [mockNode.tokenUnits],
+            );
+        }
         async lookupAddress() {
             return null;
         }
@@ -187,9 +196,12 @@ function text(id) {
 }
 
 // The ETH balance the node reports and the token rows the explorer reports,
-// fetched and stored exactly where the popup stores them.
+// fetched and stored exactly where the popup stores them. The node reports the
+// token holding the explorer does.
 async function refreshWith(balanceWei, tokenItems = []) {
     mockNode.balanceWei = balanceWei;
+    mockNode.tokenUnits =
+        tokenItems.length > 0 ? BigInt(tokenItems[0].value) : 0n;
     mockExplorer.items = tokenItems;
     state.wallets = [
         {
@@ -294,7 +306,8 @@ describe("Max on an ETH send", () => {
         openSend();
         await pressMax();
         await review();
-        expect(text("confirm-amount")).toBe(maxAfter(20n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(20n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2341 ETH");
         expect(el("confirm-errors").innerHTML).toBe("");
         expect(el("confirm-amount-fee-error").style.visibility).toBe("hidden");
         expect(canSend()).toBe(true);
@@ -310,14 +323,16 @@ describe("Max on an ETH send", () => {
         // Kept, the Send screen's amount would be refused for want of funds.
         mockNode.feeData = fees(30n * GWEI);
         await review();
-        expect(text("confirm-amount")).toBe(maxAfter(30n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(30n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2339 ETH");
         expect(canSend()).toBe(true);
 
         // And falls when the screen is shown again, as on reopening the popup.
         mockNode.feeData = fees(10n * GWEI);
         confirmTx.restore();
         await settle();
-        expect(text("confirm-amount")).toBe(maxAfter(10n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(10n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2343 ETH");
         expect(canSend()).toBe(true);
     });
 
@@ -514,7 +529,8 @@ describe("Max on an ETH send", () => {
         el("send-amount").handlers.get("input")();
         mockNode.feeData = fees(30n * GWEI);
         await review();
-        expect(text("confirm-amount")).toBe("0.5 ETH");
+        expect(confirmed.amount).toBe("0.5");
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
     });
 });
 
@@ -528,7 +544,8 @@ describe("Max on a token send", () => {
         await pressMax();
         expect(el("send-amount").value).toBe("1234.567890123456789012");
         await review();
-        expect(text("confirm-amount")).toBe("1234.567890123456789012 TOK");
+        expect(confirmed.amount).toBe("1234.567890123456789012");
+        expect(text("confirm-amount")).toBe("1234.5678 TOK");
         expect(canSend()).toBe(true);
     });
 
@@ -541,7 +558,8 @@ describe("Max on a token send", () => {
         await pressMax();
         expect(el("send-amount").value).toBe("1234.567890123456789012");
         await review();
-        expect(text("confirm-amount")).toBe("1234.567890123456789012 TOK");
+        expect(confirmed.amount).toBe("1234.567890123456789012");
+        expect(text("confirm-amount")).toBe("1234.5678 TOK");
         expect(canSend()).toBe(true);
     });
 

tests/support/popupBoot.js

@@ -43,6 +43,13 @@ jest.doMock("ethereum-blockies-base64", () => makeBlockie);
 // Taken before any boot replaces them; see bootPopup().
 const realSetInterval = globalThis.setInterval;
 const realClearInterval = globalThis.clearInterval;
+const realSetTimeout = globalThis.setTimeout;
+const realClearTimeout = globalThis.clearTimeout;
+const realFetch = globalThis.fetch;
+
+// Every timeout set since the last cleanupPopup() that has neither fired nor
+// been cleared. cleanupPopup() clears them all.
+const pendingTimeouts = new Set();
 
 const POPUP_HTML = fs.readFileSync(
     path.join(__dirname, "..", "..", "src", "popup", "index.html"),
@@ -254,8 +261,14 @@ async function settle() {
 async function bootPopup(stored, options) {
     jest.resetModules();
 
-    // The three modules that reach the network. None is on the path under
-    // test; all would make the suite hit the internet.
+    // The RPC requests made through src/shared/balances.js go through Node's
+    // own http and https modules, not fetch(), so the fetch() stub below would
+    // not stop them, which is why that module stays mocked.
+    // src/shared/prices.js and src/shared/transactions.js send their requests
+    // through fetch(), and their mocks answer with no prices and no
+    // transactions. Every request the page still sends, such as the
+    // transaction screen's Blockscout lookup and the Etherscan lookup in
+    // src/shared/etherscanLabels.js, meets the fetch() stub.
     jest.doMock("../../src/shared/prices", () => ({
         prices: {},
         refreshPrices: jest.fn(async () => {}),
@@ -328,6 +341,12 @@ async function bootPopup(stored, options) {
             windowListeners[name].push(fn);
         },
     };
+    // Every fetch() the page makes fails, as it does elsewhere in the suite,
+    // instead of reaching the internet. A new stub per boot, so the calls it
+    // records start with that boot. Put back by cleanupPopup().
+    globalThis.fetch = jest.fn(() => {
+        throw new Error("tests must not perform network requests");
+    });
     // The ten-second refresh init() starts, and a transaction wait's timers,
     // would outlive the test. So every interval is recorded rather than
     // started, clearInterval() removes it as a browser would, and tick() below
@@ -342,6 +361,24 @@ async function bootPopup(stored, options) {
     globalThis.clearInterval = (id) => {
         intervals.delete(id);
     };
+    // Timeouts, such as the one that clears a flash message, run for real, but
+    // each is recorded until it fires or is cleared, so cleanupPopup() can
+    // clear the ones still pending. One that fired after the page was removed
+    // would throw "document is not defined" into whatever test the worker runs
+    // by then. jest.useFakeTimers() in a test does not reach them. Put back by
+    // cleanupPopup().
+    globalThis.setTimeout = (fn, ms, ...args) => {
+        const timer = realSetTimeout(() => {
+            pendingTimeouts.delete(timer);
+            fn(...args);
+        }, ms);
+        pendingTimeouts.add(timer);
+        return timer;
+    };
+    globalThis.clearTimeout = (timer) => {
+        pendingTimeouts.delete(timer);
+        realClearTimeout(timer);
+    };
 
     require("../../src/popup/index");
 
@@ -407,6 +444,11 @@ function cleanupPopup() {
     delete globalThis.window;
     globalThis.setInterval = realSetInterval;
     globalThis.clearInterval = realClearInterval;
+    for (const timer of pendingTimeouts) realClearTimeout(timer);
+    pendingTimeouts.clear();
+    globalThis.setTimeout = realSetTimeout;
+    globalThis.clearTimeout = realClearTimeout;
+    globalThis.fetch = realFetch;
 }
 
 module.exports = {

tests/trackedTokensPerNetwork.test.js

@@ -1,16 +1,19 @@
 // Tracked tokens are kept per network, and the two add-token screens offer the
 // bundled token list, which holds Ethereum Mainnet contracts, on Ethereum
 // Mainnet only (https://git.eeqj.de/sneak/AutistMask/issues/523), including on
-// the screen "Back" lands on after a switch made from the Settings gear. Driven
-// through the real popup over a stored profile; the same switch made by the
-// background is in tests/coldWorkerChainSwitch.test.js.
+// the screen "Back" lands on after a switch made from the Settings gear and for
+// a contract lookup that answers after one. Driven through the real popup over
+// a stored profile; the same switch made by the background is in
+// tests/coldWorkerChainSwitch.test.js.
 
 const {
     bootPopup,
     cleanupPopup,
     unversionedValidProfile,
+    ADDRESS,
     TOKEN_ADDRESS,
 } = require("./support/popupBoot");
+const { NETWORKS } = require("../src/shared/networks");
 
 const SEPOLIA_TOKEN = {
     address: TOKEN_ADDRESS,
@@ -24,16 +27,14 @@ const MAINNET_TOKEN = {
     decimals: 18,
     name: "Dai Stablecoin",
 };
-
-// Fake timers hold the timer of the flash message a switch ends with, which
-// would otherwise fire after cleanupPopup() has removed the page and throw.
-beforeEach(() => {
-    jest.useFakeTimers();
-});
+// Tracked on neither network.
+const NEW_TOKEN_ADDRESS = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+const NETWORK_CHANGED_FLASH =
+    "The active network changed before the lookup finished, so the token was" +
+    " not added.";
 
 afterEach(() => {
     cleanupPopup();
-    jest.useRealTimers();
 });
 
 // The popup reopened onto SettingsAddToken, on `networkId`.
@@ -61,6 +62,50 @@ function bootOnAddress() {
     );
 }
 
+// The popup reopened onto AddressToken for `token`, with AddressDetail beneath
+// it, over the same tracked tokens as bootOnAddress().
+function bootOnToken(token) {
+    return bootPopup(
+        unversionedValidProfile({
+            currentView: "address-token",
+            viewStack: ["main", "address"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            selectedToken: token,
+            trackedTokens: [MAINNET_TOKEN],
+            networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+        }),
+    );
+}
+
+// AddressToken for `token` opened from AddressDetail, as tapping the token's
+// row there does.
+async function openToken(boot, token) {
+    const { state } = require("../src/shared/state");
+    state.selectedToken = token;
+    require("../src/popup/views/helpers").pushCurrentView();
+    require("../src/popup/views/addressToken").show();
+    await boot.settle();
+}
+
+// Presses `addButton` with a contract lookup that answers only after the
+// Settings gear and a switch to `networkId`.
+async function addAcrossSwitch(boot, addButton, networkId) {
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let answer;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((resolve) => {
+                answer = resolve;
+            }),
+    );
+    const adding = boot.click(addButton);
+    await boot.click("btn-settings");
+    await chooseNetwork(boot, networkId);
+    answer({ symbol: "NEW", decimals: 18, name: "New Token" });
+    await adding;
+}
+
 // Picks `networkId` in the Settings network selector, as the user does.
 async function chooseNetwork(boot, networkId) {
     const select = boot.node("settings-network");
@@ -166,6 +211,115 @@ describe("Back after a switch from the Settings gear", () => {
         expect(boot.node("address-balances").innerHTML).not.toContain("DAI");
     });
 
+    // DAI was picked on Ethereum Mainnet, where alone it is tracked.
+    test.each([
+        [
+            "opened from AddressDetail",
+            async () => {
+                const boot = await bootOnAddress();
+                await openToken(boot, MAINNET_TOKEN.address);
+                return boot;
+            },
+        ],
+        ["in a reopened popup", () => bootOnToken(MAINNET_TOKEN.address)],
+    ])(
+        "from AddressToken for DAI %s, it lands on AddressDetail",
+        async (_how, open) => {
+            const boot = await open();
+            expect(boot.visibleViews()).toEqual(["address-token"]);
+            expect(boot.text("address-token-title")).toContain("DAI");
+
+            await gearSwitchBack(boot);
+            expect(boot.visibleViews()).toEqual(["address"]);
+            const balances = boot.node("address-balances").innerHTML;
+            expect(balances).toContain("TST");
+            expect(balances).not.toContain("DAI");
+        },
+    );
+
+    // The stack is saved cut with the switch, so a popup closed straight after
+    // it and reopened onto Settings lands where this one would. Loading a
+    // saved stack cuts it at AddToken and Send as well, but not at
+    // AddressToken.
+    test.each([
+        [
+            "AddressToken for DAI",
+            (boot) => openToken(boot, MAINNET_TOKEN.address),
+        ],
+        ["AddToken", (boot) => boot.click("btn-add-token")],
+        ["Send", (boot) => boot.click("btn-send")],
+    ])(
+        "from %s, a popup reopened after the switch lands on AddressDetail",
+        async (_view, open) => {
+            const boot = await bootOnAddress();
+            await open(boot);
+            await boot.click("btn-settings");
+            await chooseNetwork(boot, "sepolia");
+
+            const reopened = await bootPopup(boot.storage.read("autistmask"));
+            expect(reopened.visibleViews()).toEqual(["settings"]);
+            await reopened.click("btn-settings-back");
+            expect(reopened.visibleViews()).toEqual(["address"]);
+            const balances = reopened.node("address-balances").innerHTML;
+            expect(balances).toContain("TST");
+            expect(balances).not.toContain("DAI");
+        },
+    );
+
+    test("AddressToken for the native token is drawn again for the new network", async () => {
+        const boot = await bootOnToken("ETH");
+        expect(boot.visibleViews()).toEqual(["address-token"]);
+
+        await gearSwitchBack(boot);
+        expect(boot.visibleViews()).toEqual(["address-token"]);
+        expect(boot.text("address-token-title")).toContain("SepoliaETH");
+    });
+
+    // A popup reopened onto ConfirmTx has no Send beneath it, so "Back" draws
+    // ConfirmTx again from the saved transaction. It is drawn for the network
+    // the transaction was reviewed on, and Sign & Send refuses it on the new
+    // one.
+    test("ConfirmTx reviewed on Sepolia is not sent on Ethereum Mainnet", async () => {
+        const boot = await bootPopup(
+            unversionedValidProfile({
+                networkId: "sepolia",
+                currentView: "confirm-tx",
+                selectedWallet: 0,
+                selectedAddress: 0,
+                viewData: {
+                    pendingTx: {
+                        token: "ETH",
+                        from: ADDRESS,
+                        to: ADDRESS,
+                        amount: "1",
+                        chainId: NETWORKS.sepolia.chainId,
+                    },
+                },
+            }),
+        );
+        expect(boot.visibleViews()).toEqual(["confirm-tx"]);
+
+        await boot.click("btn-settings");
+        await chooseNetwork(boot, "mainnet");
+        globalThis.fetch.mockClear();
+        await boot.click("btn-settings-back");
+        expect(boot.visibleViews()).toEqual(["confirm-tx"]);
+        // Drawn again: its Etherscan label check asks Sepolia's explorer.
+        expect(globalThis.fetch.mock.calls.map((call) => call[0])).toEqual([
+            NETWORKS.sepolia.explorerUrl + "/address/" + ADDRESS,
+        ]);
+        expect(boot.text("confirm-type")).toBe("Native SepoliaETH transfer");
+
+        boot.node("confirm-tx-password").value = "any password";
+        await boot.click("btn-confirm-send");
+        expect(boot.visibleViews()).toEqual(["confirm-tx"]);
+        expect(
+            boot.node("confirm-network-changed-error").style.visibility,
+        ).toBe("visible");
+        // Refused before the password is even tried.
+        expect(boot.text("confirm-tx-password-error")).toBe("");
+    });
+
     test("without a wallet, it lands on Welcome", async () => {
         const boot = await bootPopup(undefined);
         expect(boot.visibleViews()).toEqual(["welcome"]);
@@ -187,3 +341,32 @@ describe("Back after a switch from the Settings gear", () => {
         expect(boot.value("settings-rpc")).toBe("https://typed.example");
     });
 });
+
+describe("a contract lookup that answers after a switch adds nothing", () => {
+    test("from SettingsAddToken", async () => {
+        const boot = await bootOnAddToken("sepolia", {
+            networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
+        });
+        const stored = () => boot.storage.read("autistmask");
+        boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
+
+        await addAcrossSwitch(boot, "btn-settings-addtoken-manual", "mainnet");
+        expect(boot.visibleViews()).toEqual(["settings"]);
+        expect(boot.text("flash-msg")).toBe(NETWORK_CHANGED_FLASH);
+        expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);
+        expect(stored().networkTrackedTokens.sepolia).toEqual([]);
+    });
+
+    test("from AddToken", async () => {
+        const boot = await bootOnAddress();
+        const stored = () => boot.storage.read("autistmask");
+        await boot.click("btn-add-token");
+        boot.node("add-token-address").value = NEW_TOKEN_ADDRESS;
+
+        await addAcrossSwitch(boot, "btn-add-token-confirm", "sepolia");
+        expect(boot.visibleViews()).toEqual(["settings"]);
+        expect(boot.text("flash-msg")).toBe(NETWORK_CHANGED_FLASH);
+        expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
+        expect(stored().networkTrackedTokens.mainnet).toEqual([MAINNET_TOKEN]);
+    });
+});

tests/uniswap.test.js

@@ -1,7 +1,12 @@
 const { AbiCoder, Interface, solidityPacked } = require("ethers");
 const uniswap = require("../src/shared/uniswap");
 
+// A Universal Router on Ethereum Mainnet, chain id 0x1: UniversalRouterV2,
+// which reads a command's type with the mask 0x3f.
 const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
+// Two more there, which read it with 0x1f and 0x7f.
+const ROUTER_V1_ADDR = "0xEf1c6E67703c7BD7107eed8303Fbe6EC2554BF6B";
+const ROUTER_V2_1_2_ADDR = "0x23617e59A5925b2A4Bf75d73ff6711cD0b29De85";
 const USDT_ADDR = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
 const WETH_ADDR = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2";
 const USDC_ADDR = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
@@ -9,27 +14,25 @@ const DAI_ADDR = "0x6B175474E89094C44Da98b954EedeAC495271d0F";
 const SEPOLIA_WETH_ADDR = "0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14";
 const USER_ADDR = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 
-// AutistMask's first-ever swap, 2026-02-27.
+// AutistMask's first-ever swap, 2026-02-27, sent from USER_ADDR.
 // Swapped USDT for ETH via Uniswap V4 Universal Router.
 // https://etherscan.io/tx/0x6749f50c4e8f975b6d14780d5f539cf151d1594796ac49b7d6a5348ba0735e77
+// This is that transaction's input, as a public Ethereum node returns it.
 const FIRST_SWAP_CALLDATA =
     "0x3593564c" +
-    "000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a0" +
-    "0000000000000000000000000000000000000000000000000000000069a1550f00000000000000000000000000000000000000000000000000000000000000020a10000000000000000000000000000000000000000000000000000000000000" +
-    "0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000001c0" +
-    "0000000000000000000000000000000000000000000000000000000000000160000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7000000000000000000000000ffffffffffffffffffffffffffffffffffffffff" +
-    "0000000000000000000000000000000000000000000000000000000069c8daf6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066a9893cc07d91d95644aedd05d03f95e1dba8af" +
-    "0000000000000000000000000000000000000000000000000000000069a154fe00000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000041" +
-    "230249bb7133205db7b2389b587c723cc182302907b9545dc40c59c33ad1d53078a65732f4182fedbc0d9d85c51d580bdc93db3556fac38f18e140da47d0eb631c00000000000000000000000000000000000000000000000000000000000000" +
+    "000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000069a1550f0000000000000000000000000000000000000000000000000000000000000002" +
+    "0a100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000001c0" +
+    "0000000000000000000000000000000000000000000000000000000000000160000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7000000000000000000000000ffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000069c8daf6" +
+    "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066a9893cc07d91d95644aedd05d03f95e1dba8af0000000000000000000000000000000000000000000000000000000069a154fe00000000000000000000000000000000000000000000000000000000000000e0" +
+    "0000000000000000000000000000000000000000000000000000000000000041230249bb7133205db7b2389b587c723cc182302907b9545dc40c59c33ad1d53078a65732f4182fedbc0d9d85c51d580bdc93db3556fac38f18e140da47d0eb631c00000000000000000000000000000000000000000000000000000000000000" +
     "00000000000000000000000000000000000000000000000000000000000003c0000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000003" +
     "070b0e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000220" +
     "00000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7" +
-    "0000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000007a1200000000000000000000000000000000000000000000000000000dcb050d338e7" +
-    "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064" +
-    "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0" +
-    "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +
-    "dac17f958d2ee523a2206206994597c13d831ec70000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +
-    "66133e8ea0f5d1d612d2502a968757d1048c214a0000000000000000000000000000000000000000000000000000000000000000756e6978000000000012";
+    "0000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000007a1200000000000000000000000000000000000000000000000000000dcb050d338e70000000000000000000000000000000000000000000000000000000000000001" +
+    "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000000000000000000000000000000000000000000001" +
+    "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060" +
+    "000000000000000000000000dac17f958d2ee523a2206206994597c13d831ec7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000060" +
+    "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066133e8ea0f5d1d612d2502a968757d1048c214a0000000000000000000000000000000000000000000000000000000000000000756e6978000000000012";
 
 const coder = AbiCoder.defaultAbiCoder();
 const routerIface = new Interface([
@@ -104,6 +107,12 @@ function encodeV4Swap(actions, params) {
     return coder.encode(["bytes", "bytes[]"], [actions, params]);
 }
 
+// Helper: encode an EXECUTE_SUB_PLAN input (command 0x21), which holds the
+// sub-plan's own commands and inputs
+function encodeSubPlan(commands, inputs) {
+    return coder.encode(["bytes", "bytes[]"], [commands, inputs]);
+}
+
 // V4 inner action IDs, as src/shared/uniswap.js names them.
 const V4_SWAP_EXACT_IN = 0x07;
 const V4_SWAP_EXACT_IN_SINGLE_ID = 0x06;
@@ -315,13 +324,19 @@ function detail(result, label) {
 
 describe("uniswap decoder", () => {
     test("returns null for non-execute calldata", () => {
-        expect(uniswap.decode("0x", ROUTER_ADDR)).toBeNull();
-        expect(uniswap.decode("0xdeadbeef", ROUTER_ADDR)).toBeNull();
-        expect(uniswap.decode(null, ROUTER_ADDR)).toBeNull();
+        expect(uniswap.decode("0x", ROUTER_ADDR, "0x1")).toBeNull();
+        expect(uniswap.decode("0xdeadbeef", ROUTER_ADDR, "0x1")).toBeNull();
+        expect(uniswap.decode(null, ROUTER_ADDR, "0x1")).toBeNull();
     });
 
     test("decodes first-ever AutistMask swap (PERMIT2_PERMIT + V4_SWAP)", () => {
-        const result = uniswap.decode(FIRST_SWAP_CALLDATA, ROUTER_ADDR);
+        const result = uniswap.decode(
+            FIRST_SWAP_CALLDATA,
+            ROUTER_ADDR,
+            "0x1",
+            {},
+            USER_ADDR,
+        );
 
         expect(result).not.toBeNull();
         expect(result.name).toBe("Swap USDT \u2192 ETH");
@@ -345,9 +360,11 @@ describe("uniswap decoder", () => {
         expect(result.details.find((d) => d.label === "Amount").value).toBe(
             "Unlimited",
         );
+        // Its TAKE pays the From address, so the minimum is received.
         expect(
             result.details.find((d) => d.label === "Min. received").value,
         ).toBe("0.0002 ETH");
+        expect(labels).not.toContain("Paid to");
 
         // Real mainnet calldata is in the deployed shape, so its V4 step is
         // not said to be undecoded.
@@ -361,6 +378,9 @@ describe("uniswap decoder", () => {
             const result = uniswap.decode(
                 v4SwapCalldata(id, deployed),
                 ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
             );
             expect(detail(result, "Steps").value).toBe("V4 Swap");
         },
@@ -376,6 +396,9 @@ describe("uniswap decoder", () => {
             const result = uniswap.decode(
                 v4SwapCalldata(id, newer),
                 ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
             );
             expect(detail(result, "Amount")).toBeUndefined();
             expect(detail(result, "Min. received")).toBeUndefined();
@@ -406,7 +429,13 @@ describe("uniswap decoder", () => {
                 ],
                 9999999999n,
             );
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(detail(result, "Steps").value).toBe(
                 "V4 Swap (could not be decoded)",
             );
@@ -427,7 +456,13 @@ describe("uniswap decoder", () => {
                 [encodeV4Swap(new Uint8Array([id]), [newer])],
                 9999999999n,
             );
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(detail(result, "Steps").value).toBe(
                 "V4 Swap (could not be decoded)",
             );
@@ -457,7 +492,13 @@ describe("uniswap decoder", () => {
                 ],
                 9999999999n,
             );
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(result.name).toBe("Uniswap Swap");
             expect(detail(result, "Amount").value).toBe("2.0000 USDT");
             expect(detail(result, "Token Out").value).toBe(
@@ -485,7 +526,13 @@ describe("uniswap decoder", () => {
                 ],
                 9999999999n,
             );
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(result.name).toBe("Uniswap Swap");
             expect(detail(result, "Token In").value).toBe(
                 "Unknown (could not be decoded)",
@@ -507,7 +554,7 @@ describe("uniswap decoder", () => {
             ],
             9999999999n,
         );
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(detail(result, "Token Out").value).toBe(
             "Unknown (could not be decoded)",
         );
@@ -527,7 +574,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         expect(result.name).toBe("Swap USDT \u2192 WETH");
 
@@ -554,7 +601,7 @@ describe("uniswap decoder", () => {
             1767225600n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Swap USDC → WETH");
         expect(detail(result, "Token In").address).toBe(USDC_ADDR);
         expect(detail(result, "Token Out").address).toBe(WETH_ADDR);
@@ -586,7 +633,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Swap ETH → USDC");
 
         const amount = detail(result, "Amount");
@@ -615,7 +662,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Swap USDC → ETH");
         expect(detail(result, "Amount").value).toBe("Up to 1500.0000 USDC");
         expect(detail(result, "Token Out").value).toBe("ETH");
@@ -658,7 +705,13 @@ describe("uniswap decoder", () => {
                 9999999999n,
             );
 
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(detail(result, "Token Out").address).toBe(tokenOut);
             expect(detail(result, "Min. received").value).toBe(minReceived);
         },
@@ -679,14 +732,16 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Swap USDT → USDC");
         expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
         expect(detail(result, "Min. received").value).toBe("1.9000 USDC");
     });
 
     // Paid in ETH, with an exact-out step, the last swap step buys WETH, so
-    // UNWRAP_WETH makes the output ETH.
+    // UNWRAP_WETH makes the output ETH. That step is paid by the user, so the
+    // USDC the exact-out step bought stays in the router, and the minimum is
+    // not received (https://git.eeqj.de/sneak/AutistMask/issues/606).
     test("an ETH-paid swap whose last step buys WETH, then UNWRAP_WETH, shows ETH", () => {
         const data = buildExecute(
             solidityPacked(
@@ -712,9 +767,9 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(detail(result, "Token Out").value).toBe("ETH");
-        expect(detail(result, "Min. received").value).toBe("0.4000 ETH");
+        expect(detail(result, "Min. paid out").value).toBe("0.4000 ETH");
     });
 
     // Sepolia's WETH is a different contract; UNWRAP_WETH makes it ETH too.
@@ -731,7 +786,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(detail(result, "Token Out").value).toBe("ETH");
         expect(detail(result, "Min. received").value).toBe("0.0005 ETH");
     });
@@ -756,7 +811,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(detail(result, "Token Out").value).toBe(
             "Unknown (not named in the calldata)",
         );
@@ -779,7 +834,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         expect(result.name).toBe("Swap USDT \u2192 WETH");
     });
@@ -791,7 +846,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         const tokenIn = result.details.find((d) => d.label === "Token In");
@@ -814,12 +869,13 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         // UNWRAP_WETH means output is native ETH
         expect(result.name).toBe("Swap USDT \u2192 ETH");
     });
 
+    // No step pays anyone, so the minimum is not said to be received.
     test("decodes BALANCE_CHECK_ERC20 for min output", () => {
         const data = buildExecute(
             solidityPacked(["uint8", "uint8"], [0x0b, 0x0e]),
@@ -830,10 +886,10 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
-        const minOut = result.details.find((d) => d.label === "Min. received");
+        const minOut = result.details.find((d) => d.label === "Min. paid out");
         expect(minOut).toBeDefined();
         expect(minOut.value).toContain("2.0000");
         expect(minOut.value).toContain("USDT");
@@ -850,7 +906,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         // The V4 swap action's parameters are empty, so that step is said to
@@ -861,8 +917,226 @@ describe("uniswap decoder", () => {
         );
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/535 — every command's type
+    // was read from its low five bits, as only UniversalRouterV1 reads it, so
+    // the later routers listed 0x21 as a V3 exact-out swap, and
+    // UniversalRouterV2_1_2 listed 0x40 as a V3 exact-in swap.
+    test.each([
+        {
+            router: "UniversalRouterV1",
+            address: ROUTER_V1_ADDR,
+            command: "0x21",
+            steps: "V3 Swap (Exact Out)",
+        },
+        {
+            router: "UniversalRouterV2",
+            address: ROUTER_ADDR,
+            command: "0x21",
+            steps: "Execute Sub-Plan (its steps are not shown)",
+        },
+        {
+            router: "UniversalRouterV2_1_2",
+            address: ROUTER_V2_1_2_ADDR,
+            command: "0x21",
+            steps: "Execute Sub-Plan (its steps are not shown)",
+        },
+        {
+            router: "UniversalRouterV1",
+            address: ROUTER_V1_ADDR,
+            command: "0x40",
+            steps: "V3 Swap (Exact In)",
+        },
+        {
+            router: "UniversalRouterV2",
+            address: ROUTER_ADDR,
+            command: "0x40",
+            steps: "V3 Swap (Exact In)",
+        },
+        {
+            router: "UniversalRouterV2_1_2",
+            address: ROUTER_V2_1_2_ADDR,
+            command: "0x40",
+            steps: "Across Bridge Deposit",
+        },
+        // Only the routers with the 0x7f mask have 0x07, as
+        // PAY_PORTION_FULL_PRECISION; the others revert on it
+        // (https://git.eeqj.de/sneak/AutistMask/issues/599).
+        {
+            router: "UniversalRouterV1",
+            address: ROUTER_V1_ADDR,
+            command: "0x07",
+            steps: "Command 0x07",
+        },
+        {
+            router: "UniversalRouterV2",
+            address: ROUTER_ADDR,
+            command: "0x07",
+            steps: "Command 0x07",
+        },
+        {
+            router: "UniversalRouterV2_1_2",
+            address: ROUTER_V2_1_2_ADDR,
+            command: "0x07",
+            steps: "Pay Portion (Full Precision)",
+        },
+    ])(
+        "command $command sent to $router is listed as $steps",
+        ({ address, command, steps }) => {
+            const data = buildExecute(command, ["0x"], 9999999999n);
+            const result = uniswap.decode(data, address, "0x1");
+            expect(detail(result, "Steps").value).toBe(steps);
+        },
+    );
+
+    // A sub-plan holding a V3 swap of USDT for WETH, which the decoder does
+    // not read. With the allow-revert flag (0x80) the command byte is 0xa1,
+    // and the router lets the step fail
+    // (https://git.eeqj.de/sneak/AutistMask/issues/602).
+    test.each([
+        {
+            flag: "without",
+            command: 0x21,
+            steps: "Execute Sub-Plan (its steps are not shown)",
+        },
+        {
+            flag: "with",
+            command: 0xa1,
+            steps: "Execute Sub-Plan (its steps are not shown) (allowed to fail)",
+        },
+    ])(
+        "an EXECUTE_SUB_PLAN step $flag the allow-revert flag says its steps are not shown",
+        ({ command, steps }) => {
+            const subPlan = encodeSubPlan("0x00", [
+                encodeV3SwapExactIn(USER_ADDR, 2000000n, ONE_WETH, [
+                    USDT_ADDR,
+                    WETH_ADDR,
+                ]),
+            ]);
+            const data = buildExecute(
+                solidityPacked(["uint8"], [command]),
+                [subPlan],
+                9999999999n,
+            );
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
+            expect(result.name).toBe("Uniswap Swap");
+            expect(detail(result, "Steps").value).toBe(steps);
+            // The sub-plan names both currencies, so the lines must not say
+            // the calldata did not.
+            expect(detail(result, "Token In").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Token Out").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Amount")).toBeUndefined();
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
+    // The steps inside a sub-plan may spend the user's tokens or pay the user,
+    // so the steps read beside it are not the whole swap, whether they come
+    // before it or after it. No side is named and no figure is given.
+    test.each([
+        {
+            // 2,000 USDT for at least 1 WETH, paid to the router; the sub-plan
+            // swaps that WETH for USDC.
+            beside: "a swap before",
+            commands: "0x0021",
+            inputs: [
+                encodeV3SwapExactIn(ROUTER_ADDR, 2000000000n, ONE_WETH, [
+                    USDT_ADDR,
+                    WETH_ADDR,
+                ]),
+                encodeSubPlan("0x00", [
+                    encodeV3SwapExactIn(USER_ADDR, ONE_WETH, 2000000000n, [
+                        WETH_ADDR,
+                        USDC_ADDR,
+                    ]),
+                ]),
+            ],
+            steps: "V3 Swap (Exact In) \u2192 Execute Sub-Plan (its steps are not shown)",
+        },
+        {
+            // The sub-plan buys WETH with the user's USDC; 1 WETH is then
+            // swapped for at least 2,000 DAI.
+            beside: "a swap after",
+            commands: "0x2100",
+            inputs: [
+                encodeSubPlan("0x00", [
+                    encodeV3SwapExactIn(ROUTER_ADDR, 2000000000n, ONE_WETH, [
+                        USDC_ADDR,
+                        WETH_ADDR,
+                    ]),
+                ]),
+                encodeV3SwapExactIn(USER_ADDR, ONE_WETH, 2000n * ONE_WETH, [
+                    WETH_ADDR,
+                    DAI_ADDR,
+                ]),
+            ],
+            steps: "Execute Sub-Plan (its steps are not shown) \u2192 V3 Swap (Exact In)",
+        },
+        {
+            // A permit among the sub-plan's steps would replace this one.
+            beside: "a permit before",
+            commands: "0x0a21",
+            inputs: [encodePermit2(USDT_ADDR, 1000000n, ROUTER_ADDR), "0x"],
+            steps: "Permit2 Permit \u2192 Execute Sub-Plan (its steps are not shown)",
+        },
+        {
+            // The sub-plan buys USDC for the user; an UNWRAP_WETH of 0
+            // follows. No step outside the sub-plan sets the output side, and
+            // UNWRAP_WETH would then make Token Out ETH.
+            beside: "an UNWRAP_WETH after",
+            commands: "0x210c",
+            inputs: [
+                encodeSubPlan("0x00", [
+                    encodeV3SwapExactIn(USER_ADDR, 2000000000n, 1900000000n, [
+                        USDT_ADDR,
+                        USDC_ADDR,
+                    ]),
+                ]),
+                encodeWrapEth(USER_ADDR, 0n), // UNWRAP_WETH, same encoding
+            ],
+            steps: "Execute Sub-Plan (its steps are not shown) \u2192 Unwrap WETH",
+        },
+    ])(
+        "$beside an EXECUTE_SUB_PLAN step does not name either side",
+        ({ commands, inputs, steps }) => {
+            const data = buildExecute(commands, inputs, 9999999999n);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
+            expect(detail(result, "Steps").value).toBe(steps);
+            expect(result.name).toBe("Uniswap Swap");
+            expect(detail(result, "Token In").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Amount")).toBeUndefined();
+            expect(detail(result, "Token Out").value).toBe(
+                "Unknown (could not be decoded)",
+            );
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
     test("shows the deadline as a UTC date and time", () => {
-        const result = uniswap.decode(FIRST_SWAP_CALLDATA, ROUTER_ADDR);
+        const result = uniswap.decode(
+            FIRST_SWAP_CALLDATA,
+            ROUTER_ADDR,
+            "0x1",
+            {},
+            USER_ADDR,
+        );
         expect(detail(result, "Deadline").value).toBe("2026-02-27 08:25:51");
     });
 
@@ -880,7 +1154,7 @@ describe("uniswap decoder", () => {
             2n ** 256n - 1n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         expect(result.name).toBe("Swap USDT \u2192 WETH");
         expect(detail(result, "Deadline").value).toBe(
@@ -895,7 +1169,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         const amount = result.details.find((d) => d.label === "Amount");
@@ -970,7 +1244,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         // Before decodeV4Swap fix: name would be "Swap USDT → ETH" or "Uniswap Swap"
         // After fix: correctly identifies both tokens from V4 sub-actions
@@ -1004,7 +1278,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         // The amount and the token it is counted in come from the same hop.
@@ -1044,7 +1318,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toBe(
@@ -1089,7 +1363,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toContain("USDC");
@@ -1118,7 +1392,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toContain("USDC");
@@ -1155,7 +1429,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token In").value).toContain("WETH");
@@ -1172,9 +1446,12 @@ describe("uniswap decoder", () => {
     // are written. Each is tried with three endings: SETTLE_ALL and TAKE_ALL,
     // SETTLE and TAKE, and CLOSE_CURRENCY for each currency, which leaves the
     // sides to the swap actions alone.
+    // `minLabel` is the minimum's line: with no TAKE or TAKE_ALL, no step
+    // pays the user, so it is not said to be received.
     const V4_STEP_ENDINGS = [
         {
             ending: "SETTLE_ALL and TAKE_ALL",
+            minLabel: "Min. received",
             ids: [V4_SETTLE_ALL_ID, V4_TAKE_ALL_ID],
             params: [
                 encodeV4SettleAll(USDT_ADDR, 1000000000n),
@@ -1183,11 +1460,13 @@ describe("uniswap decoder", () => {
         },
         {
             ending: "SETTLE and TAKE",
+            minLabel: "Min. received",
             ids: [V4_SETTLE_ID, V4_TAKE_ID],
             params: [encodeV4Settle(USDT_ADDR), encodeV4Take(USDC_ADDR)],
         },
         {
             ending: "CLOSE_CURRENCY",
+            minLabel: "Min. paid out",
             ids: [
                 V4_CLOSE_CURRENCY_ID,
                 V4_CLOSE_CURRENCY_ID,
@@ -1336,7 +1615,7 @@ describe("uniswap decoder", () => {
         ),
     )(
         "a V4 step of $step, then $ending, reads Swap USDT → USDC",
-        ({ swaps, ids, params, amount, min }) => {
+        ({ swaps, ids, params, amount, min, minLabel }) => {
             const data = buildExecute(
                 "0x10",
                 [
@@ -1348,12 +1627,18 @@ describe("uniswap decoder", () => {
                 9999999999n,
             );
 
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(result.name).toBe("Swap USDT → USDC");
             expect(detail(result, "Token In").address).toBe(USDT_ADDR);
             expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
             expect(detail(result, "Amount")?.value).toBe(amount);
-            expect(detail(result, "Min. received")?.value).toBe(min);
+            expect(detail(result, minLabel)?.value).toBe(min);
         },
     );
 
@@ -1400,7 +1685,13 @@ describe("uniswap decoder", () => {
                 9999999999n,
             );
 
-            const result = uniswap.decode(data, ROUTER_ADDR);
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
             expect(detail(result, "Steps").value).toBe(
                 "V4 Swap (could not be decoded)",
             );
@@ -1459,7 +1750,7 @@ describe("uniswap decoder", () => {
             ],
             9999999999n,
         );
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Uniswap Swap");
         expect(detail(result, "Token In").address).toBe(
             USDT_ADDR.toLowerCase(),
@@ -1515,7 +1806,7 @@ describe("uniswap decoder", () => {
             ],
             9999999999n,
         );
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Uniswap Swap");
         expect(detail(result, "Token In").value).toBe(
             "Unknown (not named in the calldata)",
@@ -1538,7 +1829,7 @@ describe("uniswap decoder", () => {
             ],
             9999999999n,
         );
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(detail(result, "Token Out").value).toBe(
             "Unknown (not named in the calldata)",
         );
@@ -1572,7 +1863,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result.name).toBe("Swap USDT → USDC");
         expect(detail(result, "Token In").address).toBe(USDT_ADDR);
         expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
@@ -1596,7 +1887,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token In").value).toContain("USDT");
@@ -1627,7 +1918,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toContain("WETH");
@@ -1648,7 +1939,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toContain("USDC");
@@ -1656,7 +1947,8 @@ describe("uniswap decoder", () => {
     });
 
     // With no minimum stated before it, a zero balance check is what sets the
-    // output side, and it guarantees nothing.
+    // output side, and it guarantees nothing. No step pays anyone, so the
+    // minimum is not said to be received.
     test("a zero balance check with no earlier minimum states no minimum", () => {
         const data = buildExecute(
             solidityPacked(["uint8", "uint8"], [0x0b, 0x0e]),
@@ -1667,11 +1959,11 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
         expect(detail(result, "Token Out").value).toContain("USDT");
-        expect(detail(result, "Min. received").value).toBe(
+        expect(detail(result, "Min. paid out").value).toBe(
             "None (no minimum guaranteed)",
         );
     });
@@ -1687,7 +1979,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         expect(result.name).toBe("Uniswap Swap");
 
@@ -1707,7 +1999,7 @@ describe("uniswap decoder", () => {
             9999999999n,
         );
 
-        const result = uniswap.decode(data, ROUTER_ADDR);
+        const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
         expect(result.name).toBe("Uniswap Swap");
 

tests/uniswapRouterAddress.test.js

@@ -0,0 +1,298 @@
+// Which transactions are shown as a swap through the Uniswap Universal Router
+// (https://git.eeqj.de/sneak/AutistMask/issues/520).
+//
+// The decoder used to recognise the router's execute() call by its selector
+// alone, so the same calldata sent to an ordinary address was shown as a swap
+// through the router, with that address as its Protocol. It is now decoded
+// only when the transaction is sent to a Universal Router deployment on the
+// network it is for; anywhere else it is left to the raw data.
+//
+// The transaction detail screen and the approval screen are driven against a
+// minimal DOM stub in the shape tests/tokenTransferDetail.test.js uses, the
+// approval screen opened the way tests/swapStatusAmount.test.js opens it.
+
+const { AbiCoder, Interface, getAddress, solidityPacked } = require("ethers");
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: async (url) => ({
+        ok: true,
+        json: async () => mockExplorerAnswer(url),
+    }),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const approval = require("../src/popup/views/approval");
+const { decodeCalldata } = approval;
+const transactionDetail = require("../src/popup/views/transactionDetail");
+
+const MAINNET = "0x1";
+const SEPOLIA = "0xaa36a7";
+
+// From Uniswap's deployment files: one router on Ethereum Mainnet only, one on
+// Sepolia only, and one at the same address on both.
+const MAINNET_ROUTER = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
+const SEPOLIA_ROUTER = "0x3a9d48ab9751398bbfa63ad67599bb04e4bdf98b";
+const ROUTER_ON_BOTH = "0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD";
+// The address with no code from the issue.
+const ORDINARY = "0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A";
+
+const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const SEPOLIA_WETH = "0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14";
+const TOKEN = "0xE2E0000000000000000000000000000000000E2e";
+const HUNDREDTH_ETH = 10000000000000000n;
+
+const coder = AbiCoder.defaultAbiCoder();
+const routerIface = new Interface([
+    "function execute(bytes commands, bytes[] inputs, uint256 deadline)",
+]);
+
+// The calldata from the issue: wrap 0.01 ETH, then a V3 swap of it into a
+// token.
+const SWAP_DATA = routerIface.encodeFunctionData("execute", [
+    solidityPacked(["uint8", "uint8"], [0x0b, 0x00]),
+    [
+        coder.encode(["address", "uint256"], [RECIPIENT, HUNDREDTH_ETH]),
+        coder.encode(
+            ["address", "uint256", "uint256", "bytes", "bool"],
+            [
+                RECIPIENT,
+                HUNDREDTH_ETH,
+                1n,
+                solidityPacked(
+                    ["address", "uint24", "address"],
+                    [SEPOLIA_WETH, 3000, TOKEN],
+                ),
+                false,
+            ],
+        ),
+    ],
+    9999999999n,
+]);
+
+beforeEach(() => {
+    state.trackedTokens = [];
+    state.wallets = [];
+});
+
+describe("execute() calldata on the approval screen's decoder", () => {
+    test("sent to a router on the transaction's network, it is a swap", () => {
+        const onMainnet = decodeCalldata(SWAP_DATA, MAINNET_ROUTER, MAINNET);
+        expect(onMainnet.description).toBe("Swap via Uniswap Universal Router");
+        expect(onMainnet.details[0]).toMatchObject({
+            label: "Protocol",
+            address: MAINNET_ROUTER,
+        });
+        expect(
+            decodeCalldata(SWAP_DATA, SEPOLIA_ROUTER, SEPOLIA).description,
+        ).toBe("Swap via Uniswap Universal Router");
+    });
+
+    test("sent to an ordinary address, it is not decoded", () => {
+        expect(decodeCalldata(SWAP_DATA, ORDINARY, MAINNET)).toBeNull();
+        expect(decodeCalldata(SWAP_DATA, ORDINARY, SEPOLIA)).toBeNull();
+    });
+
+    test("sent to a router of the other network only, it is not decoded", () => {
+        expect(decodeCalldata(SWAP_DATA, SEPOLIA_ROUTER, MAINNET)).toBeNull();
+        expect(decodeCalldata(SWAP_DATA, MAINNET_ROUTER, SEPOLIA)).toBeNull();
+    });
+
+    test("a router deployed at the same address on both networks is one on each", () => {
+        expect(
+            decodeCalldata(SWAP_DATA, ROUTER_ON_BOTH, MAINNET),
+        ).not.toBeNull();
+        expect(
+            decodeCalldata(SWAP_DATA, ROUTER_ON_BOTH, SEPOLIA),
+        ).not.toBeNull();
+    });
+
+    test("the router address matches in any letter case", () => {
+        const upper = "0x" + MAINNET_ROUTER.slice(2).toUpperCase();
+        for (const address of [getAddress(MAINNET_ROUTER), upper]) {
+            expect(decodeCalldata(SWAP_DATA, address, MAINNET)).not.toBeNull();
+        }
+    });
+});
+
+// The transaction the explorer reports: SWAP_DATA, sent to `mockSentTo`.
+const TX_HASH = "0x" + "5".repeat(64);
+let mockSentTo = null;
+
+function mockExplorerAnswer(url) {
+    if (url.endsWith("/transactions/" + TX_HASH)) {
+        return {
+            to: { hash: mockSentTo },
+            raw_input: SWAP_DATA,
+            method: "execute",
+        };
+    }
+    return {};
+}
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        style: {},
+        dataset: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: () => false,
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Open the transaction detail screen with Sepolia active, for the
+// transaction the explorer reports sent to `sentTo`, and wait for its
+// decoded details.
+async function showDetailSentTo(sentTo) {
+    mockSentTo = sentTo;
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" } };
+    state.networkId = "sepolia";
+    state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.viewData = {};
+    state.viewStack = [];
+    state.currentView = null;
+    transactionDetail.show({
+        hash: TX_HASH,
+        from: RECIPIENT,
+        to: sentTo,
+        value: "",
+        symbol: "SepoliaETH",
+        timestamp: 1790000000,
+        isError: false,
+        direction: "contract",
+        directionLabel: "Swap",
+        method: "execute",
+        chainId: SEPOLIA,
+    });
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+describe("execute() calldata on the transaction detail screen", () => {
+    test("sent to a router on the active network, it is a swap", async () => {
+        await showDetailSentTo(SEPOLIA_ROUTER);
+        expect(node("tx-detail-calldata-details").innerHTML).toContain(
+            "Swap via Uniswap Universal Router",
+        );
+    });
+
+    test("sent to an ordinary address, it is not decoded", async () => {
+        await showDetailSentTo(ORDINARY);
+        expect(node("tx-detail-calldata-action").textContent).toBe("execute");
+        expect(node("tx-detail-calldata-details").innerHTML).toBe("");
+        expect(node("tx-detail-rawdata").innerHTML).toContain(SWAP_DATA);
+    });
+
+    test("sent to a router of the other network only, it is not decoded", async () => {
+        await showDetailSentTo(MAINNET_ROUTER);
+        expect(node("tx-detail-calldata-action").textContent).toBe("execute");
+        expect(node("tx-detail-calldata-details").innerHTML).toBe("");
+        expect(node("tx-detail-rawdata").innerHTML).toContain(SWAP_DATA);
+    });
+});
+
+// Open the approval screen with Ethereum Mainnet active, for a site's Sepolia
+// transaction that sends SWAP_DATA to `sentTo`.
+async function showApprovalSentTo(sentTo) {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" }, close: () => {} };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (_msg, reply) =>
+            reply({
+                type: "tx",
+                origin: "https://dapp.example",
+                isPhishingDomain: false,
+                approvedFrom: RECIPIENT,
+                approvedTx: {
+                    type: 2,
+                    from: RECIPIENT,
+                    chainId: SEPOLIA,
+                    nonce: "0x7",
+                    gasLimit: "0x30d40",
+                    maxPriorityFeePerGas: "0x3b9aca00",
+                    maxFeePerGas: "0x77359400",
+                    to: sentTo,
+                    value: "0x" + HUNDREDTH_ETH.toString(16),
+                    data: SWAP_DATA,
+                    accessList: [],
+                },
+            }),
+    };
+    state.networkId = "mainnet";
+    state.currentView = null;
+    await approval.show(1);
+}
+
+// The router is on Sepolia's list only, so the swap is shown only if the
+// screen decodes for the transaction's network: on Ethereum Mainnet, the
+// active network, that address is not a router.
+describe("execute() calldata on the approval screen, for a Sepolia transaction while Ethereum Mainnet is active", () => {
+    test("sent to a router on Sepolia, it is a swap", async () => {
+        await showApprovalSentTo(SEPOLIA_ROUTER);
+        expect(node("approve-tx-decoded").classList.contains("hidden")).toBe(
+            false,
+        );
+        expect(node("approve-tx-decoded-details").innerHTML).toContain(
+            "Swap via Uniswap Universal Router",
+        );
+    });
+
+    test("sent to an ordinary address, it is shown as raw data", async () => {
+        await showApprovalSentTo(ORDINARY);
+        expect(node("approve-tx-decoded").classList.contains("hidden")).toBe(
+            true,
+        );
+        expect(node("approve-tx-decoded-details").innerHTML).toBe("");
+        expect(node("approve-tx-data").textContent).toBe(SWAP_DATA);
+        expect(
+            node("approve-tx-data-section").classList.contains("hidden"),
+        ).toBe(false);
+    });
+});

tests/uniswapTokenOut.test.js

@@ -53,7 +53,14 @@ function unwrapData() {
 }
 
 function detail(data, label, sources) {
-    const decoded = uniswap.decode(data, ROUTER, sources || {});
+    // Sent by the address the swap pays, so the output is the user's.
+    const decoded = uniswap.decode(
+        data,
+        ROUTER,
+        "0x1",
+        sources || {},
+        RECIPIENT,
+    );
     return decoded.details.find((d) => d.label === label);
 }
 

tests/uniswapUndeterminedTokenIn.test.js

@@ -71,6 +71,8 @@ function exactInParams(currencyIn, path, amountIn, amountOutMin) {
 
 // BALANCE_CHECK_ERC20 (command 0x0e): (address owner, address token,
 // uint256 minBalance). It names the output token and nothing about the input.
+// Its owner is USER, the transaction's sender: a check of any other address
+// names no output token.
 function balanceCheck(token, minBalance) {
     return coder.encode(
         ["address", "address", "uint256"],
@@ -78,8 +80,13 @@ function balanceCheck(token, minBalance) {
     );
 }
 
+// A transaction from USER.
+function decode(data) {
+    return uniswap.decode(data, ROUTER, "0x1", {}, USER);
+}
+
 function detail(data, label) {
-    const decoded = uniswap.decode(data, ROUTER, {});
+    const decoded = decode(data);
     expect(decoded).not.toBeNull();
     return decoded.details.find((d) => d.label === label);
 }
@@ -87,7 +94,7 @@ function detail(data, label) {
 describe("an execute() whose input currency never decoded", () => {
     // A V4_SWAP whose sub-action params do not decode — an action encoding
     // this decoder does not know — leaves every V4 token null. The
-    // BALANCE_CHECK still names the output, so the screen has a Min. received
+    // BALANCE_CHECK still names the output, so the screen has a minimum
     // figure and a Token Out, and previously claimed the user was paying ETH
     // for them.
     const data = () =>
@@ -113,7 +120,7 @@ describe("an execute() whose input currency never decoded", () => {
     });
 
     test("does not name ETH in the swap title either", () => {
-        expect(uniswap.decode(data(), ROUTER, {}).name).toBe("Uniswap Swap");
+        expect(decode(data()).name).toBe("Uniswap Swap");
     });
 });
 
@@ -123,12 +130,13 @@ describe("an execute() that names only an output token", () => {
 
     test("refuses the input rather than defaulting it to ETH", () => {
         expect(detail(data(), "Token In").value).toBe(REFUSAL);
-        expect(uniswap.decode(data(), ROUTER, {}).name).toBe("Uniswap Swap");
+        expect(decode(data()).name).toBe("Uniswap Swap");
     });
 
     test("still states the output it did establish", () => {
         expect(detail(data(), "Token Out").value).toContain("USDT");
-        expect(detail(data(), "Min. received").value).toBe("2.0000 USDT");
+        // No step pays anyone, so the minimum is not said to be received.
+        expect(detail(data(), "Min. paid out").value).toBe("2.0000 USDT");
     });
 });
 
@@ -170,7 +178,7 @@ describe("native ETH in, which V4 spells as the zero address", () => {
 
         expect(detail(data, "Token In").value).toBe("ETH (native)");
         expect(detail(data, "Amount").value).toBe("1.0000 ETH");
-        expect(uniswap.decode(data, ROUTER, {}).name).toBe("Swap ETH → USDT");
+        expect(decode(data).name).toBe("Swap ETH → USDT");
     });
 
     test("WRAP_ETH is still ETH at 18 decimals", () => {

tests/uniswapUndeterminedTokenOut.test.js

@@ -105,7 +105,7 @@ function v3ExactIn(tokenIn, tokenOut, amountIn, amountOutMin) {
 }
 
 function detail(data, label) {
-    const decoded = uniswap.decode(data, ROUTER, {});
+    const decoded = uniswap.decode(data, ROUTER, "0x1", {}, USER);
     expect(decoded).not.toBeNull();
     return decoded.details.find((d) => d.label === label);
 }
@@ -134,13 +134,15 @@ describe("a V4 step that states a Min. received but no output currency", () => {
     });
 
     test("refuses to scale Min. received rather than assuming 18", () => {
-        expect(detail(data(), "Min. received").value).toBe(
+        // With no TAKE, no step pays the user either, so the line is not
+        // labelled received.
+        expect(detail(data(), "Min. paid out").value).toBe(
             unknownDecimalsAmount(MIN_OUT),
         );
     });
 
     test("does not name ETH in the swap title either", () => {
-        const decoded = uniswap.decode(data(), ROUTER, {});
+        const decoded = uniswap.decode(data(), ROUTER, "0x1", {});
         expect(decoded.name).toBe("Uniswap Swap");
     });
 });
@@ -206,6 +208,8 @@ describe("native ETH out, which V4 spells as the zero address", () => {
     test("is still named ETH and still scaled at 18 decimals", () => {
         expect(detail(data(), "Token Out").value).toBe("ETH");
         expect(detail(data(), "Min. received").value).toBe("0.5000 ETH");
-        expect(uniswap.decode(data(), ROUTER, {}).name).toBe("Swap USDT → ETH");
+        expect(uniswap.decode(data(), ROUTER, "0x1", {}).name).toBe(
+            "Swap USDT → ETH",
+        );
     });
 });

tests/uniswapUnknownDecimals.test.js

@@ -82,7 +82,8 @@ function walletsHolding(token, decimals) {
 // decodeCalldata() rather than uniswap.decode() directly, because the scale
 // sources the screen supplies are part of what is under test.
 function swapDetail(data, label) {
-    const decoded = decodeCalldata(data, ROUTER);
+    // Sent by the address the swap pays, so the output is the user's.
+    const decoded = decodeCalldata(data, ROUTER, "0x1", RECIPIENT);
     return decoded.details.find((d) => d.label === label);
 }
 

tests/unknownScaleSend.test.js

@@ -39,7 +39,8 @@ jest.mock("../src/shared/log", () => ({
 
 // Everything the confirmation screen would reach the network for. The gas
 // estimate is the point: with a usable scale it must succeed, so that a failure
-// in these tests is a failure of the scale and not of the stub.
+// in these tests is a failure of the scale and not of the stub. The address
+// holds the 1 ETH the wallets below record, and `tokenUnits` of the token.
 const mockProvider = {
     getFeeData: async () => ({
         maxFeePerGas: 2000000000n,
@@ -48,7 +49,14 @@ const mockProvider = {
     estimateGas: async () => 21000n,
     getCode: async () => "0x",
     getTransactionCount: async () => 1,
-    getBalance: async () => 0n,
+    getBalance: async () => 1000000000000000000n,
+    tokenUnits: 0n,
+    // The one contract call the screen makes, balanceOf().
+    call: async () =>
+        AbiCoder.defaultAbiCoder().encode(
+            ["uint256"],
+            [mockProvider.tokenUnits],
+        ),
 };
 
 jest.mock("../src/shared/balances", () => {
@@ -114,7 +122,7 @@ global.document = {
 };
 global.navigator = { clipboard: { writeText() {} } };
 
-const { parseUnits } = require("ethers");
+const { AbiCoder, parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");
 const { debugFetch } = require("../src/shared/log");
 const { state } = require("../src/shared/state");
@@ -155,8 +163,9 @@ function row(token = {}, value = FIVE_WETH) {
 }
 
 // Fetch the explorer's rows through the real fetcher and put them exactly where
-// refreshBalances() puts them.
+// refreshBalances() puts them. The node reports the holding the explorer does.
 async function fetchOnto(items) {
+    mockProvider.tokenUnits = BigInt(items[0].value);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
@@ -181,6 +190,7 @@ async function fetchOnto(items) {
 // is from the first. Two addresses is what it takes to reach
 // explorerDecimals()'s disagreement check, which is only reachable across rows.
 async function fetchOntoBoth(itemsA, itemsB) {
+    mockProvider.tokenUnits = BigInt(itemsA[0].value);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
@@ -239,6 +249,12 @@ function errors() {
     return el("confirm-errors").innerHTML;
 }
 
+// The message for an amount the balance does not cover, while it is shown.
+function balanceError() {
+    const box = el("confirm-balance-error");
+    return box.style.visibility === "visible" ? box.textContent : "";
+}
+
 function sendDisabled() {
     return el("btn-confirm-send").disabled;
 }
@@ -270,7 +286,6 @@ describe("the Send screen resolves the scale rather than reading the stored one"
         const txInfo = await reviewSend(WETH, "1.5");
         expect(txInfo.tokenDecimals).toBe(18);
         expect(txInfo.tokenDecimals).not.toBe(balances[0].decimals);
-        expect(txInfo.tokenBalance).toBe("5.0");
     });
 
     test("that scale estimates a fee and leaves Send enabled", async () => {
@@ -307,11 +322,10 @@ describe("the Send screen resolves the scale rather than reading the stored one"
         // No fallback was introduced: resolution answers null here, and the
         // null is what goes forward.
         expect(txInfo.tokenDecimals).toBeNull();
-        expect(txInfo.tokenBalance).toBeNull();
         confirmTx.show(txInfo);
         await settle();
         expect(text("confirm-balance")).toBe("unknown (NOVEL)");
-        expect(errors()).toContain("This token's balance is unknown");
+        expect(balanceError()).toContain("This token's balance is unknown");
         expect(sendDisabled()).toBe(true);
     });
 });
@@ -355,7 +369,8 @@ describe("a scale the explorer's own rows disagree about", () => {
         const txInfo = await reviewSend(NOVEL, "1.5");
         expect(txInfo.tokenDecimals).toBeNull();
         // The regression this closes: null scale alongside a non-null balance.
-        expect(txInfo.tokenBalance).toBeNull();
+        send.updateSendBalance();
+        expect(text("send-balance")).toBe("Current balance: unknown (NOVEL)");
     });
 
     test("so the user is told the balance is unknown, not only that the fee failed", async () => {
@@ -367,8 +382,7 @@ describe("a scale the explorer's own rows disagree about", () => {
         // confirm-fee-unknown-error — "the network fee could not be
         // estimated... please go back and try again" — as the only explanation
         // for a screen that can never proceed.
-        expect(errors()).not.toBe("");
-        expect(errors()).toContain("This token's balance is unknown");
+        expect(balanceError()).toContain("This token's balance is unknown");
         expect(text("confirm-balance")).toBe("unknown (NOVEL)");
         expect(sendDisabled()).toBe(true);
         // The fee line still reports the estimate as unavailable, because it
@@ -434,31 +448,20 @@ describe("a scale the explorer's own rows disagree about", () => {
         expect(text("send-balance")).toBe("Current balance: 5.0000 NOVEL");
         const txInfo = await reviewSend(NOVEL, "1.5");
         expect(txInfo.tokenDecimals).toBe(6);
-        expect(txInfo.tokenBalance).toBe("5.0");
         confirmTx.show(txInfo);
         await settle();
         expect(text("confirm-balance")).toBe("5.0000 NOVEL");
         expect(errors()).toBe("");
+        expect(balanceError()).toBe("");
         expect(sendDisabled()).toBe(false);
     });
 });
 
 describe("the confirmation screen tells an unknown balance from a zero one", () => {
-    function txInfo(tokenBalance) {
-        return {
-            from: HOLDER,
-            to: RECIPIENT,
-            ensName: null,
-            amount: "1.5",
-            token: NOVEL,
-            balance: "1.0",
-            tokenSymbol: "NOVEL",
-            tokenBalance,
-            tokenDecimals: tokenBalance === null ? null : 18,
-        };
-    }
-
-    async function render(tokenBalance) {
+    // A send of 1.5 NOVEL from an address the node reports none of, with the
+    // token's scale `tokenDecimals`, or null for a scale nobody knows.
+    async function render(tokenDecimals) {
+        mockProvider.tokenUnits = 0n;
         state.wallets = [
             {
                 name: "Wallet 1",
@@ -469,30 +472,40 @@ describe("the confirmation screen tells an unknown balance from a zero one", ()
         ];
         state.selectedWallet = 0;
         state.selectedAddress = 0;
-        confirmTx.show(txInfo(tokenBalance));
+        confirmTx.show({
+            from: HOLDER,
+            to: RECIPIENT,
+            ensName: null,
+            amount: "1.5",
+            token: NOVEL,
+            tokenSymbol: "NOVEL",
+            tokenDecimals,
+        });
         await settle();
-        return { balance: text("confirm-balance"), errors: errors() };
+        return { balance: text("confirm-balance"), message: balanceError() };
     }
 
     test("the balance line states unknown rather than a quantity of zero", async () => {
         const unknown = await render(null);
-        const zero = await render("0.0");
+        const zero = await render(18);
         expect(unknown.balance).not.toBe(zero.balance);
         expect(unknown.balance).toBe("unknown (NOVEL)");
         expect(zero.balance).toBe("0.0000 NOVEL");
     });
 
     // Both hit INSUFFICIENT_TOKEN — an unknown balance is treated as nothing to
-    // spend from, which is the fail-closed side — but "you have 0.0" is a claim
-    // about the holding, and this one has no established quantity to claim.
-    test("the insufficient-balance message names the reason, not a figure", async () => {
+    // spend from, which is the fail-closed side — but "your balance does not
+    // cover this amount" is a claim about the holding, and this one has no
+    // established quantity to claim.
+    test("the insufficient-balance message names the reason, not a shortfall", async () => {
         const unknown = await render(null);
-        const zero = await render("0.0");
-        expect(unknown.errors).not.toBe(zero.errors);
-        expect(unknown.errors).toContain("This token's balance is unknown");
-        expect(unknown.errors).not.toContain("You have");
-        expect(zero.errors).toContain("You have 0.0000 NOVEL");
-        expect(zero.errors).not.toContain("balance is unknown");
+        const zero = await render(18);
+        expect(unknown.message).toContain("This token's balance is unknown");
+        expect(unknown.message).not.toContain("does not cover");
+        expect(zero.message).toBe(
+            "Your NOVEL balance does not cover this amount. Please go back and" +
+                " send a smaller amount.",
+        );
     });
 });