fix: a transaction history that lands after a network switch is dropped (closes #657)

Home, AddressDetail and AddressToken remember which network is active
before they ask Blockscout for the transaction history. Each screen drops
the answer if another network is active on the page or in storage when the
answer lands. AddressDetail and AddressToken also drop an answer that lands
once the screen shows another address. AddressToken also drops an answer
that lands once the screen shows another token.

A dropped answer draws no rows and saves no fraud contracts. A failed
request goes through the same checks. A dropped failure shows no message.
Holding the lock, the save adds new fraud contracts only if the page and
the stored record still name the request's network.

storedNetworkIs() reads the stored network, in src/shared/storedSettings.js.

Model: opus-5-5

Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .

README.md

@@ -905,8 +905,8 @@ src/
     prices.js         — ETH/USD and token/USD from Chainlink price feeds
     scamlist.js       — known fraud contract addresses
     state.js          — persisted state (extension storage)
-    storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
+    storedSettings.js — "Use Blockscout", "Check recipients on Etherscan" and
-                        read from storage for the requests those settings gate
+                        the active network, read from storage
     symbolSpoof.js    — the known-symbol spoof rule, shared by all surfaces
     tokenList.js      — top ERC-20 tokens by market cap, and their Chainlink
                         price feeds (hardcoded)
@@ -1473,21 +1473,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. A token claiming a symbol from the bundled list from any other
+more holders. The balance list always drops a token that claims a bundled-list
-contract address is always dropped, tracked or not, and so is any token claiming
+symbol from another contract address, whatever the settings. The list also drops
-a symbol that belongs to the native asset and therefore has no legitimate
+every token that claims the native asset's symbol: `"ETH"`, or any network's
-contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`nativeCurrency`, such as `"SepoliaETH"`. That filter is unconditional — the
-`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+"Hide tokens with fewer than 1,000 holders" setting governs the transaction
-tokens with fewer than 1,000 holders" setting governs the transaction history
+history and the send-screen token selector, not this list. A token's holder
-and the send-screen token selector, not this list. A token's holder count is
+count is unknown when the explorer reports none, or reports anything other than
-unknown when the explorer reports none, or reports anything other than a whole
+a whole number written in digits alone, such as `1,000` or `1e3`
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+(`parseHoldersCount()` in `src/shared/holders.js`). This list does not take an
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+unknown count as 1,000 or more, so such a token is shown only when it is on the
-or more, so such a token is shown only when it is on the bundled list or
+bundled list or tracked. Every nonzero holding of a token shown is stored
-tracked. Every nonzero holding of a token shown is stored exactly, however
+exactly, however small, but a holding below 0.000001 is left out of the balance
-small, but a holding below 0.000001 is left out of the balance lists, the
+lists, the send-screen token selector, the address total and the remove-address
-send-screen token selector, the address total and the remove-address warning
+warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
-(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
 zero balance" is on.
@@ -2053,15 +2052,21 @@ view would leave a wallet one click from deletion.
       fee estimate and the contract and never-sent recipient checks ask that
       network's RPC endpoint, and the Etherscan label check asks that network's
       explorer
-    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
+    - "Sign & Send" (correct password) when the gas limit or a fee is over its
-      total fee the RPC endpoint fills in at signing is over its bound in
+      bound → nothing is signed; "The gas limit or fee the RPC endpoint quoted
-      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
+      for this transaction is more than this wallet will sign for, so it was not
-      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
+      sent. Please go back and try again." in its own box, no screen change. For
-      is more than this wallet will sign for, so it was not sent. Please go back
+      an ETH amount that Send's "Max" filled in, the gas limit and fees are
-      and try again." in its own box, the same sentence for all three, no screen
+      those of this screen's own fee estimate (see Amount above). For any other
-      change
+      send, the RPC endpoint fills in the gas limit and fees at signing. Just
-    - "Sign & Send" (wrong password) → "Wrong password." on the password error
+      before signing, `assertWithinCeilings()` (`src/shared/approvalVerify.js`)
-      line, no screen change
+      refuses the send when any of these is over its bound:
+        - the gas limit
+        - each fee per gas the transaction sets
+        - the total fee: the gas limit times `maxFeePerGas`, or times `gasPrice`
+          when the transaction has no `maxFeePerGas`
+    - "Sign & Send" (wrong password) → "That password is incorrect. Please try
+      again." on the password error line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
       selected: the two are saved separately, so the popup can reopen onto this
       screen with another address selected. When the selected wallet does not
@@ -2233,6 +2238,10 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
+    - "Add" with a token that the spoof rule refuses → nothing is tracked; "Not
+      added: this token fakes a known symbol." flash message, no screen change
+    - "Add", then the contract lookup answers while another screen shows, or
+      after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
       answers → nothing is tracked; "The active network changed before the
       lookup finished, so the token was not added." flash message, no screen
@@ -2282,6 +2291,8 @@ view would leave a wallet one click from deletion.
     - Either "Save" stores its URL only if the input still shows that URL when
       the endpoint answers. Otherwise a flash message says that the URL was not
       saved
+    - If the user taps the same "Save" again before the endpoint answers, the
+      earlier tap stores nothing and shows no flash message
     - Etherscan:
         - "Check recipients on Etherscan" checkbox, unticked until the user
           ticks it
@@ -2539,6 +2550,9 @@ view would leave a wallet one click from deletion.
       "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
+    - "Add" by contract address with a token that the spoof rule refuses →
+      nothing is tracked; "Not added: this token fakes a known symbol." flash
+      message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
       lookup answers → nothing is tracked; "The active network changed before
       the lookup finished, so the token was not added." flash message, no screen

docs/README.md

@@ -380,10 +380,8 @@ but comes from an unrecognized contract, it is identified as a spoof and hidden.
 In your transaction history this is the "Hide fake tokens impersonating a known
 symbol" setting, which you can switch off; doing so also stops new entries being
 added to the fraud contract blocklist below, since detecting a spoof is what
-fills it. The send token list always applies the check. Your balances apply it
+fills it. The send token list always applies the check. Your balance list always
-too, with one exception: a token claiming the symbol "ETH" is not filtered
+applies the check too.
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your

eslint.config.js

@@ -153,8 +153,7 @@ module.exports = [
         },
     },
 
-    // The helpers the script/ entrypoints call: plain node programs too, run
+    // The files in script/lib/ run on plain node too, and are never bundled.
-    // from a shell script rather than from yarn, and never bundled.
     {
         files: ["script/lib/**/*.js"],
         languageOptions: {

package.json

@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "jest --forceExit --maxWorkers=3",
+        "test": "node script/lib/jest.js --maxWorkers=3",
-        "test:verbose": "jest --forceExit --maxWorkers=3 --verbose",
+        "test:verbose": "node script/lib/jest.js --maxWorkers=3 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",

script/bootstrap

@@ -118,6 +118,7 @@ ensure_yarn() {
     fi
 }
 
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \

script/lib/jest.js

@@ -0,0 +1,40 @@
+// Runs jest with the arguments it is given, and fails the run when jest had to
+// force-stop the worker process that ran a test file. Jest itself only prints a
+// warning when that happens, and its run still passes. The warning means a test
+// left a timer or another open handle running. The test scripts in package.json
+// run jest through this file.
+//
+// Jest runs inside this process and writes to the terminal directly, so its
+// output looks the same as a plain jest run. This file only checks each write
+// to stderr for the warning below.
+
+"use strict";
+
+// The start of the warning that jest prints on stderr after it force-stops a
+// worker process.
+const WORKER_WARNING = "A worker process has failed to exit gracefully";
+
+let forceStopped = false;
+
+const writeStderr = process.stderr.write.bind(process.stderr);
+process.stderr.write = (chunk, ...rest) => {
+    if (String(chunk).includes(WORKER_WARNING)) {
+        forceStopped = true;
+    }
+    return writeStderr(chunk, ...rest);
+};
+
+// Runs after jest has finished, as the process exits.
+process.on("exit", () => {
+    if (forceStopped) {
+        console.error(
+            "script/lib/jest.js: failing the run, because jest force-stopped " +
+                "a worker process. A test left a timer or another open " +
+                "handle running.",
+        );
+        process.exitCode = 1;
+    }
+});
+
+// Jest's own command-line program. It reads its arguments from process.argv.
+require("jest/bin/jest");

src/popup/views/addToken.js

@@ -3,9 +3,15 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
+// Counts the times AddToken has opened. A contract lookup started before
+// AddToken was last opened changes neither the screen nor the status line.
+let addTokenScreenOpenings = 0;
+
 function show() {
+    addTokenScreenOpenings++;
     $("add-token-address").value = "";
     $("add-token-info").textContent = "";
     $("add-token-info").style.visibility = "hidden";
@@ -55,6 +61,7 @@ function init(ctx) {
         // The network the lookup asks, which Settings may switch away from
         // before it answers, as for a transaction in confirmTx.js.
         const chainId = currentNetwork().chainId;
+        const opening = addTokenScreenOpenings;
         try {
             const info = await lookupTokenInfo(
                 contractAddr,
@@ -71,6 +78,15 @@ function init(ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked.
+            if (isSpoofedSymbol(info.symbol, contractAddr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                if (addTokenScreenOpenings !== opening) return;
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, contractAddr);
             state.trackedTokens.push({
                 address: contractAddr,
@@ -80,6 +96,17 @@ function init(ctx) {
             });
             await saveState();
             ctx.doRefreshAndRender();
+            // If the lookup answers after AddToken was opened again, the
+            // token is still added, but the screen and the status line stay
+            // as they are.
+            if (addTokenScreenOpenings !== opening) return;
+            // The lookup is over, so a later Back onto AddToken shows no
+            // status.
+            infoEl.textContent = "";
+            infoEl.style.visibility = "hidden";
+            // If the lookup answers while another screen shows, the token is
+            // still added but the screen does not change.
+            if (state.currentView !== "add-token") return;
             // Pop the stack (back to address detail) and re-render it
             // so the newly added token is visible immediately.
             if (state.viewStack.length > 0) {
@@ -100,6 +127,7 @@ function init(ctx) {
                     ? detail
                     : "Could not add the token.",
             );
+            if (addTokenScreenOpenings !== opening) return;
             infoEl.textContent = "";
             infoEl.style.visibility = "hidden";
         }

src/popup/views/addressDetail.js

@@ -22,6 +22,7 @@ const {
     filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
+const { storedNetworkIs } = require("../../shared/storedSettings");
 const {
     updateSendBalance,
     renderSendTokenSelect,
@@ -98,6 +99,7 @@ let loadedTxs = [];
 let ensNameMap = new Map();
 
 async function loadTransactions(address) {
+    const networkId = state.networkId;
     try {
         const rawTxs = await fetchRecentTransactions(
             address,
@@ -114,43 +116,74 @@ async function loadTransactions(address) {
         });
         const txs = result.transactions;
 
-        // Persist any newly discovered fraud contracts
-        if (result.newFraudContracts.length > 0) {
-            for (const addr of result.newFraudContracts) {
-                if (!state.fraudContracts.includes(addr)) {
-                    state.fraudContracts.push(addr);
-                }
-            }
-            await saveState();
-        }
-
-        loadedTxs = txs;
-
         // Collect ALL unique addresses (from + to) for ENS resolution so
         // that reverse lookups work for every displayed address, not just
         // the ones that were originally entered as ENS names.
         const counterparties = [
             ...new Set(txs.flatMap((tx) => [tx.from, tx.to].filter(Boolean))),
         ];
+        let names = new Map();
         if (counterparties.length > 0) {
             try {
-                ensNameMap = await resolveEnsNames(
+                names = await resolveEnsNames(
                     counterparties,
                     state.rpcUrl,
                     state.networkId,
                     ctx.pageClosed,
                 );
             } catch {
-                ensNameMap = new Map();
+                // The rows then show no ENS names.
             }
         }
 
+        // If the network changed during the lookups above, or the screen now
+        // shows another address, nothing is saved or drawn. See
+        // src/shared/storedSettings.js.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId)) ||
+            $("address-line").dataset.full !== address
+        ) {
+            return;
+        }
+
+        // Persist any newly discovered fraud contracts, inside the save and
+        // holding the lock. Nothing is added unless this page and the stored
+        // record both still name the request's network.
+        if (result.newFraudContracts.length > 0) {
+            let saved = false;
+            await saveState((stored) => {
+                if (state.networkId !== networkId) return false;
+                if (stored.networkId !== networkId) return false;
+                for (const addr of result.newFraudContracts) {
+                    if (!state.fraudContracts.includes(addr)) {
+                        state.fraudContracts.push(addr);
+                    }
+                }
+                saved = true;
+            });
+            // If the network changed while the save waited for the lock,
+            // nothing is drawn.
+            if (!saved) return;
+        }
+
+        loadedTxs = txs;
+        ensNameMap = names;
         renderTransactions(txs);
     } catch (e) {
         // Cancelled by the popup closing, not failed: see pageClosed in
         // src/popup/index.js.
         if (ctx.pageClosed.aborted) return;
         log.errorf("loadTransactions failed:", e.message);
+        // If the network changed, or the screen now shows another address,
+        // the failure is not shown.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId)) ||
+            $("address-line").dataset.full !== address
+        ) {
+            return;
+        }
         $("tx-list").innerHTML =
             '<div class="text-muted text-xs py-1">Failed to load transactions.</div>';
     }

src/popup/views/addressToken.js

@@ -29,6 +29,7 @@ const {
     filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
+const { storedNetworkIs } = require("../../shared/storedSettings");
 const {
     updateSendBalance,
     renderSendTokenSelect,
@@ -170,6 +171,7 @@ function show() {
 }
 
 async function loadTransactions(address, tokenId) {
+    const networkId = state.networkId;
     try {
         const rawTxs = await fetchRecentTransactions(
             address,
@@ -186,16 +188,6 @@ async function loadTransactions(address, tokenId) {
         });
         let txs = result.transactions;
 
-        // Persist any newly discovered fraud contracts
-        if (result.newFraudContracts.length > 0) {
-            for (const addr of result.newFraudContracts) {
-                if (!state.fraudContracts.includes(addr)) {
-                    state.fraudContracts.push(addr);
-                }
-            }
-            await saveState();
-        }
-
         // Filter to this token only
         if (tokenId === "ETH") {
             txs = txs.filter((tx) => tx.contractAddress === null);
@@ -207,32 +199,75 @@ async function loadTransactions(address, tokenId) {
             );
         }
 
-        loadedTxs = txs;
-
         // Collect ALL unique addresses for ENS resolution so reverse
         // lookups work for every displayed address.
         const counterparties = [
             ...new Set(txs.flatMap((tx) => [tx.from, tx.to].filter(Boolean))),
         ];
+        let names = new Map();
         if (counterparties.length > 0) {
             try {
-                ensNameMap = await resolveEnsNames(
+                names = await resolveEnsNames(
                     counterparties,
                     state.rpcUrl,
                     state.networkId,
                     ctx.pageClosed,
                 );
             } catch {
-                ensNameMap = new Map();
+                // The rows then show no ENS names.
             }
         }
 
+        // If the network changed during the lookups above, or the screen now
+        // shows another address or token, nothing is saved or drawn. See
+        // src/shared/storedSettings.js.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId)) ||
+            $("address-token-line").dataset.full !== address ||
+            state.selectedToken !== tokenId
+        ) {
+            return;
+        }
+
+        // Persist any newly discovered fraud contracts, inside the save and
+        // holding the lock. Nothing is added unless this page and the stored
+        // record both still name the request's network.
+        if (result.newFraudContracts.length > 0) {
+            let saved = false;
+            await saveState((stored) => {
+                if (state.networkId !== networkId) return false;
+                if (stored.networkId !== networkId) return false;
+                for (const addr of result.newFraudContracts) {
+                    if (!state.fraudContracts.includes(addr)) {
+                        state.fraudContracts.push(addr);
+                    }
+                }
+                saved = true;
+            });
+            // If the network changed while the save waited for the lock,
+            // nothing is drawn.
+            if (!saved) return;
+        }
+
+        loadedTxs = txs;
+        ensNameMap = names;
         renderTransactions(txs);
     } catch (e) {
         // Cancelled by the popup closing, not failed: see pageClosed in
         // src/popup/index.js.
         if (ctx.pageClosed.aborted) return;
         log.errorf("loadTransactions failed:", e.message);
+        // If the network changed, or the screen now shows another address or
+        // token, the failure is not shown.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId)) ||
+            $("address-token-line").dataset.full !== address ||
+            state.selectedToken !== tokenId
+        ) {
+            return;
+        }
         $("address-token-tx-list").innerHTML =
             '<div class="text-muted text-xs py-1">Failed to load transactions.</div>';
     }

src/popup/views/helpers.js

@@ -33,6 +33,7 @@ const { networkByChainId } = require("../../shared/networks");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { displaySymbol } = require("../../shared/symbolDisplay");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { markViewRendered } = require("../viewRouter");
 
@@ -447,6 +448,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     if (showZero && trackedTokens) {
         for (const t of trackedTokens) {
             if (seen.has(t.address.toLowerCase())) continue;
+            // A token that the spoof rule refuses has no stored balance, and
+            // gets no zero row either.
+            if (isSpoofedSymbol(t.symbol, t.address)) continue;
             html += balanceLine(
                 t.symbol,
                 0,

src/popup/views/home.js

@@ -44,6 +44,7 @@ const {
     fetchRecentTransactions,
     filterTransactions,
 } = require("../../shared/transactions");
+const { storedNetworkIs } = require("../../shared/storedSettings");
 const { log } = require("../../shared/log");
 
 function findActiveAddr() {
@@ -183,6 +184,7 @@ async function loadHomeTxs(ctx) {
     }
     if (allAddresses.length === 0) return;
 
+    const networkId = state.networkId;
     const filters = {
         hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
@@ -202,6 +204,15 @@ async function loadHomeTxs(ctx) {
         );
         const results = await Promise.all(fetches);
 
+        // If the network changed during the lookups, nothing is saved or
+        // drawn. See src/shared/storedSettings.js.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId))
+        ) {
+            return;
+        }
+
         // Merge, deduplicate by hash, filter, sort, take 25
         const seen = new Set();
         let merged = [];
@@ -215,14 +226,24 @@ async function loadHomeTxs(ctx) {
 
         const filtered = filterTransactions(merged, filters);
 
-        // Persist any newly discovered fraud contracts
+        // Persist any newly discovered fraud contracts, inside the save and
+        // holding the lock. Nothing is added unless this page and the stored
+        // record both still name the request's network.
         if (filtered.newFraudContracts.length > 0) {
+            let saved = false;
+            await saveState((stored) => {
+                if (state.networkId !== networkId) return false;
+                if (stored.networkId !== networkId) return false;
                 for (const addr of filtered.newFraudContracts) {
                     if (!state.fraudContracts.includes(addr)) {
                         state.fraudContracts.push(addr);
                     }
                 }
-            await saveState();
+                saved = true;
+            });
+            // If the network changed while the save waited for the lock,
+            // nothing is drawn.
+            if (!saved) return;
         }
 
         merged = filtered.transactions;
@@ -234,6 +255,13 @@ async function loadHomeTxs(ctx) {
         // src/popup/index.js.
         if (ctx.pageClosed.aborted) return;
         log.errorf("loadHomeTxs failed:", e.message);
+        // If the network changed, the failure is not shown.
+        if (
+            state.networkId !== networkId ||
+            !(await storedNetworkIs(networkId))
+        ) {
+            return;
+        }
         const list = $("home-tx-list");
         if (list) {
             list.innerHTML =

src/popup/views/settings.js

@@ -50,6 +50,11 @@ let versionClickTimer = null;
 // not the one in `state`.
 let shownNetwork = null;
 
+// Each endpoint "Save" counts its taps here, under the field that it stores.
+// Once the user taps the same "Save" again, the earlier tap shows no flash
+// message. The earlier tap stores its URL only if its write had already begun.
+const saveTaps = { rpcUrl: 0, blockscoutUrl: 0 };
+
 // One row per site origin, however many addresses it appears under, each with
 // an [x] that hands it to onRemove.
 function renderSiteList(containerId, origins, onRemove) {
@@ -347,10 +352,16 @@ function showNewSettings() {
 // shows `url`, nothing is saved. The flash message then says that the URL was
 // changed during the check. The save compares the input and sets `url` in
 // `state` in one step. So a redraw after the comparison shows `url`.
-async function saveEndpoint(field, input, url, networkId) {
+//
+// `tap` is the number of the "Save" tap that checked `url`. If the user taps
+// the same "Save" again before this save holds the lock, nothing is stored. If
+// the user taps the same "Save" again before the write ends, no flash message
+// is shown.
+async function saveEndpoint(field, input, url, networkId, tap) {
     let refused = false;
     let inputChanged = false;
     await saveState((stored) => {
+        if (saveTaps[field] !== tap) return false;
         refused =
             state.networkId !== networkId || stored.networkId !== networkId;
         inputChanged = $(input).value.trim() !== url;
@@ -358,6 +369,7 @@ async function saveEndpoint(field, input, url, networkId) {
         state[field] = url;
         stored[field] = url;
     });
+    if (saveTaps[field] !== tap) return;
     if (refused) {
         showFlash("The URL was not saved because the network changed.");
     } else if (inputChanged) {
@@ -375,6 +387,8 @@ function init(_ctx) {
     showPhrase.init();
 
     $("btn-save-rpc").addEventListener("click", async () => {
+        saveTaps.rpcUrl++;
+        const tap = saveTaps.rpcUrl;
         const url = $("settings-rpc").value.trim();
         if (!url) {
             showFlash("Please enter an RPC URL.");
@@ -395,6 +409,8 @@ function init(_ctx) {
                 }),
             });
             const json = await resp.json();
+            // The user has tapped this "Save" again since the check began.
+            if (tap !== saveTaps.rpcUrl) return;
             if (json.error) {
                 log.errorf("RPC validation error:", json.error);
                 showFlash("Endpoint returned an error.");
@@ -408,6 +424,7 @@ function init(_ctx) {
             // Cancelled by the popup closing, not failed: see pageClosed in
             // src/popup/index.js.
             if (ctx.pageClosed.aborted) return;
+            if (tap !== saveTaps.rpcUrl) return;
             // Not the error's message: fetch puts the whole URL, password and
             // key included, in the message of the error it throws for a URL
             // with a user name and password or one it cannot parse.
@@ -415,10 +432,12 @@ function init(_ctx) {
             showFlash("Could not reach endpoint.");
             return;
         }
-        await saveEndpoint("rpcUrl", "settings-rpc", url, net.id);
+        await saveEndpoint("rpcUrl", "settings-rpc", url, net.id, tap);
     });
 
     $("btn-save-blockscout").addEventListener("click", async () => {
+        saveTaps.blockscoutUrl++;
+        const tap = saveTaps.blockscoutUrl;
         const url = $("settings-blockscout").value.trim();
         if (!url) {
             showFlash("Please enter a Blockscout API URL.");
@@ -428,18 +447,26 @@ function init(_ctx) {
         showFlash("Testing endpoint...");
         try {
             const resp = await debugFetch(url + "/stats");
+            if (tap !== saveTaps.blockscoutUrl) return;
             if (!resp.ok) {
                 showFlash("Endpoint returned HTTP " + resp.status + ".");
                 return;
             }
         } catch {
             if (ctx.pageClosed.aborted) return;
+            if (tap !== saveTaps.blockscoutUrl) return;
             // Not the error's message, as for the RPC check above.
             log.errorf("Blockscout validation failed:", urlOrigin(url));
             showFlash("Could not reach endpoint.");
             return;
         }
-        await saveEndpoint("blockscoutUrl", "settings-blockscout", url, net.id);
+        await saveEndpoint(
+            "blockscoutUrl",
+            "settings-blockscout",
+            url,
+            net.id,
+            tap,
+        );
     });
 
     // Each change is made inside the save, holding the lock. So

src/popup/views/settingsAddToken.js

@@ -3,6 +3,7 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
 let ctx;
@@ -155,6 +156,16 @@ function init(_ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked. The rule never refuses
+            // a bundled token, so the "Top tokens:" buttons and the top 100
+            // dropdown need no such check.
+            if (isSpoofedSymbol(info.symbol, addr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, addr);
             state.trackedTokens.push({
                 address: addr,

src/shared/chainSwitch.js

@@ -61,31 +61,20 @@ function clearPopupCaches() {
 // (https://git.eeqj.de/sneak/AutistMask/issues/653,
 // https://git.eeqj.de/sneak/AutistMask/issues/692).
 //
-// When the stored record is on another network, a switch saved elsewhere has
-// not reached this page yet. This page first takes that switch with
-// takeStoredNetwork() (state.js), as followStoredSettings() does. The switch to
-// `newNetworkId` is then made from the stored record's network. So every
-// network's list of tracked tokens in the stored record is kept
-// (https://git.eeqj.de/sneak/AutistMask/issues/701). When the stored record is
-// already on `newNetworkId`, the switch made from there only resets the
-// balances and caches.
-//
 // Before the switch, `state` takes the tracked tokens that another page stored
 // since this page's last save (takeStoredTrackedTokens() in state.js). The
 // switch then puts them away under the previous network, the network they were
-// added on.
+// added on. When the stored record is on another network, a switch saved
+// elsewhere has not reached this page yet. The stored record's tokens are then
+// that network's, and none are taken.
 async function onChainSwitch(newNetworkId) {
-    const {
+    const { state, saveState, takeStoredTrackedTokens } = require("./state");
-        state,
-        saveState,
-        takeStoredNetwork,
-        takeStoredTrackedTokens,
-    } = require("./state");
     let net = null;
     await saveState((stored) => {
         if (state.networkId === newNetworkId) return false;
-        if (stored.networkId !== state.networkId) takeStoredNetwork(stored);
+        if (stored.networkId === state.networkId) {
             takeStoredTrackedTokens(stored);
+        }
         net = applyChainSwitchFields(state, newNetworkId);
         stored.lastBalanceRefresh = 0;
         stored.fraudContracts = [];

src/shared/state.js

@@ -455,11 +455,6 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // own UI scratch space, not data another page has any reason to share
 // membership of.
 //
-// One exception: when the stored record is on another network than this
-// page's, a save keeps the stored `trackedTokens`. It merges this page's change
-// into the list in `networkTrackedTokens` for this page's network, by contract
-// address.
-//
 // This does not make two pages that both change the SAME leaf concurrently
 // safe: last write wins on that one leaf, same as before. What it removes
 // is the cross-field (and now cross-membership-vs-leaf) clobber — a page
@@ -532,26 +527,6 @@ async function saveStateOnce(beforeWrite) {
             merged[key] = current[key];
         }
     }
-    // When the merged record names a network other than this page's, this page
-    // has not yet taken a switch saved elsewhere. This page's `trackedTokens`
-    // is then the list of this page's network. The stored record keeps the
-    // list of this page's network in `networkTrackedTokens`. So a token that
-    // this page added or removed since its last save is added to or removed
-    // from that stored list. The merged record keeps the stored `trackedTokens`
-    // (https://git.eeqj.de/sneak/AutistMask/issues/701).
-    if (merged.networkId !== current.networkId) {
-        merged.trackedTokens = fresh.trackedTokens;
-        merged.networkTrackedTokens = {
-            ...fresh.networkTrackedTokens,
-            [current.networkId]: mergeListByIdentity(
-                baseline.trackedTokens,
-                current.trackedTokens,
-                fresh.networkTrackedTokens[current.networkId],
-                (token) => token.address.toLowerCase(),
-                (base, ours) => ours,
-            ),
-        };
-    }
     merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
     // Stamped on every write, never merged or diffed: the record that goes to
     // storage is in THIS build's shape whatever shape it was read in, which is
@@ -632,33 +607,15 @@ function saveState(beforeWrite) {
     return turn;
 }
 
-// Give this page the network switch held by `stored`, in `state` and in
+// Give this page the network switch held by `stored`, a record a save of this
-// `baseline` alike, as loadState() does with a whole record. `stored` is the
+// page has just read (followStoredSettings() in src/popup/index.js calls this
-// record that a save of this page has just read. followStoredSettings() in
+// from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
-// src/popup/index.js and onChainSwitch() in src/shared/chainSwitch.js call this
+// with a whole record. The switch is then not this page's own change, even when
-// from `beforeWrite`. The switch is then not this page's own change, even when
 // that save fails to write: a later switch back to the previous network still
 // differs from `baseline`, and is stored.
-//
-// A token that this page tracked or removed since its last save was tracked or
-// removed on this page's network before the switch. `state` keeps that change
-// in the list in `networkTrackedTokens` for that network, merged with the
-// stored list by contract address. `baseline` takes the stored list, so the
-// save stores the change (https://git.eeqj.de/sneak/AutistMask/issues/706).
 function takeStoredNetwork(stored) {
-    const networkTrackedTokens = {
-        ...stored.networkTrackedTokens,
-        [rawState.networkId]: mergeListByIdentity(
-            baseline.trackedTokens,
-            rawState.trackedTokens,
-            stored.networkTrackedTokens[rawState.networkId],
-            (token) => token.address.toLowerCase(),
-            (base, ours) => ours,
-        ),
-    };
     copyChainSwitchFields(rawState, stored);
     copyChainSwitchFields(baseline, structuredClone(stored));
-    rawState.networkTrackedTokens = networkTrackedTokens;
 }
 
 // Give this page the tracked tokens of `stored`, a record on this page's

src/shared/storedSettings.js

@@ -1,5 +1,5 @@
-// Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
+// Reads "Use Blockscout", "Check recipients on Etherscan" or the active network
-// profile.
+// from the stored profile.
 //
 // Before each request that sends the user's data to Blockscout or Etherscan, the
 // wallet reads that service's setting from storage. The wallet reads the setting
@@ -7,6 +7,11 @@
 // made, and an answer that lands after the setting went off is dropped. A page's
 // own copy of the setting is not used, because another page may have just
 // changed it.
+//
+// Before asking Blockscout for the transaction history, a screen remembers
+// which network is active. If another network is active on the page or in
+// storage when the answer lands, the screen drops the answer. A switch saved
+// elsewhere reaches storage first and the page later.
 
 const { storageGet } = require("./browserApi");
 const { normalizePersisted } = require("./persistedState");
@@ -24,4 +29,15 @@ async function storedSettingIsOn(name) {
     }
 }
 
-module.exports = { storedSettingIsOn };
+// Whether `networkId` is the active network in the stored profile. A failed
+// read counts as no.
+async function storedNetworkIs(networkId) {
+    try {
+        const { autistmask } = await storageGet("autistmask");
+        return normalizePersisted(autistmask).networkId === networkId;
+    } catch {
+        return false;
+    }
+}
+
+module.exports = { storedSettingIsOn, storedNetworkIs };

tests/addTokenLateAnswer.test.js

@@ -0,0 +1,137 @@
+// A contract lookup on AddToken can answer after the user has left AddToken.
+// The token is still added, and the screen the user is on does not change
+// (https://git.eeqj.de/sneak/AutistMask/issues/603). An answer while AddToken
+// still shows goes to AddressDetail. Driven through the real popup over a
+// stored profile.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+
+const TOKEN = {
+    address: TOKEN_ADDRESS,
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+
+// A second contract address, typed after AddToken was opened again.
+const OTHER_TOKEN_ADDRESS = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// The popup reopened onto AddressDetail, then AddToken opened from it with
+// TOKEN's contract address typed in.
+async function openAddToken() {
+    const boot = await bootPopup(
+        unversionedValidProfile({
+            currentView: "address",
+            selectedWallet: 0,
+            selectedAddress: 0,
+        }),
+    );
+    expect(boot.pageErrors).toEqual([]);
+    await boot.click("btn-add-token");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    boot.node("add-token-address").value = TOKEN.address;
+    return boot;
+}
+
+// Presses Add with a contract lookup that answers only when the function
+// returned here is called. That function waits for Add to finish.
+function addWithPendingLookup(boot) {
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let answer;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((resolve) => {
+                answer = resolve;
+            }),
+    );
+    const adding = boot.click("btn-add-token-confirm");
+    return async () => {
+        answer({
+            symbol: TOKEN.symbol,
+            decimals: TOKEN.decimals,
+            name: TOKEN.name,
+        });
+        await adding;
+    };
+}
+
+test("an answer after the user opened Settings adds the token and Settings stays", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+    await boot.click("btn-settings");
+    expect(boot.visibleViews()).toEqual(["settings"]);
+
+    await answerLookup();
+    expect(boot.visibleViews()).toEqual(["settings"]);
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});
+
+test("Back from Settings onto AddToken after the lookup answered shows no lookup status", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+    await boot.click("btn-settings");
+    await answerLookup();
+
+    await boot.click("btn-settings-back");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    expect(boot.text("add-token-info")).toBe("");
+    expect(boot.node("add-token-info").style.visibility).toBe("hidden");
+});
+
+test("an answer after AddToken was opened again adds the token and leaves AddToken and its status line as they are", async () => {
+    const boot = await openAddToken();
+    const answerFirstLookup = addWithPendingLookup(boot);
+    await boot.click("btn-add-token-back");
+    await boot.click("btn-add-token");
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
+    // The second lookup is never answered.
+    addWithPendingLookup(boot);
+
+    await answerFirstLookup();
+    expect(boot.visibleViews()).toEqual(["add-token"]);
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});
+
+test("a lookup that fails after AddToken was opened again leaves the status line as it is", async () => {
+    const boot = await openAddToken();
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let failFirstLookup;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((_, reject) => {
+                failFirstLookup = reject;
+            }),
+    );
+    const firstAdd = boot.click("btn-add-token-confirm");
+    await boot.click("btn-add-token-back");
+    await boot.click("btn-add-token");
+    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
+    // The second lookup is never answered.
+    addWithPendingLookup(boot);
+
+    failFirstLookup(new Error("lookup failed"));
+    await firstAdd;
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+});
+
+test("an answer while AddToken still shows goes to AddressDetail with the token listed", async () => {
+    const boot = await openAddToken();
+    const answerLookup = addWithPendingLookup(boot);
+
+    await answerLookup();
+    expect(boot.visibleViews()).toEqual(["address"]);
+    expect(boot.node("address-balances").innerHTML).toContain("TST");
+    expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
+});

tests/addressKey.test.js

@@ -161,7 +161,7 @@ function click(element) {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 // ------------------------------------------------------------ harness
@@ -188,7 +188,11 @@ let sent;
 // handler to the buttons it drew, as the browser's fresh list would have.
 let plusButton;
 
+// showFlash() starts a timer that clears the message one or two seconds later.
+// Each test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     approvalDetails = null;
     sent = [];
     mockNode.broadcast = [];
@@ -239,6 +243,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+    jest.useRealTimers();
     jest.restoreAllMocks();
 });
 

tests/backgroundApproval.test.js

@@ -537,7 +537,18 @@ async function settleIncludingRejections() {
     await new Promise((resolve) => setImmediate(resolve));
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });
@@ -1883,18 +1894,6 @@ describe("a closed approval window leaves the request pending", () => {
         return bg.actionPopups[bg.actionPopups.length - 1];
     }
 
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
     test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();

tests/backgroundStateIsolation.test.js

@@ -103,7 +103,18 @@ function deferred() {
     return { promise, resolve };
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/chainSwitchGate.test.js

@@ -56,7 +56,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerChainSwitch.test.js

@@ -64,7 +64,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerSendTransaction.test.js

@@ -76,7 +76,18 @@ async function settle() {
     for (let i = 0; i < 60; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/connectedSitesWorkerRestart.test.js

@@ -57,7 +57,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });

tests/deleteWalletLostPassword.test.js

@@ -102,6 +102,17 @@ function makeDocument() {
 
 // ------------------------------------------------------------ harness
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
+beforeEach(() => {
+    jest.useFakeTimers();
+});
+
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 function wallet(name, secret, addresses) {
     return {
         type: "hd",

tests/historyAfterNetworkSwitch.test.js

@@ -0,0 +1,498 @@
+// Home, AddressDetail and AddressToken drop a transaction history answer that
+// lands after a network switch. A dropped answer draws no rows and saves no
+// fraud contracts (https://git.eeqj.de/sneak/AutistMask/issues/657).
+//
+// Most tests hold the history request open, switch the network or what the
+// screen shows, and then let the answer land. The views run against a minimal
+// DOM stub, as in tests/transactionListCancelled.test.js, and over
+// tests/support/storageStub.js.
+
+const { makeStorageStub } = require("./support/storageStub");
+const { STATE_SCHEMA_VERSION } = require("../src/shared/stateSchema");
+
+jest.mock("../src/shared/transactions", () => ({
+    ...jest.requireActual("../src/shared/transactions"),
+    fetchRecentTransactions: jest.fn(async () => []),
+}));
+jest.mock("../src/shared/ens", () => ({
+    resolveEnsNames: jest.fn(async () => new Map()),
+}));
+
+const { fetchRecentTransactions } = require("../src/shared/transactions");
+const { resolveEnsNames } = require("../src/shared/ens");
+const { state, loadState } = require("../src/shared/state");
+const { onChainSwitch } = require("../src/shared/chainSwitch");
+const { applyChainSwitchFields } = require("../src/shared/chainSwitchFields");
+const { storedNetworkIs } = require("../src/shared/storedSettings");
+const home = require("../src/popup/views/home");
+const addressDetail = require("../src/popup/views/addressDetail");
+const addressToken = require("../src/popup/views/addressToken");
+
+const ADDRESS = "0x1111111111111111111111111111111111111111";
+const OTHER_ADDRESS = "0x2222222222222222222222222222222222222222";
+const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+// A contract that sends a token claiming USDT's symbol. Spotting the spoof
+// adds this contract to the fraud contracts.
+const SPOOF_CONTRACT = "0x3333333333333333333333333333333333333333";
+const TOKEN = "0x6B175474E89094C44Da98b954EedeAC495271d0F";
+
+// A profile on Ethereum Mainnet with two addresses, "Use Blockscout" on and no
+// fraud contracts.
+function profile() {
+    return {
+        schemaVersion: STATE_SCHEMA_VERSION,
+        hasWallet: true,
+        wallets: [
+            {
+                type: "hd",
+                name: "Main",
+                xpub: "xpub-main",
+                encryptedSecret: "encrypted-secret",
+                nextIndex: 2,
+                addresses: [
+                    { address: ADDRESS, balance: "1.0", tokenBalances: [] },
+                    {
+                        address: OTHER_ADDRESS,
+                        balance: "0.0",
+                        tokenBalances: [],
+                    },
+                ],
+            },
+        ],
+        activeAddress: ADDRESS,
+        networkId: "mainnet",
+        rpcUrl: "https://ethereum-rpc.publicnode.com",
+        blockscoutUrl: "https://eth.blockscout.com/api/v2",
+        useBlockscout: true,
+        fraudContracts: [],
+    };
+}
+
+// What Blockscout answers for ADDRESS on Ethereum Mainnet:
+//
+// - a transfer of ETH from ADDRESS;
+// - a transfer of the fake USDT from SPOOF_CONTRACT.
+function history() {
+    return [
+        {
+            hash: "0x85215772ed26ea8b39c2b3b18779030487efbe0b5fd7e882592b2f62b837be84",
+            blockNumber: 2,
+            from: ADDRESS,
+            to: RECIPIENT,
+            value: "1.0000",
+            exactValue: "1.0",
+            rawAmount: "1000000000000000000",
+            rawUnit: "wei",
+            symbol: "ETH",
+            timestamp: 1790000000,
+            isError: false,
+            directionLabel: "Sent",
+            direction: "sent",
+            contractAddress: null,
+        },
+        {
+            hash: "0x0d6a6e0a0d1b7d4c3b2a19087f6e5d4c3b2a19087f6e5d4c3b2a19087f6e5d4c",
+            blockNumber: 1,
+            from: SPOOF_CONTRACT,
+            to: ADDRESS,
+            value: "100.0000",
+            exactValue: "100.0",
+            rawAmount: "100000000",
+            rawUnit: "base units",
+            symbol: "USDT",
+            timestamp: 1790000000,
+            isError: false,
+            directionLabel: "Received",
+            direction: "received",
+            contractAddress: SPOOF_CONTRACT,
+        },
+    ];
+}
+
+// The next history request waits until the returned function is called, and
+// then answers with `answer`.
+function holdHistory(answer = history()) {
+    let land;
+    fetchRecentTransactions.mockImplementationOnce(
+        () =>
+            new Promise((resolve) => {
+                land = () => resolve(answer);
+            }),
+    );
+    return () => land();
+}
+
+// The next history request waits until the returned function is called, and
+// then fails.
+function holdFailure() {
+    let fail;
+    fetchRecentTransactions.mockImplementationOnce(
+        () =>
+            new Promise((resolve, reject) => {
+                fail = () => reject(new Error("Blockscout is down"));
+            }),
+    );
+    return () => fail();
+}
+
+// Another write holds the lock until the returned function is called. Every
+// save waits until then.
+function holdLock() {
+    let release;
+    const held = navigator.locks.request(
+        "autistmask",
+        () =>
+            new Promise((resolve) => {
+                release = resolve;
+            }),
+    );
+    return async () => {
+        release();
+        await held;
+    };
+}
+
+function makeElement(id) {
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        style: {},
+        dataset: {},
+        classList: {
+            add: () => {},
+            remove: () => {},
+            contains: () => false,
+            toggle: () => false,
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        addEventListener: () => {},
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// Lets every promise that is not held open settle.
+function settle() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+let storage;
+
+beforeEach(async () => {
+    storage = makeStorageStub({ autistmask: profile() });
+    globalThis.chrome = {
+        storage: { local: storage.local, onChanged: storage.onChanged },
+    };
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" } };
+    await loadState();
+    state.viewStack = [];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    state.selectedToken = "ETH";
+    const ctx = { pageClosed: new AbortController().signal };
+    addressDetail.init(ctx);
+    addressToken.init(ctx);
+});
+
+afterEach(() => {
+    delete globalThis.chrome;
+    delete globalThis.document;
+    delete globalThis.window;
+});
+
+const HOME = {
+    name: "Home",
+    listId: "home-tx-list",
+    open: () => home.render({ pageClosed: new AbortController().signal }),
+};
+const ADDRESS_DETAIL = {
+    name: "AddressDetail",
+    listId: "tx-list",
+    open: () => addressDetail.show(),
+};
+const ADDRESS_TOKEN = {
+    name: "AddressToken",
+    listId: "address-token-tx-list",
+    open: () => addressToken.show(),
+};
+
+// Three ways a test switches the network:
+//
+// - made in Settings: the page and storage have both switched;
+// - saved elsewhere: storage has switched and the page has not;
+// - not yet stored: the page has switched and storage has not.
+const SWITCHES = [
+    {
+        how: "made in Settings",
+        to: (networkId) => onChainSwitch(networkId),
+    },
+    {
+        // Another page or the background stored the switch, and this page has
+        // not followed it yet.
+        how: "saved elsewhere",
+        to: async (networkId) => {
+            const record = storage.read("autistmask");
+            applyChainSwitchFields(record, networkId);
+            storage.write("autistmask", record);
+        },
+    },
+    {
+        // The switch's own save has changed the page and has not yet written
+        // storage.
+        how: "not yet stored",
+        to: async (networkId) => {
+            applyChainSwitchFields(state, networkId);
+        },
+    },
+];
+
+// The list still shows `before`, and neither the page nor storage holds a
+// fraud contract.
+function expectNothingAdded(screen, before) {
+    expect(node(screen.listId).innerHTML).toBe(before);
+    expect(state.fraudContracts).toEqual([]);
+    expect(storage.read("autistmask").fraudContracts).toEqual([]);
+}
+
+describe.each([HOME, ADDRESS_DETAIL, ADDRESS_TOKEN])("$name", (screen) => {
+    test("an answer that lands on the same network is drawn and saved", async () => {
+        const land = holdHistory();
+        screen.open();
+        land();
+        await settle();
+
+        expect(node(screen.listId).innerHTML).toContain("tx-row");
+        expect(state.fraudContracts).toEqual([SPOOF_CONTRACT]);
+        expect(storage.read("autistmask").fraudContracts).toEqual([
+            SPOOF_CONTRACT,
+        ]);
+    });
+
+    test.each(SWITCHES)(
+        "an answer that lands after a switch $how adds nothing",
+        async ({ to }) => {
+            const land = holdHistory();
+            screen.open();
+            await settle();
+            const before = node(screen.listId).innerHTML;
+            await to("sepolia");
+            land();
+            await settle();
+
+            expectNothingAdded(screen, before);
+        },
+    );
+
+    // The answer is the transfer of ETH alone, which adds no fraud contract.
+    // Nothing is saved, so only the check before the save can drop the answer.
+    test.each(SWITCHES)(
+        "an answer without a fraud contract that lands after a switch $how adds nothing",
+        async ({ to }) => {
+            const land = holdHistory(history().slice(0, 1));
+            screen.open();
+            await settle();
+            const before = node(screen.listId).innerHTML;
+            await to("sepolia");
+            land();
+            await settle();
+
+            expectNothingAdded(screen, before);
+        },
+    );
+
+    test.each(SWITCHES)(
+        "a request that fails after a switch $how shows no message",
+        async ({ to }) => {
+            const fail = holdFailure();
+            screen.open();
+            await settle();
+            const before = node(screen.listId).innerHTML;
+            await to("sepolia");
+            fail();
+            await settle();
+
+            expect(node(screen.listId).innerHTML).toBe(before);
+        },
+    );
+
+    // The user picks Sepolia in Settings while another write holds the lock.
+    // The answer lands, and its save waits behind the switch.
+    test("an answer whose save waits behind a switch made in Settings adds nothing", async () => {
+        const land = holdHistory();
+        screen.open();
+        const before = node(screen.listId).innerHTML;
+        const releaseLock = holdLock();
+        const switching = onChainSwitch("sepolia");
+        land();
+        await settle();
+        await releaseLock();
+        await switching;
+        await settle();
+
+        expectNothingAdded(screen, before);
+    });
+
+    // The answer lands and its save waits for the lock. Another page or the
+    // background then stores a switch.
+    test("an answer whose save waits while a switch is saved elsewhere adds nothing", async () => {
+        const land = holdHistory();
+        screen.open();
+        const before = node(screen.listId).innerHTML;
+        const releaseLock = holdLock();
+        land();
+        await settle();
+        const record = storage.read("autistmask");
+        applyChainSwitchFields(record, "sepolia");
+        storage.write("autistmask", record);
+        await releaseLock();
+        await settle();
+
+        expectNothingAdded(screen, before);
+    });
+
+    // The answer lands and its save waits for the lock. The page then switches,
+    // and storage has not.
+    test("an answer whose save waits while the page switches adds nothing", async () => {
+        const land = holdHistory();
+        screen.open();
+        const before = node(screen.listId).innerHTML;
+        const releaseLock = holdLock();
+        land();
+        await settle();
+        applyChainSwitchFields(state, "sepolia");
+        await releaseLock();
+        await settle();
+
+        expectNothingAdded(screen, before);
+    });
+
+    test("a request that fails after a switch leaves the new network's rows", async () => {
+        const fail = holdFailure();
+        screen.open();
+        await onChainSwitch("sepolia");
+        fetchRecentTransactions.mockImplementationOnce(async () => history());
+        screen.open();
+        await settle();
+        const drawn = node(screen.listId).innerHTML;
+        fail();
+        await settle();
+
+        expect(drawn).toContain("tx-row");
+        expect(node(screen.listId).innerHTML).toBe(drawn);
+    });
+});
+
+describe.each([ADDRESS_DETAIL, ADDRESS_TOKEN])("$name", (screen) => {
+    test("an answer that lands once the screen shows another address adds nothing", async () => {
+        const land = holdHistory();
+        screen.open();
+        state.selectedAddress = 1;
+        screen.open();
+        await settle();
+        const before = node(screen.listId).innerHTML;
+        land();
+        await settle();
+
+        expectNothingAdded(screen, before);
+    });
+
+    test("a request that fails once the screen shows another address shows no message", async () => {
+        const fail = holdFailure();
+        screen.open();
+        state.selectedAddress = 1;
+        screen.open();
+        await settle();
+        const before = node(screen.listId).innerHTML;
+        fail();
+        await settle();
+
+        expect(node(screen.listId).innerHTML).toBe(before);
+    });
+
+    // The answer is the transfer of ETH alone, which adds no fraud contract.
+    // Nothing is saved, so only the check after the name lookup can drop the
+    // answer.
+    test("an answer whose name lookup lands after a switch adds nothing", async () => {
+        let landNames;
+        resolveEnsNames.mockImplementationOnce(
+            () =>
+                new Promise((resolve) => {
+                    landNames = () => resolve(new Map());
+                }),
+        );
+        fetchRecentTransactions.mockImplementationOnce(async () =>
+            history().slice(0, 1),
+        );
+        screen.open();
+        await settle();
+        const before = node(screen.listId).innerHTML;
+        await onChainSwitch("sepolia");
+        landNames();
+        await settle();
+
+        expectNothingAdded(screen, before);
+    });
+});
+
+test("AddressToken: an answer that lands once the screen shows another token adds nothing", async () => {
+    const land = holdHistory();
+    addressToken.show();
+    state.selectedToken = TOKEN;
+    addressToken.show();
+    await settle();
+    const before = node(ADDRESS_TOKEN.listId).innerHTML;
+    land();
+    await settle();
+
+    expectNothingAdded(ADDRESS_TOKEN, before);
+});
+
+test("AddressToken: a request that fails once the screen shows another token shows no message", async () => {
+    const fail = holdFailure();
+    addressToken.show();
+    state.selectedToken = TOKEN;
+    addressToken.show();
+    await settle();
+    const before = node(ADDRESS_TOKEN.listId).innerHTML;
+    fail();
+    await settle();
+
+    expect(node(ADDRESS_TOKEN.listId).innerHTML).toBe(before);
+});
+
+test("storedNetworkIs(): a failed read counts as no", async () => {
+    globalThis.chrome.storage.local = {
+        get: async () => {
+            throw new Error("storage is down");
+        },
+    };
+
+    await expect(storedNetworkIs("mainnet")).resolves.toBe(false);
+});

tests/sendAmountRule.test.js

@@ -131,10 +131,14 @@ async function review(amount, token) {
 async function confirm(amount, token) {
     const txInfo = await review("0.5", token);
     confirmTx.show({ ...txInfo, amount });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     state.wallets = [
         {
@@ -167,6 +171,10 @@ beforeEach(() => {
     state.currentView = null;
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe.each([
     ["1e-3", "ETH"],
     ["1e-3", "TOK"],

tests/sendMax.test.js

@@ -277,14 +277,18 @@ async function review() {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 function canSend() {
     return !el("btn-confirm-send").disabled;
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     log.errorf.mockClear();
     pageClosed = new AbortController();
@@ -297,6 +301,10 @@ beforeEach(() => {
     mockNode.broadcast = [];
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe("Max on an ETH send", () => {
     test("fills in the exact balance minus the fee reserve", async () => {
         await refreshWith(BALANCE_WEI);

tests/settingsEndpointSave.test.js

@@ -167,3 +167,272 @@ test.each([
         );
     },
 );
+
+// This answer passes both endpoint checks on Ethereum Mainnet.
+const PASSING_ANSWER = {
+    ok: true,
+    json: async () => ({ result: NETWORKS.mainnet.chainId }),
+};
+
+// Both endpoint checks read this answer as an error. The RPC check reads the
+// answer's `error`. The Blockscout check reads the answer's `ok`.
+const ERROR_ANSWER = {
+    ok: false,
+    status: 500,
+    json: async () => ({ error: { code: -32603, message: "Internal error" } }),
+};
+
+// The user types a URL in Settings and taps "Save". Before the endpoint answers,
+// the user types a second URL and taps "Save" again. The second check passes
+// first. The second URL is stored, and the flash message reads "Saved.". The
+// first check then ends in one of three ways:
+//
+// - It passes.
+// - It fails, because fetch cannot reach the endpoint.
+// - It gets an answer that holds an error.
+//
+// None of the three changes the stored URL or the flash message
+// (https://git.eeqj.de/sneak/AutistMask/issues/698).
+test.each([
+    {
+        button: "btn-save-rpc",
+        input: "settings-rpc",
+        field: "rpcUrl",
+        first: "passes",
+    },
+    {
+        button: "btn-save-rpc",
+        input: "settings-rpc",
+        field: "rpcUrl",
+        first: "fails",
+    },
+    {
+        button: "btn-save-rpc",
+        input: "settings-rpc",
+        field: "rpcUrl",
+        first: "answers with an error",
+    },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+        first: "passes",
+    },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+        first: "fails",
+    },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+        first: "answers with an error",
+    },
+])(
+    "$button keeps the second tap's result when the first check $first last",
+    async ({ button, input, field, first }) => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        const checks = [];
+        globalThis.fetch.mockImplementation(
+            () =>
+                new Promise((resolve, reject) => {
+                    checks.push({ resolve, reject });
+                }),
+        );
+        const secondUrl = "https://second.example.invalid";
+
+        page.node(input).value = "https://first.example.invalid";
+        const firstTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        page.node(input).value = secondUrl;
+        const secondTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        checks[1].resolve(PASSING_ANSWER);
+        await Promise.all(secondTap);
+        await page.settle();
+        expect(page.text("flash-msg")).toBe("Saved.");
+        if (first === "passes") {
+            checks[0].resolve(PASSING_ANSWER);
+        } else if (first === "answers with an error") {
+            checks[0].resolve(ERROR_ANSWER);
+        } else {
+            // fetch rejects when it cannot reach the endpoint.
+            checks[0].reject(new TypeError("Failed to fetch"));
+        }
+        await Promise.all(firstTap);
+        await page.settle();
+
+        expect(checks).toHaveLength(2);
+        expect(page.storage.read("autistmask")[field]).toBe(secondUrl);
+        expect(page.text("flash-msg")).toBe("Saved.");
+    },
+);
+
+// The user types a URL in Settings and taps "Save". Before the endpoint answers,
+// the user empties the input and taps "Save" again. The flash message asks for
+// a URL. The first check then passes. The flash message still asks for a URL,
+// and the stored URL is unchanged.
+test.each([
+    {
+        button: "btn-save-rpc",
+        input: "settings-rpc",
+        field: "rpcUrl",
+        message: "Please enter an RPC URL.",
+    },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+        message: "Please enter a Blockscout API URL.",
+    },
+])(
+    "$button keeps the empty-input message when the first check passes last",
+    async ({ button, input, field, message }) => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        const storedUrl = page.value(input);
+        let answer;
+        globalThis.fetch.mockReturnValue(
+            new Promise((resolve) => {
+                answer = resolve;
+            }),
+        );
+
+        page.node(input).value = "https://typed.example.invalid";
+        const firstTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        page.node(input).value = "";
+        await page.click(button);
+        expect(page.text("flash-msg")).toBe(message);
+        answer(PASSING_ANSWER);
+        await Promise.all(firstTap);
+        await page.settle();
+
+        expect(page.storage.read("autistmask")[field]).toBe(storedUrl);
+        expect(page.text("flash-msg")).toBe(message);
+    },
+);
+
+// The user types a URL in Settings and taps "Save". Another write holds the
+// lock. So the save waits for the lock once the check passes. The user then
+// taps "Save" again on the same URL. When the lock is free, the first save
+// stores nothing and shows no flash message. The second check then passes, and
+// the second save stores the URL.
+test.each([
+    { button: "btn-save-rpc", input: "settings-rpc", field: "rpcUrl" },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+    },
+])(
+    "$button stores nothing for an earlier tap still waiting for the lock",
+    async ({ button, input, field }) => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        const storedUrl = page.value(input);
+        const checks = [];
+        globalThis.fetch.mockImplementation(
+            () =>
+                new Promise((resolve) => {
+                    checks.push(resolve);
+                }),
+        );
+        const typedUrl = "https://typed.example.invalid";
+
+        page.node(input).value = typedUrl;
+        const firstTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        let releaseLock;
+        const lockHeld = navigator.locks.request(
+            "autistmask",
+            () =>
+                new Promise((resolve) => {
+                    releaseLock = resolve;
+                }),
+        );
+        checks[0](PASSING_ANSWER);
+        await page.settle();
+        const secondTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        releaseLock();
+        await lockHeld;
+        await Promise.all(firstTap);
+        await page.settle();
+
+        expect(page.storage.read("autistmask")[field]).toBe(storedUrl);
+        expect(page.text("flash-msg")).toBe("Testing endpoint...");
+
+        checks[1](PASSING_ANSWER);
+        await Promise.all(secondTap);
+        await page.settle();
+
+        expect(checks).toHaveLength(2);
+        expect(page.storage.read("autistmask")[field]).toBe(typedUrl);
+        expect(page.text("flash-msg")).toBe("Saved.");
+    },
+);
+
+// The user taps "Save", and the check passes. The save then begins its storage
+// write, and this test keeps the write waiting. The user taps "Save" again, and
+// the second check cannot reach the endpoint. When the write ends, the flash
+// message still reads "Could not reach endpoint.". The write stores the URL
+// anyway, because the write began before the second tap.
+test.each([
+    { button: "btn-save-rpc", input: "settings-rpc", field: "rpcUrl" },
+    {
+        button: "btn-save-blockscout",
+        input: "settings-blockscout",
+        field: "blockscoutUrl",
+    },
+])(
+    "$button keeps the second tap's message when tapped again during the write",
+    async ({ button, input, field }) => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        const checks = [];
+        globalThis.fetch.mockImplementation(
+            () =>
+                new Promise((resolve, reject) => {
+                    checks.push({ resolve, reject });
+                }),
+        );
+        const typedUrl = "https://typed.example.invalid";
+
+        page.node(input).value = typedUrl;
+        const firstTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        const { set } = page.storage.local;
+        const write = set.getMockImplementation();
+        let writeBegan = false;
+        let releaseWrite;
+        const writeHeld = new Promise((resolve) => {
+            releaseWrite = resolve;
+        });
+        set.mockImplementationOnce(async (items) => {
+            writeBegan = true;
+            await writeHeld;
+            await write(items);
+        });
+        checks[0].resolve(PASSING_ANSWER);
+        await page.settle();
+        expect(writeBegan).toBe(true);
+        const secondTap = page.node(button).listeners.click.map((fn) => fn());
+        await page.settle();
+        // fetch rejects when it cannot reach the endpoint.
+        checks[1].reject(new TypeError("Failed to fetch"));
+        await Promise.all(secondTap);
+        await page.settle();
+        expect(page.text("flash-msg")).toBe("Could not reach endpoint.");
+        releaseWrite();
+        await Promise.all(firstTap);
+        await page.settle();
+
+        expect(checks).toHaveLength(2);
+        expect(page.storage.read("autistmask")[field]).toBe(typedUrl);
+        expect(page.text("flash-msg")).toBe("Could not reach endpoint.");
+    },
+);

tests/spoofedTrackedToken.test.js

@@ -0,0 +1,91 @@
+// A token that the spoof rule refuses never shows in the balance list, even
+// tracked at zero balance with "Show tracked tokens with zero balance" on, and
+// the two add-token screens refuse to track one
+// (https://git.eeqj.de/sneak/AutistMask/issues/705). Driven through the real
+// popup over a stored profile.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+
+// Claims the symbol of the bundled USDT from another contract.
+const FAKE_USDT = {
+    address: TOKEN_ADDRESS,
+    symbol: "USDT",
+    decimals: 6,
+    name: "Tether USD",
+};
+// A symbol the bundled list does not have, so the spoof rule passes it.
+const TEST_TOKEN = {
+    address: "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+const REFUSED_FLASH = "Not added: this token fakes a known symbol.";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+test("a fake token tracked at zero balance is not listed while zero balances are shown", async () => {
+    const boot = await bootPopup(
+        unversionedValidProfile({
+            currentView: "address",
+            selectedWallet: 0,
+            selectedAddress: 0,
+            trackedTokens: [FAKE_USDT, TEST_TOKEN],
+            showZeroBalanceTokens: true,
+        }),
+    );
+    const rows = boot.node("address-balances").innerHTML;
+    expect(rows).toContain(`data-token="${TEST_TOKEN.address.toLowerCase()}"`);
+    expect(rows).not.toContain(
+        `data-token="${FAKE_USDT.address.toLowerCase()}"`,
+    );
+});
+
+// Each screen is opened from AddressDetail by the buttons named, in order.
+describe.each([
+    [
+        "AddToken",
+        ["btn-add-token"],
+        "add-token",
+        "add-token-address",
+        "btn-add-token-confirm",
+    ],
+    [
+        "SettingsAddToken",
+        ["btn-settings", "btn-settings-add-token"],
+        "settings-addtoken",
+        "settings-addtoken-address",
+        "btn-settings-addtoken-manual",
+    ],
+])("%s", (_, opening, view, field, button) => {
+    test("refuses a fake token by contract address", async () => {
+        const boot = await bootPopup(
+            unversionedValidProfile({
+                currentView: "address",
+                selectedWallet: 0,
+                selectedAddress: 0,
+            }),
+        );
+        for (const id of opening) await boot.click(id);
+        expect(boot.visibleViews()).toEqual([view]);
+        const { lookupTokenInfo } = require("../src/shared/balances");
+        lookupTokenInfo.mockResolvedValueOnce({
+            symbol: FAKE_USDT.symbol,
+            decimals: FAKE_USDT.decimals,
+            name: FAKE_USDT.name,
+        });
+        boot.node(field).value = FAKE_USDT.address;
+
+        await boot.click(button);
+        expect(boot.text("flash-msg")).toBe(REFUSED_FLASH);
+        expect(boot.visibleViews()).toEqual([view]);
+        expect(boot.storage.read("autistmask").trackedTokens).toEqual([]);
+    });
+});

tests/trackedTokensPerNetwork.test.js

@@ -257,7 +257,6 @@ test("a token tracked on Sepolia when another page switched there is not tracked
         ...boot.storage.read("autistmask"),
         networkId: "sepolia",
         trackedTokens: [SEPOLIA_TOKEN],
-        networkTrackedTokens: { mainnet: [] },
     });
 
     await chooseNetwork(boot, "sepolia");
@@ -268,140 +267,6 @@ test("a token tracked on Sepolia when another page switched there is not tracked
     expect(stored.networkTrackedTokens.mainnet).toEqual([]);
 });
 
-// Another popup page saves a switch to Sepolia, where TST is tracked. Before
-// taking that switch, this page adds a token on Ethereum Mainnet. The add's
-// save adds the token to Ethereum Mainnet's list and leaves Sepolia's list as
-// it was.
-test("a token added before this page takes another page's switch is tracked on Ethereum Mainnet", async () => {
-    const boot = await bootOnAddToken("mainnet", {
-        trackedTokens: [MAINNET_TOKEN],
-        networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
-    });
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [SEPOLIA_TOKEN],
-        networkTrackedTokens: {
-            mainnet: [MAINNET_TOKEN],
-            sepolia: [SEPOLIA_TOKEN],
-        },
-    });
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-
-    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
-    await boot.click("btn-settings-addtoken-manual");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([SEPOLIA_TOKEN]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([
-        MAINNET_TOKEN,
-        {
-            address: NEW_TOKEN_ADDRESS,
-            symbol: "NEW",
-            decimals: 18,
-            name: "New Token",
-        },
-    ]);
-});
-
-// Another popup page tracks DAI on Ethereum Mainnet and then saves a switch to
-// Sepolia. This page does not track DAI. Before taking that switch, this page
-// adds a token on Ethereum Mainnet. The add's save puts both DAI and the new
-// token on Ethereum Mainnet's list.
-test("a token added before this page takes another page's switch joins that page's tokens on Ethereum Mainnet", async () => {
-    const boot = await bootOnAddToken("mainnet");
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [],
-        networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
-    });
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-
-    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
-    await boot.click("btn-settings-addtoken-manual");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([
-        MAINNET_TOKEN,
-        {
-            address: NEW_TOKEN_ADDRESS,
-            symbol: "NEW",
-            decimals: 18,
-            name: "New Token",
-        },
-    ]);
-});
-
-// Another popup page saves a switch to Sepolia, where TST is tracked. Before
-// taking that switch, this page removes DAI on Ethereum Mainnet, as the `[x]`
-// on a tracked token in Settings does. The removal's save drops DAI from
-// Ethereum Mainnet's list and leaves Sepolia's list as it was.
-test("a token removed before this page takes another page's switch is gone from Ethereum Mainnet", async () => {
-    const boot = await bootPopup(
-        unversionedValidProfile({
-            trackedTokens: [MAINNET_TOKEN],
-            networkTrackedTokens: { sepolia: [SEPOLIA_TOKEN] },
-        }),
-    );
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [SEPOLIA_TOKEN],
-        networkTrackedTokens: {
-            mainnet: [MAINNET_TOKEN],
-            sepolia: [SEPOLIA_TOKEN],
-        },
-    });
-
-    const { state, saveState } = require("../src/shared/state");
-    state.trackedTokens.splice(0, 1);
-    await saveState();
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([SEPOLIA_TOKEN]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([]);
-});
-
-// Another popup page tracks DAI on Ethereum Mainnet and then saves a switch to
-// Sepolia. That switch puts DAI away under Ethereum Mainnet. This page has not
-// taken the switch yet. A switch to Sepolia in this page's Settings keeps DAI
-// on Ethereum Mainnet's list.
-test("a token another page tracked before its own switch stays tracked on Ethereum Mainnet", async () => {
-    const boot = await bootPopup(unversionedValidProfile());
-    expect(boot.pageErrors).toEqual([]);
-    await boot.click("btn-settings");
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [],
-        networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
-    });
-
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.networkTrackedTokens.mainnet).toEqual([MAINNET_TOKEN]);
-});
-
 // Another popup page records a fraud contract on Ethereum Mainnet after this
 // page's last save. The switch to Sepolia drops that fraud contract, as the
 // switch drops this page's own.
@@ -473,120 +338,6 @@ test("a token added while a switch in Settings waits for the lock stays tracked
     ]);
 });
 
-// The contract lookup on SettingsAddToken answers on Ethereum Mainnet while
-// this page's switch to Sepolia waits for the lock. Another popup page holds
-// the lock and stores its own switch to Sepolia, with DAI tracked on Ethereum
-// Mainnet. This page's switch keeps DAI and the new token on Ethereum Mainnet's
-// list.
-test("a token added while a switch in Settings waits for another page's switch stays tracked on Ethereum Mainnet", async () => {
-    const boot = await bootOnAddToken("mainnet");
-    expect(boot.pageErrors).toEqual([]);
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    let answer;
-    lookupTokenInfo.mockImplementationOnce(
-        () =>
-            new Promise((resolve) => {
-                answer = resolve;
-            }),
-    );
-    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
-    const adding = boot.click("btn-settings-addtoken-manual");
-    await boot.click("btn-settings");
-
-    let releaseLock;
-    const lockHeld = navigator.locks.request(
-        "autistmask",
-        () =>
-            new Promise((resolve) => {
-                releaseLock = resolve;
-            }),
-    );
-    const select = boot.node("settings-network");
-    select.value = "sepolia";
-    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
-    await boot.settle();
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [],
-        networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
-    });
-
-    answer({ symbol: "NEW", decimals: 18, name: "New Token" });
-    await boot.settle();
-    releaseLock();
-    await lockHeld;
-    await switching;
-    await adding;
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([
-        MAINNET_TOKEN,
-        {
-            address: NEW_TOKEN_ADDRESS,
-            symbol: "NEW",
-            decimals: 18,
-            name: "New Token",
-        },
-    ]);
-});
-
-// Another popup page holds the lock and stores its switch to Sepolia, with DAI
-// tracked on Ethereum Mainnet. This page waits for the lock to take that
-// switch. Meanwhile, the contract lookup on SettingsAddToken answers on
-// Ethereum Mainnet. When this page takes that switch, DAI and the new token
-// stay on Ethereum Mainnet's list.
-test("a token added while this page waits to take another page's switch stays tracked on Ethereum Mainnet", async () => {
-    const boot = await bootOnAddToken("mainnet");
-    expect(boot.pageErrors).toEqual([]);
-    let releaseLock;
-    const lockHeld = navigator.locks.request(
-        "autistmask",
-        () =>
-            new Promise((resolve) => {
-                releaseLock = resolve;
-            }),
-    );
-    await boot.storage.local.set({
-        autistmask: {
-            ...boot.storage.read("autistmask"),
-            networkId: "sepolia",
-            trackedTokens: [],
-            networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
-        },
-    });
-    await boot.settle();
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-
-    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
-    const adding = boot.click("btn-settings-addtoken-manual");
-    await boot.settle();
-    releaseLock();
-    await lockHeld;
-    await adding;
-    await boot.settle();
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([
-        MAINNET_TOKEN,
-        {
-            address: NEW_TOKEN_ADDRESS,
-            symbol: "NEW",
-            decimals: 18,
-            name: "New Token",
-        },
-    ]);
-});
-
 describe("Back after a switch from the Settings gear", () => {
     test("SettingsAddToken no longer offers the common tokens", async () => {
         const boot = await bootOnAddToken("mainnet");

tests/walletDefects.test.js

@@ -357,6 +357,11 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     beforeEach(() => {
+        // showFlash() starts a timer that clears the message two seconds
+        // later. Each test here runs on fake timers and drops them in
+        // afterEach, so that timer never outlives the test.
+        jest.useFakeTimers();
+
         const broken = brokenXprvWallet();
         // A balance, so that no Send button's zero-balance refusal can stand
         // in for the defect check.
@@ -398,6 +403,7 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     afterEach(() => {
+        jest.useRealTimers();
         state.wallets = [];
         state.activeAddress = null;
         state.selectedWallet = null;