fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout for history
and token lookups, and each recipient to Etherscan for its label. Two settings,
"Use Blockscout" and "Check recipients on Etherscan", now gate those requests
where they are made. Both are off in a new profile and offered unticked on
Welcome and in Settings. While one is off, the screens that relied on it say so
in a plain line naming the setting; after either changes in Settings, Back
draws the screen it lands on again. ENS lookups ask only the RPC endpoint, so a
name resolved off-chain does not resolve. README and the user guide say what is
contacted by default and what each setting adds.

Model: opus-5-5

docs/README.md

@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No third-party token list APIs.** Token balances come from the same block
-  explorer you configure for transaction history, and the extension ships its
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
-  detection. Any token you want tracked across all your addresses, you add
-  yourself by contract address.
+- **No third-party token list APIs.** The balances of the tokens you track are
+  read from your RPC endpoint; while you have "Use Blockscout" on, the others
+  come from the same block explorer you configure for transaction history. The
+  extension ships its own hardcoded list of top ERC-20 contract addresses for
+  symbol-spoofing detection. Any token you want tracked across all your
+  addresses, you add yourself by contract address.
 
 - **No backend servers operated by the developer.** Nothing is sent to any
   server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,11 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
-three you configure yourself, and two fixed ones used for scam detection.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing
+but token symbols. Blockscout and Etherscan are sent none of your data until you
+turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome
+screen or later in Settings. Both are off in a new install.
 
 ### External Services
 
@@ -96,16 +100,23 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
-Used to fetch token balances and transaction history. Blockscout is an
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
-transactions and token transfers. You can change this in Settings to a
-self-hosted Blockscout instance.
+Off until you turn on "Use Blockscout". Used to fetch transaction history, the
+balances of the tokens you have not tracked, and the details of a transaction
+you open. Blockscout is an open-source blockchain explorer. AutistMask queries
+it for your ERC-20 token balances (including the holder counts used for spam
+filtering), your recent transactions and token transfers, and the block, fees
+and calldata of a transaction you open. You can change this in Settings to a
+self-hosted Blockscout instance. While it is off, the screens that would show
+history say so, and only the tokens you track are listed.
 
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
+When it is contacted: while "Use Blockscout" is on, on every balance refresh,
+whenever a screen showing transaction history is opened, and when you open a
+transaction. The one exception, whether or not the setting is on, is pressing
+"Save" beside the Blockscout URL in Settings, which checks that URL by asking it
+for `/stats` and sends none of your data.
 
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+What gets sent: your Ethereum addresses (to look up balances and transactions)
+and the hash of each transaction you open.
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
@@ -122,13 +133,16 @@ address.
 
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
+Off until you turn on "Check recipients on Etherscan". When you review a send,
+AutistMask fetches the recipient's public Etherscan address page and looks for a
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
+it finds one. This is a plain page fetch with no API key, made by your browser.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
+user-configurable. While it is off, the confirmation screen says that no
+Etherscan check was made.
 
-When it is contacted: each time you reach the send confirmation screen.
+When it is contacted: only while "Check recipients on Etherscan" is on, each
+time you reach the send confirmation screen.
 
 What gets sent: the recipient address you are about to send to, and your IP
 address. Your own addresses are not sent.
@@ -185,6 +199,9 @@ password.
 
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+   On first use the same screen offers "Use Blockscout" and "Check recipients on
+   Etherscan", both off; tick either if you want what it does (see External
+   Services). You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
    recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +237,11 @@ always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-Tokens you hold show up automatically only if they are in the extension's
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
+Tokens you hold show up automatically only while "Use Blockscout" is on, and
+then only if they are in the extension's bundled list of well-known tokens or
+have at least 1,000 holders; everything else is treated as spam and hidden. To
+track a token explicitly (which also shows it at zero balance, and shows it
+whether or not "Use Blockscout" is on), add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -389,8 +407,10 @@ Click the gear icon on the home screen to access settings:
   that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
-- **Blockscout API**: Change the Blockscout instance used for token balances and
-  transaction history. You can use a self-hosted instance.
+- **Blockscout API**: "Use Blockscout", off until you tick it, and the
+  Blockscout instance used for transaction history, the tokens you have not
+  tracked and transaction details. You can use a self-hosted instance.
+- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.

package.json

@@ -13,6 +13,11 @@
         "fmt": "prettier --write .",
         "fmt-check": "prettier --check ."
     },
+    "jest": {
+        "setupFiles": [
+            "<rootDir>/tests/support/navigatorLocks.js"
+        ]
+    },
     "devDependencies": {
         "@eslint/js": "10.0.1",
         "@tailwindcss/cli": "4.3.1",

src/background/index.js

@@ -1379,6 +1379,13 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // balances that came back — by address, onto whatever storage holds NOW.
 // Applying by address rather than writing the array back is what keeps a
 // wallet or address added, renamed or deleted during the round trip.
+//
+// Nothing is applied when the network stored NOW is not the one the refresh
+// ran on. A network switch during the round trip cleared every address's
+// balances (applyChainSwitchFields()), and the previous network's must not come
+// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
+// lastBalanceRefresh is left as the switch set it, so the next tick refreshes
+// the new network.
 async function backgroundRefresh() {
     const s = await getState();
     const now = Date.now();
@@ -1390,6 +1397,7 @@ async function backgroundRefresh() {
         wallets,
         s.rpcUrl,
         s.blockscoutUrl,
+        s.useBlockscout,
         s.trackedTokens,
         s.networkId,
     );
@@ -1402,6 +1410,7 @@ async function backgroundRefresh() {
     }
 
     await updateState((fresh) => {
+        if (fresh.networkId !== s.networkId) return;
         for (const wallet of fresh.wallets) {
             for (const addr of wallet.addresses || []) {
                 const got = refreshed.get(String(addr.address).toLowerCase());

src/background/state.js

@@ -16,17 +16,20 @@
 //                     across any number of awaits and no concurrent work can
 //                     move it.
 //   updateState(fn)   read fresh, apply fn to that fresh record, write it
-//                     back — all inside a queue, so two background writes
-//                     never interleave, and the read is one storage round trip
-//                     ahead of the write rather than a page lifetime ahead of
-//                     it (which is what made the popup's saveState() need a
+//                     back — all holding the lock every write of the stored
+//                     record takes, so no other write lands in between, by
+//                     the background or by any page except a page in a
+//                     Firefox private window (README, "Stored state and its
+//                     version"). The read is one storage round trip ahead of
+//                     the write rather than a page lifetime ahead of it
+//                     (which is what made the popup's saveState() need a
 //                     per-field merge against a baseline at all).
 //
 // A handler that must both read and write therefore does its network work
 // against a snapshot it owns, and applies the RESULT inside updateState().
 // It never publishes an object other in-flight work is holding.
 
-const { storageGet, storageSet } = require("../shared/browserApi");
+const { storageGet, storageSet, withLock } = require("../shared/browserApi");
 const { normalizePersisted } = require("../shared/persistedState");
 const {
     STATE_SCHEMA_VERSION,
@@ -51,11 +54,6 @@ async function getState() {
     return normalizePersisted(result.autistmask);
 }
 
-// Serializes the read-modify-write turns below. Two of them interleaved would
-// each read before the other wrote, and the second write would carry the first
-// one's fields back to their pre-turn values.
-let updateQueue = Promise.resolve();
-
 async function updateStateOnce(mutate) {
     const s = await getState();
     await mutate(s);
@@ -70,27 +68,22 @@ async function updateStateOnce(mutate) {
 
 // Apply `mutate` to a record read fresh from storage and write the result
 // back. `mutate` receives a detached, normalized profile and mutates it in
-// place; it may be async, but it must not do anything slow — the window
-// between the read and the write is the window in which another context's
-// write is lost, and keeping it to one storage round trip is what makes a
-// whole-record write safe here. Concretely: the write is the WHOLE record, so
-// a popup write that lands inside that window is reverted, in every field, by
-// the record this turn read before it. That is accepted because the window is
-// one round trip long and the popup is not writing while the worker is;
-// widening it is what would make it a real hazard.
+// place; it may be async, but it must not do anything slow. The write is the
+// WHOLE record, which is safe only because the lock (withLock() in
+// src/shared/browserApi.js) is held from the read to the write: two
+// background turns, or a turn and a page's save, never interleave
+// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every page's save waits
+// while it is held, except a page in a Firefox private window, which Firefox
+// gives locks of its own (README, "Stored state and its version").
 //
 // `mutate` must also not call updateState() itself, directly or through
-// anything it awaits: the queue is strictly serial, so the inner turn waits on
-// the outer one, which is waiting on the inner one. That deadlocks the whole
-// background, not just the caller. Mutate the record you were handed.
+// anything it awaits: the inner turn waits for the lock the outer one holds,
+// and the outer one is waiting on the inner one. That deadlocks every write of
+// the stored record, not just the caller. Mutate the record you were handed.
 //
 // Resolves with the record that was written.
 function updateState(mutate) {
-    const turn = updateQueue.then(() => updateStateOnce(mutate));
-    // The queue must advance even when a turn rejects, or every update after
-    // it queues behind a promise that never settles.
-    updateQueue = turn.catch(() => {});
-    return turn;
+    return withLock("autistmask", () => updateStateOnce(mutate));
 }
 
 module.exports = { getState, updateState };

src/popup/index.html

@@ -43,6 +43,38 @@
             <!-- ============ WELCOME / FIRST USE ============ -->
             <div id="view-welcome" class="view hidden">
                 <p class="mb-3">Welcome! To get started, add a wallet.</p>
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <p class="text-xs mb-2">
+                        This wallet sends your data only to the Ethereum RPC
+                        endpoint, unless you turn on either of these, here or
+                        later in Settings.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="welcome-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Sends your addresses, and the hash of each transaction
+                        you open, to the Blockscout API, for transaction
+                        history, tokens you have not tracked, and transaction
+                        details.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="welcome-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends the address you are about to send to, to
+                        Etherscan, to look for a phishing or scam label on it.
+                    </p>
+                </div>
                 <button
                     id="btn-welcome-add"
                     class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
@@ -90,7 +122,7 @@
                 <div id="add-wallet-section-mnemonic">
                     <!-- The die button shares the instruction's row: on a row
                          of its own it pushes Import below the fold at
-                         360x600. -->
+                         396x600. -->
                     <div class="mb-2 flex justify-between items-start gap-2">
                         <p>
                             Enter your 12 or 24 word recovery phrase below, or
@@ -212,7 +244,7 @@
                     />
                 </div>
                 <!-- The error line sits beside Import, not above it: at
-                     360x600 the button already starts near the bottom of
+                     396x600 the button already starts near the bottom of
                      the popup, and a line of its own would push it below
                      the fold. The longest error fits on one line here. -->
                 <div class="flex items-center gap-2">
@@ -272,6 +304,10 @@
 
                 <!-- wallet list -->
                 <div id="wallet-list"></div>
+                <p id="home-tokens-note" class="text-xs text-muted py-1 hidden">
+                    Only tracked tokens are listed, because "Use Blockscout" is
+                    off in Settings.
+                </p>
 
                 <!-- recent transactions across all addresses -->
                 <div>
@@ -336,6 +372,13 @@
                     <div id="address-balances" class="min-h-[1.25rem]">
                         &nbsp;
                     </div>
+                    <p
+                        id="address-tokens-note"
+                        class="text-xs text-muted hidden"
+                    >
+                        Only tracked tokens are listed, because "Use Blockscout"
+                        is off in Settings.
+                    </p>
                 </div>
 
                 <!-- actions -->
@@ -660,6 +703,13 @@
                         phishing/scam. Do not send funds to this address.
                     </div>
                 </div>
+                <p
+                    id="confirm-etherscan-note"
+                    class="mb-2 text-xs text-muted hidden"
+                >
+                    This address was not checked on Etherscan, because "Check
+                    recipients on Etherscan" is off in Settings.
+                </p>
                 <div
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
@@ -697,9 +747,10 @@
                     id="confirm-fee-unknown-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
                 ></div>
-                <!-- Shown when Sign & Send refuses a send for its network, or
-                for its gas limit or fee. Each holds its space from the first
-                paint, so the refusal moves nothing. -->
+                <!-- Shown when Sign & Send refuses a send for its network, for
+                a From address the selected wallet does not hold, or for its
+                gas limit or fee. Each holds its space from the first paint, so
+                the refusal moves nothing. -->
                 <div
                     id="confirm-network-changed-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
@@ -708,6 +759,13 @@
                     reviewed, so it was not sent. Please go back and review it
                     again.
                 </div>
+                <div
+                    id="confirm-from-address-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
+                >
+                    The selected wallet does not hold the From address above, so
+                    nothing was sent. Please go back and send again.
+                </div>
                 <div
                     id="confirm-fee-bound-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
@@ -994,8 +1052,19 @@
 
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Blockscout API</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="settings-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Sends your addresses, and the hash of each transaction
+                        you open, to the Blockscout API below, for transaction
+                        history, tokens you have not tracked, and transaction
+                        details.
+                    </p>
                     <p class="text-xs text-muted mb-1">
-                        Used to fetch token balances and transaction history.
                         Change this if you run your own Blockscout instance.
                     </p>
                     <input
@@ -1011,6 +1080,23 @@
                     </button>
                 </div>
 
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <h3 class="font-bold mb-1">Etherscan</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends the address you are about to send to, to
+                        Etherscan, to look for a phishing or scam label on it.
+                    </p>
+                </div>
+
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Token Spam Protection</h3>
                     <p class="text-xs text-muted mb-2">
@@ -1496,6 +1582,16 @@
                     </div>
                 </div>
 
+                <!-- Shown in place of the block, decoded details, network
+                details and raw data, which only Blockscout gives. -->
+                <p
+                    id="tx-detail-blockscout-note"
+                    class="text-xs text-muted mx-1 mb-3 hidden"
+                >
+                    No block, decoded details, network details or raw data are
+                    shown, because "Use Blockscout" is off in Settings.
+                </p>
+
                 <!-- ── Decoded details ── -->
                 <div id="tx-detail-calldata-section" class="hidden">
                     <div class="bg-well p-3 mx-1 mb-3">

src/popup/index.js

@@ -5,12 +5,14 @@ const {
     state,
     saveState,
     onSaveFailure,
+    takeStoredNetwork,
     loadState,
 } = require("../shared/state");
 const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
+const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
     $,
     showView,
@@ -22,6 +24,7 @@ const {
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
 const {
+    onStorageChanged,
     tabsGetCurrent,
     tabsGetZoom,
     windowsGetCurrent,
@@ -68,23 +71,56 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 
+// The refresh writes into a copy of the wallets. Inside the save, under the
+// lock, its results are copied onto the address records in `state` only if the
+// network it ran on is still the active one, on this page and in the stored
+// record; the background's switch, after the user approves a site's request,
+// reaches this page only after the stored record (followNetworkSwitch() below).
+// A switch while the refresh ran cleared every address's balances
+// (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
+// previous network's must not come back over them
+// (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
+// recorded as done. Results are copied by address, so an address added or
+// removed meanwhile is left as it is.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
+        const networkId = state.networkId;
+        const wallets = structuredClone(state.wallets);
         await Promise.all([
             refreshPrices(),
             refreshBalances(
-                state.wallets,
+                wallets,
                 state.rpcUrl,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 state.trackedTokens,
-                state.networkId,
+                networkId,
                 pageClosed.signal,
             ),
         ]);
-        state.lastBalanceRefresh = Date.now();
-        await saveState();
+        const refreshed = new Map();
+        for (const wallet of wallets) {
+            for (const addr of wallet.addresses) {
+                refreshed.set(addr.address, addr);
+            }
+        }
+        await saveState((stored) => {
+            if (state.networkId !== networkId) return false;
+            if (stored.networkId !== networkId) return false;
+            for (const wallet of state.wallets) {
+                for (const addr of wallet.addresses) {
+                    const got = refreshed.get(addr.address);
+                    if (!got) continue;
+                    for (const key of ["balance", "ensName", "tokenBalances"]) {
+                        if (got[key] !== undefined) addr[key] = got[key];
+                    }
+                }
+            }
+            state.lastBalanceRefresh = Date.now();
+            return true;
+        });
         renderWalletList();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten
@@ -116,6 +152,7 @@ const ctx = {
     renderWalletList,
     doRefreshAndRender,
     startRefresh,
+    restoreView,
     pageClosed: pageClosed.signal,
     showAddWalletView: () => {
         pushCurrentView();
@@ -183,6 +220,28 @@ function fallbackView() {
     showView("main");
 }
 
+// When the background saves a network switch, once the user approves a site's
+// request, or another popup page saves one, this page follows the stored
+// record. It takes the network the record names as a save reads it, holding
+// the lock, so no later save of this page writes the previous network back, and
+// then leaves the page as a switch in Settings leaves it. This page's own
+// switch in Settings is made under the lock as well (onChainSwitch() in
+// src/shared/chainSwitch.js), so a record naming a network other than this
+// page's always holds a switch saved elsewhere, and a switch the user picks
+// here while this waits for the lock is made after it.
+async function followNetworkSwitch() {
+    let switched = false;
+    // A failed save is reported by saveState() itself: see onSaveFailure().
+    await saveState((stored) => {
+        if (stored.networkId === state.networkId) return false;
+        settings.cutViewStack();
+        takeStoredNetwork(stored);
+        clearPopupCaches();
+        switched = true;
+    }).catch(() => {});
+    if (switched) settings.showNewNetwork();
+}
+
 // The background opens the approval window as wide as the page, but the
 // browser counts the window's frame in that width, and a screen taller than
 // the window takes a vertical scrollbar out of it too. So once the screen is
@@ -220,7 +279,7 @@ async function widenApprovalWindow() {
 async function init() {
     // First, before anything can save: showView() saves on every navigation
     // without awaiting, so a save that fails from here on has somewhere to be
-    // reported rather than being swallowed by the save queue
+    // reported rather than reaching only the console
     // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
     // the approval-window branch below too, since that window saves as well.
     //
@@ -327,8 +386,19 @@ async function init() {
     settingsAddToken.init(ctx);
     deleteAddress.init(ctx);
 
+    // Only a record naming a network other than this page's is followed: the
+    // one this page's own switch in Settings saves names the network it
+    // already has, and a record naming none is no switch.
+    onStorageChanged((changes) => {
+        const written = changes.autistmask && changes.autistmask.newValue;
+        if (!written || !written.networkId) return;
+        if (written.networkId !== state.networkId) followNetworkSwitch();
+    });
+    // A switch saved since loadState() above, before there was a listener.
+    followNetworkSwitch();
+
     if (!state.hasWallet) {
-        showView("welcome");
+        welcome.show();
     } else {
         renderWalletList();
         restoreView();

src/popup/viewRouter.js

@@ -39,10 +39,12 @@ function markViewRendered(view) {
 }
 
 // Begin a fresh page-load scope. The popup gets one by being loaded, and
-// asks for one when the user switches the network, because every screen
-// then on the page shows the previous network (views/settings.js); the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one too.
+// asks for one after a network switch, because every screen then on the page
+// shows the previous network (showNewNetwork() in views/settings.js), and
+// after "Use Blockscout" or "Check recipients on Etherscan" changes in
+// Settings, because every screen then on the page was drawn under the old
+// setting; the unit tests, which simulate several page loads against one
+// module instance, ask for one too.
 function resetRenderedViews() {
     renderedViews.clear();
 }
@@ -127,28 +129,33 @@ function isRenderableDecoded(value) {
 }
 
 // The pending transaction confirmTx.show() renders: `token` reaches
-// renderAddressHtml() when it is not "ETH", and `from`/`to` reach
-// addressTitle(), makeBlockie() and getLocalWarnings(). `chainId`, which
-// show() fills in when it is absent, picks the network whose explorer the
-// address links open, so it has to name one.
+// renderAddressHtml() when it is not "ETH", `from`/`to` reach
+// addressTitle(), makeBlockie() and getLocalWarnings(), and `amount` reaches
+// truncateAmountNeverZero(), which splits it. `chainId`, which show() fills in
+// when it is absent, picks the network whose explorer the address links open,
+// so it has to name one.
 function isRenderablePendingTx(value) {
     return (
         isRecord(value) &&
         isText(value.token) &&
         isAddressText(value.from) &&
         isAddressText(value.to) &&
+        isText(value.amount) &&
         (!value.chainId || SUPPORTED_CHAIN_IDS.has(value.chainId))
     );
 }
 
 // The stored transaction transactionDetail.render() shows. contractAddress is
 // optional on an ETH transfer, and reaches addressDotHtml() when it is there.
+// `chainId` picks the network whose explorer the links open and whose
+// Blockscout the transaction is read from, so it has to name one.
 function isRenderableTx(value) {
     return (
         isRecord(value) &&
         isAddressText(value.from) &&
         isAddressText(value.to) &&
-        (!value.contractAddress || isAddressText(value.contractAddress))
+        (!value.contractAddress || isAddressText(value.contractAddress)) &&
+        SUPPORTED_CHAIN_IDS.has(value.chainId)
     );
 }
 
@@ -200,11 +207,19 @@ function renderView(view, state, views) {
             if (!data.hash) return false;
             if (!isAddressText(data.to)) return false;
             if (!isRenderableDecoded(data.decoded)) return false;
+            // `chainId` picks the network whose explorer the links open, so
+            // when it is there it has to name one. Likewise on error-tx.
+            if (data.chainId && !SUPPORTED_CHAIN_IDS.has(data.chainId)) {
+                return false;
+            }
             views.txStatus.renderSuccess();
             return true;
         case "error-tx":
             if (!data.message) return false;
             if (!isAddressText(data.to)) return false;
+            if (data.chainId && !SUPPORTED_CHAIN_IDS.has(data.chainId)) {
+                return false;
+            }
             views.txStatus.renderError();
             return true;
         default:

src/popup/views/addressDetail.js

@@ -4,6 +4,7 @@ const {
     showFlash,
     balanceLinesForAddress,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -83,6 +84,8 @@ function show() {
                 ctx.showAddressToken();
             });
         });
+    // Tokens the user has not tracked are Blockscout's to report.
+    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     renderSendTokenSelect(addr);
     $("tx-list").innerHTML =
         '<div class="text-muted text-xs py-1">Loading...</div>';
@@ -99,6 +102,7 @@ async function loadTransactions(address) {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -155,6 +159,10 @@ async function loadTransactions(address) {
 
 function renderTransactions(txs) {
     const list = $("tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';

src/popup/views/addressToken.js

@@ -7,6 +7,7 @@ const {
     showFlash,
     flashCopyFeedback,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -173,6 +174,7 @@ async function loadTransactions(address, tokenId) {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -239,6 +241,10 @@ async function loadTransactions(address, tokenId) {
 
 function renderTransactions(txs) {
     const list = $("address-token-tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';

src/popup/views/approval.js

@@ -11,6 +11,7 @@ const {
     onViewLeave,
     formatFee,
     tokenLabel,
+    tokenSourcesByChainId,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const {
@@ -57,9 +58,15 @@ const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
 
 const erc20Iface = new Interface(ERC20_ABI);
 
-function approvalAddressHtml(address) {
+// The link opens the explorer of the network with `chainId`, or of the active
+// network when none is given. A chain id that names no network has no
+// explorer, so the address is drawn without a link.
+function approvalAddressHtml(address, chainId) {
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    if (chainId && !networkByChainId(chainId)) {
+        return renderAddressHtml(address, { title, noLink: true });
+    }
+    return renderAddressHtml(address, { title, chainId });
 }
 
 // The amount line for a decoded ERC-20 call. With a known scale it is the
@@ -85,13 +92,12 @@ function tokenAmountText(rawAmount, decimals, symbol) {
 function decodeCalldata(data, toAddress, chainId, fromAddress) {
     if (!data || data === "0x" || data.length < 10) return null;
 
-    // Where a token's scale is looked for, for every decoder below: the ERC-20
-    // amount line and the swap's Amount and Min. received lines resolve it the
-    // same way, and refuse to format the same way when it is nowhere.
-    const decimalsSources = {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    };
+    // Where a token's name and scale are looked for, for every decoder below:
+    // what the wallet knows of the tokens on the network with `chainId`, which
+    // need not be the active one. The ERC-20 amount line and the swap's Amount
+    // and Min. received lines resolve the scale the same way, and refuse to
+    // format the same way when it is nowhere.
+    const decimalsSources = tokenSourcesByChainId(chainId);
 
     // Try ERC-20 (approve / transfer)
     try {
@@ -225,10 +231,11 @@ function showTxFee(approvedTx) {
     const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
     // Through formatFee(), as the confirmation screen's fee is, so the same
     // fee reads the same on both. In the native currency of the network shown
-    // above, as the value is.
+    // above, and at the price on it, as the value is.
     $("approve-tx-fee").textContent = formatFee(
         gasLimit * feePerGas,
         nativeCurrencyByChainId(approvedTx.chainId),
+        approvedTx.chainId,
     );
 
     let detail =
@@ -261,10 +268,7 @@ function showTxApproval(details) {
 
     const toAddr = approvedTx.to;
     const ethValue = formatEther(approvedTx.value || "0");
-    const sources = {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    };
+    const sources = tokenSourcesByChainId(approvedTx.chainId);
 
     // Build txInfo for status screens
     pendingTxDetails = {
@@ -341,27 +345,35 @@ function showTxApproval(details) {
         };
     }
 
+    // Every address link on this screen opens the explorer of the network the
+    // transaction is for, which the Network line names, whichever network is
+    // active.
     $("approve-tx-origin").textContent = details.origin;
-    $("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
+    $("approve-tx-from").innerHTML = approvalAddressHtml(
+        details.approvedFrom,
+        approvedTx.chainId,
+    );
 
-    // Show token symbol next to contract address if known
-    const symbol = toAddr ? tokenLabel(toAddr) : null;
+    // Show token symbol next to contract address if known on the network the
+    // transaction is for
+    const symbol = toAddr ? tokenLabel(toAddr, approvedTx.chainId) : null;
     if (toAddr) {
         let toHtml = "";
         if (symbol) {
             toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
         }
-        toHtml += approvalAddressHtml(toAddr);
+        toHtml += approvalAddressHtml(toAddr, approvedTx.chainId);
         $("approve-tx-to").innerHTML = toHtml;
     } else {
         $("approve-tx-to").innerHTML = escapeHtml(CONTRACT_CREATION_TEXT);
     }
 
-    const ethValueFormatted = formatTxValue(
-        formatEther(approvedTx.value || "0"),
-    );
-    const ethPrice = getPrice("ETH");
-    const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
+    const ethValueFormatted = formatTxValue(ethValue);
+    // Priced from the exact value, not the four-decimal figure, at the price
+    // on the network the transaction is for, as the confirmation screen prices
+    // its amount, so the same value reads the same on both.
+    const ethPrice = getPrice("ETH", approvedTx.chainId);
+    const ethUsd = ethPrice ? parseFloat(ethValue) * ethPrice : null;
     const usdStr = formatUsd(ethUsd);
     // In the native currency of the network the transaction is for, which the
     // Network line names, not the active network's: the active network can
@@ -388,9 +400,12 @@ function showTxApproval(details) {
             detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
             if (d.address) {
                 if (d.isToken) {
-                    detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
+                    detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
                 }
-                detailsHtml += approvalAddressHtml(d.address);
+                detailsHtml += approvalAddressHtml(
+                    d.address,
+                    approvedTx.chainId,
+                );
             } else {
                 detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
             }

src/popup/views/confirmTx.js

@@ -23,12 +23,10 @@ const {
     goBack,
     onViewLeave,
     formatFee,
+    reviewedNetworkProvider,
 } = require("./helpers");
 const { state, currentNetwork } = require("../../shared/state");
-const {
-    networkByChainId,
-    nativeCurrencyByChainId,
-} = require("../../shared/networks");
+const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
 const { decryptWithPassword } = require("../../shared/vault");
@@ -45,8 +43,8 @@ const {
     transferAmountUnits,
 } = require("../../shared/transferAmount");
 const { assertWithinCeilings } = require("../../shared/approvalVerify");
-// The balance line and the fee reserve go through it, as the approval screen's
-// amounts do.
+// The amount, the balance line and the fee reserve go through it, as the
+// approval screen's amounts do.
 const { truncateAmountNeverZero } = require("../../shared/amountDisplay");
 const {
     CODES,
@@ -100,8 +98,32 @@ function valueWithUsd(text, usdAmount) {
     return text;
 }
 
-// The Amount line, with its USD value. A max ETH send's line is drawn again
-// once its amount is re-derived from the fee estimate.
+// The amount as this screen and the wait, success and error screens show it,
+// written as the approval screen writes a site's amount: the amount being
+// signed, parsed at the scale it is encoded with and written back as plain
+// decimal text, then cut to four decimals with the nonzero floor. So `.5` and
+// `00.5` read `0.5000`, as `0.5` does, except for a token whose scale is
+// unknown, which cannot be sent: its amount is cut as typed, so `.5` reads
+// `.5000`. txInfo.amount, which is what gets signed, is left as it is.
+function shownAmount(txInfo) {
+    let exact = txInfo.amount;
+    try {
+        if (txInfo.token === "ETH") {
+            exact = formatEther(parseEther(txInfo.amount));
+        } else {
+            const decimals = displayedDecimals(txInfo.tokenDecimals);
+            exact = formatUnits(parseUnits(txInfo.amount, decimals), decimals);
+        }
+    } catch {
+        // A token whose scale is unknown, which is never signed, or an amount
+        // the amount check refuses: cut as Send's amount field held it.
+    }
+    return truncateAmountNeverZero(exact);
+}
+
+// The Amount line, with its USD value, which is priced from the exact amount.
+// A max ETH send's line is drawn again once its amount is re-derived from the
+// fee estimate.
 function renderAmount(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
     const rawSymbol = isErc20
@@ -110,7 +132,7 @@ function renderAmount(txInfo) {
     const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const amountUsd = price ? parseFloat(txInfo.amount) * price : null;
     $("confirm-amount").textContent = valueWithUsd(
-        txInfo.amount + " " + displaySymbol(rawSymbol),
+        shownAmount(txInfo) + " " + displaySymbol(rawSymbol),
         amountUsd,
     );
 }
@@ -296,6 +318,7 @@ function show(txInfo) {
     $("confirm-tx-password").value = "";
     hideError("confirm-tx-password-error");
     setVisible("confirm-network-changed-error", false);
+    setVisible("confirm-from-address-error", false);
     setVisible("confirm-fee-bound-error", false);
 
     // Gas estimate — show placeholder then fetch async
@@ -311,6 +334,11 @@ function show(txInfo) {
     $("confirm-contract-warning").style.visibility = "hidden";
     $("confirm-burn-warning").style.visibility = "hidden";
     $("confirm-etherscan-warning").style.visibility = "hidden";
+    // While "Check recipients on Etherscan" is off there is no Etherscan
+    // warning to reserve space for, and a line in its place says so.
+    const etherscanOn = !!state.checkRecipientsOnEtherscan;
+    $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
+    $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
 
     // Show burn warning via reserved element (in addition to inline warning)
     if (isBurnAddress(txInfo.to)) {
@@ -433,20 +461,6 @@ function setVisible(id, visible) {
     $(id).style.visibility = visible ? "visible" : "hidden";
 }
 
-// The node of the network this transaction was reviewed for, which need not be
-// the active one: the popup can reopen onto this screen after Settings switched
-// the network. Its RPC URL is the one Settings has for that network: the
-// active network's is state.rpcUrl, any other's the one remembered for it (see
-// applyChainSwitchFields()).
-function reviewedNetworkProvider(txInfo) {
-    const net = networkByChainId(txInfo.chainId);
-    if (net.id === state.networkId) {
-        return getProvider(state.rpcUrl, net.id);
-    }
-    const remembered = state.networkEndpoints[net.id] || {};
-    return getProvider(remembered.rpcUrl || net.defaultRpcUrl, net.id);
-}
-
 async function estimateGas(txInfo) {
     try {
         const provider = reviewedNetworkProvider(txInfo);
@@ -603,6 +617,7 @@ async function checkRecipientHistory(txInfo) {
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
             chainId: txInfo.chainId,
+            checkRecipientsOnEtherscan: state.checkRecipientsOnEtherscan,
         });
         // The user may have left this transaction while the checks were in
         // flight; its warnings must not reach another recipient's screen.
@@ -637,6 +652,7 @@ function init(_ctx) {
     $("btn-confirm-send").addEventListener("click", async () => {
         // A press shows only its own refusal, if any.
         setVisible("confirm-network-changed-error", false);
+        setVisible("confirm-from-address-error", false);
         setVisible("confirm-fee-bound-error", false);
 
         const wallet = state.wallets[state.selectedWallet];
@@ -662,11 +678,7 @@ function init(_ctx) {
         // address selected.
         const addr = wallet.addresses.find((a) => a.address === pendingTx.from);
         if (!addr) {
-            showError(
-                "confirm-tx-password-error",
-                "The selected wallet does not hold the From address above, " +
-                    "so nothing was sent. Please go back and send again.",
-            );
+            setVisible("confirm-from-address-error", true);
             return;
         }
 
@@ -698,6 +710,10 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
+        // The wait, success and error screens show the amount as this screen
+        // does, so they are handed a copy carrying that text. pendingTx keeps
+        // the exact amount, which is the one signed.
+        const shownTx = { ...pendingTx, amount: shownAmount(pendingTx) };
         let tx;
         try {
             const signer = getSignerForAddress(wallet, addr, decryptedSecret);
@@ -714,7 +730,7 @@ function init(_ctx) {
             // Note: JS strings are immutable; this nulls the reference but
             // the original string may persist in memory until GC.
             decryptedSecret = null;
-            txStatus.showWait(pendingTx, tx.hash);
+            txStatus.showWait(shownTx, tx.hash);
         } catch (e) {
             decryptedSecret = null;
             // A gas limit or fee over its bound is refused before anything is
@@ -730,7 +746,7 @@ function init(_ctx) {
                 return;
             }
             const hash = tx ? tx.hash : null;
-            txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
+            txStatus.showError(shownTx, hash, e.shortMessage || e.message);
         } finally {
             $("btn-confirm-send").disabled = false;
             $("btn-confirm-send").classList.remove("text-muted");

src/popup/views/deleteWallet.js

@@ -16,6 +16,7 @@ const {
     broadcastActiveChanged,
 } = require("../../shared/walletDelete");
 const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
+const welcome = require("./welcome");
 
 let deleteWalletIndex = null;
 let lostPasswordIndex = null;
@@ -135,7 +136,7 @@ async function finishDelete(walletIdx) {
         // Save before broadcasting: the background reads the active
         // address back out of storage to build accountsChanged.
         if (activeAddressChanged) broadcastActiveChanged();
-        showView("welcome");
+        welcome.show();
         return;
     }
 

src/popup/views/helpers.js

@@ -1,4 +1,7 @@
-// Shared DOM helpers used by all views.
+// Helpers the views in this directory share: showing a view and going back,
+// error and flash lines and the warning banners, formatting of amounts, fees,
+// balances, addresses and dates, the RPC and Blockscout URLs, node and tokens
+// of the network a chain id names, explorer links, and click-to-copy.
 //
 // Escaping rule for every view in this directory, since they all build
 // markup by concatenation: any VALUE interpolated into an innerHTML string
@@ -19,6 +22,7 @@ const {
     isBelowOneMillionth,
 } = require("../../shared/amountDisplay");
 const { resolveTokenSymbol } = require("../../shared/approvalAmount");
+const { getProvider } = require("../../shared/balances");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
@@ -128,7 +132,8 @@ function showView(name) {
 }
 
 // Create or update the debug/insecure warning banner.
-// Called on every view switch and after the settings debug toggle changes.
+// Called on every view switch, after the settings debug toggle changes, and
+// after a network switch in Settings.
 // The banner is shown when the compile-time DEBUG constant is true OR when
 // the user has enabled runtime debug mode via the settings easter egg, OR
 // when the active network is a testnet.
@@ -295,15 +300,30 @@ function nativeCurrency() {
     return currentNetwork().nativeCurrency;
 }
 
-// The symbol shown for a token line, resolved from the bundled list, the
-// tokens the user tracks, and the explorer's report — the same chain the
-// amount line's scale comes from. Null when no source names one, so the token
-// lines keep saying `Unknown token` for a token nothing knows.
-function tokenLabel(address) {
-    return resolveTokenSymbol(address, {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    });
+// What the wallet knows of the tokens on the network with this chain id, or
+// on the active network when no chain id is given, as the `sources` that
+// resolveTokenSymbol() and resolveTokenDecimals() take. A contract address
+// names a token on one network only, and every token balance held is the
+// active network's, so another network gets the tokens tracked on it
+// (state.networkTrackedTokens, see applyChainSwitchFields()) and no balances.
+function tokenSourcesByChainId(chainId) {
+    const net = chainId ? networkByChainId(chainId) : currentNetwork();
+    if (net && net.id === state.networkId) {
+        return { trackedTokens: state.trackedTokens, wallets: state.wallets };
+    }
+    return {
+        trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
+        wallets: [],
+    };
+}
+
+// The symbol shown for a token line on the network with `chainId`, or on the
+// active network when none is given: from the bundled list, the tokens the
+// user tracks, and the explorer's report, the sources the amount line's scale
+// comes from. Null when no source names one, so the token lines keep saying
+// `Unknown token` for a token nothing knows.
+function tokenLabel(address, chainId) {
+    return resolveTokenSymbol(address, tokenSourcesByChainId(chainId));
 }
 
 // A network fee in wei as the confirmation and approval screens both show it:
@@ -514,6 +534,11 @@ function addressTitle(address, wallets) {
 const CONTRACT_CREATION_TEXT =
     "This transaction creates a new contract. It has no recipient.";
 
+// What the transaction lists on Home, AddressDetail and AddressToken say while
+// the user has "Use Blockscout" off: the history comes from Blockscout alone.
+const HISTORY_OFF_TEXT =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
 // The last two lines of a transaction history row: the counterparty's colour
 // dot and name beside the amount, then its full address. A contract creation
 // the user sent has no counterparty (its `to` is ""), so its row has the
@@ -606,6 +631,30 @@ const EXT_ICON =
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
     `</svg></span>`;
 
+// The RPC and Blockscout URLs Settings has for the network with this chain id,
+// which need not be the active one: ConfirmTx, WaitTx and TransactionDetail
+// use the network their transaction's chain id names, and the popup can reopen
+// onto them after Settings switched the network. The active network's are
+// state.rpcUrl and state.blockscoutUrl, any other's the ones remembered for it,
+// or its defaults (see applyChainSwitchFields()).
+function endpointsByChainId(chainId) {
+    const net = networkByChainId(chainId);
+    if (net.id === state.networkId) {
+        return { rpcUrl: state.rpcUrl, blockscoutUrl: state.blockscoutUrl };
+    }
+    const remembered = state.networkEndpoints[net.id] || {};
+    return {
+        rpcUrl: remembered.rpcUrl || net.defaultRpcUrl,
+        blockscoutUrl: remembered.blockscoutUrl || net.defaultBlockscoutUrl,
+    };
+}
+
+// The node of the network a transaction was reviewed for.
+function reviewedNetworkProvider(txInfo) {
+    const net = networkByChainId(txInfo.chainId);
+    return getProvider(endpointsByChainId(txInfo.chainId).rpcUrl, net.id);
+}
+
 // Block-explorer URLs. The origin is a per-network constant from
 // src/shared/networks.js, the explorer of the network with `chainId`, or of
 // the active network when no chain id is given; only the path segment is
@@ -746,6 +795,7 @@ module.exports = {
     keyMaterialName,
     unknownableAmount,
     nativeCurrency,
+    tokenSourcesByChainId,
     tokenLabel,
     formatFee,
     addressDotHtml,
@@ -754,6 +804,7 @@ module.exports = {
     displaySymbol,
     addressTitle,
     CONTRACT_CREATION_TEXT,
+    HISTORY_OFF_TEXT,
     txCounterpartyHtml,
     formatAddressHtml,
     renderAddressHtml,
@@ -761,6 +812,8 @@ module.exports = {
     attachCopyHandlers,
     etherscanLinkHtml,
     explorerUrl,
+    endpointsByChainId,
+    reviewedNetworkProvider,
     EXT_ICON,
     truncateMiddle,
     isoDate,

src/popup/views/home.js

@@ -7,6 +7,7 @@ const {
     timeAgo,
     addressDotHtml,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -100,6 +101,10 @@ let homeTxs = [];
 function renderHomeTxList(ctx) {
     const list = $("home-tx-list");
     if (!list) return;
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (homeTxs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -192,6 +197,7 @@ async function loadHomeTxs(ctx) {
             fetchRecentTransactions(
                 addr,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 currentNetwork().chainId,
             ),
         );
@@ -300,6 +306,8 @@ function walletListHtml() {
 
 function render(ctx) {
     const container = $("wallet-list");
+    // Tokens the user has not tracked are Blockscout's to report.
+    $("home-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     if (state.wallets.length === 0) {
         container.innerHTML =
             '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';

src/popup/views/settings.js

@@ -38,6 +38,8 @@ const {
 
 const { notify, sendMessage } = require("../../shared/browserApi");
 
+let ctx;
+
 let versionClickCount = 0;
 let versionClickTimer = null;
 
@@ -199,6 +201,10 @@ function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
     $("settings-network").value = state.networkId;
+    // Set on every show, not only at init: Welcome can change these two.
+    $("settings-use-blockscout").checked = state.useBlockscout;
+    $("settings-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -243,7 +249,51 @@ async function renderSiteLists() {
     );
 }
 
-function init(ctx) {
+// A network switch, made by the user here or saved by the background once the
+// user approved a site's request (src/popup/index.js), leaves every screen on
+// the page showing the previous network. These two leave the page as README's
+// Screen Map describes, the first before the switch is saved, so that save
+// keeps the cut for a popup closed straight after, the second once `state`
+// holds the new network.
+//
+// The stack is cut at the first screen that cannot be rendered from saved
+// state, such as Send or AddToken, and at AddressToken unless it shows the
+// native token: any other token there was picked on the previous network, so
+// it is no longer selected either. Without a wallet the stack starts at
+// Welcome, which that cut would drop, and Welcome shows nothing from a network.
+function cutViewStack() {
+    if (!state.hasWallet) return;
+    if (state.selectedToken !== "ETH") {
+        const tokenView = state.viewStack.indexOf("address-token");
+        if (tokenView !== -1) {
+            state.viewStack = state.viewStack.slice(0, tokenView);
+        }
+        state.selectedToken = null;
+    }
+    state.viewStack = restorableStack(state.viewStack, state.currentView);
+}
+
+// Every screen counts as not yet rendered, so "Back" renders the one it lands
+// on for the new network. Settings on top is brought up to date in place;
+// any other screen is drawn again as a reopened popup draws it, which is Home
+// for one that cannot be rendered from saved state. Without a wallet any other
+// screen is Welcome or AddWallet, which show nothing from a network.
+function showNewNetwork() {
+    resetRenderedViews();
+    if (state.currentView === "settings") {
+        markViewRendered("settings");
+        $("settings-network").value = state.networkId;
+        $("settings-rpc").value = state.rpcUrl;
+        $("settings-blockscout").value = state.blockscoutUrl;
+        renderTrackedTokens();
+    } else if (state.hasWallet) {
+        ctx.restoreView();
+    }
+    updateDebugBanner(state.currentView);
+}
+
+function init(_ctx) {
+    ctx = _ctx;
     deleteWallet.init(ctx);
     showPhrase.init();
 
@@ -317,37 +367,47 @@ function init(ctx) {
         showFlash("Saved.");
     });
 
+    // The screens under Settings were drawn under the old setting, so each
+    // change makes every screen but Settings count as not yet drawn, as a
+    // network switch does, and Back draws the one it lands on again. Welcome
+    // offers the same two settings and is only unhidden on Back, so its boxes
+    // are set here too.
+    $("settings-use-blockscout").addEventListener("change", async () => {
+        state.useBlockscout = $("settings-use-blockscout").checked;
+        $("welcome-use-blockscout").checked = state.useBlockscout;
+        resetRenderedViews();
+        markViewRendered("settings");
+        await saveState();
+    });
+
+    $("settings-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            state.checkRecipientsOnEtherscan = $(
+                "settings-check-recipients-on-etherscan",
+            ).checked;
+            $("welcome-check-recipients-on-etherscan").checked =
+                state.checkRecipientsOnEtherscan;
+            resetRenderedViews();
+            markViewRendered("settings");
+            await saveState();
+        },
+    );
+
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
+        // Whether `state` already has the network picked is asked only once
+        // the switch holds the lock: while an earlier pick waits for it,
+        // `state` still has the network before that pick, and a pick back to
+        // that network must still be made.
         const newId = networkSelect.value;
-        if (newId === state.networkId) return;
-        // The screens beneath Settings show the previous network, so Back
-        // finds them as it does in a reopened popup: each is rendered again
-        // when Back lands on it, and the stack is cut at the first one that
-        // cannot be rendered from saved state, such as Send or AddToken. It
-        // is cut at AddressToken too, unless that shows the native token: any
-        // other token there was picked on the previous network. Without a
-        // wallet the stack starts at Welcome, which that cut would drop, and
-        // Welcome shows nothing from a network. The cut comes before the
-        // switch so that the switch's save keeps it for a popup closed
-        // straight after.
-        if (state.hasWallet) {
-            const tokenView = state.viewStack.indexOf("address-token");
-            if (tokenView !== -1 && state.selectedToken !== "ETH") {
-                state.viewStack = state.viewStack.slice(0, tokenView);
-            }
-            state.viewStack = restorableStack(state.viewStack, "settings");
-        }
+        cutViewStack();
         const net = await onChainSwitch(newId);
+        if (!net) return;
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        resetRenderedViews();
-        // Settings itself is brought up to date for the new network here.
-        markViewRendered("settings");
-        $("settings-rpc").value = state.rpcUrl;
-        $("settings-blockscout").value = state.blockscoutUrl;
-        renderTrackedTokens();
+        showNewNetwork();
         showFlash("Switched to " + net.name + ".");
     });
 
@@ -482,4 +542,10 @@ function init(ctx) {
     });
 }
 
-module.exports = { init, show, renderSiteLists };
+module.exports = {
+    init,
+    show,
+    renderSiteLists,
+    cutViewStack,
+    showNewNetwork,
+};

src/popup/views/stateRecovery.js

@@ -24,7 +24,11 @@
 // than written again locally so that tests/popupElementIds.test.js sees these
 // lookups and holds every id below against the markup.
 const { $, VIEWS } = require("./helpers");
-const { storageGet, storageRemove } = require("../../shared/browserApi");
+const {
+    storageGet,
+    storageRemove,
+    withLock,
+} = require("../../shared/browserApi");
 const { log } = require("../../shared/log");
 
 // Typed in full before anything is erased, in the same spirit as the wallet
@@ -137,7 +141,11 @@ async function resetProfile() {
         return;
     }
     try {
-        await storageRemove("autistmask");
+        // Under the lock every write of the stored record takes, so the erase
+        // cannot land between another write's read and its write and be undone.
+        // A page in a Firefox private window is the exception: Firefox gives
+        // it locks of its own (README, "Stored state and its version").
+        await withLock("autistmask", () => storageRemove("autistmask"));
     } catch (e) {
         log.errorf("state recovery: reset failed:", e);
         setFlash("The saved data could not be erased. Nothing was changed.");

src/popup/views/transactionDetail.js

@@ -18,10 +18,11 @@ const {
     copyableHtml,
     etherscanLinkHtml,
     explorerUrl,
+    endpointsByChainId,
     displaySymbol,
     goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("../../shared/log");
@@ -48,16 +49,16 @@ function getTransactionType(tx) {
     return "Native " + nativeCurrencyByChainId(tx.chainId) + " Transfer";
 }
 
-function txAddressHtml(address, ensName, title) {
+function txAddressHtml(address, ensName, title, chainId) {
     const blockie = blockieHtml(address);
     return (
         `<div class="mb-1">${blockie}</div>` +
-        renderAddressHtml(address, { title, ensName })
+        renderAddressHtml(address, { title, ensName, chainId })
     );
 }
 
-function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+function txHashHtml(hash, chainId) {
+    const link = explorerUrl("tx", hash, chainId);
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -83,10 +84,11 @@ function show(tx) {
             method: tx.method || null,
             contractAddress: tx.contractAddress || null,
             // The network the history entry was read from. The type line and
-            // the fee are in its native currency, not the active network's:
-            // the active network can change, in Settings or when the user
-            // approves a site's request, before a later popup shows this
-            // screen again.
+            // the fee are in its native currency, not the active network's,
+            // the links open its explorer, and the block, network details and
+            // calldata are read from its Blockscout: the active network can
+            // change, in Settings or when the user approves a site's request,
+            // before a later popup shows this screen again.
             chainId: tx.chainId,
         },
     };
@@ -96,18 +98,24 @@ function show(tx) {
 function render() {
     const tx = state.viewData.tx;
     if (!tx) return;
-    $("tx-detail-hash").innerHTML = txHashHtml(tx.hash);
+    $("tx-detail-hash").innerHTML = txHashHtml(tx.hash, tx.chainId);
 
     const fromTitle = addressTitle(tx.from, state.wallets);
     $("tx-detail-from").innerHTML = txAddressHtml(
         tx.from,
         tx.fromEns,
         fromTitle,
+        tx.chainId,
     );
     // A contract creation has no recipient: transactions.js gives it `to: ""`.
     if (tx.to) {
         const toTitle = addressTitle(tx.to, state.wallets);
-        $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
+        $("tx-detail-to").innerHTML = txAddressHtml(
+            tx.to,
+            tx.toEns,
+            toTitle,
+            tx.chainId,
+        );
     } else {
         $("tx-detail-to").innerHTML = escapeHtml(CONTRACT_CREATION_TEXT);
     }
@@ -146,7 +154,7 @@ function render() {
     if (tokenContractSection && tokenContractEl) {
         if (tx.contractAddress) {
             const dot = addressDotHtml(tx.contractAddress);
-            const link = explorerUrl("token", tx.contractAddress);
+            const link = explorerUrl("token", tx.contractAddress, tx.chainId);
             // Hand-rolled rather than renderAddressHtml() because the
             // link goes to the explorer's /token/ page, not /address/.
             // Same two-row shape though: dot and link on the strip, the
@@ -183,6 +191,11 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
+    // Those details are Blockscout's; this line says why there are none.
+    $("tx-detail-blockscout-note").classList.toggle(
+        "hidden",
+        !!state.useBlockscout,
+    );
     loadFullTxDetails(tx.hash, tx.chainId);
 
     const isoStr = isoDate(tx.timestamp);
@@ -204,7 +217,11 @@ function showDetailField(sectionId, contentId, value) {
 function populateOnChainDetails(txData, chainId) {
     // Block number
     if (txData.block_number != null) {
-        const blockLink = explorerUrl("block", String(txData.block_number));
+        const blockLink = explorerUrl(
+            "block",
+            String(txData.block_number),
+            chainId,
+        );
         const blockSection = $("tx-detail-block-section");
         const blockEl = $("tx-detail-block");
         if (blockSection && blockEl) {
@@ -291,7 +308,11 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
+// The block, network details, calldata and its decoding, from Blockscout. While
+// the user has "Use Blockscout" off, Blockscout is not asked and none of them
+// is shown.
 async function loadFullTxDetails(txHash, chainId) {
+    if (!state.useBlockscout) return;
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -301,8 +322,9 @@ async function loadFullTxDetails(txHash, chainId) {
     if (!section || !actionEl || !detailsEl) return;
 
     try {
+        const { blockscoutUrl } = endpointsByChainId(chainId);
         const resp = await debugFetch(
-            state.blockscoutUrl + "/transactions/" + txHash,
+            blockscoutUrl + "/transactions/" + txHash,
         );
         if (!resp.ok) return;
         const txData = await resp.json();
@@ -316,12 +338,12 @@ async function loadFullTxDetails(txHash, chainId) {
         // Decoded against the address the transaction was sent to, as the
         // explorer reports it, not the history entry's `to`: for a token
         // transfer that is the transfer's recipient, not the token contract.
-        // On the active network, the one whose explorer was just asked, and
-        // from the sender it reports.
+        // On the network the transaction was sent on, whose Blockscout was
+        // just asked, and from the sender it reports.
         const decoded = decodeCalldata(
             inputData,
             txData.to?.hash || "",
-            currentNetwork().chainId,
+            chainId,
             txData.from?.hash || "",
         );
         if (decoded) {
@@ -340,9 +362,9 @@ async function loadFullTxDetails(txHash, chainId) {
                     if (tokenSymbol) {
                         detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
                     }
-                    detailsHtml += renderAddressHtml(d.address);
+                    detailsHtml += renderAddressHtml(d.address, { chainId });
                 } else if (d.address) {
-                    detailsHtml += renderAddressHtml(d.address);
+                    detailsHtml += renderAddressHtml(d.address, { chainId });
                 } else {
                     detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
                 }

src/popup/views/txStatus.js

@@ -14,10 +14,13 @@ const {
     displaySymbol,
     clearViewStack,
     tokenLabel,
+    reviewedNetworkProvider,
 } = require("./helpers");
 const { state } = require("../../shared/state");
-const { nativeCurrencyByChainId } = require("../../shared/networks");
-const { getProvider } = require("../../shared/balances");
+const {
+    SUPPORTED_CHAIN_IDS,
+    nativeCurrencyByChainId,
+} = require("../../shared/networks");
 const { log } = require("../../shared/log");
 
 // Receipt poll cadence and the deadline after which the wait is reported as
@@ -61,21 +64,22 @@ function endWait() {
 }
 
 // A contract creation reaches these screens with `to` as "" (approval.js
-// writes `to: toAddr || ""`).
-function toAddressHtml(address) {
+// writes `to: toAddr || ""`). The links below open the explorer of the network
+// with `chainId`, or of the active network when none is given.
+function toAddressHtml(address, chainId) {
     if (!address) return escapeHtml(CONTRACT_CREATION_TEXT);
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    return renderAddressHtml(address, { title, chainId });
 }
 
-function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+function txHashHtml(hash, chainId) {
+    const link = explorerUrl("tx", hash, chainId);
     return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
 }
 
-function blockNumberHtml(blockNumber) {
+function blockNumberHtml(blockNumber, chainId) {
     const num = String(blockNumber);
-    const link = explorerUrl("block", num);
+    const link = explorerUrl("block", num, chainId);
     return copyableHtml(num) + etherscanLinkHtml(link);
 }
 
@@ -91,9 +95,11 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     // native currency of txInfo.chainId, the network the transaction was sent
     // on, not the active network's: the active network can change, in
     // Settings or when the user approves a site's request, while this screen
-    // is open or before a later popup resumes it. A null token is a swap whose
-    // amount was not decoded (see showTxApproval() in approval.js): the amount
-    // says so, and no symbol follows it.
+    // is open or before a later popup resumes it. The links on all three
+    // screens open that network's explorer, and this screen's receipt is
+    // asked of that network's node, for the same reason. A null token is a
+    // swap whose amount was not decoded (see showTxApproval() in
+    // approval.js): the amount says so, and no symbol follows it.
     let symbol = "";
     if (txInfo.token === "ETH") {
         symbol = nativeCurrencyByChainId(txInfo.chainId);
@@ -102,8 +108,8 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     }
     $("wait-tx-summary").textContent =
         txInfo.amount + (symbol ? " " + symbol : "");
-    $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
-    $("wait-tx-hash").innerHTML = txHashHtml(txHash);
+    $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to, txInfo.chainId);
+    $("wait-tx-hash").innerHTML = txHashHtml(txHash, txInfo.chainId);
     attachCopyHandlers("view-wait-tx");
 
     // Persisted so closing and reopening the popup resumes this wait
@@ -128,7 +134,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
         renderElapsed();
     }, 1000);
 
-    const provider = getProvider(state.rpcUrl, state.networkId);
+    const provider = reviewedNetworkProvider(txInfo);
     let consecutiveFailures = 0;
 
     async function poll() {
@@ -207,10 +213,11 @@ function showWait(txInfo, txHash) {
 // an object merely missing one of them throws a TypeError out of
 // restoreView() — which init() does not guard, skipping the rest of popup
 // init and leaving wait-tx on screen with no back control. A non-numeric
-// broadcastTime leaves an unexitable wait counting "NaNs". txInfo.token,
-// txInfo.tokenSymbol and txInfo.chainId are deliberately unchecked: they are
-// compared and coalesced rather than dereferenced, and tokenSymbol is null for
-// ETH.
+// broadcastTime leaves an unexitable wait counting "NaNs". txInfo.chainId picks
+// the node the receipt is asked of and the explorer the links open, so it has
+// to name a network. txInfo.token and txInfo.tokenSymbol are deliberately
+// unchecked: they are compared and coalesced rather than dereferenced, and
+// tokenSymbol is null for ETH.
 function restoreWait() {
     const d = state.viewData;
     if (!d || !d.pendingWait) return false;
@@ -226,6 +233,7 @@ function restoreWait() {
     // path itself created.
     if (typeof info.to !== "string") return false;
     if (typeof info.amount !== "string") return false;
+    if (!SUPPORTED_CHAIN_IDS.has(info.chainId)) return false;
     if (typeof w.broadcastTime !== "number" || !isFinite(w.broadcastTime)) {
         return false;
     }
@@ -250,12 +258,13 @@ function showSuccess(txInfo, txHash, blockNumber) {
         hash: txHash,
         blockNumber: blockNumber,
         decoded: txInfo.decoded || null,
+        chainId: txInfo.chainId,
     };
     renderSuccess();
     ctx.doRefreshAndRender();
 }
 
-function decodedDetailsHtml(decoded) {
+function decodedDetailsHtml(decoded, chainId) {
     if (!decoded || !decoded.details) return "";
     let html = `<div class="border border-border border-dashed p-2 mb-3">`;
     if (decoded.name) {
@@ -271,11 +280,11 @@ function decodedDetailsHtml(decoded) {
         html += `<div class="text-xs text-muted mb-1">${escapeHtml(d.label)}</div>`;
         if (d.address) {
             if (d.isToken) {
-                const sym = tokenLabel(d.address) || "Unknown token";
+                const sym = tokenLabel(d.address, chainId) || "Unknown token";
                 html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
-                html += toAddressHtml(d.address);
+                html += toAddressHtml(d.address, chainId);
             } else {
-                html += toAddressHtml(d.address);
+                html += toAddressHtml(d.address, chainId);
             }
         } else {
             html += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
@@ -304,16 +313,16 @@ function renderSuccess() {
         toSection.classList.remove("hidden");
         $("success-tx-summary").textContent =
             d.amount + (d.symbol ? " " + d.symbol : "");
-        $("success-tx-to").innerHTML = toAddressHtml(d.to);
+        $("success-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
     }
 
-    $("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
-    $("success-tx-hash").innerHTML = txHashHtml(d.hash);
+    $("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber, d.chainId);
+    $("success-tx-hash").innerHTML = txHashHtml(d.hash, d.chainId);
 
     // Show decoded calldata details if present
     const decodedEl = $("success-tx-decoded");
     if (decodedEl && hasDecoded) {
-        decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
+        decodedEl.innerHTML = decodedDetailsHtml(d.decoded, d.chainId);
         decodedEl.classList.remove("hidden");
     } else if (decodedEl) {
         decodedEl.classList.add("hidden");
@@ -339,6 +348,7 @@ function showError(txInfo, txHash, message) {
         to: txInfo.to,
         hash: txHash || null,
         message: message,
+        chainId: txInfo.chainId,
     };
     renderError();
 }
@@ -348,11 +358,11 @@ function renderError() {
     if (!d || !d.message) return;
     $("error-tx-summary").textContent =
         d.amount + (d.symbol ? " " + d.symbol : "");
-    $("error-tx-to").innerHTML = toAddressHtml(d.to);
+    $("error-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
     $("error-tx-message").textContent = d.message;
 
     if (d.hash) {
-        $("error-tx-hash").innerHTML = txHashHtml(d.hash);
+        $("error-tx-hash").innerHTML = txHashHtml(d.hash, d.chainId);
         $("error-tx-hash-section").classList.remove("hidden");
         attachCopyHandlers("view-error-tx");
     } else {

src/popup/views/welcome.js

@@ -1,7 +1,34 @@
-const { $ } = require("./helpers");
+// The first screen, shown while there is no wallet. It offers the two lookups
+// at services other than the RPC endpoint, both off until the user ticks them,
+// which Settings offers as well.
+
+const { $, showView } = require("./helpers");
+const { state, saveState } = require("../../shared/state");
+
+function show() {
+    $("welcome-use-blockscout").checked = state.useBlockscout;
+    $("welcome-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
+    showView("welcome");
+}
 
 function init(ctx) {
     $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
+
+    $("welcome-use-blockscout").addEventListener("change", async () => {
+        state.useBlockscout = $("welcome-use-blockscout").checked;
+        await saveState();
+    });
+
+    $("welcome-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            state.checkRecipientsOnEtherscan = $(
+                "welcome-check-recipients-on-etherscan",
+            ).checked;
+            await saveState();
+        },
+    );
 }
 
-module.exports = { init };
+module.exports = { init, show };

src/shared/addressWarnings.js

@@ -60,6 +60,8 @@ function getLocalWarnings(address, options = {}) {
  * @param {string} [options.fromAddress] - Sender address (for self-send check).
  * @param {string} [options.chainId] - Chain id of the network whose explorer
  *   the Etherscan label check asks; the active network's when omitted.
+ * @param {boolean} [options.checkRecipientsOnEtherscan] - The user's setting
+ *   of that name. The Etherscan label check is made only while it is on.
  * @returns {Promise<Array<{type: string, message: string, severity: string}>>}
  */
 async function getFullWarnings(address, provider, options = {}) {
@@ -114,6 +116,7 @@ async function getFullWarnings(address, provider, options = {}) {
     try {
         const etherscanWarning = await checkEtherscanLabel(
             address,
+            options.checkRecipientsOnEtherscan,
             options.chainId,
         );
         if (etherscanWarning) {

src/shared/balances.js

@@ -1,5 +1,7 @@
-// Balance fetching: ETH balances via RPC, ERC-20 token balances via
-// Blockscout, ENS reverse lookup via RPC.
+// Balance fetching: ETH balances and the balances of the tokens the user
+// tracks via RPC, the other ERC-20 token balances and the holder counts via
+// Blockscout while the user has "Use Blockscout" on, ENS reverse lookup via
+// RPC.
 
 const {
     JsonRpcProvider,
@@ -36,9 +38,18 @@ const { resolveTokenDecimals } = require("./approvalAmount");
 // ethers knows chains this wallet does not, so an id that is not one of ours
 // is a caller bug and must not resolve to a working provider for some other
 // chain.
+//
+// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. Left on, as
+// ethers has it, a resolver that says a name is resolved off-chain makes ethers
+// fetch the web address the resolver gives, straight from the browser, with the
+// name being looked up; for the reverse lookup of the user's addresses that is
+// the user's own name (https://git.eeqj.de/sneak/AutistMask/issues/668). Such a
+// name does not resolve.
 function getProvider(rpcUrl, networkId) {
     const net = Network.from(requireNetworkId(networkId).id);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    provider.disableCcipRead = true;
+    return provider;
 }
 
 function requireNetworkId(networkId) {
@@ -80,8 +91,15 @@ function rawUnits(value) {
 
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
+//
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
+// Blockscout is not asked and the answer is an empty list: no token the user
+// has not tracked is listed.
+//
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders.
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
+// balance is read through the RPC endpoint instead, and its row here gives that
+// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -93,9 +111,11 @@ function rawUnits(value) {
 async function fetchTokenBalances(
     address,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     signal,
 ) {
+    if (!useBlockscout) return [];
     try {
         const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -205,18 +225,109 @@ async function fetchTokenBalances(
     }
 }
 
-// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// The entries at `address` of the tokens the user tracks, shaped as
+// fetchTokenBalances() returns them, for the tokens the address holds.
+//
+// The balance is read with balanceOf through the RPC endpoint. The name and
+// symbol are the tracked token's. `decimals` and `holders` are those of
+// Blockscout's entry for the token in `explorerRequest`, this refresh's
+// fetchTokenBalances() for the address; while Blockscout fails they are kept
+// from the token's entry in `previous`, the address's entries before this
+// refresh. The balance is stated at the scale the screens read the token at
+// (resolveTokenDecimals()): the bundled list's, then the one the tracked token
+// records, then Blockscout's, as in fetchTokenBalances().
+//
+// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
+// balance keeps its figure, or takes Blockscout's entry from this refresh when
+// it has none. The failure is logged. A balance of zero gets no entry, as a
+// zero Blockscout reports gets none: the balance lists take a tracked token's
+// zero from the tracked list. A token whose symbol the spoof rule refuses gets
+// no entry either, as in fetchTokenBalances().
+//
 // `signal` is as for fetchTokenBalances().
+async function fetchTrackedTokenBalances(
+    provider,
+    address,
+    trackedTokens,
+    previous,
+    explorerRequest,
+    signal,
+) {
+    const listed = trackedTokens.filter(
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
+    );
+    // Each token's balanceOf answer, or null where it failed.
+    const balances = await Promise.all(
+        listed.map(async (token) => {
+            try {
+                const contract = new Contract(
+                    token.address,
+                    ERC20_ABI,
+                    provider,
+                );
+                return await contract.balanceOf(address);
+            } catch (e) {
+                if (!signal?.aborted) {
+                    log.errorf(
+                        "token balance failed",
+                        address,
+                        token.address,
+                        e.shortMessage || e.message,
+                    );
+                }
+                return null;
+            }
+        }),
+    );
+    const explorerRows = await explorerRequest;
+    const reported = explorerRows ?? previous;
+
+    const rows = [];
+    listed.forEach((token, i) => {
+        const lower = token.address.toLowerCase();
+        const entryIn = (list) =>
+            list.find((row) => String(row.address).toLowerCase() === lower);
+        const raw = balances[i];
+        if (raw === null) {
+            const kept = entryIn(previous) || entryIn(explorerRows || []);
+            if (kept) rows.push(kept);
+            return;
+        }
+        if (raw === 0n) return;
+        const entry = entryIn(reported);
+        const decimals = entry ? entry.decimals : null;
+        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const scale = known !== null ? known : decimals;
+        rows.push({
+            address: token.address,
+            name: token.name || "",
+            symbol: token.symbol || "???",
+            decimals: decimals,
+            // null when nothing knows the scale: a holding whose amount
+            // cannot be stated, never a zero.
+            balance: scale === null ? null : formatTokenBalance(raw, scale),
+            holders: entry ? entry.holders : null,
+        });
+    });
+    return rows;
+}
+
+// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// `trackedTokens` are the tokens tracked on the active network.
+// `useBlockscout` and `signal` are as for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     networkId,
     signal,
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
+    const tracked = trackedTokens || [];
+    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
 
     for (const wallet of wallets) {
@@ -266,23 +377,44 @@ async function refreshBalances(
                     }),
             );
 
-            // ERC-20 token balances via Blockscout
+            // ERC-20 token balances: the tracked tokens' through the RPC
+            // endpoint, and from Blockscout the tokens the user has not
+            // tracked. When Blockscout fails, the untracked rows from before
+            // this refresh stay; while "Use Blockscout" is off there are none.
+            // The Blockscout request is started first and handed to
+            // fetchTrackedTokenBalances() too, which waits for it after
+            // sending its balanceOf reads, so the two run side by side.
+            const previous = addr.tokenBalances || [];
+            const explorerRequest = fetchTokenBalances(
+                addr.address,
+                blockscoutUrl,
+                useBlockscout,
+                tracked,
+                signal,
+            );
             updates.push(
-                fetchTokenBalances(
-                    addr.address,
-                    blockscoutUrl,
-                    trackedTokens,
-                    signal,
-                ).then((balances) => {
-                    if (balances !== null) {
-                        addr.tokenBalances = balances;
-                        log.debugf(
-                            "Token balances",
-                            addr.address,
-                            balances.length,
-                            "tokens",
-                        );
-                    }
+                Promise.all([
+                    fetchTrackedTokenBalances(
+                        provider,
+                        addr.address,
+                        tracked,
+                        previous,
+                        explorerRequest,
+                        signal,
+                    ),
+                    explorerRequest,
+                ]).then(([trackedRows, explorerRows]) => {
+                    const untrackedRows = (explorerRows ?? previous).filter(
+                        (row) =>
+                            !trackedSet.has(String(row.address).toLowerCase()),
+                    );
+                    addr.tokenBalances = trackedRows.concat(untrackedRows);
+                    log.debugf(
+                        "Token balances",
+                        addr.address,
+                        addr.tokenBalances.length,
+                        "tokens",
+                    );
                 }),
             );
         }

src/shared/browserApi.js

@@ -31,6 +31,11 @@
 // Everything is resolved on use rather than captured at module load. The MV3
 // service worker is torn down and re-evaluated repeatedly, and the unit
 // suite installs its stubs on `global.chrome` around a require().
+//
+// The module also holds withLock(), a wrapper around the browser's
+// `navigator.locks`, which is in neither namespace. It sits beside
+// storageGet() and storageSet() because every write of the stored record
+// takes it.
 
 // The extension API namespace, preferring `browser.*` where it exists.
 //
@@ -219,6 +224,46 @@ function storageRemove(keys) {
     return Promise.resolve(storage.remove(keys));
 }
 
+/**
+ * Call `listener` after every write to `storage.local`, whether this page,
+ * another page or the background made it, with what the write changed, as the
+ * browser reports it: `{ [key]: { oldValue, newValue } }`.
+ *
+ * @param {function(Object): void} listener
+ */
+function onStorageChanged(listener) {
+    namespaceMember("storage").onChanged.addListener((changes, areaName) => {
+        if (areaName === "local") listener(changes);
+    });
+}
+
+/**
+ * Run `fn` while holding the browser's lock called `name`
+ * (`navigator.locks`), and settle as `fn` settles. Every page of the extension
+ * and its background share these locks, except a page in a Firefox private
+ * window (README, "Stored state and its version"), so while one of them holds
+ * `name` another asking for it waits, in the order they asked. The lock is let
+ * go when `fn` settles, whether it resolved or rejected.
+ *
+ * Every write of the stored record holds the lock named after its key,
+ * "autistmask", from its read to its write: saveState() in
+ * src/shared/state.js, updateState() in src/background/state.js, and the
+ * reset in src/popup/views/stateRecovery.js.
+ *
+ * @param {string} name
+ * @param {function(): Promise<*>} fn
+ * @returns {Promise<*>} what `fn` resolved with.
+ * @throws rejects, without running `fn`, where `navigator.locks` is absent.
+ */
+function withLock(name, fn) {
+    if (typeof navigator === "undefined" || !navigator.locks) {
+        return Promise.reject(
+            new Error("navigator.locks is not available in this context"),
+        );
+    }
+    return navigator.locks.request(name, () => fn());
+}
+
 // `storage.session`, the browser's session storage: what is kept there lasts
 // until the browser closes. It survives the background worker being stopped
 // and started again, which module-level variables do not (README, Background
@@ -353,6 +398,7 @@ module.exports = {
     getPlatformInfo,
     hasBrowserNamespace,
     notify,
+    onStorageChanged,
     runtimeApi,
     sendMessage,
     sessionStorageGet,
@@ -373,4 +419,5 @@ module.exports = {
     windowsGetLastFocused,
     windowsRemove,
     windowsUpdate,
+    withLock,
 };

src/shared/chainSwitch.js

@@ -1,8 +1,18 @@
-// Consolidated chain-switch handler for the popup.
+// The popup's network switch.
 //
-// Every state change required when the active network changes is
-// performed here so that callers (settings UI, future chain additions) all go
-// through a single code path.
+// A network switch reaches the popup's `state` in one of two ways:
+//
+// - onChainSwitch() below makes the switch the user picks in Settings, with
+//   applyChainSwitchFields() (chainSwitchFields.js).
+// - followNetworkSwitch() in src/popup/index.js takes a switch the background
+//   or another popup page saved, from the stored record, with
+//   takeStoredNetwork() (state.js), which copies it with
+//   copyChainSwitchFields() (chainSwitchFields.js).
+//
+// Both change `state` inside a save, holding the lock, and both reset the
+// popup's own caches through clearPopupCaches(), so a reset added there
+// reaches both. A field applyChainSwitchFields() sets has to be copied by
+// copyChainSwitchFields() too.
 //
 // Adding a new chain (e.g. ETC) requires only a new entry in
 // networks.js — no per-caller wiring is needed.
@@ -20,22 +30,32 @@
 const { applyChainSwitchFields } = require("./chainSwitchFields");
 const { clearPrices } = require("./prices");
 
+// The popup's own caches a network switch resets. Prices are chain-specific
+// (testnet tokens are worthless, ETC has different pricing, etc.). In-memory
+// and per bundle, so this is the popup's own cache — the only context that
+// ever fills it.
+function clearPopupCaches() {
+    clearPrices();
+}
+
 // Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain.
+// Returns the network configuration object for the new chain, or null when
+// `state` already has that network once the save holds the lock, and nothing
+// is switched.
+//
+// `state` is switched inside the save that stores the switch, holding the
+// lock, so it is never switched while a follow of a switch saved elsewhere
+// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
+// follow runs first, and this switch is made after it.
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");
-
-    const net = applyChainSwitchFields(state, newNetworkId);
-
-    // --- price cache ---
-    // Prices are chain-specific (testnet tokens are worthless,
-    // ETC has different pricing, etc.). In-memory and per bundle, so this is
-    // the popup's own cache — the only context that ever fills it.
-    clearPrices();
-
-    await saveState();
-
+    let net = null;
+    await saveState(() => {
+        if (state.networkId === newNetworkId) return false;
+        net = applyChainSwitchFields(state, newNetworkId);
+        clearPopupCaches();
+    });
     return net;
 }
 
-module.exports = { onChainSwitch };
+module.exports = { onChainSwitch, clearPopupCaches };

src/shared/chainSwitchFields.js

@@ -7,7 +7,7 @@
 // the singleton and saves; the background applies it to the detached record of
 // its own read-modify-write (src/background/state.js).
 //
-// Everything here is synchronous and touches nothing but the object it is
+// Everything here is synchronous and touches nothing but the objects it is
 // given: no storage, no caches, no imports beyond the network table. That is
 // what makes it usable on a record that has been read fresh from storage
 // microseconds earlier and is about to be written back.
@@ -76,4 +76,33 @@ function applyChainSwitchFields(s, newNetworkId) {
     return net;
 }
 
-module.exports = { applyChainSwitchFields };
+// Give `s` every field applyChainSwitchFields() sets, as `switched` holds it:
+// the popup takes a switch the background saved from the stored record this
+// way, rather than performing it again (takeStoredNetwork() in
+// src/shared/state.js). Balances are taken by address, and an address
+// `switched` does not have keeps none.
+function copyChainSwitchFields(s, switched) {
+    s.networkEndpoints = switched.networkEndpoints;
+    s.networkTrackedTokens = switched.networkTrackedTokens;
+    s.trackedTokens = switched.trackedTokens;
+    s.networkId = switched.networkId;
+    s.rpcUrl = switched.rpcUrl;
+    s.blockscoutUrl = switched.blockscoutUrl;
+    s.lastBalanceRefresh = switched.lastBalanceRefresh;
+    s.tokenHolderCache = switched.tokenHolderCache;
+    s.fraudContracts = switched.fraudContracts;
+
+    const stored = new Map();
+    for (const wallet of switched.wallets) {
+        for (const addr of wallet.addresses) stored.set(addr.address, addr);
+    }
+    for (const wallet of s.wallets) {
+        for (const addr of wallet.addresses) {
+            const got = stored.get(addr.address);
+            addr.balance = got ? got.balance : "0";
+            addr.tokenBalances = got ? got.tokenBalances : [];
+        }
+    }
+}
+
+module.exports = { applyChainSwitchFields, copyChainSwitchFields };

src/shared/etherscanLabels.js

@@ -78,11 +78,20 @@ function parseEtherscanPage(html) {
  * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
  * Sepolia.
  *
+ * While the user's "Check recipients on Etherscan" setting is off, Etherscan
+ * is not asked and the answer is null.
+ *
  * @param {string} address - Ethereum address to check.
+ * @param {boolean} checkRecipientsOnEtherscan - The user's setting.
  * @param {string} [chainId] - Chain id of the network to look it up on.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
-async function checkEtherscanLabel(address, chainId) {
+async function checkEtherscanLabel(
+    address,
+    checkRecipientsOnEtherscan,
+    chainId,
+) {
+    if (!checkRecipientsOnEtherscan) return null;
     try {
         // Lazy require to avoid pulling in chrome.storage at module scope
         // (which breaks unit tests that only exercise parseEtherscanPage).

src/shared/persistedState.js

@@ -48,6 +48,12 @@ const DEFAULT_STATE = {
     hideDustTransactions: true,
     dustThresholdGwei: 100000,
     utcTimestamps: false,
+    // "Use Blockscout" and "Check recipients on Etherscan" in Settings, one
+    // setting each for every network. Both off until the user turns them on:
+    // the requests they allow send the user's addresses to a service other
+    // than the RPC endpoint.
+    useBlockscout: false,
+    checkRecipientsOnEtherscan: false,
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
@@ -406,6 +412,12 @@ function normalizePersisted(saved) {
             : 100000;
     out.utcTimestamps =
         saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+    out.useBlockscout =
+        saved.useBlockscout !== undefined ? saved.useBlockscout : false;
+    out.checkRecipientsOnEtherscan =
+        saved.checkRecipientsOnEtherscan !== undefined
+            ? saved.checkRecipientsOnEtherscan
+            : false;
     // A list of contract addresses, floored the same way: send.js builds its
     // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
     // and filterTransactions() maps the same list through normalizeAddress(),

src/shared/prices.js

@@ -38,11 +38,12 @@ function clearPrices() {
 }
 
 // Return the USD price for a symbol on the network with `chainId`, or on the
-// active network when no chain id is given; null on testnet / unknown.
+// active network when no chain id is given; null on testnet, on a chain id
+// that names no network, or for a symbol with no price.
 function getPrice(symbol, chainId) {
     const { currentNetwork } = require("./state");
     const network = chainId ? networkByChainId(chainId) : currentNetwork();
-    if (network.isTestnet) return null;
+    if (!network || network.isTestnet) return null;
     return prices[symbol] || null;
 }
 

src/shared/state.js

@@ -23,6 +23,7 @@
 // guarantee.
 
 const { networkById } = require("./networks");
+const { copyChainSwitchFields } = require("./chainSwitchFields");
 const {
     DEFAULT_STATE,
     PERSISTED_FIELDS,
@@ -35,7 +36,7 @@ const {
     migrationNeeded,
 } = require("./stateSchema");
 
-const { storageGet, storageSet } = require("./browserApi");
+const { storageGet, storageSet, withLock } = require("./browserApi");
 const { log } = require("./log");
 
 // The live record the proxy below guards. Everything inside this module reads
@@ -125,8 +126,10 @@ function currentNetwork() {
 }
 
 // The persisted fields as this page held them when its last loadState()
-// finished, or when its last successful saveState() began. saveState() diffs
-// the live state against this to find only the fields THIS page changed since.
+// finished, or when its last successful saveState() began, with any network
+// switch saved elsewhere that this page has taken since (takeStoredNetwork()).
+// saveState() diffs the live state against this to find only the fields THIS
+// page changed since.
 //
 // Deep-cloned, not a reference: callers mutate persisted objects and arrays
 // in place (state.wallets.push(...)), and a reference baseline would mutate
@@ -458,20 +461,18 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // This page's own live `state` is deliberately NOT rehydrated from a field
 // another page changed — only the record written to storage is merged.
 // showView() fires saveState() on every navigation without awaiting it,
-// which is what makes the queue above necessary in the first place, and a
-// save that is slow to come back has no way to tell whether the field it
+// which is why saves from one page wait for each other (see saveState()), and
+// a save that is slow to come back has no way to tell whether the field it
 // is about to hand back is still the current answer or has since been
 // overtaken by something this very page did in the meantime; writing it
 // into `state` regardless reintroduced exactly the clobber this function
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current.
-async function saveStateOnce() {
-    // A copy, so what this save compares and writes is the page's state as it
-    // stood when the save began. A change made while it waits on storage is
-    // left for the next save, which compares against this copy.
-    const current = structuredClone(snapshotPersisted());
+// before this fix; only the persisted record is guaranteed current. The
+// network is the exception: the popup takes a switch another context saved
+// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
+async function saveStateOnce(beforeWrite) {
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written
     // back, so it is validated exactly like a load validates it. Without this,
@@ -485,6 +486,12 @@ async function saveStateOnce() {
     // come from storage in its loaded (self-healed) shape. See
     // normalizePersisted() in persistedState.js.
     const fresh = normalizePersisted(result.autistmask);
+    if (beforeWrite && beforeWrite(fresh) === false) return;
+
+    // A copy, so what this save compares and writes is the page's state as it
+    // stood once the stored record was read. A change made while it waits on
+    // the write is left for the next save, which compares against this copy.
+    const current = structuredClone(snapshotPersisted());
 
     const merged = { ...fresh };
     for (const key of PERSISTED_FIELDS) {
@@ -529,35 +536,21 @@ async function saveStateOnce() {
     rawState.hasWallet = rawState.wallets.length > 0;
 
     // What this save compared and wrote, not the page's state now: a change
-    // made during the save must still differ from the baseline, or the save
-    // queued after it finds nothing to store
+    // made during the save must still differ from the baseline, or the next
+    // save finds nothing to store
     // (https://git.eeqj.de/sneak/AutistMask/issues/448).
     baseline = current;
 }
 
-// showView() calls saveState() on every navigation without awaiting it, so
-// two saves from the SAME page can be in flight at once — e.g. a screen
-// shown, then immediately replaced before the first save's storageGet()
-// round trip has come back. Left concurrent, the first save's turn would
-// finish after the second's live-state mutation and then re-hydrate `state`
-// from what IT read, stomping the second, later change back to a stale
-// value — the same clobber this function exists to prevent, just between
-// two saves on one page instead of two pages. Queuing makes every save's
-// snapshot-diff-write-rehydrate run start to finish before the next one
-// begins, so each one only ever sees the true live state at its turn.
-let saveQueue = Promise.resolve();
-
 // Where a failed save is REPORTED, set once by the context that has a screen
 // to say it on (src/popup/index.js).
 //
 // A save that fails must not fail silently. showView() fires saveState() on
-// every navigation without awaiting it, and the queue below has to attach a
-// rejection handler to keep advancing — so a failing save was swallowed
-// entirely: no throw, no message, nothing on screen. The wallet kept running
-// against storage that was rejecting every write, which is the data-loss half
-// of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
-// no better off: `await saveState()` inside an unguarded event handler surfaces
-// in the console and nowhere the user looks.
+// every navigation without awaiting it, and `await saveState()` inside an
+// unguarded event handler is no better: either way, without this, a failure
+// would reach only the console, where the user never looks, and the wallet
+// would keep running against storage that rejects every write. That is the
+// data-loss half of https://git.eeqj.de/sneak/AutistMask/issues/362.
 //
 // This is the "tell the user" half; the other half is the floor in
 // normalizePersisted(), which stops the malformed-record cause from arising in
@@ -583,11 +576,25 @@ function reportSaveFailure(err) {
     }
 }
 
-function saveState() {
-    const turn = saveQueue.then(saveStateOnce);
-    // The queue must advance even when a save rejects, or every save after
-    // it queues behind a promise that never settles.
-    saveQueue = turn.catch(() => {});
+// Each save runs start to finish holding the lock every write of the stored
+// record takes (withLock() in src/shared/browserApi.js), so no write by
+// another page or the background lands between its read and its write and is
+// lost (https://git.eeqj.de/sneak/AutistMask/issues/641). A page in a Firefox
+// private window is the exception: Firefox gives it locks of its own (README,
+// "Stored state and its version").
+//
+// The same lock orders this page's own saves. showView() calls saveState() on
+// every navigation without awaiting it, so two saves from one page can be
+// asked for at once; they take the lock in the order they were asked, and each
+// compares the page's state, as it stands once the stored record has been read
+// and `beforeWrite` has run, against the baseline the save before it left.
+//
+// `beforeWrite`, when given, is called inside the lock with the stored record
+// as just read, before this page's state is compared against it. It may change
+// `state`, and this save writes that change. When it returns false, nothing is
+// written; any other return lets the save go ahead.
+function saveState(beforeWrite) {
+    const turn = withLock("autistmask", () => saveStateOnce(beforeWrite));
     // Every failed save is reported, whether or not the caller awaited this
     // one. The returned promise still rejects, so a caller that DOES await
     // keeps its own error handling.
@@ -595,6 +602,17 @@ function saveState() {
     return turn;
 }
 
+// Give this page the network switch held by `stored`, a record a save of this
+// page has just read (followNetworkSwitch() in src/popup/index.js calls this
+// from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
+// with a whole record. The switch is then not this page's own change, even when
+// that save fails to write: a later switch back to the previous network still
+// differs from `baseline`, and is stored.
+function takeStoredNetwork(stored) {
+    copyChainSwitchFields(rawState, stored);
+    copyChainSwitchFields(baseline, structuredClone(stored));
+}
+
 // Rejects with StateUnusableError for a stored record this build cannot make
 // sense of. Nothing is assigned and `loaded` stays false in that case, so a
 // caller that ignores the rejection gets StateNotLoadedError on the first
@@ -640,6 +658,7 @@ module.exports = {
     state,
     saveState,
     onSaveFailure,
+    takeStoredNetwork,
     loadState,
     currentAddress,
     currentNetwork,

src/shared/transactions.js

@@ -20,6 +20,7 @@ const { toDecimals } = require("./transferAmount");
 // truncation without the approval screens' nonzero floor: the transaction
 // detail view is the authoritative record and already shows exact precision.
 const { truncateAmount: formatTxValue } = require("./amountDisplay");
+const { routerRelease } = require("./uniswap");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -51,7 +52,6 @@ function parseTx(tx, addrLower, chainId) {
         }
         // Map known DEX methods to "Swap" for cleaner display
         const SWAP_METHODS = new Set([
-            "execute",
             "swap",
             "swapExactTokensForTokens",
             "swapTokensForExactTokens",
@@ -59,9 +59,16 @@ function parseTx(tx, addrLower, chainId) {
             "swapTokensForExactETH",
             "swapExactTokensForETH",
             "swapETHForExactTokens",
-            "multicall",
         ]);
-        const label = SWAP_METHODS.has(method)
+        // Multisigs, smart accounts and many other contracts also have an
+        // `execute` or `multicall` method, so either is a swap only when sent
+        // to a Universal Router on this transaction's network: the same
+        // addresses the approval screen decodes a swap for.
+        const isSwap =
+            SWAP_METHODS.has(method) ||
+            ((method === "execute" || method === "multicall") &&
+                routerRelease(to, chainId) !== null);
+        const label = isSwap
             ? "Swap"
             : method.charAt(0).toUpperCase() + method.slice(1);
         direction = "contract";
@@ -228,12 +235,18 @@ function mergeTransactions(txs, tokenTransfers) {
 // `chainId` is the chain id of the network `blockscoutUrl` serves. Every entry
 // carries it, and a native entry is labelled with that network's
 // `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
+//
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
+// Blockscout is not asked and there is no history: the answer is an empty
+// list.
 async function fetchRecentTransactions(
     address,
     blockscoutUrl,
+    useBlockscout,
     chainId,
     count = 25,
 ) {
+    if (!useBlockscout) return [];
     log.debugf("fetchRecentTransactions", address);
     const addrLower = normalizeAddress(address);
 

tests/addressKey.test.js

@@ -442,11 +442,25 @@ describe("a confirmation screen whose From is not the selected address", () => {
         expect(Transaction.from(signed).from).toBe(derived(1).address);
     });
 
+    // The refusal's sentence is fixed in index.html, in a box of its own that
+    // holds its space from the first paint, so showing it moves nothing.
     test("nothing is sent when the selected wallet does not hold it", async () => {
         expect(await confirmSend(derived(5).address, 0)).toBeUndefined();
-        expect(node("confirm-tx-password-error").textContent).toBe(
-            "The selected wallet does not hold the From address above, " +
-                "so nothing was sent. Please go back and send again.",
+        expect(node("confirm-from-address-error").style.visibility).toBe(
+            "visible",
+        );
+        expect(node("confirm-tx-password-error").textContent).toBe("");
+
+        // Reviewing a send again draws the screen again, which hides it.
+        confirmTx.show({
+            from: derived(0).address,
+            to: RECIPIENT,
+            amount: "0.5",
+            token: "ETH",
+        });
+        await settle();
+        expect(node("confirm-from-address-error").style.visibility).toBe(
+            "hidden",
         );
     });
 });

tests/approvalTokenNetwork.test.js

@@ -0,0 +1,270 @@
+// The approval screen for a site's Sepolia token transfer while Ethereum
+// Mainnet is active.
+//
+// The screen named the token, and scaled its amount, from the active network's
+// tracked tokens and balances, so a token the wallet tracks on Sepolia read as
+// an unknown token with its amount in base units, and the screens after it
+// labelled the amount `?` (https://git.eeqj.de/sneak/AutistMask/issues/629).
+// It now uses what the wallet knows of the tokens on the network the
+// transaction is for.
+//
+// Its address links opened the active network's explorer
+// (https://git.eeqj.de/sneak/AutistMask/issues/631). They now open the
+// explorer of the network the transaction is for.
+//
+// Driven through the real approval screen, password and Confirm included,
+// against a minimal DOM stub in the shape tests/swapStatusAmount.test.js uses.
+// The vault is mocked so that no password has to be hashed.
+
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+}));
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { Interface } = require("ethers");
+const { state } = require("../src/shared/state");
+const { NETWORKS } = require("../src/shared/networks");
+const { decryptWithPassword } = require("../src/shared/vault");
+const approval = require("../src/popup/views/approval");
+const txStatus = require("../src/popup/views/txStatus");
+
+// A well-known test phrase, and its first address.
+const PHRASE = "test test test test test test test test test test test junk";
+const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
+const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
+// A token the bundled token list does not name.
+const TOKEN = "0x74de5d4FCbf63E00296fd95d33236B9794016631";
+
+// FROM sends 1234.5 of the 6-decimal token to RECIPIENT.
+const TRANSFER_DATA = new Interface([
+    "function transfer(address to, uint256 amount)",
+]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+function click(id) {
+    return Promise.all((node(id).listeners.click || []).map((fn) => fn()));
+}
+
+// One line of the decoded details: its label and what is drawn under it.
+function decodedLine(label) {
+    return node("approve-tx-decoded-details")
+        .innerHTML.split('<div class="mb-2">')
+        .find((line) =>
+            line.startsWith(`<div class="text-muted">${label}</div>`),
+        );
+}
+
+// Open the approval screen, with Ethereum Mainnet active and FROM holding
+// `tokenBalances` there, for the site's transaction sending TRANSFER_DATA to
+// the token, on Sepolia unless `chainId` names another chain. Confirm answers
+// the signed transaction with a failure, which leads to the error screen.
+async function showTokenTransfer(
+    tokenBalances = [],
+    chainId = NETWORKS.sepolia.chainId,
+) {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" }, close: () => {} };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (msg, reply) => {
+            if (!reply) return;
+            if (msg.type !== "AUTISTMASK_GET_APPROVAL") {
+                return reply({
+                    error: "The transaction could not be sent.",
+                    retryable: false,
+                });
+            }
+            reply({
+                type: "tx",
+                origin: "https://dapp.example",
+                isPhishingDomain: false,
+                approvedFrom: FROM,
+                approvedTx: {
+                    type: 2,
+                    from: FROM,
+                    chainId,
+                    nonce: "0x7",
+                    gasLimit: "0x30d40",
+                    maxPriorityFeePerGas: "0x3b9aca00",
+                    maxFeePerGas: "0x77359400",
+                    to: TOKEN,
+                    value: "0x0",
+                    data: TRANSFER_DATA,
+                    accessList: [],
+                },
+            });
+        },
+    };
+    state.networkId = "mainnet";
+    state.activeAddress = FROM;
+    state.wallets = [
+        {
+            type: "hd",
+            name: "Wallet 1",
+            xpub: "xpub-wallet-1",
+            encryptedSecret: "encrypted-secret-1",
+            nextIndex: 1,
+            addresses: [
+                { address: FROM, index: 0, balance: "0", tokenBalances },
+            ],
+        },
+    ];
+    state.currentView = null;
+    txStatus.init({ doRefreshAndRender: () => {} });
+    approval.init({});
+    await approval.show(1);
+}
+
+async function confirm() {
+    decryptWithPassword.mockResolvedValue(PHRASE);
+    node("approve-tx-password").value = "any password";
+    await click("btn-approve-tx");
+}
+
+beforeEach(() => {
+    state.trackedTokens = [];
+    state.networkTrackedTokens = {};
+});
+
+describe("a token tracked on Sepolia only", () => {
+    beforeEach(() => {
+        state.networkTrackedTokens = {
+            sepolia: [{ address: TOKEN, symbol: "TDOL", decimals: 6 }],
+        };
+    });
+
+    test("is named on the Contract line and the decoded Token line, with its amount at its scale", async () => {
+        await showTokenTransfer();
+        expect(node("approve-tx-to").innerHTML).toContain(
+            '<div class="font-bold mb-1">TDOL</div>',
+        );
+        expect(decodedLine("Token")).toContain(
+            '<div class="font-bold">TDOL</div>',
+        );
+        expect(decodedLine("Amount")).toContain(
+            '<div class="font-bold">1234.5000 TDOL</div>',
+        );
+    });
+
+    test("labels the amount on the error screen that follows", async () => {
+        await showTokenTransfer();
+        await confirm();
+        expect(state.currentView).toBe("error-tx");
+        expect(node("error-tx-summary").textContent).toBe("1234.5000 TDOL");
+    });
+});
+
+// The same contract address on mainnet is another token, so what the wallet
+// tracks and holds there names nothing on Sepolia.
+test("a token tracked and held on mainnet only is not named, and its amount is in base units", async () => {
+    state.trackedTokens = [{ address: TOKEN, symbol: "MDOL", decimals: 18 }];
+    await showTokenTransfer([
+        { address: TOKEN, symbol: "MDOL", decimals: 18, balance: "1.0" },
+    ]);
+    expect(node("approve-tx-to").innerHTML).not.toContain("MDOL");
+    expect(decodedLine("Token")).toContain(
+        '<div class="font-bold">Unknown token</div>',
+    );
+    expect(decodedLine("Amount")).toContain(
+        '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
+    );
+});
+
+// The From and Contract lines, and the decoded Token and Recipient lines.
+test("every address links to the Sepolia explorer", async () => {
+    await showTokenTransfer();
+    const sepolia = NETWORKS.sepolia.explorerUrl;
+    expect(node("approve-tx-from").innerHTML).toContain(
+        `href="${sepolia}/address/${FROM}"`,
+    );
+    expect(node("approve-tx-to").innerHTML).toContain(
+        `href="${sepolia}/address/${TOKEN}"`,
+    );
+    expect(decodedLine("Token")).toContain(
+        `href="${sepolia}/address/${TOKEN}"`,
+    );
+    expect(decodedLine("Recipient")).toContain(
+        `href="${sepolia}/address/${RECIPIENT}"`,
+    );
+    for (const id of [
+        "approve-tx-from",
+        "approve-tx-to",
+        "approve-tx-decoded-details",
+    ]) {
+        expect(node(id).innerHTML).not.toContain(NETWORKS.mainnet.explorerUrl);
+    }
+});
+
+// Chain id 1337 names no network here, so it has no explorer to link to.
+test("a transaction on a chain id that names no network is shown with no address links", async () => {
+    await showTokenTransfer([], "0x539");
+    expect(state.currentView).toBe("approve-tx");
+    expect(node("approve-tx-network").textContent).toBe(
+        "Unknown network (chain id 1337)",
+    );
+    expect(node("approve-tx-from").innerHTML).toContain(FROM);
+    for (const id of [
+        "approve-tx-from",
+        "approve-tx-to",
+        "approve-tx-decoded-details",
+    ]) {
+        expect(node(id).innerHTML).not.toContain("href=");
+    }
+});

tests/approvalValueUsd.test.js

@@ -0,0 +1,192 @@
+// The USD value on the approval screen's Value and Network fee lines, for a
+// site's ETH send.
+//
+// It was worked out from the four-decimal figure the line shows, at the price
+// on the active network, so the same value read a few cents different here than
+// on the confirmation screen, which prices the exact amount at the price on the
+// transaction's own network, and a transaction on another network than the
+// active one was priced at the active one's rate, its fee too
+// (https://git.eeqj.de/sneak/AutistMask/issues/614).
+//
+// Driven through the real approval screen, against a minimal DOM stub in the
+// shape tests/approvalTokenNetwork.test.js uses.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const { NETWORKS } = require("../src/shared/networks");
+const { prices, clearPrices } = require("../src/shared/prices");
+const approval = require("../src/popup/views/approval");
+
+const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
+const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        listeners: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: (n, force) => {
+                const on = force === undefined ? !classes.has(n) : force;
+                if (on) classes.add(n);
+                else classes.delete(n);
+                return on;
+            },
+        },
+        addEventListener: (name, fn) => {
+            el.listeners[name] = el.listeners[name] || [];
+            el.listeners[name].push(fn);
+        },
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Open the approval screen, with the network `networkId` active, for the
+// site's transaction sending 1.23414 ETH to RECIPIENT on the chain `chainId`.
+async function showEthSend(chainId, networkId) {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" }, close: () => {} };
+    globalThis.chrome.runtime = {
+        connect: () => ({ postMessage: () => {} }),
+        sendMessage: (msg, reply) => {
+            if (!reply) return;
+            reply({
+                type: "tx",
+                origin: "https://dapp.example",
+                isPhishingDomain: false,
+                approvedFrom: FROM,
+                approvedTx: {
+                    type: 2,
+                    from: FROM,
+                    chainId,
+                    nonce: "0x7",
+                    gasLimit: "0x5208",
+                    maxPriorityFeePerGas: "0x3b9aca00",
+                    maxFeePerGas: "0x77359400",
+                    to: RECIPIENT,
+                    value: "1234140000000000000",
+                    data: "0x",
+                    accessList: [],
+                },
+            });
+        },
+    };
+    state.networkId = networkId;
+    state.activeAddress = FROM;
+    state.wallets = [
+        {
+            type: "hd",
+            name: "Wallet 1",
+            xpub: "xpub-wallet-1",
+            encryptedSecret: "encrypted-secret-1",
+            nextIndex: 1,
+            addresses: [{ address: FROM, index: 0, balance: "0" }],
+        },
+    ];
+    state.trackedTokens = [];
+    state.networkTrackedTokens = {};
+    state.currentView = null;
+    approval.init({});
+    await approval.show(1);
+}
+
+beforeEach(() => {
+    prices.ETH = 2000;
+});
+
+afterEach(() => {
+    clearPrices();
+});
+
+// 1.23414 ETH reads 1.2341 ETH. At $2,000 the exact value is $2,468.28, the
+// figure the confirmation screen shows for it; the shown figure would be
+// $2,468.20.
+test.each([
+    [
+        "a mainnet transaction is priced from its exact value",
+        NETWORKS.mainnet.chainId,
+        "mainnet",
+        "1.2341 ETH ($2,468.28)",
+    ],
+    [
+        "a mainnet transaction shown with Sepolia active is priced at the mainnet price",
+        NETWORKS.mainnet.chainId,
+        "sepolia",
+        "1.2341 ETH ($2,468.28)",
+    ],
+    [
+        "a Sepolia transaction shown with mainnet active has no USD value",
+        NETWORKS.sepolia.chainId,
+        "mainnet",
+        "1.2341 SepoliaETH",
+    ],
+    // Chain id 1337 names no network here, so nothing knows its price.
+    [
+        "a transaction on a chain id that names no network has no USD value",
+        "0x539",
+        "mainnet",
+        "1.2341 ETH",
+    ],
+])("%s", async (_label, chainId, networkId, expected) => {
+    await showEthSend(chainId, networkId);
+    expect(state.currentView).toBe("approve-tx");
+    expect(node("approve-tx-value").textContent).toBe(expected);
+});
+
+// The Network fee line is priced on the transaction's network too. 21000 gas at
+// up to 2 gwei is 0.000042 ETH, $0.08 at $2,000.
+test.each([
+    [
+        "the fee of a mainnet transaction shown with Sepolia active is priced at the mainnet price",
+        NETWORKS.mainnet.chainId,
+        "sepolia",
+        "0.00004 ETH ($0.08)",
+    ],
+    [
+        "the fee of a Sepolia transaction shown with mainnet active has no USD value",
+        NETWORKS.sepolia.chainId,
+        "mainnet",
+        "0.00004 SepoliaETH",
+    ],
+])("%s", async (_label, chainId, networkId, expected) => {
+    await showEthSend(chainId, networkId);
+    expect(state.currentView).toBe("approve-tx");
+    expect(node("approve-tx-fee").textContent).toBe(expected);
+});

tests/backNavigation.test.js

@@ -154,7 +154,14 @@ describe("Back onto a view the reopened popup never rendered", () => {
 
     test("Back onto the transaction detail renders it", () => {
         reopenedOn("settings", ["main", "transaction"], {
-            viewData: { tx: { hash: "0xdead", from: ADDRESS, to: ADDRESS } },
+            viewData: {
+                tx: {
+                    hash: "0xdead",
+                    from: ADDRESS,
+                    to: ADDRESS,
+                    chainId: "0x1",
+                },
+            },
         });
         goBack();
         expect(calls).toEqual(["transactionDetail"]);

tests/backgroundStateIsolation.test.js

@@ -19,7 +19,10 @@
 //     that followed persisted the pre-refresh values — while still stamping
 //     lastBalanceRefresh, suppressing the redo.
 //
-// Both use the real persistence path over a cloning storage stub. Nothing here
+// A network switch landing inside a balance refresh's round trip is covered at
+// the end (https://git.eeqj.de/sneak/AutistMask/issues/577).
+//
+// All use the real persistence path over a cloning storage stub. Nothing here
 // asserts the absence of a loadState() call; each asserts the OUTCOME, so it
 // holds against any implementation that gets the outcome right.
 
@@ -395,3 +398,55 @@ describe("a balance refresh under another handler's state read", () => {
         expect(after.wallets[0].addresses[0].balance).toBe(REFRESHED_BALANCE);
     });
 });
+
+describe("a balance refresh under a network switch", () => {
+    // https://git.eeqj.de/sneak/AutistMask/issues/577. The switch clears every
+    // address's balances, and a refresh that started on the previous network
+    // must not write that network's back over them when it returns. The same
+    // refresh in the popup is in tests/balanceRefreshNetworkSwitch.test.js.
+    test("a refresh that returns after a switch writes nothing, and the next one runs on the new network", async () => {
+        const roundTrip = deferred();
+        const reachedNetwork = deferred();
+        const ranOn = [];
+
+        const bg = loadWorker("sepolia", {
+            refreshBalances: async (
+                wallets,
+                rpcUrl,
+                explorer,
+                useBlockscout,
+                tokens,
+                id,
+            ) => {
+                ranOn.push(id);
+                reachedNetwork.resolve();
+                await roundTrip.promise;
+                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
+            },
+        });
+
+        const refresh = bg.fireBalanceAlarm();
+        await reachedNetwork.promise;
+
+        // The user switches to Ethereum Mainnet in Settings while the round
+        // trip is out.
+        const during = bg.persisted();
+        applyChainSwitchFields(during, MAINNET.id);
+        global.chrome.storage.write("autistmask", during);
+
+        roundTrip.resolve();
+        await refresh;
+
+        const after = bg.persisted();
+        expect(after.networkId).toBe("mainnet");
+        expect(after.wallets[0].addresses[0].balance).toBe("0");
+        expect(after.lastBalanceRefresh).toBe(0);
+
+        await bg.fireBalanceAlarm();
+
+        expect(ranOn).toEqual(["sepolia", "mainnet"]);
+        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
+            REFRESHED_BALANCE,
+        );
+    });
+});

tests/balanceRefreshCancelled.test.js

@@ -18,6 +18,11 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TRACKED = {
+    address: "0x7777777777777777777777777777777777777777",
+    symbol: "TRK",
+    decimals: 6,
+};
 
 const realFetch = globalThis.fetch;
 let logged;
@@ -30,9 +35,9 @@ beforeEach(() => {
     const failedToFetch = async () => {
         throw new TypeError("Failed to fetch");
     };
-    // The RPC calls (ETH balance, ENS name, and the scan's balance and
-    // transaction count) and the explorer request (token balances) all fail
-    // the same way.
+    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
+    // the scan's balance and transaction count) and the explorer request (the
+    // other token balances) all fail the same way.
     FetchRequest.registerGetUrl(failedToFetch);
     globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -49,7 +54,8 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
-        [],
+        true,
+        [TRACKED],
         "mainnet",
         signal,
     );
@@ -60,6 +66,7 @@ test("a failure while the popup is open is reported", async () => {
     for (const label of [
         "ETH balance failed",
         "ENS reverse failed",
+        "token balance failed",
         "fetchTokenBalances failed: Failed to fetch",
     ]) {
         expect(logged.some((line) => line.includes(label))).toBe(true);

tests/balanceRefreshNetworkSwitch.test.js

@@ -0,0 +1,161 @@
+// A balance refresh the popup started on one network, and that returns after
+// the network was switched to another, writes nothing: the switch cleared every
+// address's balances, and the previous network's must not come back over them
+// (https://git.eeqj.de/sneak/AutistMask/issues/577). The switch is made either
+// by the user in this popup's Settings, or by the background after the user
+// approved a site's request, which changes only the stored record. Driven
+// through the real popup over a stored profile on Ethereum Mainnet. The same
+// refresh in the background is in tests/backgroundStateIsolation.test.js.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+const { applyChainSwitchFields } = require("../src/shared/chainSwitchFields");
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// Starts the ten-second refresh and holds it open. The balance stand-in writes
+// Ethereum Mainnet's balances in place, on the records handed in, as the real
+// refreshBalances() does, once the returned function is called. Resolves with
+// that function and the refresh still running.
+async function holdRefresh(page) {
+    const { refreshBalances } = require("../src/shared/balances");
+    let answer;
+    refreshBalances.mockImplementationOnce(async (wallets) => {
+        await new Promise((resolve) => {
+            answer = resolve;
+        });
+        wallets[0].addresses[0].balance = "7.0";
+        wallets[0].addresses[0].tokenBalances = [
+            {
+                address: TOKEN_ADDRESS,
+                name: "Test Token",
+                symbol: "TST",
+                decimals: 18,
+                balance: "5.0",
+                holders: null,
+            },
+        ];
+    });
+    const ticking = page.tick();
+    await page.settle();
+    return {
+        finish: async () => {
+            answer();
+            await ticking;
+        },
+    };
+}
+
+// Picks `networkId` in the Settings network selector, as the user does.
+async function chooseNetwork(page, networkId) {
+    const select = page.node("settings-network");
+    select.value = networkId;
+    for (const fn of select.listeners.change) await fn();
+    await page.settle();
+}
+
+// The stored record holds none of Ethereum Mainnet's balances, and no refresh
+// recorded as done.
+function expectNothingStored(page) {
+    const stored = page.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.wallets[0].addresses[0].balance).toBe("0");
+    expect(stored.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expect(stored.lastBalanceRefresh).toBe(0);
+}
+
+test("a refresh that returns after a switch in Settings writes nothing, and the next one runs on the new network", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { refreshBalances } = require("../src/shared/balances");
+    const { state } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    await page.click("btn-settings");
+    await chooseNetwork(page, "sepolia");
+    await refresh.finish();
+
+    expect(state.wallets[0].addresses[0].balance).toBe("0");
+    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expectNothingStored(page);
+
+    await page.click("btn-settings-back");
+    expect(page.visibleViews()).toEqual(["main"]);
+    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
+
+    await page.tick();
+
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
+    expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
+        0,
+    );
+});
+
+// The switch is made only once the refresh's save, holding the lock, has
+// written Ethereum Mainnet's balances, and the switch then clears them.
+test("a refresh whose save is reading the stored record when the user switches in Settings leaves none of its balances stored", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { state } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    await page.click("btn-settings");
+
+    // The next read of the stored record, the refresh's save's, is held.
+    const get = page.storage.local.get;
+    const read = get.getMockImplementation();
+    let releaseRead;
+    get.mockImplementationOnce(async (key) => {
+        await new Promise((resolve) => {
+            releaseRead = resolve;
+        });
+        return read(key);
+    });
+    const finishing = refresh.finish();
+    await page.settle();
+
+    // The user picks Sepolia meanwhile; the switch's own save waits for the
+    // refresh's save to let the lock go.
+    const select = page.node("settings-network");
+    select.value = "sepolia";
+    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
+    await page.settle();
+
+    releaseRead();
+    await finishing;
+    await switching;
+    await page.settle();
+
+    expect(state.networkId).toBe("sepolia");
+    expect(state.wallets[0].addresses[0].balance).toBe("0");
+    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expectNothingStored(page);
+});
+
+test("a refresh that returns after the background switched the network writes nothing", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { saveState } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    // The background writes the switch to Sepolia, as its updateState() does
+    // once the user approves a site's request. This page is not told of it
+    // yet.
+    const record = page.storage.read("autistmask");
+    applyChainSwitchFields(record, "sepolia");
+    page.storage.write("autistmask", record);
+    await refresh.finish();
+
+    expectNothingStored(page);
+
+    // Nor does a later save by this page, such as every navigation makes.
+    await saveState();
+
+    expectNothingStored(page);
+});

tests/blockscoutEtherscanSettings.test.js

@@ -0,0 +1,470 @@
+// Blockscout and Etherscan are sent none of the user's data until the user
+// turns them on (https://git.eeqj.de/sneak/AutistMask/issues/668). A new
+// profile has "Use Blockscout" and "Check recipients on Etherscan" both off.
+// Each request to either service is skipped where it is made while its setting
+// is off, and made while it is on; the popup and the background hand the
+// stored setting to the code that makes the request. The one exception is the
+// endpoint check Settings makes when the user presses "Save" beside the
+// Blockscout URL. It asks only for `/stats` and carries no user data; it is
+// made whether or not the setting is on.
+//
+// The functions that make the requests are driven directly, against a fetch()
+// that records every URL it is asked for. The screens are driven through the
+// real popup over a stored profile (tests/support/popupBoot.js), whose fetch()
+// stub records the same way.
+
+"use strict";
+
+const { FetchRequest } = require("ethers");
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    ADDRESS,
+} = require("./support/popupBoot");
+const { makeStorageStub } = require("./support/storageStub");
+const {
+    DEFAULT_STATE,
+    normalizePersisted,
+} = require("../src/shared/persistedState");
+const {
+    fetchTokenBalances,
+    refreshBalances,
+} = require("../src/shared/balances");
+const { fetchRecentTransactions } = require("../src/shared/transactions");
+const { getFullWarnings } = require("../src/shared/addressWarnings");
+const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
+
+const RPC_URL = "https://rpc.example.invalid";
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+const RECIPIENT = "0x2222222222222222222222222222222222222222";
+const TX_HASH = "0x" + "ab".repeat(32);
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+// USDC, from the bundled list, as Blockscout reports a holding of it.
+const USDC_ROW = {
+    value: "5000000",
+    token: {
+        type: "ERC-20",
+        address_hash: "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
+        symbol: "USDC",
+        name: "USD Coin",
+        decimals: "6",
+        holders_count: "50000",
+    },
+};
+
+const realFetch = globalThis.fetch;
+
+afterEach(() => {
+    cleanupPopup();
+    jest.restoreAllMocks();
+});
+
+describe("a new profile", () => {
+    test("has both settings off", () => {
+        expect(DEFAULT_STATE.useBlockscout).toBe(false);
+        expect(DEFAULT_STATE.checkRecipientsOnEtherscan).toBe(false);
+        const loaded = normalizePersisted(undefined);
+        expect(loaded.useBlockscout).toBe(false);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(false);
+    });
+
+    test("keeps either setting the user turned on", () => {
+        const loaded = normalizePersisted({
+            useBlockscout: true,
+            checkRecipientsOnEtherscan: true,
+        });
+        expect(loaded.useBlockscout).toBe(true);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(true);
+    });
+});
+
+describe("where each request is made", () => {
+    // Every URL fetch() was asked for, in order.
+    let asked;
+
+    beforeEach(() => {
+        asked = [];
+        globalThis.fetch = jest.fn(async (url) => {
+            asked.push(String(url));
+            return {
+                ok: true,
+                status: 200,
+                json: async () =>
+                    String(url).endsWith("/token-balances")
+                        ? [USDC_ROW]
+                        : { items: [] },
+                text: async () => "<html><body></body></html>",
+            };
+        });
+    });
+
+    afterEach(() => {
+        globalThis.fetch = realFetch;
+    });
+
+    test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
+        expect(
+            await fetchTokenBalances(ADDRESS, BLOCKSCOUT, false, []),
+        ).toEqual([]);
+        expect(asked).toEqual([]);
+
+        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, true, []);
+        expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
+        expect(asked).toEqual([
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+        ]);
+    });
+
+    test("the transaction history is asked for only while Use Blockscout is on", async () => {
+        expect(
+            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, false, "0x1"),
+        ).toEqual([]);
+        expect(asked).toEqual([]);
+
+        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, true, "0x1");
+        expect(asked.sort()).toEqual([
+            BLOCKSCOUT +
+                "/addresses/" +
+                ADDRESS +
+                "/token-transfers?type=ERC-20",
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/transactions",
+        ]);
+    });
+
+    test("the Etherscan label check is made only while Check recipients on Etherscan is on", async () => {
+        const provider = {
+            getCode: async () => "0x",
+            getTransactionCount: async () => 1,
+            getBalance: async () => 0n,
+        };
+        await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
+        await getFullWarnings(RECIPIENT, provider, {
+            chainId: "0x1",
+            checkRecipientsOnEtherscan: false,
+        });
+        expect(asked).toEqual([]);
+
+        await getFullWarnings(RECIPIENT, provider, {
+            chainId: "0x1",
+            checkRecipientsOnEtherscan: true,
+        });
+        expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
+    });
+
+    describe("a balance refresh", () => {
+        // The RPC endpoint answers every balance with zero, and every other
+        // call, the ENS reverse lookup's, with no resolver.
+        beforeEach(() => {
+            FetchRequest.registerGetUrl(async (req) => {
+                const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+                const reply = (r) => ({
+                    jsonrpc: "2.0",
+                    id: r.id,
+                    result: r.method === "eth_getBalance" ? "0x0" : ZERO_WORD,
+                });
+                const answer = Array.isArray(body)
+                    ? body.map(reply)
+                    : reply(body);
+                return {
+                    statusCode: 200,
+                    statusMessage: "OK",
+                    headers: { "content-type": "application/json" },
+                    body: Buffer.from(JSON.stringify(answer)),
+                };
+            });
+        });
+
+        afterEach(() => {
+            FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+        });
+
+        // An address that was refreshed while Use Blockscout was on, and holds
+        // the USDC Blockscout reported then.
+        function addressWithUsdc() {
+            return {
+                address: ADDRESS,
+                tokenBalances: [
+                    {
+                        address: USDC_ROW.token.address_hash,
+                        name: "USD Coin",
+                        symbol: "USDC",
+                        decimals: 6,
+                        balance: "5.0",
+                        holders: 50000,
+                    },
+                ],
+            };
+        }
+
+        async function refresh(addr, useBlockscout) {
+            await refreshBalances(
+                [{ addresses: [addr] }],
+                RPC_URL,
+                BLOCKSCOUT,
+                useBlockscout,
+                [],
+                "mainnet",
+            );
+        }
+
+        test("asks Blockscout nothing while Use Blockscout is off, and then lists no token the user has not tracked", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, false);
+            expect(asked).toEqual([]);
+            expect(addr.tokenBalances).toEqual([]);
+        });
+
+        test("asks Blockscout for the token balances while Use Blockscout is on", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, true);
+            expect(asked).toEqual([
+                BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+            ]);
+            expect(addr.tokenBalances.map((row) => row.symbol)).toEqual([
+                "USDC",
+            ]);
+        });
+    });
+});
+
+describe("the popup", () => {
+    // Every URL the booted page handed to fetch().
+    function fetched() {
+        return globalThis.fetch.mock.calls.map((call) => String(call[0]));
+    }
+
+    function blockscoutOrEtherscan(url) {
+        return url.includes("blockscout") || url.includes("etherscan");
+    }
+
+    beforeEach(() => {
+        // The screens below log their failed RPC reads; the stub node in
+        // popupBoot.js answers none.
+        jest.spyOn(console, "error").mockImplementation(() => {});
+    });
+
+    test("hands its balance refresh and Home's history the stored Use Blockscout setting", async () => {
+        await bootPopup(unversionedValidProfile());
+        const {
+            refreshBalances: popupRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: popupHistory,
+        } = require("../src/shared/transactions");
+        expect(popupRefresh.mock.calls[0][3]).toBe(false);
+        expect(popupHistory.mock.calls[0][2]).toBe(false);
+        cleanupPopup();
+
+        await bootPopup(unversionedValidProfile({ useBlockscout: true }));
+        const {
+            refreshBalances: onRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: onHistory,
+        } = require("../src/shared/transactions");
+        expect(onRefresh.mock.calls[0][3]).toBe(true);
+        expect(onHistory.mock.calls[0][2]).toBe(true);
+    });
+
+    test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        expect(page.node("home-tx-list").innerHTML).toContain(
+            escapeHtml(HISTORY_OFF_TEXT),
+        );
+        expect(page.hidden("home-tokens-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            unversionedValidProfile({ useBlockscout: true }),
+        );
+        expect(on.node("home-tx-list").innerHTML).toContain(
+            "No transactions found.",
+        );
+        expect(on.hidden("home-tokens-note")).toBe(true);
+    });
+
+    // The transaction screen, as a reopened popup draws it.
+    function onTransactionScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "transaction",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                tx: {
+                    hash: TX_HASH,
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    value: "1.0000",
+                    exactValue: "1.0",
+                    symbol: "ETH",
+                    timestamp: 1790000000,
+                    isError: false,
+                    direction: "sent",
+                    directionLabel: "Sent",
+                    contractAddress: null,
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("TransactionDetail asks Blockscout for the transaction only while Use Blockscout is on", async () => {
+        const page = await bootPopup(onTransactionScreen());
+        expect(page.visibleViews()).toEqual(["transaction"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onTransactionScreen({ useBlockscout: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            BLOCKSCOUT + "/transactions/" + TX_HASH,
+        ]);
+        expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
+    });
+
+    // The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
+    // reopened popup draws it.
+    function onConfirmScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "confirm-tx",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                pendingTx: {
+                    token: "ETH",
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    amount: "0.1",
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("ConfirmTx asks Etherscan about the recipient only while Check recipients on Etherscan is on", async () => {
+        const page = await bootPopup(onConfirmScreen());
+        expect(page.visibleViews()).toEqual(["confirm-tx"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("confirm-etherscan-note")).toBe(false);
+        expect(page.hidden("confirm-etherscan-warning")).toBe(true);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            "https://etherscan.io/address/" + RECIPIENT,
+        ]);
+        expect(on.hidden("confirm-etherscan-note")).toBe(true);
+        expect(on.hidden("confirm-etherscan-warning")).toBe(false);
+    });
+
+    // Ticks a checkbox on the page, as the user does.
+    async function tick(page, id) {
+        const box = page.node(id);
+        box.checked = true;
+        for (const fn of box.listeners.change) await fn();
+        await page.settle();
+    }
+
+    test("Welcome offers both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(undefined);
+        expect(page.visibleViews()).toEqual(["welcome"]);
+        expect(page.node("welcome-use-blockscout").checked).toBe(false);
+        expect(page.node("welcome-check-recipients-on-etherscan").checked).toBe(
+            false,
+        );
+
+        await tick(page, "welcome-use-blockscout");
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await tick(page, "welcome-check-recipients-on-etherscan");
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+
+    test("Settings shows both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        expect(page.node("settings-use-blockscout").checked).toBe(false);
+        expect(
+            page.node("settings-check-recipients-on-etherscan").checked,
+        ).toBe(false);
+
+        await tick(page, "settings-use-blockscout");
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await tick(page, "settings-check-recipients-on-etherscan");
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+});
+
+describe("the background", () => {
+    afterEach(() => {
+        delete globalThis.chrome;
+        jest.dontMock("../src/shared/balances");
+    });
+
+    // Starts the background over `profile`, fires its balance alarm, and
+    // answers with the Use Blockscout setting its refresh was handed.
+    async function settingTheRefreshIsHanded(profile) {
+        jest.resetModules();
+        let handed;
+        const called = new Promise((resolve) => {
+            handed = resolve;
+        });
+        jest.doMock("../src/shared/balances", () => ({
+            getProvider: () => ({}),
+            refreshBalances: async (...args) => handed(args[3]),
+        }));
+        let onAlarm = null;
+        globalThis.chrome = {
+            storage: makeStorageStub({ autistmask: profile }),
+            alarms: {
+                create: () => {},
+                get: async () => undefined,
+                clear: async () => false,
+                onAlarm: {
+                    addListener: (fn) => {
+                        onAlarm = fn;
+                    },
+                },
+            },
+            runtime: {
+                onMessage: { addListener: () => {} },
+                onConnect: { addListener: () => {} },
+                onInstalled: { addListener: () => {} },
+                onStartup: { addListener: () => {} },
+                getURL: (p) => "chrome-extension://test/" + p,
+                lastError: null,
+            },
+            windows: { onRemoved: { addListener: () => {} } },
+            tabs: { query: () => {}, sendMessage: () => {} },
+            action: { setPopup: () => {} },
+        };
+        require("../src/background/index");
+        const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
+        onAlarm({ name: BALANCE_REFRESH_ALARM });
+        return called;
+    }
+
+    test("hands its balance refresh the stored Use Blockscout setting", async () => {
+        const profile = { ...unversionedValidProfile(), lastBalanceRefresh: 0 };
+        expect(await settingTheRefreshIsHanded(profile)).toBe(false);
+        expect(
+            await settingTheRefreshIsHanded({
+                ...profile,
+                useBlockscout: true,
+            }),
+        ).toBe(true);
+    });
+});

tests/chainSwitchGate.test.js

@@ -446,7 +446,10 @@ describe("switching the network in Settings tells every open tab", () => {
         global.chrome.runtime.sendMessage = (msg) => {
             bg.send(msg, POPUP);
         };
-        await require("../src/shared/state").loadState();
+        const { state, loadState } = require("../src/shared/state");
+        await loadState();
+        // Set by showView(), which is mocked above.
+        state.currentView = "settings";
         require("../src/popup/views/settings").init({
             pageClosed: new AbortController().signal,
         });

tests/confirmTxAmount.test.js

@@ -0,0 +1,416 @@
+// The amount of the wallet's own send on the confirmation, wait, success and
+// error screens (https://git.eeqj.de/sneak/AutistMask/issues/522).
+//
+// These screens printed the text from Send's amount field as it was typed or
+// filled in: `0.5 ETH`, or `1.234147890123456789 ETH` after Max, where the
+// approval screen shows a site's send as `0.5000 ETH`. They now show it to four
+// decimal places with the nonzero floor, as the approval screen does, and the
+// transaction is still signed for the exact amount.
+//
+// Driven through the real Send screen, confirmation screen, Sign & Send and
+// wait screen, with only the node, the explorer and the DOM stubbed.
+
+"use strict";
+
+// What the stub node answers, and the signed transactions it was handed. The
+// token's own decimals() answers 6, as the explorer does.
+const mockNode = {
+    balanceWei: 0n,
+    tokenUnits: 0n,
+    tokenDecimals: 6n,
+    broadcast: [],
+    broadcastError: null,
+    receipt: null,
+};
+
+// The token rows the stub explorer reports for the address.
+const mockExplorer = { items: [] };
+
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    // The selector of decimals(); every other contract call is balanceOf().
+    const DECIMALS = "0x313ce567";
+    class StubProvider {
+        async getBalance() {
+            return mockNode.balanceWei;
+        }
+        async call(tx) {
+            return actual.AbiCoder.defaultAbiCoder().encode(
+                ["uint256"],
+                [
+                    tx.data.startsWith(DECIMALS)
+                        ? mockNode.tokenDecimals
+                        : mockNode.tokenUnits,
+                ],
+            );
+        }
+        async lookupAddress() {
+            return null;
+        }
+        // 20 gwei reserved per gas.
+        async getFeeData() {
+            return {
+                maxFeePerGas: 20000000000n,
+                maxPriorityFeePerGas: 1000000000n,
+                gasPrice: 10000000000n,
+            };
+        }
+        async estimateGas() {
+            return 21000n;
+        }
+        async getCode() {
+            return "0x";
+        }
+        async getTransactionCount() {
+            return 1;
+        }
+        async getNetwork() {
+            return { chainId: 1n };
+        }
+        async broadcastTransaction(signed) {
+            if (mockNode.broadcastError) throw mockNode.broadcastError;
+            mockNode.broadcast.push(signed);
+            return { hash: "0x" + "ab".repeat(32) };
+        }
+        async getTransactionReceipt() {
+            return mockNode.receipt;
+        }
+    }
+    return {
+        ...actual,
+        JsonRpcProvider: StubProvider,
+        Network: { from: () => ({}) },
+    };
+});
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    // The explorer's token list, which refreshBalances() also fetches.
+    debugFetch: jest.fn(async () => ({
+        ok: true,
+        status: 200,
+        json: async () => mockExplorer.items,
+    })),
+    urlOrigin: () => "",
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+// The confirmation screen's Etherscan label lookup is the only fetch() these
+// screens make; it fails, as it does offline.
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+
+// A stub DOM: every id resolves to a recording element.
+const elements = new Map();
+
+function makeEl(id) {
+    const handlers = new Map();
+    return {
+        id,
+        textContent: "",
+        innerHTML: "",
+        value: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add() {},
+            remove() {},
+            toggle() {},
+            contains: () => false,
+        },
+        handlers,
+        children: [],
+        addEventListener(name, fn) {
+            handlers.set(name, fn);
+        },
+        appendChild(child) {
+            this.children.push(child);
+            return child;
+        },
+        querySelectorAll: () => [],
+        querySelector: () => null,
+        remove() {},
+        focus() {},
+        // The success screen hides whole sections through .parentElement.
+        get parentElement() {
+            return global.document.getElementById(id + "-parent");
+        },
+    };
+}
+
+global.document = {
+    getElementById(id) {
+        if (!elements.has(id)) elements.set(id, makeEl(id));
+        return elements.get(id);
+    },
+    createElement: (tag) => makeEl(tag),
+    body: { prepend() {}, appendChild() {} },
+    addEventListener() {},
+};
+global.navigator.clipboard = { writeText() {} };
+
+const {
+    Interface,
+    Transaction,
+    Wallet,
+    getAddress,
+    parseEther,
+} = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+const { encryptWithPassword } = require("../src/shared/vault");
+const { state } = require("../src/shared/state");
+const { clearPrices } = require("../src/shared/prices");
+const send = require("../src/popup/views/send");
+const confirmTx = require("../src/popup/views/confirmTx");
+const txStatus = require("../src/popup/views/txStatus");
+
+const PRIVATE_KEY = "0x" + "11".repeat(32);
+const HOLDER = new Wallet(PRIVATE_KEY).address;
+const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const PASSWORD = "correct horse battery staple";
+
+const GWEI = 1000000000n;
+// 1.234567890123456789 ETH.
+const BALANCE_WEI = 1234567890123456789n;
+
+// A token the bundled list does not know, with enough holders to be listed,
+// at 6 decimal places.
+const TOKEN = "0x" + "d".repeat(40);
+
+const transferIface = new Interface([
+    "function transfer(address to, uint256 amount)",
+]);
+
+let encryptedSecret;
+
+// The confirmation screen Review leads to, once shown.
+let confirmed = null;
+
+function el(id) {
+    return global.document.getElementById(id);
+}
+
+function text(id) {
+    return el(id).textContent;
+}
+
+// show() reads the balance and then estimates the fee without awaiting
+// either; this lets both settle.
+async function settle() {
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+// The address holds BALANCE_WEI and, when `tokenUnits` is given, that many
+// base units of TOKEN, fetched and stored where the popup stores them. Send
+// is then open for `token` ("ETH" or TOKEN) with the recipient entered.
+async function openSend(token, tokenUnits = null) {
+    mockNode.balanceWei = BALANCE_WEI;
+    mockNode.tokenUnits = tokenUnits ?? 0n;
+    mockExplorer.items =
+        tokenUnits === null
+            ? []
+            : [
+                  {
+                      value: String(tokenUnits),
+                      token: {
+                          type: "ERC-20",
+                          address_hash: TOKEN,
+                          symbol: "TOK",
+                          name: "Token",
+                          decimals: "6",
+                          holders_count: "50000",
+                      },
+                  },
+              ];
+    state.wallets = [
+        {
+            type: "key",
+            name: "Wallet 1",
+            encryptedSecret,
+            addresses: [{ address: HOLDER }],
+        },
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    await refreshBalances(
+        state.wallets,
+        "https://rpc.example.invalid",
+        "https://blockscout.example/api/v2",
+        true,
+        state.trackedTokens,
+        "mainnet",
+    );
+    send.init({
+        showConfirmTx: (info) => (confirmed = info),
+        pageClosed: new AbortController().signal,
+    });
+    confirmTx.init({});
+    send.resetSendValidation();
+    state.currentView = "send";
+    state.selectedToken = token;
+    el("send-to").value = RECIPIENT;
+    el("send-amount").value = "";
+}
+
+// Press Review and show the confirmation screen with its fee estimate settled.
+async function review() {
+    await el("btn-send-review").handlers.get("click")();
+    confirmTx.show(confirmed);
+    await settle();
+}
+
+async function signAndSend() {
+    el("confirm-tx-password").value = PASSWORD;
+    await el("btn-confirm-send").handlers.get("click")();
+}
+
+// The one transaction the stub node was handed.
+function broadcastTx() {
+    expect(mockNode.broadcast).toHaveLength(1);
+    return Transaction.from(mockNode.broadcast[0]);
+}
+
+beforeAll(async () => {
+    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
+});
+
+beforeEach(() => {
+    elements.clear();
+    clearPrices();
+    confirmed = null;
+    state.selectedToken = null;
+    state.trackedTokens = [];
+    state.fraudContracts = [];
+    state.currentView = null;
+    mockNode.broadcast = [];
+    mockNode.broadcastError = null;
+    mockNode.receipt = null;
+    txStatus.init({
+        doRefreshAndRender() {},
+        pageClosed: new AbortController().signal,
+    });
+});
+
+afterEach(() => {
+    txStatus.endWait();
+});
+
+describe("the wallet's own send shows its amount to four decimal places", () => {
+    test("for a short amount", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.5"));
+    });
+
+    // Send accepts both. The approval screen writes the same value `0.5000`.
+    test.each([".5", "00.5"])("for an amount typed as %s", async (typed) => {
+        await openSend("ETH");
+        el("send-amount").value = typed;
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.5"));
+    });
+
+    test("for a token amount typed as .5", async () => {
+        // 100 TOK.
+        await openSend(TOKEN, 100000000n);
+        el("send-amount").value = ".5";
+        await review();
+        expect(text("confirm-amount")).toBe("0.5000 TOK");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.5000 TOK");
+        const [, amount] = transferIface.decodeFunctionData(
+            "transfer",
+            broadcastTx().data,
+        );
+        expect(amount).toBe(500000n);
+    });
+
+    test("for a Max amount with many decimals", async () => {
+        await openSend("ETH");
+        await el("btn-send-max").handlers.get("click")();
+        // The balance minus 21000 gas at 20 gwei.
+        expect(el("send-amount").value).toBe("1.234147890123456789");
+        await review();
+        expect(text("confirm-amount")).toBe("1.2341 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("1.2341 ETH");
+        expect(broadcastTx().value).toBe(BALANCE_WEI - 21000n * 20n * GWEI);
+    });
+
+    // Cut to four decimals it would read 0.0000, so it is shown to its first
+    // significant digit instead, and signed in full.
+    test("for a tiny nonzero amount", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.000012345";
+        await review();
+        expect(text("confirm-amount")).toBe("0.00001 ETH");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("0.00001 ETH");
+        expect(broadcastTx().value).toBe(parseEther("0.000012345"));
+    });
+
+    test("for a token amount", async () => {
+        // 100 TOK.
+        await openSend(TOKEN, 100000000n);
+        el("send-amount").value = "12.345678";
+        await review();
+        expect(text("confirm-amount")).toBe("12.3456 TOK");
+
+        await signAndSend();
+        expect(text("wait-tx-summary")).toBe("12.3456 TOK");
+        const tx = broadcastTx();
+        expect(tx.to).toBe(getAddress(TOKEN));
+        const [to, amount] = transferIface.decodeFunctionData(
+            "transfer",
+            tx.data,
+        );
+        expect(to).toBe(RECIPIENT);
+        expect(amount).toBe(12345678n);
+    });
+
+    test("on the success screen", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        await signAndSend();
+        // A popup opened later resumes the wait, and the receipt is there.
+        mockNode.receipt = { blockNumber: 21000000 };
+        txStatus.restoreWait();
+        await settle();
+        expect(state.currentView).toBe("success-tx");
+        expect(text("success-tx-summary")).toBe("0.5000 ETH");
+    });
+
+    test("on the error screen", async () => {
+        await openSend("ETH");
+        el("send-amount").value = "0.5";
+        await review();
+        mockNode.broadcastError = new Error("the node refused it");
+        await signAndSend();
+        expect(state.currentView).toBe("error-tx");
+        expect(text("error-tx-summary")).toBe("0.5000 ETH");
+    });
+});

tests/confirmTxLateResult.test.js

@@ -50,8 +50,14 @@ function explorerPage(title) {
 // The explorer labels no address.
 global.fetch = jest.fn(async () => explorerPage("Etherscan"));
 
+// The Etherscan label check is made, so its box can be shown.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();

tests/confirmTxNetworkSwitch.test.js

@@ -142,13 +142,19 @@ jest.mock("../src/popup/views/txStatus", () => ({
 }));
 
 // The Etherscan label check is its only caller here: the explorer pages it
-// asks for are recorded, and nothing is fetched.
+// asks for are recorded, and nothing is fetched. The stored profile has the
+// check turned on.
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -189,7 +195,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const {
     BaseWallet,
@@ -333,7 +339,7 @@ function expectNativeTransferOn(networkId) {
         "Native " + symbol + " transfer",
     );
     expect(el("confirm-amount").textContent).toBe(
-        "1 " + symbol + usdOn(networkId, "$2,000.00"),
+        "1.0000 " + symbol + usdOn(networkId, "$2,000.00"),
     );
     expect(el("confirm-balance").textContent).toBe(
         "5.0000 " + symbol + usdOn(networkId, "$10,000.00"),
@@ -649,7 +655,7 @@ describe.each([
                 `href="${explorerUrl}/address/${TOKEN}"`,
             );
             expect(el("confirm-amount").textContent).toBe(
-                "10 USDC" + usdOn(reviewedOn, "$10.00"),
+                "10.0000 USDC" + usdOn(reviewedOn, "$10.00"),
             );
             expect(el("confirm-balance").textContent).toBe(
                 "50.0000 USDC" + usdOn(reviewedOn, "$50.00"),

tests/contractCreation.test.js

@@ -192,6 +192,7 @@ describe("the wait, success and error screens", () => {
         amount: "0.0000",
         token: "ETH",
         tokenSymbol: null,
+        chainId: "0x1",
     };
     const transfer = { ...creation, to: RECIPIENT };
 
@@ -296,6 +297,8 @@ describe.each([
         state.selectedWallet = 0;
         state.selectedAddress = 0;
         state.selectedToken = "ETH";
+        // The history is Blockscout's.
+        state.useBlockscout = true;
     });
 
     test("a contract creation's row says so, with no colour dot and no address line", async () => {

tests/dustThreshold.test.js

@@ -101,7 +101,7 @@ describe("the flash line the message is shown in", () => {
     //
     // The line cuts a message too long for it with an ellipsis (see
     // showFlash() in src/popup/views/helpers.js). The assertions that
-    // measure that, in a real browser at the documented 360x600 popup, are
+    // measure that, in a real browser at the documented 396x600 popup, are
     // "a rejected dust threshold shifts no layout (#233)" and "an over-long
     // flash message keeps to one line (#252)" in tests/e2e/run.js, run by
     // make test-e2e. They are not in make check because REPO_POLICIES.md

tests/e2e/firefox/run.js

@@ -867,6 +867,14 @@ step(
             "the page was not told of the approved switch: " +
                 JSON.stringify(events),
         );
+        // The popup, open all along, shows the new network
+        // (https://git.eeqj.de/sneak/AutistMask/issues/650).
+        await d.switchToWindow(env.popupWindow);
+        await d.waitFor(
+            "the open popup to show the testnet banner",
+            `const banner = document.getElementById("debug-banner");
+             return banner !== null && banner.textContent === "[TESTNET]";`,
+        );
 
         await openNetworkPrompt(env, "switch-restore", sepolia, mainnet);
         await d.click("#btn-approve-network");
@@ -881,6 +889,10 @@ step(
             isDeepStrictEqual(await storedNetwork(env), before),
             "switching back did not restore the mainnet network and endpoints",
         );
+        await d.waitFor(
+            "the open popup to drop the testnet banner",
+            `return document.getElementById("debug-banner") === null;`,
+        );
         await d.switchToWindow(env.dappWindow);
     },
 );

tests/e2e/network.js

@@ -653,6 +653,12 @@ function traceEnabled(raw) {
  *   confirmed receipt instead of null, so a wait screen resolves.
  * @param {boolean} [opts.failReceiptLookup]  answer eth_getTransactionReceipt
  *   with an error, so every receipt lookup fails; read at request time.
+ * @param {string} [opts.etherscanLabel]  the label Etherscan's page gives the
+ *   address asked about, such as "Fake_Phishing1"; none when unset. Read at
+ *   request time.
+ * @param {object[]} [opts.requests]  every request this handler sees, from the
+ *   popup's pages and the background worker alike, appended in order as
+ *   { method, url, fromWorker }.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -691,6 +697,13 @@ async function installNetworkStubs(ctx, opts) {
             const origin = fromWorker ? "[sw] " : "[page] ";
             console.log("# routed " + origin + req.method() + " " + req.url());
         }
+        if (Array.isArray(opts.requests)) {
+            opts.requests.push({
+                method: req.method(),
+                url: req.url(),
+                fromWorker,
+            });
+        }
 
         // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
         if (req.method() === "POST") {
@@ -762,12 +775,20 @@ async function installNetworkStubs(ctx, opts) {
             return route.fulfill({ status: 204, body: "" });
         }
 
-        // Best-effort Etherscan address labels: served as an empty page.
+        // Best-effort Etherscan address labels: served as an empty page, or
+        // as a page labelling the address with opts.etherscanLabel.
         if (url.hostname.endsWith("etherscan.io")) {
+            const title = opts.etherscanLabel
+                ? "<title>" +
+                  opts.etherscanLabel +
+                  " | Address: " +
+                  p.split("/").pop() +
+                  " | Etherscan</title>"
+                : "";
             return route.fulfill({
                 status: 200,
                 contentType: "text/html",
-                body: "<html><body></body></html>",
+                body: "<html><head>" + title + "</head><body></body></html>",
             });
         }
 

tests/e2e/run.js

@@ -60,6 +60,14 @@ const TEST_TIMEOUT_MS = 120000;
 // trailing drain in main().
 const TRAILING_WATCH_MS = 1500;
 
+// The popup's size, as README gives it: `body` in src/popup/styles/main.css
+// is 396px wide, and src/background/index.js opens an approval window at
+// the same 396x600. Pages in this context otherwise get Playwright's
+// 1280x720 default, where the page never scrolls sideways and a button
+// below the popup's fold is still on screen, so a layout measured there
+// passes whatever the page does.
+const POPUP_VIEWPORT = { width: 396, height: 600 };
+
 const tests = [];
 
 function test(name, fn) {
@@ -261,6 +269,62 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
     }
 });
 
+// ------------------ Blockscout and Etherscan are sent no user data (#668)
+//
+// A fresh install sends Blockscout and Etherscan none of the user's data until
+// the user turns on "Use Blockscout" or "Check recipients on Etherscan". The
+// endpoint check Settings makes when the user presses "Save" beside the
+// Blockscout URL asks only for `/stats` and carries no user data; it is made
+// whether or not the setting is on. The route handler in tests/e2e/network.js
+// records every request the extension makes, from its pages and its background
+// worker, in env.routeOpts.requests. Recording starts when launch() in
+// tests/e2e/harness.js installs that handler, before the first popup page
+// opens; a request the background worker makes while it starts up, before
+// then, is not recorded. These tests drive Home, AddressDetail, AddressToken
+// and ConfirmTx, and the background's own balance refresh, before either
+// setting is changed, then turn each on and watch its requests start.
+// TransactionDetail, which also asks Blockscout, is left to the unit tests in
+// tests/blockscoutEtherscanSettings.test.js.
+
+// What the three transaction lists say while Use Blockscout is off. Written
+// out here rather than imported, so the assertion does not compare the popup
+// with itself.
+const HISTORY_OFF =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
+// The requests made so far to Blockscout or Etherscan.
+function explorerRequests(env) {
+    return env.routeOpts.requests.filter(({ url }) => {
+        const host = new URL(url).hostname;
+        return host.endsWith("blockscout.com") || host.endsWith("etherscan.io");
+    });
+}
+
+// Waits until the list `listId` says what Use Blockscout being off leaves out.
+async function waitForHistoryOff(page, listId) {
+    await page.waitForFunction(
+        ([id, want]) => document.getElementById(id).textContent.trim() === want,
+        [listId, HISTORY_OFF],
+        { timeout: 15000 },
+    );
+}
+
+test("Welcome offers Use Blockscout and Check recipients on Etherscan, both unticked (#668)", async (env) => {
+    await visible(env.page, "#view-welcome");
+    for (const id of [
+        "welcome-use-blockscout",
+        "welcome-check-recipients-on-etherscan",
+    ]) {
+        const st = await controlState(env.page, id);
+        assert(st !== null, "Welcome has no #" + id);
+        assert(
+            st.tag === "input" && st.type === "checkbox",
+            "#" + id + " is a <" + st.tag + " type=" + st.type + ">",
+        );
+        assert(st.checked === false, "#" + id + " is ticked on a new install");
+    }
+});
+
 // The address scan that follows creating the wallet is held, so the popup
 // reloads while it is in flight. As for the reloads mid-refresh further down,
 // the assertion for that is the harness's own: a console.error from the page
@@ -288,6 +352,202 @@ test("wallet creation through the UI reaches the main view, and reloading mid-sc
     assert(addrCount > 0, "no addresses rendered in the wallet list");
 });
 
+test("with neither setting changed, Home, AddressDetail, AddressToken and ConfirmTx say what is off (#668)", async (env) => {
+    // Funded, so Send leads to the confirmation screen.
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    try {
+        await visible(env.page, "#view-main");
+        await waitForHistoryOff(env.page, "home-tx-list");
+        await visible(env.page, "#home-tokens-note");
+        await env.page.waitForFunction(
+            (want) =>
+                document
+                    .getElementById("wallet-list")
+                    .textContent.includes(want),
+            quantity(FUNDED_ETH_WEI),
+            { timeout: 60000 },
+        );
+
+        await openAddressDetail(env.page);
+        await waitForHistoryOff(env.page, "tx-list");
+        await visible(env.page, "#address-tokens-note");
+
+        await env.page.locator('#address-balances [data-token="ETH"]').click();
+        await visible(env.page, "#view-address-token");
+        await waitForHistoryOff(env.page, "address-token-tx-list");
+        await env.page.click("#btn-address-token-back");
+        await visible(env.page, "#view-address");
+
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await waitForEstimate(env.page);
+        await visible(env.page, "#confirm-etherscan-note");
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-warning")),
+            "ConfirmTx keeps the Etherscan warning's place while no Etherscan check is made",
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+    }
+});
+
+// The background refreshes balances on its alarm, once a minute, and skips a
+// refresh when the stored record says one ran in the last 30 seconds, which
+// the open popup's own refresh does every 10. So the popup is closed, and that
+// record is written back to say no refresh has run, from the background
+// worker, as another extension page saving it would.
+test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
+    await waitForPersisted(
+        env.page,
+        "currentView",
+        "address",
+        "before the popup is closed",
+    );
+    await env.page.close();
+    const [worker] = env.ctx.serviceWorkers();
+    await worker.evaluate(
+        () =>
+            new Promise((resolve) => {
+                chrome.storage.local.get("autistmask", (r) => {
+                    const record = r.autistmask;
+                    record.lastBalanceRefresh = 0;
+                    chrome.storage.local.set({ autistmask: record }, resolve);
+                });
+            }),
+    );
+    const before = env.routeOpts.requests.length;
+    const deadline = Date.now() + 75000;
+    while (
+        !env.routeOpts.requests
+            .slice(before)
+            .some((r) => r.fromWorker && r.method === "POST")
+    ) {
+        assert(
+            Date.now() < deadline,
+            "the background's balance refresh never asked the RPC endpoint",
+        );
+        await sleep(250);
+    }
+    // Its RPC reads and any Blockscout request start together.
+    await sleep(3000);
+
+    const seen = explorerRequests(env);
+    assert(
+        seen.length === 0,
+        "a fresh install asked Blockscout or Etherscan: " +
+            JSON.stringify(seen),
+    );
+    // The watch saw the popup's own traffic as well as the worker's.
+    assert(
+        env.routeOpts.requests.some((r) => !r.fromWorker),
+        "no request from the popup was recorded",
+    );
+    // It reopens on the address screen the test above left it on.
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, "#view-address");
+});
+
+// Ticked from AddressDetail's gear, so Back lands on the screen that said the
+// setting is off.
+test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for that screen's history on Back, then for the tokens (#668)", async (env) => {
+    await openAddressDetail(env.page);
+    await waitForHistoryOff(env.page, "tx-list");
+    await openSettings(env.page);
+    await env.page.check("#settings-use-blockscout");
+    await waitForPersisted(env.page, "useBlockscout", true, "once ticked");
+    const historyAsked = env.page.waitForRequest(
+        (r) =>
+            r.url().includes("blockscout.com") &&
+            r.url().endsWith("/transactions"),
+    );
+    const tokensAsked = env.page.waitForRequest(
+        (r) => r.url().endsWith("/token-balances"),
+        { timeout: 30000 },
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+    await historyAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#address-tokens-note")),
+        "AddressDetail still says only tracked tokens are listed",
+    );
+
+    await goHome(env.page);
+    await tokensAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("home-tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#home-tokens-note")),
+        "Home still says only tracked tokens are listed",
+    );
+});
+
+// Ticked from ConfirmTx's gear, so Back lands on the screen that said no
+// Etherscan check was made. Left on for the rest of the run, as the check was
+// always made before #668.
+test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    env.routeOpts.etherscanLabel = "Fake_Phishing668";
+    try {
+        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI });
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await visible(env.page, "#confirm-etherscan-note");
+
+        await openSettings(env.page);
+        await env.page.check("#settings-check-recipients-on-etherscan");
+        await waitForPersisted(
+            env.page,
+            "checkRecipientsOnEtherscan",
+            true,
+            "once ticked",
+        );
+        const before = env.routeOpts.requests.length;
+        await env.page.click("#btn-settings-back");
+        await visible(env.page, "#view-confirm-tx");
+        await visible(env.page, "#confirm-etherscan-warning", 30000);
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-note")),
+            "ConfirmTx says no Etherscan check was made, with the check on",
+        );
+        const asked = env.routeOpts.requests
+            .slice(before)
+            .map((r) => r.url.toLowerCase())
+            .filter((url) => url.includes("etherscan.io"));
+        assert(
+            asked.length === 1 &&
+                asked[0] ===
+                    "https://etherscan.io/address/" + STUB_COUNTERPARTY,
+            "ConfirmTx asked Etherscan for " + JSON.stringify(asked),
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+        env.routeOpts.etherscanLabel = null;
+    }
+});
+
 test("add token screen opens from address detail (#150)", async (env) => {
     await openAddressDetail(env.page);
     await env.page.click("#btn-add-token");
@@ -359,11 +619,14 @@ async function leaveTransactionDetail(page) {
     await openAddressDetail(page);
 }
 
-// Back out to Home from wherever the previous test finished.
+// Back out to Home from wherever the previous test finished, and wait for the
+// save that navigation makes, so a test reading the stored stack next reads
+// the one Home left.
 async function goHome(page) {
     await leaveTransactionDetail(page);
     await page.click("#btn-address-back");
     await visible(page, "#view-main");
+    await waitForPersisted(page, "currentView", "main", "back on Home");
 }
 
 // One field of the popup's state as it was actually persisted, read out of
@@ -1824,13 +2087,66 @@ test("the Settings assertions above all ran (#229)", async (env) => {
     );
 });
 
-// ------------------------------------------------ dust threshold (#233)
+// ------------------------------------------------ testnet banner (#511)
 
-// The popup size README documents the UI as designed for. Pages in this
-// context otherwise get Playwright's 1280x720 default, at which the flash
-// line has room for any plausible message and never wraps — measuring
-// there would pass for every string and prove nothing.
-const POPUP_VIEWPORT = { width: 360, height: 600 };
+// This suite runs a release build, so the red banner at the top reads
+// "[TESTNET]" on Sepolia and is absent on mainnet. A network switch in
+// Settings must change it while Settings is still on screen; it used to
+// change only when the next screen came up
+// (https://git.eeqj.de/sneak/AutistMask/issues/511).
+
+// The banner's text, or null when there is none, once the switch to `net`
+// has finished. The switch's flash is the last thing its handler does, and
+// showView() clears the flash, so the banner read while that flash is up is
+// the one the switch left on the screen it was made from.
+async function bannerAfterSwitch(page, net) {
+    await page.waitForFunction(
+        (text) => document.getElementById("flash-msg").textContent === text,
+        "Switched to " + net.name + ".",
+    );
+    return page.evaluate(() => {
+        const banner = document.getElementById("debug-banner");
+        return {
+            text: banner === null ? null : banner.textContent,
+            onSettings: !document
+                .getElementById("view-settings")
+                .classList.contains("hidden"),
+        };
+    });
+}
+
+test("a network switch in Settings shows and removes the testnet banner at once (#511)", async (env) => {
+    const { mainnet, sepolia } = NETWORKS;
+    await openSettings(env.page);
+    assert(
+        (await env.page.locator("#debug-banner").count()) === 0,
+        "a banner is up on mainnet before the switch",
+    );
+
+    await env.page.selectOption("#settings-network", "sepolia");
+    let after = await bannerAfterSwitch(env.page, sepolia);
+    assert(after.onSettings, "Settings left the screen on the switch");
+    assert(
+        after.text === "[TESTNET]",
+        "after the switch to Sepolia, Settings shows the banner " +
+            JSON.stringify(after.text) +
+            ', expected "[TESTNET]"',
+    );
+
+    await env.page.selectOption("#settings-network", "mainnet");
+    after = await bannerAfterSwitch(env.page, mainnet);
+    assert(after.onSettings, "Settings left the screen on the switch back");
+    assert(
+        after.text === null,
+        "after the switch back to mainnet, Settings still shows the banner " +
+            JSON.stringify(after.text),
+    );
+
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-main");
+});
+
+// ------------------------------------------------ dust threshold (#233)
 
 // Everything below the flash line that must not move when it fills, plus
 // the height of the line itself. Runs in the page.
@@ -2080,7 +2396,7 @@ test("a password error moves nothing on any screen (#297)", async (env) => {
 
 // ------------------------------------------ add wallet Import button (#493)
 
-// At 360x600 the add wallet screen's Import button already starts near the
+// At 396x600 the add wallet screen's Import button already starts near the
 // bottom of the popup, so its password error line sits beside the button
 // rather than above it. Measures the button and the line empty and again
 // filled with the longest error addWallet.js puts there. Runs in the page.
@@ -2915,9 +3231,10 @@ async function goToTokenConfirm(env) {
         amount: TOKEN_AMOUNT,
     });
     await waitForEstimate(env.page);
+    // TOKEN_AMOUNT to four decimal places (README.md, Display Consistency).
     const shown = await shownAmount(env.page);
     assert(
-        shown === TOKEN_AMOUNT + " " + STUB_TOKEN.symbol,
+        shown === "0.2500 " + STUB_TOKEN.symbol,
         "the confirmation screen is not showing the amount that was entered: " +
             JSON.stringify(shown),
     );
@@ -3152,6 +3469,125 @@ test("a send refused for its fee leaves the password field and Sign & Send where
     }
 });
 
+// --------- a send from an address the selected wallet does not hold (#609)
+//
+// The selection is saved apart from the confirmation screen, so the popup can
+// reopen onto the screen with a wallet selected that does not hold its From
+// address, and Sign & Send then refuses the send. Another popup selecting the
+// key wallet would save that selection; here it is written into storage, and
+// the popup reopened.
+
+test("a send from an address the selected wallet does not hold leaves the password field and Sign & Send where they were (#609)", async (env) => {
+    try {
+        // From the HD wallet's address.
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        // The screen's own save lands first, so it cannot write over the
+        // selection below.
+        await waitForPersisted(
+            env.page,
+            "currentView",
+            "confirm-tx",
+            "before selecting the key wallet",
+        );
+        await env.page.evaluate(
+            () =>
+                new Promise((resolve) => {
+                    chrome.storage.local.get("autistmask", (r) => {
+                        const record = {
+                            ...r.autistmask,
+                            selectedWallet: 1,
+                            selectedAddress: 0,
+                        };
+                        chrome.storage.local.set(
+                            { autistmask: record },
+                            resolve,
+                        );
+                    });
+                }),
+        );
+        await reopenPopup(env, "confirm-tx");
+        await waitForEstimate(env.page);
+        // The refusal shown anywhere on the screen, not only in its own box:
+        // shown on the password error line instead, the test fails on the
+        // moves checked below rather than on the wait for it.
+        const refusal = env.page
+            .locator("#view-confirm-tx")
+            .getByText("does not hold the From address above")
+            .filter({ visible: true });
+        const before = await confirmState(env.page);
+        assert(
+            !before.sendDisabled && (await refusal.count()) === 0,
+            "the screen is not ready to send: " + JSON.stringify(before),
+        );
+
+        const sent = env.routeOpts.broadcastTransactions.length;
+        await fillPasswordAndSend(env.page);
+        await refusal.waitFor({ timeout: 60000 });
+        const after = await confirmState(env.page);
+
+        // Printed pass or fail, as the dust threshold test does.
+        console.log(
+            "# refused From address: password field top " +
+                before.passwordTop +
+                " -> " +
+                after.passwordTop +
+                "px, Sign & Send top " +
+                before.sendTop +
+                " -> " +
+                after.sendTop +
+                "px",
+        );
+        assert(
+            env.routeOpts.broadcastTransactions.length === sent,
+            "a send from an address the selected wallet does not hold" +
+                " reached the RPC",
+        );
+        assert(
+            after.passwordTop === before.passwordTop,
+            "the password field moved " +
+                (after.passwordTop - before.passwordTop) +
+                "px when the send was refused",
+        );
+        assert(
+            after.sendTop === before.sendTop,
+            "Sign & Send moved " +
+                (after.sendTop - before.sendTop) +
+                "px when the send was refused",
+        );
+        // Only now, where the refusal is shown. Its sentence is wrapped across
+        // lines in index.html.
+        const shownIn = await refusal.evaluate((el) => ({
+            id: el.id,
+            text: el.textContent.replace(/\s+/g, " ").trim(),
+        }));
+        assert(
+            shownIn.id === "confirm-from-address-error" &&
+                shownIn.text ===
+                    "The selected wallet does not hold the From address above," +
+                        " so nothing was sent. Please go back and send again.",
+            "wrong From address refusal: " + JSON.stringify(shownIn),
+        );
+    } finally {
+        // A reopened popup restores no Send screen beneath this one, so Back
+        // lands on the selected address. Then Home, and the HD wallet's
+        // address, which the later tests send from.
+        if (await env.page.isVisible("#view-confirm-tx")) {
+            await env.page.click("#btn-confirm-back");
+        }
+        if (await env.page.isVisible("#view-send")) {
+            await env.page.click("#btn-send-back");
+        }
+        await visible(env.page, "#view-address");
+        await env.page.click("#btn-address-back");
+        await visible(env.page, "#view-main");
+        await openAddressDetail(env.page);
+    }
+});
+
 // ------------------------------ the wait for a receipt ending in error (#315)
 //
 // README.md (WaitTx) documents two ways the wait ends on the error screen: a
@@ -3252,10 +3688,14 @@ test("six failed receipt lookups in a row end on the unreachable-network message
 // timeout ("<iframe id=\"pwn\"> intercepts pointer events") rather than as
 // anything that names the defect.
 
-// Verbatim from the issue's reproduction.
+// The issue's reproduction, with the frame sized to the popup.
 const HOSTILE_SYMBOL =
     '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
+    'style="position:fixed;left:0;top:0;width:' +
+    POPUP_VIEWPORT.width +
+    "px;height:" +
+    POPUP_VIEWPORT.height +
+    'px;z-index:99999"></iframe>';
 
 // What a correctly escaped and capped render of it reads as: the first
 // MAX_SYMBOL_LENGTH-1 characters and an ellipsis. Spelled out rather than
@@ -3292,6 +3732,24 @@ function hostileSymbolState(page, tokenAddress) {
 }
 
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
+    // The stub token is no longer tracked from here on, so the explorer is
+    // what lists it, as it lists a token airdropped to the victim. A tracked
+    // token is listed from the RPC endpoint under the symbol it was added
+    // with, which the hostile symbol below never reaches
+    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+    await env.page.click("#settings-tracked-tokens .btn-remove-token");
+    // The list is drawn again once the removal is saved.
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("settings-tracked-tokens")
+                .innerText.trim() === "None",
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.seedTokenBalance = true;
     env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;
@@ -4677,6 +5135,12 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         "the page was not told of the approved switch: " +
             JSON.stringify(events),
     );
+    // The popup, open all along, shows the new network
+    // (https://git.eeqj.de/sneak/AutistMask/issues/650).
+    await env.page.waitForFunction(() => {
+        const banner = document.getElementById("debug-banner");
+        return banner !== null && banner.textContent === "[TESTNET]";
+    });
 
     const restored = await openNetworkPrompt(
         env,
@@ -4698,6 +5162,9 @@ test("a site's network switch changes nothing until the user approves it (#408)"
         isDeepStrictEqual(await storedNetwork(env.page), before),
         "switching back did not restore the mainnet network and endpoints",
     );
+    await env.page.waitForFunction(
+        () => document.getElementById("debug-banner") === null,
+    );
 });
 
 // Switching the network in Settings tells the page too, as an approved site
@@ -4847,8 +5314,20 @@ function addressRowReport(page) {
     });
 }
 
+// Measured at the popup's 396x600 (POPUP_VIEWPORT). Every page in this
+// context, approval windows included, is otherwise 1280x720 whatever size
+// the extension asks for, and a page that wide never scrolls sideways. The
+// page is then put back to the size it had, so the size a later step runs at
+// does not depend on whether this one ran.
 async function assertAddressesFit(page, where) {
-    const report = await addressRowReport(page);
+    const sizeBefore = page.viewportSize();
+    await page.setViewportSize(POPUP_VIEWPORT);
+    let report;
+    try {
+        report = await addressRowReport(page);
+    } finally {
+        await page.setViewportSize(sizeBefore);
+    }
     assert(
         report.rows.length > 0,
         where + ": no address rows were rendered, so nothing was measured",
@@ -5031,10 +5510,17 @@ async function main() {
         seedReceipt: false,
         // Whether eth_getTransactionReceipt fails instead of answering (#315).
         failReceiptLookup: false,
+        // The label Etherscan's page gives an address, when it gives one
+        // (#668).
+        etherscanLabel: null,
         // Every raw signed transaction handed to eth_sendRawTransaction, in
         // order. The dApp transaction round trip asserts against these bytes
         // rather than against anything the extension reported about them.
         broadcastTransactions: [],
+        // Every request the extension makes, in order, from when launch()
+        // installs the route handler, before the first popup page opens
+        // (#668).
+        requests: [],
     };
 
     let session;

tests/ensOffchainLookup.test.js

@@ -0,0 +1,111 @@
+// ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
+// name is resolved off-chain, naming a web address to fetch the answer from;
+// ethers fetches it unless the provider has `disableCcipRead` set, and that
+// request would carry the name to a server other than the RPC endpoint
+// (https://git.eeqj.de/sneak/AutistMask/issues/668). With it set, such a name
+// does not resolve.
+//
+// The provider getProvider() builds runs against a fake JSON-RPC node,
+// answered through ethers' own request hook, which also records the address of
+// every request ethers makes, the off-chain fetch included.
+
+const { FetchRequest, Interface } = require("ethers");
+const { getProvider } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const RESOLVER = "0x5555555555555555555555555555555555555555";
+const USER = "0x1111111111111111111111111111111111111111";
+const NAME = "offchain.eth";
+
+// The ENS registry's resolver(), and the resolver's functions ethers calls: the
+// registry names RESOLVER for every name, the resolver says it resolves names
+// through resolve(), gives NAME as the reverse record of any address, and
+// answers resolve() with the OffchainLookup error that says the name is
+// resolved off-chain.
+const ens = new Interface([
+    "function resolver(bytes32) view returns (address)",
+    "function supportsInterface(bytes4) view returns (bool)",
+    "function name(bytes32) view returns (string)",
+    "function resolve(bytes, bytes) view returns (bytes)",
+    "error OffchainLookup(address sender, string[] urls, bytes callData, bytes4 callbackFunction, bytes extraData)",
+]);
+
+let asked;
+
+// One JSON-RPC answer. Anything but a call to one of the functions above is
+// refused.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    const call =
+        req.method === "eth_call" ? ens.parseTransaction(req.params[0]) : null;
+    if (call === null) {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    if (call.name === "resolve") {
+        const offchain = ens.encodeErrorResult("OffchainLookup", [
+            RESOLVER,
+            ["https://gateway.example.invalid/{sender}/{data}.json"],
+            "0x1234",
+            "0x12345678",
+            "0x",
+        ]);
+        return {
+            ...envelope,
+            error: { code: 3, message: "execution reverted", data: offchain },
+        };
+    }
+    const answers = {
+        resolver: [RESOLVER],
+        supportsInterface: [true],
+        name: [NAME],
+    };
+    return {
+        ...envelope,
+        result: ens.encodeFunctionResult(call.name, answers[call.name]),
+    };
+}
+
+beforeEach(() => {
+    asked = [];
+    FetchRequest.registerGetUrl(async (req) => {
+        asked.push(req.url);
+        // Any other address is the off-chain fetch, answered as not found.
+        if (req.url !== RPC_URL) {
+            return {
+                statusCode: 404,
+                statusMessage: "Not Found",
+                headers: {},
+                body: null,
+            };
+        }
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+});
+
+test("a name typed into Send that is resolved off-chain does not resolve, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.resolveName(NAME)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});
+
+test("the reverse lookup of a user's address whose name is resolved off-chain finds no name, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.lookupAddress(USER)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});

tests/fabricatedDecimals.test.js

@@ -114,6 +114,7 @@ async function fetchOnto(items, trackedTokens = []) {
     const balances = await fetchTokenBalances(
         HOLDER,
         BLOCKSCOUT,
+        true,
         trackedTokens,
     );
     state.trackedTokens = trackedTokens;

tests/holders.test.js

@@ -150,19 +150,23 @@ describe("the balance-list spam gate", () => {
 
     test("a token with plenty of reported holders is listed", async () => {
         respondWith([item()]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBe(50000);
     });
 
     test("a token reporting zero holders is still excluded", async () => {
         respondWith([item({ token: { holders_count: "0" } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("an unknown holder count does not admit an unvouched token", async () => {
         respondWith([item({ token: { holders_count: null } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The path that reaches the send selector and the history filter: a token
@@ -171,7 +175,7 @@ describe("the balance-list spam gate", () => {
     // zero that would then hide it downstream.
     test("a tracked token with an unknown count is listed with holders null", async () => {
         respondWith([item({ token: { holders_count: undefined } })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: NOVEL_TOKEN.toUpperCase() },
         ]);
         expect(balances).toHaveLength(1);
@@ -188,7 +192,7 @@ describe("the balance-list spam gate", () => {
                 },
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBeNull();
     });

tests/nativeCurrency.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { state } = require("../src/shared/state");
 const { NETWORKS } = require("../src/shared/networks");
@@ -245,7 +245,7 @@ describe.each([
     test("the value", async () => {
         await confirmSend("0.1");
         expect(text("confirm-type")).toBe("Native " + symbol + " transfer");
-        expect(text("confirm-amount")).toBe("0.1 " + symbol);
+        expect(text("confirm-amount")).toBe("0.1000 " + symbol);
         await approveTx(NETWORKS[networkId].chainId);
         expect(text("approve-tx-value")).toBe("0.0100 " + symbol);
     });
@@ -429,13 +429,15 @@ describe.each([
             await global.document
                 .getElementById("btn-confirm-send")
                 .handlers.get("click")();
-            expect(text("wait-tx-summary")).toBe("0.1 " + symbol);
+            expect(text("wait-tx-summary")).toBe("0.1000 " + symbol);
             state.networkId = activeNetworkId;
             txStatus.restoreWait();
-            expect(text("wait-tx-summary")).toBe("0.1 " + symbol);
+            expect(text("wait-tx-summary")).toBe("0.1000 " + symbol);
         });
 
         test("the transaction detail screen's type line and fee", async () => {
+            // The fee is Blockscout's.
+            state.useBlockscout = true;
             debugFetch.mockImplementationOnce(async () => ({
                 ok: true,
                 status: 200,

tests/persistedEntryFloors.test.js

@@ -364,7 +364,7 @@ describe("a save that fails", () => {
         return storage;
     }
 
-    test("is reported, not swallowed by the save queue", async () => {
+    test("is reported when the caller does not await it", async () => {
         const storage = failingStorage(unversionedValidProfile());
         const { state, loadState, saveState, onSaveFailure } =
             loadStateModule(storage);

tests/persistedFieldContract.test.js

@@ -441,6 +441,17 @@ const CONTRACT = [
                 views: ["error-tx"],
                 restored: false,
             },
+            // A chain id naming no network has no explorer to link to.
+            {
+                value: { hash: "0x1", to: ADDRESS, chainId: "0x5" },
+                views: ["success-tx"],
+                restored: false,
+            },
+            {
+                value: { message: "boom", to: ADDRESS, chainId: "0x5" },
+                views: ["error-tx"],
+                restored: false,
+            },
             // transaction passes on `data.tx`.
             {
                 value: { tx: { hash: "0x1" } },
@@ -454,6 +465,26 @@ const CONTRACT = [
                         from: ADDRESS,
                         to: ADDRESS,
                         contractAddress: 42,
+                        chainId: "0x1",
+                    },
+                },
+                views: ["transaction"],
+                restored: false,
+            },
+            // A transaction whose chain id is missing or names no network has
+            // no explorer to link to and no Blockscout to be read from.
+            {
+                value: { tx: { hash: "0x1", from: ADDRESS, to: ADDRESS } },
+                views: ["transaction"],
+                restored: false,
+            },
+            {
+                value: {
+                    tx: {
+                        hash: "0x1",
+                        from: ADDRESS,
+                        to: ADDRESS,
+                        chainId: "0x5",
                     },
                 },
                 views: ["transaction"],
@@ -477,6 +508,19 @@ const CONTRACT = [
                 views: ["confirm-tx"],
                 restored: false,
             },
+            // The amount line splits the amount to cut it to four decimals.
+            {
+                value: {
+                    pendingTx: {
+                        token: "ETH",
+                        from: ADDRESS,
+                        to: ADDRESS,
+                        amount: 42,
+                    },
+                },
+                views: ["confirm-tx"],
+                restored: false,
+            },
             // A chain id naming no network has no explorer to link to.
             {
                 value: {
@@ -574,6 +618,8 @@ const CONTRACT = [
         "hideFraudContracts",
         "hideDustTransactions",
         "utcTimestamps",
+        "useBlockscout",
+        "checkRecipientsOnEtherscan",
         "debugMode",
     ].map((field) => ({
         field,
@@ -581,8 +627,9 @@ const CONTRACT = [
         // A flag: only ever tested for truthiness, and written back verbatim.
         hostile: [42, "notabool", { a: 1 }],
         // Both answers to that truthiness test have to be driven, and 0 is a
-        // value src/ never writes for a flag. For utcTimestamps and debugMode
-        // the falsy answer is also the DEFAULT_STATE default.
+        // value src/ never writes for a flag. For utcTimestamps,
+        // useBlockscout, checkRecipientsOnEtherscan and debugMode the falsy
+        // answer is also the DEFAULT_STATE default.
         falsy: [0],
     })),
 ];
@@ -799,7 +846,13 @@ const WELL_FORMED_DATA = {
     message: "boom",
     to: ADDRESS,
     decoded: { details: [{ address: TOKEN_ADDRESS }] },
-    tx: { hash: "0x1", from: ADDRESS, to: ADDRESS, contractAddress: null },
+    tx: {
+        hash: "0x1",
+        from: ADDRESS,
+        to: ADDRESS,
+        contractAddress: null,
+        chainId: "0x1",
+    },
     pendingTx: {
         token: "ETH",
         from: ADDRESS,
@@ -808,7 +861,7 @@ const WELL_FORMED_DATA = {
     },
     pendingWait: {
         hash: "0x1",
-        txInfo: { to: ADDRESS, amount: "1" },
+        txInfo: { to: ADDRESS, amount: "1", chainId: "0x1" },
         broadcastTime: BROADCAST_TIME,
     },
 };

tests/popupBoot.test.js

@@ -44,7 +44,8 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
 
 // A boot onto a screen that sends a request no mocked module answers: that
 // request reaches the boot's fetch() stub, never the internet
-// (https://git.eeqj.de/sneak/AutistMask/issues/559).
+// (https://git.eeqj.de/sneak/AutistMask/issues/559). Both requests are made
+// only while the user has the setting for them on.
 function restoringOnto(view, viewData) {
     return unversionedValidProfile({
         currentView: view,
@@ -52,13 +53,15 @@ function restoringOnto(view, viewData) {
         selectedAddress: 0,
         viewStack: ["main"],
         viewData,
+        useBlockscout: true,
+        checkRecipientsOnEtherscan: true,
     });
 }
 
 test("the transaction screen's Blockscout request reaches the stub", async () => {
     const page = await bootPopup(
         restoringOnto("transaction", {
-            tx: { hash: "0x1", from: ADDRESS, to: ADDRESS },
+            tx: { hash: "0x1", from: ADDRESS, to: ADDRESS, chainId: "0x1" },
         }),
     );
 

tests/popupFollowsNetworkSwitch.test.js

@@ -0,0 +1,300 @@
+// An open popup follows a network switch the background saves once the user
+// approves a site's request: it takes the new network from the stored record
+// and draws the screen it is on for it, as a switch in Settings does
+// (https://git.eeqj.de/sneak/AutistMask/issues/650). Driven through the real
+// popup over a stored profile on Ethereum Mainnet. The background's write is
+// the storage stub's set, which the stub reports to the page as the browser
+// does.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+const { makeStorageStub } = require("./support/storageStub");
+const {
+    applyChainSwitchFields,
+    copyChainSwitchFields,
+} = require("../src/shared/chainSwitchFields");
+const { NETWORKS } = require("../src/shared/networks");
+const { STATE_SCHEMA_VERSION } = require("../src/shared/stateSchema");
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+const SEPOLIA_TOKEN = {
+    address: TOKEN_ADDRESS,
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+const MAINNET_TOKEN = {
+    address: "0x6B175474E89094C44Da98b954EedeAC495271d0F",
+    symbol: "DAI",
+    decimals: 18,
+    name: "Dai Stablecoin",
+};
+
+// A profile on Ethereum Mainnet that reopens the popup onto AddressDetail,
+// with DAI tracked there and TST tracked on Sepolia.
+function profileOnAddress() {
+    return unversionedValidProfile({
+        currentView: "address",
+        viewStack: ["main"],
+        selectedWallet: 0,
+        selectedAddress: 0,
+        trackedTokens: [MAINNET_TOKEN],
+        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+    });
+}
+
+// The popup reopened onto it.
+function bootOnAddress() {
+    return bootPopup(profileOnAddress());
+}
+
+// The background saves a switch to `networkId`, as its updateState() does
+// once the user approves a site's request.
+async function backgroundSwitch(page, networkId) {
+    const record = page.storage.read("autistmask");
+    applyChainSwitchFields(record, networkId);
+    await page.storage.local.set({ autistmask: record });
+    await page.settle();
+    await page.settle();
+}
+
+test("the popup open on AddressDetail shows the new network and its balances", async () => {
+    const page = await bootOnAddress();
+    expect(page.pageErrors).toEqual([]);
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).toContain("DAI");
+    expect(page.node("debug-banner")).toBeNull();
+
+    await backgroundSwitch(page, "sepolia");
+
+    const { state } = require("../src/shared/state");
+    expect(state.networkId).toBe("sepolia");
+    expect(state.rpcUrl).toBe(NETWORKS.sepolia.defaultRpcUrl);
+    expect(page.visibleViews()).toEqual(["address"]);
+    const balances = page.node("address-balances").innerHTML;
+    expect(balances).toContain("TST");
+    expect(balances).toContain("SepoliaETH");
+    expect(balances).not.toContain("DAI");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+
+    // Its next refresh runs on Sepolia, and what it fetched is stored.
+    await page.tick();
+    const { refreshBalances } = require("../src/shared/balances");
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
+    const stored = page.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.lastBalanceRefresh).toBeGreaterThan(0);
+});
+
+test("the popup open on Settings shows the new network, and Back draws the screen beneath for it", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+    expect(page.visibleViews()).toEqual(["settings"]);
+
+    await backgroundSwitch(page, "sepolia");
+
+    expect(page.visibleViews()).toEqual(["settings"]);
+    expect(page.value("settings-network")).toBe("sepolia");
+    expect(page.value("settings-rpc")).toBe(NETWORKS.sepolia.defaultRpcUrl);
+    expect(page.node("settings-tracked-tokens").innerHTML).toContain("TST");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+
+    await page.click("btn-settings-back");
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).not.toContain("DAI");
+});
+
+// Neither can be drawn again for the new network: Send cannot be rendered from
+// saved state, and DAI was picked on Ethereum Mainnet, where alone it is
+// tracked. A reopened popup goes to Home in their place.
+test.each([
+    ["Send", (page) => page.click("btn-send")],
+    [
+        "AddressToken for DAI",
+        async (page) => {
+            const { state } = require("../src/shared/state");
+            state.selectedToken = MAINNET_TOKEN.address;
+            require("../src/popup/views/helpers").pushCurrentView();
+            require("../src/popup/views/addressToken").show();
+            await page.settle();
+        },
+    ],
+])("the popup open on %s goes to Home", async (_view, open) => {
+    const page = await bootOnAddress();
+    await open(page);
+    expect(page.visibleViews()).not.toEqual(["address"]);
+
+    await backgroundSwitch(page, "sepolia");
+
+    expect(page.visibleViews()).toEqual(["main"]);
+    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
+});
+
+// The report of the switch's own save names the network the page already has.
+test("a switch in Settings is not taken a second time when its save is reported", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+    const { get, set } = page.storage.local;
+    const reads = get.mock.calls.length;
+    const writes = set.mock.calls.length;
+
+    const select = page.node("settings-network");
+    select.value = "sepolia";
+    for (const fn of select.listeners.change) await fn();
+    await page.settle();
+    await page.settle();
+
+    expect(get).toHaveBeenCalledTimes(reads + 1);
+    expect(set).toHaveBeenCalledTimes(writes + 1);
+    expect(page.text("flash-msg")).toBe("Switched to Sepolia Testnet.");
+});
+
+// The background saves the switch once the popup has read the stored record
+// and before it listens for changes to it, so the browser tells the page
+// nothing of it. Nor is any later write reported here: Chrome reports none
+// that leaves the record as it was, such as the popup's own save at start-up.
+test("a switch saved while the popup opens, before it listens for one, is followed", async () => {
+    const storage = makeStorageStub({ autistmask: profileOnAddress() });
+    storage.onChanged = { addListener: () => {} };
+    const read = storage.local.get.getMockImplementation();
+    storage.local.get.mockImplementationOnce(async (key) => {
+        const loaded = await read(key);
+        const record = storage.read("autistmask");
+        applyChainSwitchFields(record, "sepolia");
+        storage.write("autistmask", record);
+        return loaded;
+    });
+    const page = await bootPopup(undefined, { storage });
+    await page.settle();
+
+    const { state } = require("../src/shared/state");
+    expect(page.pageErrors).toEqual([]);
+    expect(state.networkId).toBe("sepolia");
+    expect(page.visibleViews()).toEqual(["address"]);
+    expect(page.node("address-balances").innerHTML).toContain("SepoliaETH");
+    expect(page.text("debug-banner")).toBe("[TESTNET]");
+});
+
+// While the popup's follow of the background's switch to Sepolia waits for the
+// lock, the user picks Sepolia in Settings and then Ethereum Mainnet again. The
+// last pick is the network stored, and the last one sites are told of.
+test("a switch in Settings made while a follow waits for the lock is not overwritten by it", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+
+    // Another write holds the lock, so every save of the page waits for it.
+    let releaseLock;
+    const lockHeld = navigator.locks.request(
+        "autistmask",
+        () =>
+            new Promise((resolve) => {
+                releaseLock = resolve;
+            }),
+    );
+    await backgroundSwitch(page, "sepolia");
+    const select = page.node("settings-network");
+    const picks = [];
+    for (const networkId of ["sepolia", "mainnet"]) {
+        select.value = networkId;
+        for (const fn of select.listeners.change) picks.push(fn());
+    }
+    releaseLock();
+    await lockHeld;
+    await Promise.all(picks);
+    await page.settle();
+
+    const { state } = require("../src/shared/state");
+    expect(state.networkId).toBe("mainnet");
+    expect(page.storage.read("autistmask").networkId).toBe("mainnet");
+    expect(page.value("settings-network")).toBe("mainnet");
+    const told = globalThis.chrome.runtime.sendMessage.mock.calls
+        .map(([message]) => message)
+        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
+    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
+});
+
+// The popup follows the background's switch to Sepolia, but its own write in
+// that save fails. The user then picks Ethereum Mainnet in Settings, the
+// network the popup was on before: that switch is stored, and only then
+// flashed and sent to sites.
+test("a switch back in Settings after a follow whose write failed is stored", async () => {
+    const page = await bootOnAddress();
+    await page.click("btn-settings");
+    const { set } = page.storage.local;
+    const write = set.getMockImplementation();
+    // The background's write lands; the next, the follow's, fails.
+    set.mockImplementationOnce(write).mockRejectedValueOnce(
+        new Error("quota exceeded"),
+    );
+    await backgroundSwitch(page, "sepolia");
+    const { state } = require("../src/shared/state");
+    expect(state.networkId).toBe("sepolia");
+
+    const select = page.node("settings-network");
+    select.value = "mainnet";
+    for (const fn of select.listeners.change) await fn();
+    await page.settle();
+
+    const stored = page.storage.read("autistmask");
+    expect(stored.networkId).toBe("mainnet");
+    expect(stored.rpcUrl).toBe(NETWORKS.mainnet.defaultRpcUrl);
+    expect(stored.trackedTokens).toEqual([MAINNET_TOKEN]);
+    expect(page.text("flash-msg")).toBe("Switched to Ethereum Mainnet.");
+    const told = globalThis.chrome.runtime.sendMessage.mock.calls
+        .map(([message]) => message)
+        .filter((message) => message.type === "AUTISTMASK_NETWORK_CHANGED");
+    expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
+});
+
+// Such as one a newer build wrote, which this build cannot read. Nothing reads
+// or writes the stored record for it: the popup's next save finds it, as
+// before.
+test("a record that names no network is not followed", async () => {
+    const page = await bootOnAddress();
+    const { get, set } = page.storage.local;
+    const reads = get.mock.calls.length;
+
+    await set({
+        autistmask: {
+            schemaVersion: STATE_SCHEMA_VERSION + 1,
+            wallets: [{ type: "hd", name: "Main", addresses: [] }],
+        },
+    });
+    await page.settle();
+
+    expect(get).toHaveBeenCalledTimes(reads);
+    expect(page.visibleViews()).toEqual(["address"]);
+});
+
+// A record that takes the switch from the switched record ends up as that
+// record, balances the background fetched since included.
+test("copyChainSwitchFields() takes every field applyChainSwitchFields() sets", () => {
+    const before = unversionedValidProfile({
+        trackedTokens: [MAINNET_TOKEN],
+        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
+        networkEndpoints: {
+            sepolia: {
+                rpcUrl: "http://127.0.0.1:8545",
+                blockscoutUrl: "http://127.0.0.1:4000/api/v2",
+            },
+        },
+        lastBalanceRefresh: 1,
+        tokenHolderCache: { [MAINNET_TOKEN.address]: 5000 },
+        fraudContracts: ["0x1111111111111111111111111111111111111111"],
+    });
+    const switched = structuredClone(before);
+    applyChainSwitchFields(switched, "sepolia");
+    switched.wallets[0].addresses[0].balance = "2.0";
+
+    const follower = structuredClone(before);
+    copyChainSwitchFields(follower, switched);
+
+    expect(follower).toEqual(switched);
+});

tests/rpcErrorLog.test.js

@@ -88,6 +88,7 @@ test("the balance refresh", async () => {
         wallets,
         RPC_URL,
         "https://explorer.example.invalid/api/v2",
+        true,
         [],
         "mainnet",
     );

tests/sendAmountRule.test.js

@@ -97,7 +97,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { state } = require("../src/shared/state");
 const send = require("../src/popup/views/send");

tests/sendDisplayFloor.test.js

@@ -151,7 +151,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { refreshBalances } = require("../src/shared/balances");
 const { state } = require("../src/shared/state");
@@ -224,6 +224,7 @@ async function refreshWith(balanceWei, tokenItems = []) {
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/sendMax.test.js

@@ -146,7 +146,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { Transaction, Wallet, formatEther } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");
@@ -217,6 +217,7 @@ async function refreshWith(balanceWei, tokenItems = []) {
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );
@@ -306,7 +307,8 @@ describe("Max on an ETH send", () => {
         openSend();
         await pressMax();
         await review();
-        expect(text("confirm-amount")).toBe(maxAfter(20n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(20n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2341 ETH");
         expect(el("confirm-errors").innerHTML).toBe("");
         expect(el("confirm-amount-fee-error").style.visibility).toBe("hidden");
         expect(canSend()).toBe(true);
@@ -322,14 +324,16 @@ describe("Max on an ETH send", () => {
         // Kept, the Send screen's amount would be refused for want of funds.
         mockNode.feeData = fees(30n * GWEI);
         await review();
-        expect(text("confirm-amount")).toBe(maxAfter(30n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(30n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2339 ETH");
         expect(canSend()).toBe(true);
 
         // And falls when the screen is shown again, as on reopening the popup.
         mockNode.feeData = fees(10n * GWEI);
         confirmTx.restore();
         await settle();
-        expect(text("confirm-amount")).toBe(maxAfter(10n * GWEI) + " ETH");
+        expect(confirmed.amount).toBe(maxAfter(10n * GWEI));
+        expect(text("confirm-amount")).toBe("1.2343 ETH");
         expect(canSend()).toBe(true);
     });
 
@@ -526,7 +530,8 @@ describe("Max on an ETH send", () => {
         el("send-amount").handlers.get("input")();
         mockNode.feeData = fees(30n * GWEI);
         await review();
-        expect(text("confirm-amount")).toBe("0.5 ETH");
+        expect(confirmed.amount).toBe("0.5");
+        expect(text("confirm-amount")).toBe("0.5000 ETH");
     });
 });
 
@@ -540,7 +545,8 @@ describe("Max on a token send", () => {
         await pressMax();
         expect(el("send-amount").value).toBe("1234.567890123456789012");
         await review();
-        expect(text("confirm-amount")).toBe("1234.567890123456789012 TOK");
+        expect(confirmed.amount).toBe("1234.567890123456789012");
+        expect(text("confirm-amount")).toBe("1234.5678 TOK");
         expect(canSend()).toBe(true);
     });
 
@@ -553,7 +559,8 @@ describe("Max on a token send", () => {
         await pressMax();
         expect(el("send-amount").value).toBe("1234.567890123456789012");
         await review();
-        expect(text("confirm-amount")).toBe("1234.567890123456789012 TOK");
+        expect(confirmed.amount).toBe("1234.567890123456789012");
+        expect(text("confirm-amount")).toBe("1234.5678 TOK");
         expect(canSend()).toBe(true);
     });
 

tests/stateMerge.test.js

@@ -160,7 +160,7 @@ describe("the approval-window reproduction", () => {
         await approvalWindow.state.loadState();
         approvalWindow.helpers.showView("approve-tx");
         // showView() does not await its own saveState(); an extra save
-        // joins the same queue and only resolves once that one has too,
+        // waits for the lock behind that one and so resolves only after it,
         // which is the black-box way to know it landed.
         await approvalWindow.state.saveState();
 

tests/stateRecovery.test.js

@@ -225,7 +225,12 @@ describe("a popup already open when the stored profile becomes unreadable", () =
                 viewData: {
                     pendingWait: {
                         hash: "0x1",
-                        txInfo: { to: ADDRESS, amount: "1", token: "ETH" },
+                        txInfo: {
+                            to: ADDRESS,
+                            amount: "1",
+                            token: "ETH",
+                            chainId: "0x1",
+                        },
                         broadcastTime: Date.now(),
                     },
                 },

tests/stateWriteLock.test.js

@@ -0,0 +1,96 @@
+// A popup save reads the stored record, merges this page's changes into it
+// and writes it back. The background's write of a network the user approved
+// used to be able to land between that read and that write, and the popup's
+// write then put the old network back
+// (https://git.eeqj.de/sneak/AutistMask/issues/641). Every write of the record
+// now holds a lock from its read to its write.
+//
+// The popup and the background run here as the real modules over one shared
+// storage stub, and share the lock the way the background and a page outside
+// a Firefox private window share the browser's
+// (tests/support/navigatorLocks.js).
+
+const { makeStorageStub } = require("./support/storageStub");
+
+function loadContexts(storage) {
+    jest.resetModules();
+    globalThis.chrome = { storage: { local: storage.local } };
+    return {
+        popup: require("../src/shared/state"),
+        background: require("../src/background/state"),
+        applyChainSwitchFields: require("../src/shared/chainSwitchFields")
+            .applyChainSwitchFields,
+    };
+}
+
+// Lets every pending promise callback run, and then some.
+function nextMacrotask() {
+    return new Promise((resolve) => setImmediate(resolve));
+}
+
+afterEach(() => {
+    delete globalThis.chrome;
+    jest.restoreAllMocks();
+});
+
+test("a network the background switches to during a popup save stays stored", async () => {
+    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
+    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
+    await popup.loadState();
+
+    // The popup navigates, so its save has a change of its own to write.
+    popup.state.currentView = "settings";
+
+    // The popup's save has read the record and is about to write it back when
+    // the user's approval of a site's switch to mainnet reaches the
+    // background. Without the lock the background's whole update runs before
+    // the next macrotask; with it, the update waits for the popup's write.
+    let backgroundSwitch;
+    const realSet = storage.local.set.getMockImplementation();
+    storage.local.set.mockImplementationOnce(async (items) => {
+        backgroundSwitch = background.updateState((fresh) =>
+            applyChainSwitchFields(fresh, "mainnet"),
+        );
+        await nextMacrotask();
+        return realSet(items);
+    });
+
+    await popup.saveState();
+    await backgroundSwitch;
+
+    const stored = storage.read("autistmask");
+    expect(stored.networkId).toBe("mainnet");
+    expect(stored.currentView).toBe("settings");
+});
+
+test("after a save that failed, the next save still keeps a network the background switches to during it", async () => {
+    jest.spyOn(console, "error").mockImplementation(() => {});
+    const storage = makeStorageStub({ autistmask: { networkId: "sepolia" } });
+    const { popup, background, applyChainSwitchFields } = loadContexts(storage);
+    await popup.loadState();
+    popup.state.currentView = "settings";
+
+    // The first save's write is refused, so it gives the lock back having
+    // failed.
+    storage.local.set.mockRejectedValueOnce(new Error("quota exceeded"));
+    await expect(popup.saveState()).rejects.toThrow("quota exceeded");
+
+    // The next save is between its read and its write when the background
+    // switches to mainnet, as in the test above.
+    let backgroundSwitch;
+    const realSet = storage.local.set.getMockImplementation();
+    storage.local.set.mockImplementationOnce(async (items) => {
+        backgroundSwitch = background.updateState((fresh) =>
+            applyChainSwitchFields(fresh, "mainnet"),
+        );
+        await nextMacrotask();
+        return realSet(items);
+    });
+
+    await popup.saveState();
+    await backgroundSwitch;
+
+    const stored = storage.read("autistmask");
+    expect(stored.networkId).toBe("mainnet");
+    expect(stored.currentView).toBe("settings");
+});

tests/support/navigatorLocks.js

@@ -0,0 +1,27 @@
+// `navigator.locks` for the unit tests, which run on node, where there is none.
+//
+// One lock per name: granted in the order it was asked for, and let go when
+// the callback settles, whether it resolved or rejected. That is what the
+// browser's own does for the one call the extension makes,
+// `navigator.locks.request(name, callback)`. Every module a test file loads
+// shares it, as the extension's background and its pages share the browser's,
+// except a page in a Firefox private window (README, "Stored state and its
+// version").
+//
+// Run before each test file by `setupFiles` in package.json.
+
+// For each name, a promise that settles once the last request for it has
+// let the lock go.
+const released = new Map();
+
+function request(name, callback) {
+    const previous = released.get(name) || Promise.resolve();
+    const result = previous.then(() => callback({ name, mode: "exclusive" }));
+    released.set(
+        name,
+        result.catch(() => {}),
+    );
+    return result;
+}
+
+globalThis.navigator = { locks: { request } };

tests/support/popupBoot.js

@@ -311,7 +311,7 @@ async function bootPopup(stored, options) {
     const windowListeners = {};
 
     globalThis.chrome = {
-        storage: { local: storage.local },
+        storage: { local: storage.local, onChanged: storage.onChanged },
         runtime: {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,

tests/support/storageStub.js

@@ -18,7 +18,9 @@
 // a storage stub by hand.
 
 // One storage area: get, set and remove over its own store, cloning both ways.
-function makeArea(store, tick) {
+// `changed` is handed what each set or remove changed, in the shape
+// storage.onChanged reports it.
+function makeArea(store, tick, changed) {
     const get = jest.fn(async (key) => {
         tick();
         if (key === undefined || key === null) return structuredClone(store);
@@ -34,14 +36,25 @@ function makeArea(store, tick) {
 
     const set = jest.fn(async (items) => {
         tick();
+        const changes = {};
         for (const k of Object.keys(items)) {
+            changes[k] = structuredClone({
+                oldValue: store[k],
+                newValue: items[k],
+            });
             store[k] = structuredClone(items[k]);
         }
+        changed(changes);
     });
 
     const remove = jest.fn(async (key) => {
         tick();
-        for (const k of Array.isArray(key) ? key : [key]) delete store[k];
+        const changes = {};
+        for (const k of Array.isArray(key) ? key : [key]) {
+            changes[k] = { oldValue: store[k] };
+            delete store[k];
+        }
+        changed(changes);
     });
 
     return { get, set, remove };
@@ -54,12 +67,22 @@ function makeArea(store, tick) {
 function makeStorageStub(initial, onOp) {
     const store = initial ? structuredClone(initial) : {};
     const tick = onOp || (() => {});
-    const local = makeArea(store, tick);
+    // storage.onChanged: after a set or remove has finished, every listener is
+    // called with what it changed and the area's name, as the browser calls
+    // them for a write by any page or the background.
+    const listeners = [];
+    const announce = (areaName) => (changes) => {
+        Promise.resolve().then(() => {
+            for (const fn of listeners) fn(structuredClone(changes), areaName);
+        });
+    };
+    const local = makeArea(store, tick, announce("local"));
 
     return {
         // Drop this straight in as chrome.storage.
         local,
-        session: makeArea({}, tick),
+        session: makeArea({}, tick, announce("session")),
+        onChanged: { addListener: (fn) => listeners.push(fn) },
         get: local.get,
         set: local.set,
         remove: local.remove,
@@ -71,7 +94,9 @@ function makeStorageStub(initial, onOp) {
                 ? structuredClone(store)
                 : structuredClone(store[key]),
         // Seed or replace a record without going through the module under
-        // test — for standing in as "another page wrote this".
+        // test — for standing in as "another page wrote this". Nothing is
+        // announced to storage.onChanged, so it also stands in for the time
+        // before the browser tells this page of such a write.
         write: (key, value) => {
             store[key] = structuredClone(value);
         },

tests/symbolSpoof.test.js

@@ -582,12 +582,14 @@ describe("surface 3: the balance list", () => {
     // 1,000-holder floor and was listed as a holding named ETH.
     test("a fake ETH token clearing the holder floor is filtered", async () => {
         respondWith([fakeEthItem()]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("tracking the fake token manually does not admit it either", async () => {
         respondWith([fakeEthItem({ holders_count: "0" })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: FAKE_ETH_CONTRACT },
         ]);
         expect(balances).toEqual([]);
@@ -597,12 +599,16 @@ describe("surface 3: the balance list", () => {
     // their belief about what they own, and it renders the symbol into HTML.
     test("a padded fake ETH token is filtered too", async () => {
         respondWith([fakeEthItem({ symbol: " ETH " })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("a fake ETH token padded with a no-break space is filtered", async () => {
         respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The false-positive direction on the surface that matters most: a real
@@ -617,7 +623,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -631,7 +637,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
@@ -642,7 +648,9 @@ describe("surface 3: the balance list", () => {
     // before the symbol rule is consulted.
     test("a non-ERC-20 row claiming ETH never reaches the symbol rule", async () => {
         respondWith([fakeEthItem({ type: "ERC-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The adjacent finding from the same review as issue #260: the type gate
@@ -660,16 +668,20 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
     test("case insensitivity does not admit another token type", async () => {
         respondWith([fakeEthItem({ type: "erc-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
         respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The money test: the user holds real ETH and has been airdropped a fake
@@ -682,6 +694,7 @@ describe("surface 3: the balance list", () => {
             [{ addresses: [addr] }],
             "https://rpc.example.invalid",
             BLOCKSCOUT,
+            true,
             [],
             "mainnet",
         );

tests/timestampDisplay.test.js

@@ -134,6 +134,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 describe.each([

tests/tokenTransferDetail.test.js

@@ -8,6 +8,14 @@
 // tracks. It decodes against the address the explorer reports the transaction
 // was sent to.
 //
+// Its links open the explorer of the network the transaction was sent on,
+// whichever network is active
+// (https://git.eeqj.de/sneak/AutistMask/issues/584), and the transaction is
+// read from that network's Blockscout, the one Settings has for it
+// (https://git.eeqj.de/sneak/AutistMask/issues/623). Its decoded details name
+// the token, and scale its amount, from what the wallet knows of that
+// network's tokens (https://git.eeqj.de/sneak/AutistMask/issues/629).
+//
 // The row is the one the real history parser makes from the explorer's answer,
 // opened through transactionDetail.show(), which is what a click on the row
 // calls. Driven against a minimal DOM stub in the shape
@@ -22,10 +30,10 @@ jest.mock("../src/shared/log", () => ({
         warnf: () => {},
         errorf: () => {},
     },
-    debugFetch: async (url) => ({
-        ok: true,
-        json: async () => mockExplorerAnswer(url),
-    }),
+    debugFetch: async (url) => {
+        mockAsked.push(url);
+        return { ok: true, json: async () => mockExplorerAnswer(url) };
+    },
     setRuntimeDebug: () => {},
     isDebug: () => false,
 }));
@@ -35,10 +43,13 @@ globalThis.chrome = {
 };
 
 const { state } = require("../src/shared/state");
+const { NETWORKS } = require("../src/shared/networks");
 const { fetchRecentTransactions } = require("../src/shared/transactions");
 const transactionDetail = require("../src/popup/views/transactionDetail");
 
 const EXPLORER = "https://explorer.example/api/v2";
+// A Blockscout that knows nothing of the transaction.
+const OTHER_EXPLORER = "https://other-explorer.example/api/v2";
 const HOLDER = "0x0000000000000000000000000000000000000a11";
 const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
 // A token the wallet tracks and the bundled token list does not name.
@@ -51,6 +62,9 @@ const TRANSFER_DATA = new Interface([
     "function transfer(address to, uint256 amount)",
 ]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
 
+// Every URL asked of a Blockscout, in order.
+const mockAsked = [];
+
 // The explorer's answers: the transfer in HOLDER's token transfers, and the
 // transaction itself, sent to the token contract.
 function mockExplorerAnswer(url) {
@@ -77,7 +91,11 @@ function mockExplorerAnswer(url) {
         };
     }
     if (url === EXPLORER + "/transactions/" + TX_HASH) {
-        return { to: { hash: TOKEN }, raw_input: TRANSFER_DATA };
+        return {
+            to: { hash: TOKEN },
+            raw_input: TRANSFER_DATA,
+            block_number: 100,
+        };
     }
     return { items: [] };
 }
@@ -140,6 +158,8 @@ beforeEach(() => {
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" } };
     state.blockscoutUrl = EXPLORER;
+    state.useBlockscout = true;
+    state.networkEndpoints = {};
     state.wallets = [
         {
             name: "Main",
@@ -148,13 +168,19 @@ beforeEach(() => {
         },
     ];
     state.trackedTokens = [{ address: TOKEN, symbol: "TDOL", decimals: 6 }];
+    state.networkTrackedTokens = {};
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;
 });
 
 test("a token transfer's decoded details name the token contract and the amount at its scale", async () => {
-    const [row] = await fetchRecentTransactions(HOLDER, EXPLORER, 1);
+    const [row] = await fetchRecentTransactions(
+        HOLDER,
+        EXPLORER,
+        true,
+        NETWORKS.mainnet.chainId,
+    );
     expect(row.to).toBe(RECIPIENT);
     expect(row.contractAddress).toBe(TOKEN.toLowerCase());
 
@@ -174,3 +200,99 @@ test("a token transfer's decoded details name the token contract and the amount
         '<div class="font-bold">1234.5000 TDOL</div>',
     );
 });
+
+// Mainnet is active, and its Blockscout knows nothing of the transaction. The
+// row was read from the Blockscout Settings remembers for Sepolia, and the
+// screen reads the transaction from there too, so every link on it is drawn.
+test("with mainnet active, a Sepolia transaction is read from Sepolia's Blockscout and its links open the Sepolia explorer", async () => {
+    state.networkId = "mainnet";
+    state.blockscoutUrl = OTHER_EXPLORER;
+    state.networkEndpoints = { sepolia: { blockscoutUrl: EXPLORER } };
+    const [row] = await fetchRecentTransactions(
+        HOLDER,
+        EXPLORER,
+        true,
+        NETWORKS.sepolia.chainId,
+    );
+
+    transactionDetail.show(row);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+
+    const sepolia = "https://sepolia.etherscan.io";
+    const links = (id) =>
+        [...node(id).innerHTML.matchAll(/href="([^"]*)"/g)].map((m) => m[1]);
+    expect(links("tx-detail-hash")).toEqual([`${sepolia}/tx/${TX_HASH}`]);
+    expect(links("tx-detail-from")).toEqual([`${sepolia}/address/${HOLDER}`]);
+    expect(links("tx-detail-to")).toEqual([`${sepolia}/address/${RECIPIENT}`]);
+    expect(links("tx-detail-token-contract")).toEqual([
+        `${sepolia}/token/${TOKEN.toLowerCase()}`,
+    ]);
+    expect(links("tx-detail-block")).toEqual([`${sepolia}/block/100`]);
+    expect(links("tx-detail-calldata-details")).toEqual([
+        `${sepolia}/address/${TOKEN}`,
+        `${sepolia}/address/${RECIPIENT}`,
+    ]);
+});
+
+test("with mainnet active and no Blockscout remembered for Sepolia, a Sepolia transaction is asked of Sepolia's default Blockscout", async () => {
+    state.networkId = "mainnet";
+    state.blockscoutUrl = OTHER_EXPLORER;
+    const [row] = await fetchRecentTransactions(
+        HOLDER,
+        EXPLORER,
+        true,
+        NETWORKS.sepolia.chainId,
+    );
+    mockAsked.length = 0;
+
+    transactionDetail.show(row);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+
+    expect(mockAsked).toEqual([
+        NETWORKS.sepolia.defaultBlockscoutUrl + "/transactions/" + TX_HASH,
+    ]);
+});
+
+// Open the Sepolia transfer's detail screen with mainnet active, and wait for
+// its decoded details.
+async function showSepoliaTransferWithMainnetActive() {
+    state.networkId = "mainnet";
+    state.blockscoutUrl = OTHER_EXPLORER;
+    state.networkEndpoints = { sepolia: { blockscoutUrl: EXPLORER } };
+    const [row] = await fetchRecentTransactions(
+        HOLDER,
+        EXPLORER,
+        true,
+        NETWORKS.sepolia.chainId,
+    );
+    transactionDetail.show(row);
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+test("with mainnet active, a Sepolia token transfer's decoded details name the token tracked on Sepolia and its amount at its scale", async () => {
+    state.trackedTokens = [];
+    state.networkTrackedTokens = {
+        sepolia: [{ address: TOKEN, symbol: "TDOL", decimals: 6 }],
+    };
+    await showSepoliaTransferWithMainnetActive();
+
+    expect(decodedLine("Token")).toContain('<div class="font-bold">TDOL</div>');
+    expect(decodedLine("Amount")).toContain(
+        '<div class="font-bold">1234.5000 TDOL</div>',
+    );
+});
+
+// The same contract address on mainnet is another token, so what the wallet
+// tracks and holds there names nothing on Sepolia.
+test("with mainnet active, a Sepolia token transfer's decoded details take nothing from mainnet's tracked tokens or balances", async () => {
+    state.trackedTokens = [{ address: TOKEN, symbol: "MDOL", decimals: 18 }];
+    state.wallets[0].addresses[0].tokenBalances = [
+        { address: TOKEN, symbol: "MDOL", decimals: 18, balance: "1.0" },
+    ];
+    await showSepoliaTransferWithMainnetActive();
+
+    expect(decodedLine("Token")).not.toContain("MDOL");
+    expect(decodedLine("Amount")).toContain(
+        '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
+    );
+});

tests/trackedTokenBalances.test.js

@@ -0,0 +1,304 @@
+// The balance of each token the user tracks is read with balanceOf through the
+// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
+// holder count and decimals, and adds the tokens the user has not tracked
+// (https://git.eeqj.de/sneak/AutistMask/issues/669).
+//
+// The real refreshBalances() runs against a fake JSON-RPC node, answered
+// through ethers' own request hook, and a fake Blockscout, answered through
+// fetch().
+
+const { AbiCoder, FetchRequest } = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
+const FIRST = "0x1111111111111111111111111111111111111111";
+const SECOND = "0x2222222222222222222222222222222222222222";
+
+// A token the user tracks, outside the bundled list, at 6 decimals.
+const TOKEN = "0x7777777777777777777777777777777777777777";
+const TRACKED = {
+    address: TOKEN,
+    symbol: "TRK",
+    name: "Tracked Token",
+    decimals: 6,
+};
+
+// USDC, from the bundled list, which the user does not track.
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+// Neither on the bundled list nor tracked.
+const OTHER = "0x8888888888888888888888888888888888888888";
+
+const ZERO_WORD = "0x" + "0".repeat(64);
+const BALANCE_OF = "0x70a08231";
+
+// What balanceOf answers, by token contract and then by holder. A pair that is
+// not here makes balanceOf fail.
+let holdings;
+// What Blockscout answers for every address; null makes the request fail.
+let explorerRows;
+let logged;
+
+// One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
+// answered with no resolver, so no name.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    if (req.method === "eth_getBalance") {
+        return { ...envelope, result: "0x0" };
+    }
+    if (req.method !== "eth_call") {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    const { to, data } = req.params[0];
+    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
+    const holder = "0x" + data.slice(-40);
+    const amount = (holdings[to.toLowerCase()] || {})[holder];
+    if (amount === undefined) {
+        return {
+            ...envelope,
+            error: { code: -32000, message: "fixture: balanceOf failed" },
+        };
+    }
+    return {
+        ...envelope,
+        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
+    };
+}
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+    holdings = {};
+    explorerRows = null;
+    logged = [];
+    jest.spyOn(console, "error").mockImplementation((...args) => {
+        logged.push(args.map(String).join(" "));
+    });
+    FetchRequest.registerGetUrl(async (req) => {
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+    globalThis.fetch = jest.fn(async () => {
+        if (explorerRows === null) throw new TypeError("Failed to fetch");
+        return { ok: true, status: 200, json: async () => explorerRows };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    jest.restoreAllMocks();
+});
+
+// One Blockscout token-balances row.
+function explorerRow(address, symbol, value, holders = "50000") {
+    return {
+        value: String(value),
+        token: {
+            type: "ERC-20",
+            address_hash: address,
+            symbol: symbol,
+            name: symbol,
+            decimals: "6",
+            holders_count: holders,
+        },
+    };
+}
+
+// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
+// decimals and holder count Blockscout reported for it, if any.
+function trackedRow(balance, decimals = null, holders = null) {
+    return {
+        address: TOKEN,
+        name: "Tracked Token",
+        symbol: "TRK",
+        decimals: decimals,
+        balance: balance,
+        holders: holders,
+    };
+}
+
+async function refresh(addresses, trackedTokens) {
+    await refreshBalances(
+        [{ addresses }],
+        RPC_URL,
+        EXPLORER_URL,
+        true,
+        trackedTokens,
+        "mainnet",
+        new AbortController().signal,
+    );
+    return addresses;
+}
+
+test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
+    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
+    // Exact, never cut: one base unit is not zero.
+    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
+});
+
+test("with Blockscout failing, the untracked rows from before stay", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const usdc = {
+        address: USDC,
+        name: "USD Coin",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [usdc] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
+});
+
+test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [
+        explorerRow(TOKEN, "TRK", 9000000),
+        explorerRow(USDC, "USDC", 5000000),
+        // Too few holders, and neither on the bundled list nor tracked.
+        explorerRow(OTHER, "SPAM", 5000000, "10"),
+        // A known symbol from a contract it does not belong to.
+        explorerRow(OTHER, "USDC", 5000000),
+    ];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        trackedRow("2.0", 6, 50000),
+        {
+            address: USDC,
+            name: "USDC",
+            symbol: "USDC",
+            decimals: 6,
+            balance: "5.0",
+            holders: 50000,
+        },
+    ]);
+});
+
+test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
+    // through to Send's token list.
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const before = trackedRow("7.0", 6, 50000);
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([before]);
+    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
+        true,
+    );
+});
+
+test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
+    // balanceOf fails at FIRST and answers at SECOND.
+    holdings[TOKEN] = { [SECOND]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: TOKEN,
+            name: "TRK",
+            symbol: "TRK",
+            decimals: 6,
+            balance: "9.0",
+            holders: 50000,
+        },
+    ]);
+    // Where balanceOf answers, its figure stands.
+    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
+    holdings[TOKEN] = { [FIRST]: 0n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});
+
+test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
+    holdings[TOKEN] = { [FIRST]: 5n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow(null)]);
+});
+
+test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a tracked token wearing a known symbol from another contract is not listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    // Its entry from before goes too, although Blockscout fails.
+    const before = {
+        address: OTHER,
+        name: "Fake",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});

tests/trackedTokensPerNetwork.test.js

@@ -161,6 +161,7 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
     );
     expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
 
+    await boot.click("btn-settings");
     await chooseNetwork(boot, "mainnet");
     expect(stored().networkId).toBe("mainnet");
     expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);
@@ -286,6 +287,7 @@ describe("Back after a switch from the Settings gear", () => {
                 currentView: "confirm-tx",
                 selectedWallet: 0,
                 selectedAddress: 0,
+                checkRecipientsOnEtherscan: true,
                 viewData: {
                     pendingTx: {
                         token: "ETH",

tests/transactionListCancelled.test.js

@@ -125,6 +125,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 afterEach(() => {

tests/transactions.test.js

@@ -1219,7 +1219,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
 
     test("queries only the two Blockscout endpoints for the address", async () => {
         respondWith([], []);
-        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1");
         expect(debugFetch).toHaveBeenCalledTimes(2);
         const urls = debugFetch.mock.calls.map((c) => c[0]);
         expect(urls).toContain(
@@ -1283,7 +1283,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         const merged = txs[0];
         // The received leg (the swap output) supplies the display amount.
@@ -1320,7 +1325,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].value).toBe("1500.5000");
@@ -1346,7 +1356,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([], [leg("1000000"), leg("2000000")]);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         // Keyed by hash plus contract, so the later leg wins.
         expect(txs[0].exactValue).toBe("2.0");
@@ -1386,7 +1401,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
     });
 
@@ -1427,7 +1447,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].exactValue).toBe("1.0");
@@ -1453,7 +1478,13 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([item(6), item(8), item(7)], []);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1", 2);
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+            2,
+        );
         expect(txs.map((t) => t.blockNumber)).toEqual([21000008, 21000007]);
     });
 
@@ -1479,6 +1510,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const sepolia = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0xaa36a7",
         );
         expect(sepolia[0].symbol).toBe("SepoliaETH");
@@ -1487,6 +1519,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const mainnet = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0x1",
         );
         expect(mainnet[0].symbol).toBe("ETH");
@@ -1513,7 +1546,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].contractAddress).toBe(FAKE_ETH_CONTRACT);
         expect(txs[0].holders).toBe(0);
@@ -1555,6 +1593,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1565,6 +1604,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1575,6 +1615,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(filterTransactions(txs, filters()).transactions).toEqual(
@@ -1591,6 +1632,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBe(0);
@@ -1608,7 +1650,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             },
         }));
         await expect(
-            fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1"),
+            fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1"),
         ).resolves.toEqual([]);
     });
 

tests/txStatus.test.js

@@ -29,8 +29,13 @@ jest.mock("../src/shared/log", () => ({
 }));
 
 const mockReceiptLookup = jest.fn();
+// The RPC URL and network of every node a wait was given.
+const mockNodes = [];
 jest.mock("../src/shared/balances", () => ({
-    getProvider: () => ({ getTransactionReceipt: mockReceiptLookup }),
+    getProvider: (rpcUrl, networkId) => {
+        mockNodes.push({ rpcUrl, networkId });
+        return { getTransactionReceipt: mockReceiptLookup };
+    },
     refreshBalances: jest.fn(),
 }));
 
@@ -107,6 +112,7 @@ global.chrome = { storage };
 
 const txStatus = require("../src/popup/views/txStatus");
 const { state } = require("../src/shared/state");
+const { NETWORKS } = require("../src/shared/networks");
 const { RESTORABLE_VIEWS } = require("../src/shared/restorableViews");
 const { log } = require("../src/shared/log");
 
@@ -118,6 +124,7 @@ const TX_INFO = {
     amount: "0.0050",
     token: "ETH",
     tokenSymbol: null,
+    chainId: NETWORKS.mainnet.chainId,
 };
 
 // True when a view element is not hidden.
@@ -137,8 +144,14 @@ beforeEach(() => {
     jest.setSystemTime(new Date("2026-08-11T12:00:00Z"));
     elements.clear();
     mockReceiptLookup.mockReset();
+    mockNodes.length = 0;
     log.errorf.mockClear();
+    state.networkId = "mainnet";
+    state.rpcUrl = NETWORKS.mainnet.defaultRpcUrl;
+    state.networkEndpoints = {};
     state.wallets = [];
+    state.trackedTokens = [];
+    state.networkTrackedTokens = {};
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;
@@ -349,14 +362,14 @@ describe("WaitTx persistence across popup close", () => {
             // out of restoreView().
             {
                 hash: TX_HASH,
-                txInfo: { to: 42, amount: "0.0050" },
+                txInfo: { ...TX_INFO, to: 42 },
                 broadcastTime: Date.now(),
             },
             // Otherwise complete but an array: only Array.isArray() rejects
             // it, since typeof [] is "object" and the fields are present.
             {
                 hash: TX_HASH,
-                txInfo: Object.assign([], { to: RECIPIENT, amount: "0.0050" }),
+                txInfo: Object.assign([], TX_INFO),
                 broadcastTime: Date.now(),
             },
             {
@@ -364,6 +377,18 @@ describe("WaitTx persistence across popup close", () => {
                 txInfo: { to: RECIPIENT },
                 broadcastTime: Date.now(),
             },
+            // Otherwise complete but for a chain id naming no network: there
+            // is no node to ask for the receipt, and no explorer to link to.
+            {
+                hash: TX_HASH,
+                txInfo: { ...TX_INFO, chainId: undefined },
+                broadcastTime: Date.now(),
+            },
+            {
+                hash: TX_HASH,
+                txInfo: { ...TX_INFO, chainId: "0x5" },
+                broadcastTime: Date.now(),
+            },
         ]) {
             state.viewData = { pendingWait: bad };
             expect(txStatus.restoreWait()).toBe(false);
@@ -499,6 +524,154 @@ describe("WaitTx when the popup closes", () => {
     });
 });
 
+// The popup can reopen onto WaitTx after Settings switched the network. The
+// wait asked the active network's node for the receipt, never found it, and
+// reported a timeout, and its links went to the active network's explorer
+// (https://git.eeqj.de/sneak/AutistMask/issues/584).
+describe("WaitTx for a Sepolia transaction with mainnet active", () => {
+    const SEPOLIA_NODE = "https://sepolia.node.example.invalid";
+    const sepoliaTx = { ...TX_INFO, chainId: NETWORKS.sepolia.chainId };
+
+    beforeEach(() => {
+        state.rpcUrl = "https://mainnet.node.example.invalid";
+        state.networkEndpoints = { sepolia: { rpcUrl: SEPOLIA_NODE } };
+    });
+
+    test("the receipt is asked of the Sepolia node Settings has", async () => {
+        mockReceiptLookup.mockResolvedValue({ blockNumber: 21000000 });
+        state.viewData = {
+            pendingWait: {
+                txInfo: sepoliaTx,
+                hash: TX_HASH,
+                broadcastTime: Date.now(),
+            },
+        };
+        expect(txStatus.restoreWait()).toBe(true);
+        await jest.advanceTimersByTimeAsync(0);
+
+        expect(mockNodes).toEqual([
+            { rpcUrl: SEPOLIA_NODE, networkId: "sepolia" },
+        ]);
+        expect(state.currentView).toBe("success-tx");
+    });
+
+    test("the recipient and hash link to the Sepolia explorer", () => {
+        mockReceiptLookup.mockResolvedValue(null);
+        txStatus.showWait(sepoliaTx, TX_HASH);
+
+        expect(getElement("wait-tx-to").innerHTML).toContain(
+            `href="https://sepolia.etherscan.io/address/${RECIPIENT}"`,
+        );
+        expect(getElement("wait-tx-hash").innerHTML).toContain(
+            `href="https://sepolia.etherscan.io/tx/${TX_HASH}"`,
+        );
+    });
+});
+
+// SuccessTx and ErrorTx follow WaitTx and describe the same transaction, but
+// their links went to the active network's explorer
+// (https://git.eeqj.de/sneak/AutistMask/issues/622). Each test checks the
+// screen again after rendering it from its stored view data alone, as a
+// reopened popup does.
+describe("SuccessTx and ErrorTx for a Sepolia transaction with mainnet active", () => {
+    const SEPOLIA_EXPLORER = "https://sepolia.etherscan.io";
+    const TOKEN = "0x1c7D4B196Cb0C7B01d743Fbc6116a902379C7238";
+    const sepoliaTx = { ...TX_INFO, chainId: NETWORKS.sepolia.chainId };
+
+    test("the recipient, block and hash on SuccessTx link to the Sepolia explorer", async () => {
+        function expectSepoliaLinks() {
+            expect(getElement("success-tx-to").innerHTML).toContain(
+                `href="${SEPOLIA_EXPLORER}/address/${RECIPIENT}"`,
+            );
+            expect(getElement("success-tx-block").innerHTML).toContain(
+                `href="${SEPOLIA_EXPLORER}/block/21000000"`,
+            );
+            expect(getElement("success-tx-hash").innerHTML).toContain(
+                `href="${SEPOLIA_EXPLORER}/tx/${TX_HASH}"`,
+            );
+        }
+        mockReceiptLookup.mockResolvedValue({ blockNumber: 21000000 });
+        txStatus.showWait(sepoliaTx, TX_HASH);
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(state.currentView).toBe("success-tx");
+        expectSepoliaLinks();
+
+        elements.clear();
+        txStatus.renderSuccess();
+        expectSepoliaLinks();
+    });
+
+    test("the addresses in SuccessTx's decoded action link to the Sepolia explorer", async () => {
+        function expectSepoliaLinks() {
+            const html = getElement("success-tx-decoded").innerHTML;
+            expect(html).toContain(
+                `href="${SEPOLIA_EXPLORER}/address/${TOKEN}"`,
+            );
+            expect(html).toContain(
+                `href="${SEPOLIA_EXPLORER}/address/${RECIPIENT}"`,
+            );
+        }
+        const decoded = {
+            name: "Transfer",
+            details: [
+                { label: "Token", address: TOKEN, isToken: true },
+                { label: "Recipient", address: RECIPIENT },
+            ],
+        };
+        mockReceiptLookup.mockResolvedValue({ blockNumber: 21000000 });
+        txStatus.showWait({ ...sepoliaTx, decoded }, TX_HASH);
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(state.currentView).toBe("success-tx");
+        expectSepoliaLinks();
+
+        elements.clear();
+        txStatus.renderSuccess();
+        expectSepoliaLinks();
+    });
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/629
+    test("SuccessTx's decoded action names the token from the tokens tracked on Sepolia", async () => {
+        function expectTokenNamed() {
+            expect(getElement("success-tx-decoded").innerHTML).toContain(
+                '<div class="font-bold">TDOL</div>',
+            );
+        }
+        state.networkTrackedTokens = {
+            sepolia: [{ address: TOKEN, symbol: "TDOL", decimals: 6 }],
+        };
+        const decoded = {
+            name: "Transfer",
+            details: [{ label: "Token", address: TOKEN, isToken: true }],
+        };
+        mockReceiptLookup.mockResolvedValue({ blockNumber: 21000000 });
+        txStatus.showWait({ ...sepoliaTx, decoded }, TX_HASH);
+        await jest.advanceTimersByTimeAsync(10000);
+        expect(state.currentView).toBe("success-tx");
+        expectTokenNamed();
+
+        elements.clear();
+        txStatus.renderSuccess();
+        expectTokenNamed();
+    });
+
+    test("the recipient and hash on ErrorTx link to the Sepolia explorer", () => {
+        function expectSepoliaLinks() {
+            expect(getElement("error-tx-to").innerHTML).toContain(
+                `href="${SEPOLIA_EXPLORER}/address/${RECIPIENT}"`,
+            );
+            expect(getElement("error-tx-hash").innerHTML).toContain(
+                `href="${SEPOLIA_EXPLORER}/tx/${TX_HASH}"`,
+            );
+        }
+        txStatus.showError(sepoliaTx, TX_HASH, "The transaction failed.");
+        expectSepoliaLinks();
+
+        elements.clear();
+        txStatus.renderError();
+        expectSepoliaLinks();
+    });
+});
+
 describe("wait-tx is a view the popup may reopen onto", () => {
     // The resume feature is wired through RESTORABLE_VIEWS: restoreView()
     // refuses any view not in the set, so dropping "wait-tx" from it kills

tests/uniswapRouterAddress.test.js

@@ -7,6 +7,12 @@
 // only when the transaction is sent to a Universal Router deployment on the
 // network it is for; anywhere else it is left to the raw data.
 //
+// The transaction history labelled any call named `execute` or `multicall` a
+// Swap, whatever address it went to
+// (https://git.eeqj.de/sneak/AutistMask/issues/580). It now does so only for
+// such a call sent to a Universal Router deployment on the network the
+// transaction is on; any other is labelled by its method name.
+//
 // The transaction detail screen and the approval screen are driven against a
 // minimal DOM stub in the shape tests/tokenTransferDetail.test.js uses, the
 // approval screen opened the way tests/swapStatusAmount.test.js opens it.
@@ -33,6 +39,7 @@ globalThis.chrome = {
 };
 
 const { state } = require("../src/shared/state");
+const { fetchRecentTransactions } = require("../src/shared/transactions");
 const approval = require("../src/popup/views/approval");
 const { decodeCalldata } = approval;
 const transactionDetail = require("../src/popup/views/transactionDetail");
@@ -47,6 +54,8 @@ const SEPOLIA_ROUTER = "0x3a9d48ab9751398bbfa63ad67599bb04e4bdf98b";
 const ROUTER_ON_BOTH = "0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD";
 // The address with no code from the issue.
 const ORDINARY = "0x0b0050Da68435b3EcBC236c40F16dB2070bCD79A";
+// A contract that is not a router, such as a multisig.
+const OTHER_CONTRACT = "0x5afe000000000000000000000000000000005afe";
 
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const SEPOLIA_WETH = "0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14";
@@ -129,8 +138,13 @@ describe("execute() calldata on the approval screen's decoder", () => {
 // The transaction the explorer reports: SWAP_DATA, sent to `mockSentTo`.
 const TX_HASH = "0x" + "5".repeat(64);
 let mockSentTo = null;
+// The transactions the explorer reports for RECIPIENT's history.
+let mockHistory = [];
 
 function mockExplorerAnswer(url) {
+    if (url.endsWith("/addresses/" + RECIPIENT + "/transactions")) {
+        return { items: mockHistory };
+    }
     if (url.endsWith("/transactions/" + TX_HASH)) {
         return {
             to: { hash: mockSentTo },
@@ -186,57 +200,128 @@ function node(id) {
     return globalThis.document.getElementById(id);
 }
 
-// Open the transaction detail screen with Sepolia active, for the
-// transaction the explorer reports sent to `sentTo`, and wait for its
-// decoded details.
-async function showDetailSentTo(sentTo) {
-    mockSentTo = sentTo;
+// Open the transaction detail screen with `activeNetworkId` active, for the
+// history row `row`, and wait for its decoded details.
+async function showDetail(row, activeNetworkId) {
+    mockSentTo = row.to;
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" } };
-    state.networkId = "sepolia";
+    state.networkId = activeNetworkId;
     state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.useBlockscout = true;
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;
-    transactionDetail.show({
-        hash: TX_HASH,
-        from: RECIPIENT,
-        to: sentTo,
-        value: "",
-        symbol: "SepoliaETH",
-        timestamp: 1790000000,
-        isError: false,
-        direction: "contract",
-        directionLabel: "Swap",
-        method: "execute",
-        chainId: SEPOLIA,
-    });
+    transactionDetail.show(row);
     for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
+// Open the transaction detail screen with `activeNetworkId` active, for the
+// Sepolia transaction the explorer reports sent to `sentTo`, and wait for its
+// decoded details.
+async function showDetailSentTo(sentTo, activeNetworkId) {
+    await showDetail(
+        {
+            hash: TX_HASH,
+            from: RECIPIENT,
+            to: sentTo,
+            value: "",
+            symbol: "SepoliaETH",
+            timestamp: 1790000000,
+            isError: false,
+            direction: "contract",
+            directionLabel: "Swap",
+            method: "execute",
+            chainId: SEPOLIA,
+        },
+        activeNetworkId,
+    );
+}
+
 describe("execute() calldata on the transaction detail screen", () => {
     test("sent to a router on the active network, it is a swap", async () => {
-        await showDetailSentTo(SEPOLIA_ROUTER);
+        await showDetailSentTo(SEPOLIA_ROUTER, "sepolia");
+        expect(node("tx-detail-calldata-details").innerHTML).toContain(
+            "Swap via Uniswap Universal Router",
+        );
+    });
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/623
+    test("sent to a router on its network, with the other network active, it is a swap", async () => {
+        await showDetailSentTo(SEPOLIA_ROUTER, "mainnet");
         expect(node("tx-detail-calldata-details").innerHTML).toContain(
             "Swap via Uniswap Universal Router",
         );
     });
 
     test("sent to an ordinary address, it is not decoded", async () => {
-        await showDetailSentTo(ORDINARY);
+        await showDetailSentTo(ORDINARY, "sepolia");
         expect(node("tx-detail-calldata-action").textContent).toBe("execute");
         expect(node("tx-detail-calldata-details").innerHTML).toBe("");
         expect(node("tx-detail-rawdata").innerHTML).toContain(SWAP_DATA);
     });
 
     test("sent to a router of the other network only, it is not decoded", async () => {
-        await showDetailSentTo(MAINNET_ROUTER);
+        await showDetailSentTo(MAINNET_ROUTER, "sepolia");
         expect(node("tx-detail-calldata-action").textContent).toBe("execute");
         expect(node("tx-detail-calldata-details").innerHTML).toBe("");
         expect(node("tx-detail-rawdata").innerHTML).toContain(SWAP_DATA);
     });
 });
 
+// The history row made from the explorer's answer for RECIPIENT's `method`
+// call sent to the contract `sentTo` on the network with `chainId`. The
+// explorer gives the address in checksummed form.
+async function historyRow(method, sentTo, chainId) {
+    mockHistory = [
+        {
+            hash: TX_HASH,
+            block_number: 7000000,
+            timestamp: "2026-09-01T00:00:00Z",
+            from: { hash: RECIPIENT },
+            to: { hash: getAddress(sentTo), is_contract: true },
+            value: "0",
+            method,
+            status: "ok",
+        },
+    ];
+    const rows = await fetchRecentTransactions(
+        RECIPIENT,
+        "https://explorer.example/api/v2",
+        true,
+        chainId,
+    );
+    return rows[0];
+}
+
+// The history row's label and TransactionDetail's Type line, for a Sepolia
+// transaction. The active network does not decide either.
+describe.each([
+    ["execute", "Execute"],
+    ["multicall", "Multicall"],
+])("a %s() call in the history", (method, methodLabel) => {
+    test("sent to a router on its network, it is a Swap", async () => {
+        const row = await historyRow(method, SEPOLIA_ROUTER, SEPOLIA);
+        expect(row.directionLabel).toBe("Swap");
+        await showDetail(row, "mainnet");
+        expect(node("tx-detail-type").textContent).toBe("Swap");
+    });
+
+    test("sent to another contract, it is labelled by its method name", async () => {
+        const row = await historyRow(method, OTHER_CONTRACT, SEPOLIA);
+        expect(row.directionLabel).toBe(methodLabel);
+        await showDetail(row, "sepolia");
+        expect(node("tx-detail-type").textContent).toBe("Contract Call");
+    });
+
+    test("sent to a router of the other network only, it is labelled by its method name", async () => {
+        const row = await historyRow(method, MAINNET_ROUTER, SEPOLIA);
+        expect(row.directionLabel).toBe(methodLabel);
+        await showDetail(row, "mainnet");
+        expect(node("tx-detail-type").textContent).toBe("Contract Call");
+    });
+});
+
 // Open the approval screen with Ethereum Mainnet active, for a site's Sepolia
 // transaction that sends SWAP_DATA to `sentTo`.
 async function showApprovalSentTo(sentTo) {

tests/uniswapUndeterminedTokenIn.test.js

@@ -71,6 +71,8 @@ function exactInParams(currencyIn, path, amountIn, amountOutMin) {
 
 // BALANCE_CHECK_ERC20 (command 0x0e): (address owner, address token,
 // uint256 minBalance). It names the output token and nothing about the input.
+// Its owner is USER, the transaction's sender: a check of any other address
+// names no output token.
 function balanceCheck(token, minBalance) {
     return coder.encode(
         ["address", "address", "uint256"],
@@ -78,8 +80,13 @@ function balanceCheck(token, minBalance) {
     );
 }
 
+// A transaction from USER.
+function decode(data) {
+    return uniswap.decode(data, ROUTER, "0x1", {}, USER);
+}
+
 function detail(data, label) {
-    const decoded = uniswap.decode(data, ROUTER, "0x1", {});
+    const decoded = decode(data);
     expect(decoded).not.toBeNull();
     return decoded.details.find((d) => d.label === label);
 }
@@ -113,9 +120,7 @@ describe("an execute() whose input currency never decoded", () => {
     });
 
     test("does not name ETH in the swap title either", () => {
-        expect(uniswap.decode(data(), ROUTER, "0x1", {}).name).toBe(
-            "Uniswap Swap",
-        );
+        expect(decode(data()).name).toBe("Uniswap Swap");
     });
 });
 
@@ -125,9 +130,7 @@ describe("an execute() that names only an output token", () => {
 
     test("refuses the input rather than defaulting it to ETH", () => {
         expect(detail(data(), "Token In").value).toBe(REFUSAL);
-        expect(uniswap.decode(data(), ROUTER, "0x1", {}).name).toBe(
-            "Uniswap Swap",
-        );
+        expect(decode(data()).name).toBe("Uniswap Swap");
     });
 
     test("still states the output it did establish", () => {
@@ -175,9 +178,7 @@ describe("native ETH in, which V4 spells as the zero address", () => {
 
         expect(detail(data, "Token In").value).toBe("ETH (native)");
         expect(detail(data, "Amount").value).toBe("1.0000 ETH");
-        expect(uniswap.decode(data, ROUTER, "0x1", {}).name).toBe(
-            "Swap ETH → USDT",
-        );
+        expect(decode(data).name).toBe("Swap ETH → USDT");
     });
 
     test("WRAP_ETH is still ETH at 18 decimals", () => {

tests/unknownScaleSend.test.js

@@ -120,7 +120,7 @@ global.document = {
     body: { prepend() {}, appendChild() {} },
     addEventListener() {},
 };
-global.navigator = { clipboard: { writeText() {} } };
+global.navigator.clipboard = { writeText() {} };
 
 const { AbiCoder, parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");
@@ -172,7 +172,7 @@ async function fetchOnto(items) {
         statusText: "OK",
         json: async () => items,
     }));
-    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",
@@ -197,14 +197,14 @@ async function fetchOntoBoth(itemsA, itemsB) {
         statusText: "OK",
         json: async () => itemsA,
     }));
-    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
         statusText: "OK",
         json: async () => itemsB,
     }));
-    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, []);
+    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",

tests/walletDefects.test.js

@@ -475,7 +475,7 @@ describe("every way to a signature or the private key refuses a defective wallet
                 to: RECIPIENT,
                 value: "0x0",
                 data: "0x",
-                chainId: 1,
+                chainId: "0x1",
                 nonce: 0,
                 gasLimit: "21000",
                 maxFeePerGas: "1000000000",