Compare commits
1 Commits
6114afbeea
...
fix/55-swa
| Author | SHA1 | Date | |
|---|---|---|---|
|
868f7a6ff8 |
@@ -1,3 +1,4 @@
|
||||
.git
|
||||
node_modules
|
||||
.DS_Store
|
||||
dist
|
||||
|
||||
@@ -6,4 +6,4 @@ jobs:
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/cibuild
|
||||
- run: docker build .
|
||||
|
||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -25,4 +25,3 @@ dist/
|
||||
|
||||
# Yarn
|
||||
.yarn-integrity
|
||||
package-lock.json
|
||||
|
||||
10
Dockerfile
10
Dockerfile
@@ -1,15 +1,13 @@
|
||||
# node:22-slim (22.x LTS), 2026-02-24
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
|
||||
RUN corepack enable && corepack prepare yarn@1.22.22 --activate
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# script/bootstrap installs all prerequisites (make via apt here; node
|
||||
# is already in the base image, yarn comes via corepack) and runs
|
||||
# yarn install --frozen-lockfile. Dependency manifests are copied first
|
||||
# so the bootstrap layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
RUN yarn install --frozen-lockfile
|
||||
|
||||
COPY . .
|
||||
|
||||
|
||||
107
LICENSE
107
LICENSE
@@ -672,110 +672,3 @@ may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
||||
|
||||
===========================================================================
|
||||
THIRD-PARTY FILES
|
||||
===========================================================================
|
||||
|
||||
The following files are not original to this project and are distributed
|
||||
under their own licenses. They are NOT covered by the GPL-3.0 license above.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/phishingBlocklist.json
|
||||
Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
|
||||
Copyright: Copyright (c) 2018 kumavis
|
||||
License: Don't Be a Dick Public License (DBAD), Version 1.2
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
DON'T BE A DICK PUBLIC LICENSE
|
||||
|
||||
Version 1.2, February 2021
|
||||
|
||||
Copyright (C) 2018 kumavis
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim or modified
|
||||
copies of this license document.
|
||||
|
||||
DON'T BE A DICK PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
1. Do whatever you like with the original work, just don't be a dick.
|
||||
|
||||
Being a dick includes - but is not limited to - the following instances:
|
||||
|
||||
1a. Outright copyright infringement - Don't just copy the original
|
||||
work/works and change the name.
|
||||
1b. Selling the unmodified original with no work done what-so-ever,
|
||||
that's REALLY being a dick.
|
||||
1c. Modifying the original work to contain hidden harmful content.
|
||||
That would make you a PROPER dick.
|
||||
|
||||
2. If you become rich through modifications, related works/services, or
|
||||
supporting the original work, share the love. Only a dick would make
|
||||
loads off this work and not buy the original work's creator(s) a pint.
|
||||
|
||||
3. Code is provided with no warranty. Using somebody else's code and
|
||||
bitching when it goes wrong makes you a DONKEY dick. Fix the problem
|
||||
yourself. A non-dick would submit the fix back or submit a bug report.
|
||||
|
||||
4. If you use code, calling it your own would make you a ROYAL dick.
|
||||
Alternatively, even just a comment giving attribution to where you found
|
||||
the code would be OK.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/scamlist.js (address data from MyEtherWallet ethereum-lists)
|
||||
Source: https://github.com/MyEtherWallet/ethereum-lists (addresses-darklist.json)
|
||||
Copyright: Copyright (c) 2020 MyEtherWallet
|
||||
License: MIT License
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2020 MyEtherWallet
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/scamlist.js (address data from EtherScamDB)
|
||||
Source: https://github.com/MrLuit/EtherScamDB (scams.yaml)
|
||||
Copyright: Copyright (c) 2018 Luit Hollander
|
||||
License: MIT License
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2018 Luit Hollander
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
63
Makefile
63
Makefile
@@ -1,60 +1,29 @@
|
||||
.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
|
||||
|
||||
# Standard targets are thin shims; the implementations live in script/
|
||||
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
||||
# of README.md).
|
||||
|
||||
bootstrap:
|
||||
@script/bootstrap
|
||||
|
||||
setup:
|
||||
@script/setup
|
||||
.PHONY: install test lint fmt fmt-check check docker hooks build clean dev
|
||||
|
||||
install:
|
||||
@yarn install
|
||||
|
||||
test:
|
||||
@script/test
|
||||
|
||||
# Browser end-to-end suite. Requires docker; not part of check.
|
||||
test-e2e:
|
||||
@script/test-e2e
|
||||
@echo "Running tests..."
|
||||
@timeout 30 yarn run test 2>&1
|
||||
|
||||
lint:
|
||||
@script/lint
|
||||
@echo "Linting..."
|
||||
@yarn run lint 2>&1
|
||||
|
||||
fmt:
|
||||
@script/fmt
|
||||
@echo "Formatting..."
|
||||
@yarn run fmt 2>&1
|
||||
|
||||
fmt-check:
|
||||
@script/fmt-check
|
||||
@echo "Checking formatting..."
|
||||
@yarn run fmt-check 2>&1
|
||||
|
||||
check:
|
||||
@script/check
|
||||
|
||||
docker:
|
||||
@script/docker
|
||||
|
||||
hooks:
|
||||
@script/install-precommit
|
||||
check: test lint fmt-check
|
||||
|
||||
build:
|
||||
@echo "Building extension..."
|
||||
@yarn run build 2>&1
|
||||
@script/verify-build
|
||||
|
||||
# Development-only build: enables the red DEBUG / INSECURE banner and makes
|
||||
# the hardcoded test recovery phrase the output of wallet creation. Never
|
||||
# distribute the artifacts this produces.
|
||||
build-debug:
|
||||
@echo "Building extension (DEBUG)..."
|
||||
@AUTISTMASK_DEBUG=1 yarn run build 2>&1
|
||||
@AUTISTMASK_DEBUG=1 script/verify-build
|
||||
|
||||
# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
|
||||
# the end of build and build-debug; separate target for re-running it alone.
|
||||
verify-build:
|
||||
@script/verify-build
|
||||
|
||||
clean:
|
||||
@rm -rf dist/
|
||||
@@ -62,3 +31,15 @@ clean:
|
||||
dev:
|
||||
@echo "Building in watch mode..."
|
||||
@yarn run build --watch 2>&1
|
||||
|
||||
docker:
|
||||
@docker build -t autistmask .
|
||||
|
||||
hooks:
|
||||
@echo "Installing pre-commit hook..."
|
||||
@mkdir -p .git/hooks
|
||||
@echo '#!/usr/bin/env bash' > .git/hooks/pre-commit
|
||||
@echo 'set -euo pipefail' >> .git/hooks/pre-commit
|
||||
@echo 'make check' >> .git/hooks/pre-commit
|
||||
@chmod +x .git/hooks/pre-commit
|
||||
@echo "Pre-commit hook installed."
|
||||
|
||||
629
README.md
629
README.md
@@ -15,12 +15,10 @@ Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
|
||||
Everything you need, nothing you don't. We import as few libraries as possible,
|
||||
don't implement any crypto, and don't send user-specific data anywhere but a
|
||||
(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
|
||||
extension contacts three user-configurable services: the configured RPC node for
|
||||
extension contacts exactly three external services: the configured RPC node for
|
||||
blockchain interactions, a public CoinDesk API (no API key) for realtime price
|
||||
information, and a Blockscout block-explorer API for transaction history and
|
||||
token balances. It also fetches a community-maintained phishing domain blocklist
|
||||
periodically and performs best-effort Etherscan address label lookups during
|
||||
transaction confirmation.
|
||||
token balances. All three endpoints are user-configurable.
|
||||
|
||||
In the extension is a hardcoded list of the top ERC20 contract addresses. You
|
||||
can add any ERC20 contract by contract address if you wish, but the hardcoded
|
||||
@@ -42,121 +40,6 @@ Load the extension:
|
||||
- **Firefox**: Navigate to `about:debugging#/runtime/this-firefox`, click "Load
|
||||
Temporary Add-on", and select `dist/firefox/manifest.json`.
|
||||
|
||||
### Debug Builds
|
||||
|
||||
`make build` always produces a release build: the build-time `DEBUG` constant is
|
||||
`false`, so wallet creation uses real entropy and the red banner is off. To
|
||||
produce a debug build instead, set `AUTISTMASK_DEBUG=1` in the environment:
|
||||
|
||||
```bash
|
||||
make build-debug # or: AUTISTMASK_DEBUG=1 make build
|
||||
```
|
||||
|
||||
Only the exact value `1` enables it; any other value (including unset, empty, or
|
||||
`true`) yields a release build, so a typo cannot accidentally ship the debug
|
||||
behavior. The build prints which mode it used. See the
|
||||
[DEBUG Mode Policy](#debug-mode-policy) for what the flag changes. **Never
|
||||
distribute a debug build** — every wallet it creates gets the same publicly
|
||||
known test recovery phrase.
|
||||
|
||||
Both builds end by running `script/verify-build`, which reads the compiled
|
||||
`DEBUG` state back out of the emitted bundles and fails the build if it is not
|
||||
the one that was asked for. The test suite cannot check this: it loads
|
||||
`src/shared/constants.js` outside a bundle, so it only ever sees the fallback
|
||||
value. The assertion is on the artifacts because that is where the property
|
||||
lives.
|
||||
|
||||
## Entrypoints
|
||||
|
||||
This repository adheres to the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
standard: normalized scripts in `script/` are the entrypoints for the
|
||||
development workflow, and the Makefile targets are thin shims that call them. We
|
||||
provide:
|
||||
|
||||
- `script/bootstrap` — install all dependencies (pinned node via nvm if needed,
|
||||
yarn via corepack, `yarn install --frozen-lockfile`)
|
||||
- `script/setup` — make a fresh clone ready for development: bootstrap plus the
|
||||
git pre-commit hook
|
||||
- `script/projectname` — print the project name (used for the Docker image tag)
|
||||
- `script/test` — run the test suite (jest)
|
||||
- `script/test-e2e` — run the browser end-to-end suite (docker required; see
|
||||
[End-to-End Tests](#end-to-end-tests))
|
||||
- `script/lint` — run the linter
|
||||
- `script/fmt` — format all files (writes)
|
||||
- `script/fmt-check` — check formatting (read-only)
|
||||
- `script/check` — run test, lint, and fmt-check
|
||||
- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
|
||||
`dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
|
||||
off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
|
||||
`make build` and `make build-debug`; fails loudly rather than passing if it
|
||||
cannot determine a bundle's state. Not part of `make check`, which does not
|
||||
depend on build artifacts existing.
|
||||
- `script/docker` — build the Docker image tagged via `script/projectname`
|
||||
- `script/cibuild` — CI entrypoint: plain `docker build .`
|
||||
- `script/precommit` — run by the git pre-commit hook; runs `script/check`
|
||||
- `script/install-precommit` — install the git pre-commit hook
|
||||
|
||||
## End-to-End Tests
|
||||
|
||||
`make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
|
||||
Chrome**, loaded as an unpacked MV3 extension inside a pinned
|
||||
`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
|
||||
docker is required and the suite fails loudly rather than skipping if it is
|
||||
unavailable). The suite lives in `tests/e2e/` and is driven by
|
||||
`playwright-core`, whose version must stay matched to the container's Playwright
|
||||
version — the browsers ship inside the image.
|
||||
|
||||
It covers popup load, wallet creation through the UI, the Add Token screen and
|
||||
the transaction detail screen for an ERC-20 transfer. All outbound network is
|
||||
intercepted at the browser level and served from fixtures in
|
||||
`tests/e2e/network.js`, so the run is deterministic and fully offline;
|
||||
unrecognised outbound requests are reported as failures rather than silently
|
||||
allowed.
|
||||
|
||||
That reporting has one bound worth knowing. Observation ends when the browser
|
||||
context is torn down, and nothing can watch traffic after that, so the run keeps
|
||||
collecting for a fixed grace period after the last test returns
|
||||
(`TRAILING_WATCH_MS` in `tests/e2e/run.js`, currently 1500ms) and then closes
|
||||
the context. A request whose _first_ dispatch falls after that window is never
|
||||
seen at all and cannot fail the run. In practice a request a test fires without
|
||||
awaiting reaches the route handler about 10ms later, and anything on a repeating
|
||||
timer gets observed on an earlier tick during the ~20s suite — but a one-shot
|
||||
call deliberately deferred past the window will escape.
|
||||
|
||||
That interception covers the MV3 background service worker as well as the popup
|
||||
page, which it does not by default — `script/test-e2e` sets
|
||||
`PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
|
||||
experimental, the harness does not take it on trust. At launch it waits for the
|
||||
background worker's **own** startup request — the phishing blocklist fetch that
|
||||
`src/background/index.js` issues unconditionally — to arrive in the route
|
||||
handler, and aborts the entire suite if none does within 30 seconds
|
||||
(`tests/e2e/harness.js`). The check is passive on purpose: a synthetic probe
|
||||
fetched from inside the worker via `worker.evaluate()` was tried first and
|
||||
rejected, because evaluating in an extension service worker that early kills the
|
||||
worker outright, destroying the thing being measured. Observing traffic the
|
||||
extension already generates perturbs nothing. Losing the race fails closed — the
|
||||
suite refuses to run rather than passing quietly.
|
||||
|
||||
As defence in depth, Chrome is also started with
|
||||
`--host-resolver-rules=MAP * ~NOTFOUND`, so a request that ever did slip past
|
||||
the route handler could not resolve a host at all. That only bounds the damage;
|
||||
detecting escaping traffic remains the canary's job. To see what is actually
|
||||
being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
|
||||
printed, tagged `[sw]` or `[page]`.
|
||||
|
||||
**Any uncaught page error or `console.error` fails the run.** That is the point:
|
||||
a `ReferenceError` from a used-but-not-imported identifier is invisible to
|
||||
`make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
|
||||
and this suite exists because exactly that class of bug shipped twice.
|
||||
|
||||
`make test-e2e` is deliberately **not** part of `make check` or `make test`.
|
||||
`REPO_POLICIES.md` caps `make test` at 20 seconds and a browser suite does not
|
||||
fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot pick it up
|
||||
either. It is also not wired into the Gitea workflow yet — docker-in-docker in
|
||||
CI is a separate question. Run it locally before changing anything under
|
||||
`src/popup/views/`.
|
||||
|
||||
## Rationale
|
||||
|
||||
Common popular EVM wallets have become bloated with swap UIs, portfolio
|
||||
@@ -271,10 +154,10 @@ on a different table knows exactly tf I am talking about.
|
||||
|
||||
Every interactive element must visually indicate that it is clickable. Buttons
|
||||
use a visible border, padding, and a hover state (invert to white-on-black).
|
||||
Text that triggers an action (e.g. "Add additional wallet...") uses an
|
||||
underline. No invisible hit targets, no bare text that happens to have a click
|
||||
handler. If it does something when you click it, it must look like it does
|
||||
something when you click it.
|
||||
Text that triggers an action (e.g. "Import private key") uses an underline. No
|
||||
invisible hit targets, no bare text that happens to have a click handler. If it
|
||||
does something when you click it, it must look like it does something when you
|
||||
click it.
|
||||
|
||||
#### Display Consistency
|
||||
|
||||
@@ -334,18 +217,12 @@ attack.
|
||||
|
||||
The core hierarchy is **Wallets → Addresses**:
|
||||
|
||||
- A **wallet** is one of three types:
|
||||
- An **HD wallet** (`type: "hd"`, recovery phrase): generates multiple
|
||||
addresses from a single 12/24 word recovery phrase using BIP-39/BIP-44
|
||||
derivation. The user can add more addresses with a "+" button.
|
||||
- A **key wallet** (`type: "key"`, private key): a single address imported
|
||||
directly from a private key. No "+" button since there is only one
|
||||
address.
|
||||
- An **xprv wallet** (`type: "xprv"`, extended private key): the same
|
||||
multi-address behavior as an HD wallet, including the "+" button and the
|
||||
address scan on import, but imported from an extended private key rather
|
||||
than a recovery phrase. It therefore has no recovery phrase to display or
|
||||
back up.
|
||||
- A **wallet** is either:
|
||||
- An **HD wallet** (recovery phrase): generates multiple addresses from a
|
||||
single 12/24 word recovery phrase using BIP-39/BIP-44 derivation. The user
|
||||
can add more addresses with a "+" button.
|
||||
- A **key wallet** (private key): a single address imported directly from a
|
||||
private key. No "+" button since there is only one address.
|
||||
- An **address** holds ETH and any user-added ERC-20 tokens.
|
||||
- The user can have multiple wallets, each with multiple addresses (HD) or a
|
||||
single address (key).
|
||||
@@ -360,140 +237,95 @@ menus.
|
||||
|
||||
### Screen Map
|
||||
|
||||
Navigation uses a stack model (like iOS): each forward action pushes the current
|
||||
screen onto `state.viewStack`, and "Back" pops it (`pushCurrentView()` and
|
||||
`goBack()` in `src/popup/views/helpers.js`). The root screen is either Welcome
|
||||
(no wallets) or Home (has wallets). Each screen below gives its view id in
|
||||
parentheses; the registry of view ids is the `VIEWS` array in
|
||||
`src/popup/views/helpers.js`, and the markup for a screen is the element with id
|
||||
`view-` plus that view id in `src/popup/index.html`.
|
||||
Navigation uses a stack model (like iOS): each action pushes a screen onto the
|
||||
stack, and "Back" pops it. The root screen is either Welcome (no wallets) or
|
||||
Home (has wallets). Screens are listed below with their elements and
|
||||
transitions.
|
||||
|
||||
Three elements sit outside the screens and are present on all of them: the title
|
||||
bar ("AutistMask by @sneak" plus the Settings gear), the flash message line
|
||||
under it, and the red banner at the very top that appears on a debug build, when
|
||||
runtime debug mode is on, or when the active network is a testnet. They are not
|
||||
repeated in the element lists below.
|
||||
#### Welcome
|
||||
|
||||
Closing and reopening the popup returns to the screen the user was last on only
|
||||
for the views listed in `RESTORABLE_VIEWS` (`src/popup/index.js`). Every other
|
||||
screen, including ExportPrivKey, falls back to Home.
|
||||
|
||||
#### Welcome (`welcome`)
|
||||
|
||||
- **When**: No wallets exist yet (`state.hasWallet` is false). This is the root
|
||||
screen in that case.
|
||||
- **Elements**:
|
||||
- "Welcome! To get started, add a wallet." text
|
||||
- "Add wallet" button
|
||||
- **When**: No wallets exist yet.
|
||||
- **Elements**: "AutistMask" heading, brief intro text, "Add wallet" button.
|
||||
- **Transitions**:
|
||||
- "Add wallet" → **AddWallet**
|
||||
|
||||
#### Home (`main`)
|
||||
#### Home
|
||||
|
||||
- **When**: At least one wallet exists. This is the root screen.
|
||||
- **Elements**:
|
||||
- Active address ETH balance (large) + USD value in parentheses
|
||||
- "Total:" USD value across ETH and all tracked tokens of the active address
|
||||
- Header: "AutistMask", Settings gear button
|
||||
- Active address ETH balance (large) + USD value (inline parentheses)
|
||||
- Total USD value across all tokens (small text)
|
||||
- Active address (color dot, full address, etherscan link, tap to copy)
|
||||
- Send / Receive quick-action buttons, both acting on the active address
|
||||
- Send / Receive quick-action buttons
|
||||
- ETH/USD price display
|
||||
- Wallet list: each wallet shows its name (tap to rename inline) and a "+"
|
||||
button for HD and xprv wallets, then one block per address with "Address
|
||||
N" (bold when active), the ENS name if resolved, the full address, an
|
||||
`[info]` button, the address USD total, and a balance line for ETH and for
|
||||
each tracked token
|
||||
- "Recent Transactions": up to 25 transactions merged across every address
|
||||
of every wallet, deduplicated by hash and filtered
|
||||
- Wallet list: each wallet shows name (tap to rename), "+" button (HD only),
|
||||
and its addresses with color dots, balances, and `[info]` buttons
|
||||
- Recent transactions across all addresses (merged, deduplicated, filtered)
|
||||
- "Add additional wallet..." link at bottom
|
||||
- **Transitions**:
|
||||
- Tap address row → sets the active address and broadcasts
|
||||
`AUTISTMASK_ACTIVE_CHANGED` (no screen change)
|
||||
- Tap wallet name → inline rename field (no screen change)
|
||||
- "+" on wallet → derives the next address inline (no screen change)
|
||||
- Tap address row → sets active address (no screen change)
|
||||
- `[info]` on address → **AddressDetail**
|
||||
- "Send" → **Send** (refuses with a flash message on a zero balance)
|
||||
- "Send" → **Send** (selects active address)
|
||||
- "Receive" → **Receive** (shows active address QR)
|
||||
- Tap home tx row → **TransactionDetail**
|
||||
- "+" on wallet → derives next address inline
|
||||
- "Add additional wallet..." → **AddWallet**
|
||||
- Settings gear → **Settings** (toggles; tap again to return)
|
||||
- Tap home tx row → **AddressDetail** (for the address involved)
|
||||
|
||||
#### AddWallet (`add-wallet`)
|
||||
#### AddWallet
|
||||
|
||||
- **When**: User wants to add a new wallet (from Welcome, Home, or Settings).
|
||||
This one screen covers all three import modes; there is no separate import
|
||||
screen.
|
||||
- **When**: User wants to add a new wallet (from Home, Welcome, or Settings).
|
||||
- **Elements**:
|
||||
- "Back" button, "Add Wallet" heading
|
||||
- Three tabs — "From Phrase" (`tab-mnemonic`), "From Key" (`tab-privkey`),
|
||||
"From xprv" (`tab-xprv`) — each showing its own form section:
|
||||
- **From Phrase**: instruction text, a die button that generates a
|
||||
random recovery phrase, a recovery phrase textarea, and a backup
|
||||
warning box that becomes visible once the die button has been used
|
||||
- **From Key**: instruction text and a masked private key input
|
||||
- **From xprv**: instruction text and a masked extended private key
|
||||
input
|
||||
- Password + confirm password inputs, with a hint line whose wording depends
|
||||
on the selected tab
|
||||
- "Add Wallet" heading, "Back" button
|
||||
- Instruction text
|
||||
- Die button `[die]` (generates random recovery phrase)
|
||||
- Recovery phrase textarea
|
||||
- Backup warning box (shown after die is clicked)
|
||||
- Password + confirm password inputs
|
||||
- "Add" button
|
||||
- "Have a private key instead?" link
|
||||
- **Transitions**:
|
||||
- "Add" (valid phrase + password) → **Home**
|
||||
- "Back" → previous screen (Home or Welcome)
|
||||
- "Have a private key instead?" → **ImportKey**
|
||||
|
||||
#### ImportKey
|
||||
|
||||
- **When**: User wants to import a single private key.
|
||||
- **Elements**:
|
||||
- "Import Private Key" heading, "Back" button
|
||||
- Instruction text
|
||||
- Private key input (password-masked)
|
||||
- Password + confirm password inputs
|
||||
- "Import" button
|
||||
- **Transitions**:
|
||||
- "Import" with a valid entry and a matching password of at least 12
|
||||
characters → creates the wallet, clears the navigation stack, and →
|
||||
**Home**. The phrase and xprv modes then scan for further used addresses
|
||||
and report the count as a flash message.
|
||||
- "Import" with an invalid entry, a duplicate wallet or address, or a short
|
||||
or mismatched password → flash message, no screen change
|
||||
- "Back" → previous screen (Welcome, Home, or Settings)
|
||||
- "Import" (valid key + password) → **Home**
|
||||
- "Back" → **AddWallet**
|
||||
|
||||
#### AddressDetail (`address`)
|
||||
#### AddressDetail
|
||||
|
||||
- **When**: User tapped `[info]` on an address from Home.
|
||||
- **Elements**:
|
||||
- "Back" button
|
||||
- Blockie identicon (48px, centered)
|
||||
- Title: "Wallet Name — Address N"
|
||||
- ENS name (if resolved, bold above the address)
|
||||
- ENS name (if resolved, bold with color dot)
|
||||
- Full address (color dot, etherscan link, tap to copy)
|
||||
- USD total for address
|
||||
- Balance list: ETH + tracked ERC-20 tokens (4 decimal places, USD inline).
|
||||
Each balance row is clickable → **AddressToken**
|
||||
- Send / Receive / + Token buttons and a "···" menu button
|
||||
- "···" dropdown containing a single "Export Private Key" entry
|
||||
- Send / Receive / + Token buttons
|
||||
- Transaction list (with ENS resolution for counterparties)
|
||||
- **Transitions**:
|
||||
- Tap balance row → **AddressToken** (for that token)
|
||||
- "Send" → **Send** (refuses with a flash message on a zero balance)
|
||||
- "Send" → **Send**
|
||||
- "Receive" → **Receive**
|
||||
- "+ Token" → **AddToken**
|
||||
- "···" → "Export Private Key" → **ExportPrivKey**
|
||||
- Tap transaction row → **TransactionDetail**
|
||||
- "Back" → previous screen (Home)
|
||||
- "Back" → **Home**
|
||||
|
||||
#### ExportPrivKey (`export-privkey`)
|
||||
|
||||
- **When**: User chose "Export Private Key" from the "···" menu on
|
||||
AddressDetail. This screen discloses secret material.
|
||||
- **Elements**:
|
||||
- "Back" button
|
||||
- Blockie identicon (48px, centered)
|
||||
- "Export Private Key" heading
|
||||
- "Wallet Name — Address N" and the full address (etherscan link, tap to
|
||||
copy)
|
||||
- Warning that anyone holding the private key can transfer all funds from
|
||||
the address
|
||||
- Error line
|
||||
- Password input and "Reveal" button, shown until the key is revealed
|
||||
- The private key on a highlighted background, tap to copy, shown only after
|
||||
the password has been accepted
|
||||
- **Transitions**:
|
||||
- "Reveal" (correct password) → decrypts the wallet secret, derives this
|
||||
address's key, hides the password input and shows the key (no screen
|
||||
change)
|
||||
- "Reveal" (wrong password) → "Wrong password." on the error line, nothing
|
||||
revealed
|
||||
- "Back" → clears the key and password from the DOM, then → previous screen
|
||||
(AddressDetail)
|
||||
|
||||
#### AddressToken (`address-token`)
|
||||
#### AddressToken
|
||||
|
||||
- **When**: User clicked a specific token balance on AddressDetail.
|
||||
- **Elements**:
|
||||
@@ -504,64 +336,49 @@ screen, including ExportPrivKey, falls back to Home.
|
||||
- USD total for this token
|
||||
- Single token balance line (4 decimal places)
|
||||
- Send / Receive buttons
|
||||
- Token contract well (ERC-20 only): full contract address (tap to copy,
|
||||
etherscan link) plus name, symbol, decimals, holder count and project
|
||||
website where known
|
||||
- Token-filtered transaction list (only this token's transfers)
|
||||
- **Transitions**:
|
||||
- "Send" → **Send** (token locked: the dropdown is replaced by a static
|
||||
symbol and contract address)
|
||||
- "Send" → **Send** (token pre-selected and locked in dropdown)
|
||||
- "Receive" → **Receive** (ERC-20 warning shown for non-ETH tokens)
|
||||
- Tap transaction row → **TransactionDetail**
|
||||
- "Back" → previous screen (AddressDetail)
|
||||
- "Back" → **AddressDetail**
|
||||
|
||||
#### Send (`send`)
|
||||
#### Send
|
||||
|
||||
- **When**: User wants to send ETH or a token, from Home, AddressDetail, or
|
||||
AddressToken.
|
||||
- **When**: User wants to send ETH or a token from this address.
|
||||
- **Elements**:
|
||||
- "Back" button, "Send" heading
|
||||
- "Send" heading, "Back" button
|
||||
- From: address with color dot + etherscan link
|
||||
- What to send: token dropdown (or static display with contract address when
|
||||
locked from AddressToken)
|
||||
- To: address or ENS name input, with an inline validation message
|
||||
- To: address or ENS name input
|
||||
- Amount input with current balance display
|
||||
- "Review" button, disabled until the recipient validates
|
||||
- "Review" button
|
||||
- **Transitions**:
|
||||
- "Review" (valid inputs, ENS resolved) → **ConfirmTx**
|
||||
- "Review" with an unresolvable ENS name or an invalid amount → flash
|
||||
message, no screen change
|
||||
- "Back" → previous screen (Home, AddressDetail, or AddressToken)
|
||||
- "Back" → **AddressToken** (if came from token view) or **AddressDetail**
|
||||
|
||||
#### ConfirmTx (`confirm-tx`)
|
||||
#### ConfirmTx
|
||||
|
||||
- **When**: User reviewed send details and is ready to authorize.
|
||||
- **Elements**:
|
||||
- "Back" button, "Confirm Transaction" heading
|
||||
- "Confirm Transaction" heading, "Back" button
|
||||
- Type: "Native ETH transfer" or "ERC-20 token transfer (SYMBOL)"
|
||||
- Token contract: full address + etherscan link (ERC-20 only)
|
||||
- From: blockie + color dot + full address + etherscan link + wallet title
|
||||
- To: blockie + color dot + full address + etherscan link + ENS name
|
||||
- Amount: value + symbol (USD in parentheses)
|
||||
- Your balance: value + symbol (USD in parentheses)
|
||||
- Estimated network fee: "Estimating..." then the ETH amount (USD in
|
||||
parentheses) or "Unable to estimate", fetched async
|
||||
- Warnings: inline warnings from the local checks (scam address, self-send)
|
||||
plus four reserved warning boxes made visible by the async checks —
|
||||
recipient with no transaction history, recipient is a contract, burn
|
||||
address, and an Etherscan phishing/scam label
|
||||
- Estimated network fee: ETH amount (USD in parentheses), fetched async
|
||||
- Warnings (scam address, self-send)
|
||||
- Errors (insufficient balance)
|
||||
- Password: an inline field on this screen, not a modal, with its own error
|
||||
line
|
||||
- "Sign & Send" button (disabled if errors)
|
||||
- "Send" button (disabled if errors)
|
||||
- **Transitions**:
|
||||
- "Sign & Send" (correct password) → broadcast tx → **WaitTx**
|
||||
- "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
|
||||
- "Sign & Send" (wrong password) → "Wrong password." on the password error
|
||||
line, no screen change
|
||||
- "Send" → password modal → broadcast tx → **WaitTx**
|
||||
- "Send" → password modal → broadcast fails → **ErrorTx**
|
||||
- "Back" → **Send**
|
||||
|
||||
#### WaitTx (`wait-tx`)
|
||||
#### WaitTx
|
||||
|
||||
- **When**: Transaction has been broadcast, waiting for on-chain confirmation.
|
||||
- **Elements**:
|
||||
@@ -575,24 +392,20 @@ screen, including ExportPrivKey, falls back to Home.
|
||||
- Receipt found → **SuccessTx**
|
||||
- 60 seconds without confirmation → **ErrorTx** (timeout message)
|
||||
|
||||
#### SuccessTx (`success-tx`)
|
||||
#### SuccessTx
|
||||
|
||||
- **When**: Transaction confirmed on-chain.
|
||||
- **Elements**:
|
||||
- "Transaction Confirmed" heading
|
||||
- Decoded action well (shown when the transaction carried recognized
|
||||
calldata; the top-level Amount and To are hidden in that case)
|
||||
- Amount + symbol
|
||||
- To: color dot + full address + etherscan link
|
||||
- Block number
|
||||
- Transaction hash: full hash (tap to copy) + etherscan link
|
||||
- "Done" button
|
||||
- **Transitions**:
|
||||
- "Done" in the approval popup → closes the popup window
|
||||
- "Done" otherwise → resets the navigation stack, then → **AddressToken**
|
||||
(if `selectedToken` set) or **AddressDetail**
|
||||
- "Done" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
|
||||
|
||||
#### ErrorTx (`error-tx`)
|
||||
#### ErrorTx
|
||||
|
||||
- **When**: Transaction broadcast failed, or timed out waiting for confirmation.
|
||||
- **Elements**:
|
||||
@@ -604,227 +417,120 @@ screen, including ExportPrivKey, falls back to Home.
|
||||
full hash (tap to copy) + etherscan link
|
||||
- "Done" button
|
||||
- **Transitions**:
|
||||
- "Done" in the approval popup → closes the popup window
|
||||
- "Done" otherwise → resets the navigation stack, then → **AddressToken**
|
||||
(if `selectedToken` set) or **AddressDetail**
|
||||
- "Done" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
|
||||
|
||||
#### Receive (`receive`)
|
||||
#### Receive
|
||||
|
||||
- **When**: User wants to receive funds at this address, from Home,
|
||||
AddressDetail, or AddressToken.
|
||||
- **When**: User wants to receive funds at this address.
|
||||
- **Elements**:
|
||||
- "Back" button, "Receive" heading
|
||||
- "Receive" heading, "Back" button
|
||||
- Instruction text
|
||||
- QR code encoding the address
|
||||
- Full address (color dot, selectable, etherscan link)
|
||||
- "Copy address" button
|
||||
- ERC-20 warning (shown when navigating from AddressToken for non-ETH token)
|
||||
- **Transitions**:
|
||||
- "Back" → previous screen (Home, AddressDetail, or AddressToken)
|
||||
- "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
|
||||
|
||||
#### TransactionDetail (`transaction`)
|
||||
#### TransactionDetail
|
||||
|
||||
- **When**: User tapped a transaction row on Home, AddressDetail, or
|
||||
AddressToken.
|
||||
- **Elements** (grouped into logical blocks using light well containers; field
|
||||
labels are self-explanatory so groups have no headings):
|
||||
- "Transaction" heading, "Back" button
|
||||
- Transaction hash: full hash (tap to copy) + etherscan link
|
||||
- Type: transaction classification — one of: Native ETH Transfer, ERC-20
|
||||
Token Transfer, Swap, Token Approval, Contract Call, Contract Creation
|
||||
- Status: "Success" or "Failed"
|
||||
- From: blockie + color dot + full address (tap to copy) + etherscan link;
|
||||
ENS name if available
|
||||
- To: blockie + color dot + full address (tap to copy) + etherscan link; ENS
|
||||
name if available
|
||||
- Time: ISO datetime + relative age in parentheses
|
||||
- Block: block number (tap to copy) + etherscan block link
|
||||
- Amount: value + symbol (bold)
|
||||
- Native quantity: raw integer + unit (shown when available)
|
||||
- Token contract: shown for ERC-20 transfers — color dot + full contract
|
||||
address (tap to copy) + etherscan token link
|
||||
- Decoded details (shown for contract calls): action name, decoded
|
||||
parameters, token details, swap steps
|
||||
- Network details (shown when on-chain data is available): nonce, gas price,
|
||||
gas used, transaction fee (all tap to copy)
|
||||
- Raw data (shown when calldata is present): full calldata in monospace
|
||||
dashed border
|
||||
- **Transitions**:
|
||||
- "Back" → previous screen (Home, AddressDetail, or AddressToken)
|
||||
|
||||
#### AddToken (`add-token`)
|
||||
|
||||
- **When**: User wants to track an ERC-20 token, reached from "+ Token" on
|
||||
AddressDetail.
|
||||
- **When**: User tapped a transaction row from AddressDetail or AddressToken.
|
||||
- **Elements**:
|
||||
- "Back" button, "Add Token" heading
|
||||
- "Transaction" heading, "Back" button
|
||||
- Status: "Success" or "Failed"
|
||||
- Time: ISO datetime + relative age in parentheses
|
||||
- Amount: value + symbol (bold)
|
||||
- From: blockie + color dot + full address (tap to copy) + etherscan link
|
||||
- ENS name if available
|
||||
- To: blockie + color dot + full address (tap to copy) + etherscan link
|
||||
- ENS name if available
|
||||
- Transaction hash: full hash (tap to copy) + etherscan link
|
||||
- **Transitions**:
|
||||
- "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
|
||||
|
||||
#### AddToken
|
||||
|
||||
- **When**: User wants to track an ERC-20 token on this address.
|
||||
- **Elements**:
|
||||
- "Add Token" heading, "Back" button
|
||||
- Instruction text (find contract address on Etherscan)
|
||||
- Contract address input
|
||||
- Status line ("Looking up token...", cleared or replaced on failure)
|
||||
- Common token quick-pick buttons (top 25 by market cap), which fill the
|
||||
contract address input
|
||||
- Token info preview (name, symbol — fetched from contract)
|
||||
- Common token quick-pick buttons
|
||||
- "Add" button
|
||||
- **Transitions**:
|
||||
- "Add" (valid contract) → tracks the token, pops the stack, and re-renders
|
||||
**AddressDetail**
|
||||
- "Add" with a token already tracked, a scam-listed address, or a failed
|
||||
contract lookup → flash message, no screen change
|
||||
- "Back" → previous screen (AddressDetail)
|
||||
- "Add" (valid contract) → **AddressDetail**
|
||||
- "Back" → **AddressDetail**
|
||||
|
||||
#### Settings (`settings`)
|
||||
#### Settings
|
||||
|
||||
- **When**: User tapped the Settings gear.
|
||||
- **When**: User tapped Settings gear from Home.
|
||||
- **Elements**:
|
||||
- "Back" button, "Settings" heading
|
||||
- Wallets: one row per wallet with its name (tap to rename inline) and an
|
||||
`[x]` delete button, plus a "+ Add wallet" button
|
||||
- Tracked Tokens: one row per tracked token with an `[x]` remove button,
|
||||
plus a "+ Add token" button
|
||||
- Display: "Show tracked tokens with zero balance" checkbox, "UTC
|
||||
Timestamps" checkbox, and a Theme selector (System / Light / Dark)
|
||||
- Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
|
||||
resets the RPC and Blockscout endpoints to that network's defaults
|
||||
- Ethereum RPC: endpoint URL input + "Save" button (validated against
|
||||
`eth_chainId` before being saved)
|
||||
- Blockscout API: endpoint URL input + "Save" button (validated against
|
||||
`/stats` before being saved)
|
||||
- "Settings" heading, "Back" button
|
||||
- Wallets: "+ Add wallet" button
|
||||
- Display: "Show tracked tokens with zero balance" checkbox
|
||||
- Ethereum RPC: endpoint URL input + "Save" button
|
||||
- Blockscout API: endpoint URL input + "Save" button
|
||||
- Token Spam Protection:
|
||||
- "Hide tokens with fewer than 1,000 holders" checkbox
|
||||
- "Hide transactions from detected fraud contracts" checkbox
|
||||
- "Hide dust transactions below N gwei" checkbox + threshold input
|
||||
- Allowed Sites: list with remove buttons
|
||||
- Denied Sites: list with remove buttons
|
||||
- About: project link, license, author, version, release date, and the
|
||||
commit, which links to the commit in the repository
|
||||
- Debug: hidden until revealed, then an "Enable debug mode" checkbox that
|
||||
turns on the red banner and verbose logging
|
||||
- **Transitions**:
|
||||
- "+ Add wallet" → **AddWallet**
|
||||
- "+ Add token" → **SettingsAddToken**
|
||||
- `[x]` on a wallet → **DeleteWallet**
|
||||
- Tap wallet name → inline rename field (no screen change)
|
||||
- `[x]` on a tracked token or a site → removes it in place (no screen
|
||||
change)
|
||||
- Ten clicks on the version → reveals the Debug well (no screen change)
|
||||
- "Back" (or Settings gear again) → previous screen (Home)
|
||||
- "Back" (or Settings gear again) → **Home**
|
||||
|
||||
#### DeleteWallet (`delete-wallet-confirm`)
|
||||
#### SiteApproval
|
||||
|
||||
- **When**: User tapped the `[x]` next to a wallet in Settings.
|
||||
- **Elements**:
|
||||
- "Back" button, "Delete Wallet" heading
|
||||
- Warning naming the wallet and stating that deletion is permanent and any
|
||||
funds are unrecoverable without the recovery phrase
|
||||
- Error line
|
||||
- Password input
|
||||
- "Confirm Delete" button
|
||||
- **Transitions**:
|
||||
- "Confirm Delete" (correct password, other wallets remain) → deletes the
|
||||
wallet and its site permissions, then → **Settings** with a "Wallet
|
||||
deleted." flash message
|
||||
- "Confirm Delete" (correct password, last wallet) → deletes the wallet,
|
||||
clears the selection and the navigation stack, then → **Welcome**
|
||||
- Either way, the active address moves only if it belonged to the deleted
|
||||
wallet, and `AUTISTMASK_ACTIVE_CHANGED` is broadcast when it does
|
||||
(`src/shared/walletDelete.js`)
|
||||
- "Confirm Delete" (wrong password) → "Wrong password." on the error line,
|
||||
nothing deleted
|
||||
- "Back" → previous screen (Settings)
|
||||
|
||||
#### SettingsAddToken (`settings-addtoken`)
|
||||
|
||||
- **When**: User tapped "+ Add token" in Settings. Tokens added here are tracked
|
||||
across every address, unlike AddToken which is reached from one address.
|
||||
- **Elements**:
|
||||
- "Back" button, "Add Token" heading
|
||||
- Instruction text
|
||||
- "Top tokens:" quick-pick buttons (top 10 by market cap; already-tracked
|
||||
tokens are disabled)
|
||||
- "Or pick from top 100:" dropdown (already-tracked tokens are disabled) +
|
||||
"Add selected" button
|
||||
- "Or enter contract address:" input, a status line, and an "Add" button
|
||||
- **Transitions**:
|
||||
- Any of the three add paths, on success → adds the token and shows an
|
||||
"Added SYMBOL" flash message (no screen change)
|
||||
- A duplicate, a scam-listed address, or a failed contract lookup → flash
|
||||
message, no screen change
|
||||
- "Back" → previous screen (Settings)
|
||||
|
||||
#### SiteApproval (`approve-site`)
|
||||
|
||||
- **When**: A website requests wallet access via `eth_requestAccounts` or
|
||||
`wallet_requestPermissions` and is on neither the allowed nor the denied list.
|
||||
The background script prefers the toolbar popup (`action.openPopup()`) and
|
||||
falls back to a separate popup window (`src/background/index.js`,
|
||||
`requestApproval()`).
|
||||
- **When**: A website requests wallet access via `eth_requestAccounts`. Opened
|
||||
in a separate popup by the background script.
|
||||
- **Elements**:
|
||||
- "Connection Request" heading
|
||||
- Phishing warning banner (shown when the hostname is on the phishing
|
||||
blocklist)
|
||||
- Site hostname (bold) + "wants to connect to your wallet"
|
||||
- Site hostname (bold)
|
||||
- Address that will be shared (color dot + full address + etherscan link)
|
||||
- "Remember my choice for this site" checkbox
|
||||
- "Allow" / "Deny" buttons
|
||||
- **Transitions**:
|
||||
- "Allow" / "Deny" → closes popup (returns result to background script; the
|
||||
choice is persisted to the allowed or denied list when "Remember" is
|
||||
checked)
|
||||
- Popup closed without answering → treated as a denial
|
||||
- "Allow" / "Deny" → closes popup (returns result to background script)
|
||||
|
||||
#### TxApproval (`approve-tx`)
|
||||
#### TxApproval
|
||||
|
||||
- **When**: A connected website requests a transaction via
|
||||
`eth_sendTransaction`. Always opened in a separate popup window by the
|
||||
background script (`windows.create()`), because the request is triggered
|
||||
programmatically rather than by a user gesture.
|
||||
`eth_sendTransaction`. Opened via the toolbar popup by the background script.
|
||||
- **Elements**:
|
||||
- "Transaction Request" heading
|
||||
- Phishing warning banner (shown when the hostname is on the phishing
|
||||
blocklist)
|
||||
- Site hostname (bold) + "wants to send a transaction"
|
||||
- Decoded action (if calldata is recognized): action name, token details,
|
||||
amounts, steps, deadline (see Transaction Decoding)
|
||||
- From: color dot + full address + etherscan link
|
||||
- Contract: color dot + full address + etherscan link (or "contract
|
||||
- To/Contract: color dot + full address + etherscan link (or "contract
|
||||
creation"), token symbol label if known
|
||||
- Value: amount in ETH (4 decimal places, USD in parentheses)
|
||||
- Value: amount in ETH (4 decimal places)
|
||||
- Raw data: full calldata displayed inline (shown if present)
|
||||
- Password input and an error line
|
||||
- Password input
|
||||
- "Confirm" / "Reject" buttons
|
||||
- **Transitions**:
|
||||
- "Confirm" (correct password) → decrypts and signs in the popup, hands the
|
||||
signed transaction to the background to broadcast, then → **WaitTx** in
|
||||
the same popup window
|
||||
- "Confirm" (wrong password) → error line, no screen change
|
||||
- "Confirm" (with password) → closes popup (returns result to background)
|
||||
- "Reject" → closes popup (returns rejection to background)
|
||||
- Popup window closed without answering → the request is rejected with
|
||||
EIP-1193 code 4001
|
||||
|
||||
#### SignApproval (`approve-sign`)
|
||||
#### SignApproval
|
||||
|
||||
- **When**: A connected website requests a message signature via
|
||||
`personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened the same way as
|
||||
TxApproval, in a separate popup window.
|
||||
`personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened via the toolbar
|
||||
popup by the background script.
|
||||
- **Elements**:
|
||||
- "Signature Request" heading
|
||||
- Phishing warning banner (shown when the hostname is on the phishing
|
||||
blocklist)
|
||||
- Site hostname (bold) + "wants you to sign a message"
|
||||
- Danger warning box (shown for `eth_sign`, which signs a raw hash)
|
||||
- Type: "Personal message" or "Typed data (EIP-712)"
|
||||
- From: color dot + full address + etherscan link
|
||||
- Message: decoded UTF-8 text (personal_sign) or formatted domain/type/
|
||||
message fields (EIP-712 typed data)
|
||||
- Password input and an error line
|
||||
- Password input
|
||||
- "Sign" / "Reject" buttons
|
||||
- **Transitions**:
|
||||
- "Sign" (correct password) → signs locally → closes popup (returns
|
||||
signature)
|
||||
- "Sign" (wrong password, or a signing failure) → error line, no screen
|
||||
change
|
||||
- "Sign" (with password) → signs locally → closes popup (returns signature)
|
||||
- "Reject" → closes popup (returns rejection to background)
|
||||
- Popup window closed without answering → the request is rejected with
|
||||
EIP-1193 code 4001
|
||||
|
||||
### External Services
|
||||
|
||||
@@ -861,25 +567,14 @@ What the extension does NOT do:
|
||||
|
||||
- No analytics or telemetry services
|
||||
- No token list APIs (user adds tokens manually by contract address)
|
||||
- No phishing/blocklist APIs
|
||||
- No Infura/Alchemy dependency (any JSON-RPC endpoint works)
|
||||
- No backend servers operated by the developer
|
||||
|
||||
In addition to the three user-configurable services above (RPC endpoint,
|
||||
CoinDesk price API, and Blockscout API), AutistMask also contacts:
|
||||
|
||||
- **Phishing domain blocklist**: A community-maintained phishing domain
|
||||
blocklist is vendored into the extension at build time. At runtime, the
|
||||
extension fetches the live list once every 24 hours to detect newly added
|
||||
domains. Only the delta (domains not already in the vendored list) is kept in
|
||||
memory, keeping runtime memory usage small. The delta is persisted to
|
||||
localStorage if it is under 256 KiB.
|
||||
- **Etherscan address labels**: When confirming a transaction, the extension
|
||||
performs a best-effort lookup of the recipient address on Etherscan to check
|
||||
for phishing/scam labels. This is a direct page fetch with no API key; the
|
||||
user's browser makes the request.
|
||||
|
||||
Users who want maximum privacy can point the RPC and Blockscout URLs at their
|
||||
own self-hosted instances (price fetching can be disabled in a future version).
|
||||
These three services (RPC endpoint, CoinDesk price API, and Blockscout API) are
|
||||
the only external services. All three endpoints are user-configurable. Users who
|
||||
want maximum privacy can point the RPC and Blockscout URLs at their own
|
||||
self-hosted instances (price fetching can be disabled in a future version).
|
||||
|
||||
### Dependencies
|
||||
|
||||
@@ -924,19 +619,6 @@ flows, or alter program behavior beyond the banner and the hardcoded mnemonic.
|
||||
Adding new DEBUG-conditional branches requires explicit approval from the
|
||||
project owner.
|
||||
|
||||
`DEBUG` is a build-time constant, not a runtime setting. `build.js` injects it
|
||||
into the bundle as the `__BUILD_DEBUG__` define — `false` unless the build was
|
||||
run with `AUTISTMASK_DEBUG=1` (see [Debug Builds](#debug-builds)) — and
|
||||
`src/shared/constants.js` reads it. It cannot be changed after the bundle is
|
||||
produced.
|
||||
|
||||
The debug-mode toggle in settings is a separate, runtime-only flag. It raises
|
||||
the log level and turns the banner on, and that is all it may ever do: it feeds
|
||||
`isDebug()` in `src/shared/log.js`, which is deliberately not what
|
||||
`generateMnemonic()` consults. Mnemonic generation reads the build-time `DEBUG`
|
||||
constant directly, so no runtime toggle in a release build can reach the
|
||||
hardcoded test phrase.
|
||||
|
||||
### Key Decisions
|
||||
|
||||
- **No framework**: The popup UI is vanilla JS and HTML. The extension is small
|
||||
@@ -979,7 +661,6 @@ hardcoded test phrase.
|
||||
- Create new HD wallet (generates 12-word recovery phrase)
|
||||
- Import HD wallet from existing 12 or 24 word recovery phrase
|
||||
- Import single-address wallet from private key
|
||||
- Import multi-address wallet from an extended private key (`xprv`)
|
||||
- Add multiple addresses within an HD wallet
|
||||
- Manage multiple wallets simultaneously
|
||||
- View ETH balance per address
|
||||
@@ -1083,21 +764,6 @@ indexes it as a real token transfer.
|
||||
designed as a sharp tool — users who understand the risks can configure the
|
||||
wallet to show everything unfiltered, unix-style.
|
||||
|
||||
#### Phishing Domain Protection
|
||||
|
||||
AutistMask protects users from known phishing sites when they connect their
|
||||
wallet or approve transactions/signatures. A community-maintained domain
|
||||
blocklist is vendored into the extension at build time, providing immediate
|
||||
protection without any network requests. At runtime, the extension fetches the
|
||||
live list once every 24 hours and keeps only the delta (newly added domains not
|
||||
in the vendored list) in memory. This architecture keeps runtime memory usage
|
||||
small while ensuring fresh coverage of new phishing domains.
|
||||
|
||||
When a dApp on a blocklisted domain requests a wallet connection, transaction
|
||||
approval, or signature, the approval popup displays a prominent red warning
|
||||
banner alerting the user. The domain checker matches exact hostnames and all
|
||||
parent domains (subdomain matching).
|
||||
|
||||
#### Transaction Decoding
|
||||
|
||||
When a dApp asks the user to approve a transaction, AutistMask attempts to
|
||||
@@ -1145,13 +811,13 @@ Currently supported:
|
||||
|
||||
### Wallet Management
|
||||
|
||||
- [x] Delete wallet (with confirmation)
|
||||
- [ ] Delete wallet (with confirmation)
|
||||
- [ ] Delete address from HD wallet (with confirmation)
|
||||
- [ ] Show wallet's recovery phrase (requires password)
|
||||
|
||||
### Transactions
|
||||
|
||||
- [x] Gas estimation and fee display before confirming
|
||||
- [ ] Gas estimation and fee display before confirming
|
||||
|
||||
### Testing
|
||||
|
||||
@@ -1180,21 +846,6 @@ Currently supported:
|
||||
|
||||
GPL-3.0. See [LICENSE](LICENSE).
|
||||
|
||||
### Third-Party Data Files
|
||||
|
||||
This repository includes data files from third-party projects that are not
|
||||
covered by the GPL-3.0 license above. These files, their copyright holders, and
|
||||
their licenses are:
|
||||
|
||||
| File | Source | Copyright | License |
|
||||
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
|
||||
| `src/shared/phishingBlocklist.json` | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
|
||||
| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json` | Copyright (c) 2020 MyEtherWallet | MIT |
|
||||
| `src/shared/scamlist.js` (address data from EtherScamDB) | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml` | Copyright (c) 2018 Luit Hollander | MIT |
|
||||
|
||||
The full license texts for these third-party files are included in the
|
||||
[LICENSE](LICENSE) file.
|
||||
|
||||
## Author
|
||||
|
||||
[@sneak](https://sneak.berlin)
|
||||
|
||||
252
REPO_POLICIES.md
252
REPO_POLICIES.md
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Repository Policies
|
||||
last_modified: 2026-07-06
|
||||
last_modified: 2026-02-22
|
||||
---
|
||||
|
||||
This document covers repository structure, tooling, and workflow standards. Code
|
||||
@@ -34,46 +34,10 @@ style conventions are in separate documents:
|
||||
every file before committing. There are zero exceptions to this rule.
|
||||
|
||||
- Every repo with software must have a root `Makefile` with these targets:
|
||||
`make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
|
||||
`make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
|
||||
`make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
|
||||
is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Repos follow the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
pattern: the implementation of each Makefile target lives in an executable
|
||||
script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
|
||||
`script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
|
||||
`script/docker`), and the Makefile targets are thin shims that call them. The
|
||||
scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
|
||||
minimal containers (e.g. alpine images have no bash); locate the repo root
|
||||
with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
|
||||
the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
|
||||
for development after a fresh clone: runs `bootstrap`, then
|
||||
`install-precommit`, plus any repo-specific initialization), `test`, and
|
||||
`cibuild`. `script/bootstrap` installs all dependencies idempotently and
|
||||
assumes nothing is present: base tools come from nix, apt, brew, or apk
|
||||
(detected in that order; apt runs noninteractive). For node it uses the
|
||||
installed node if present; otherwise it installs a PINNED node version via
|
||||
nvm, first installing nvm itself if missing — from a hash-verified GitHub
|
||||
release archive (never `curl | sh`), with bash installed as an explicit
|
||||
prerequisite since nvm requires bash. yarn is then pinned via
|
||||
`corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
|
||||
always exact versions. `script/cibuild` runs the CI build: it changes to the
|
||||
repo root and runs `docker build .`; the Gitea workflow calls it. Four further
|
||||
scripts are our own extensions to the standard: `script/check` runs
|
||||
`script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
|
||||
what the git pre-commit hook runs, and it calls `script/check`;
|
||||
`script/install-precommit` installs the git pre-commit hook (the `make hooks`
|
||||
target shims to it); and `script/projectname` (literally that filename) simply
|
||||
outputs the project's name. Scripts that need the name call
|
||||
`script/projectname` — e.g. `script/docker` assembles its image tag from it —
|
||||
so those scripts stay byte-identical across all repos. Repo-type-specific
|
||||
pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
|
||||
`script/precommit`, not in the hook itself. Model scripts are at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
|
||||
must document the provided scripts in an **Entrypoints** section (see the
|
||||
README requirements below).
|
||||
`make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
|
||||
`make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
|
||||
`make hooks` (installs pre-commit hook). A model Makefile is at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
|
||||
instead of invoking the underlying tools directly. The Makefile is the single
|
||||
@@ -93,83 +57,11 @@ style conventions are in separate documents:
|
||||
as a build step so the build fails if the branch is not green. For non-server
|
||||
repos, the Dockerfile should bring up a development environment and run
|
||||
`make check`. For server repos, `make check` should run as an early build
|
||||
stage before the final image is assembled. Dockerfiles install development
|
||||
prerequisites by running `script/bootstrap` rather than duplicating installs
|
||||
inline; COPY `script/` and the dependency manifests (`package.json` +
|
||||
`yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
|
||||
layer stays cached until dependencies change.
|
||||
|
||||
- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
|
||||
repos use a multistage build where linting runs in an independent stage based
|
||||
on the `golangci/golangci-lint` image (pinned by hash). This stage runs
|
||||
`make fmt-check` and `make lint` before the full build begins. The build stage
|
||||
then declares an explicit dependency on the lint stage via
|
||||
`COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
|
||||
linting before proceeding to compilation and tests. This ensures lint failures
|
||||
surface in seconds rather than minutes, without blocking on dependency
|
||||
download or compilation in the build stage.
|
||||
|
||||
The standard pattern for a Go repo Dockerfile is:
|
||||
|
||||
```dockerfile
|
||||
# Lint stage — fast feedback on formatting and lint issues
|
||||
# golangci/golangci-lint:v2.x.x, YYYY-MM-DD
|
||||
FROM golangci/golangci-lint@sha256:... AS lint
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make fmt-check
|
||||
RUN make lint
|
||||
|
||||
# Build stage
|
||||
# golang:1.x-alpine, YYYY-MM-DD
|
||||
FROM golang@sha256:... AS builder
|
||||
WORKDIR /src
|
||||
|
||||
# Force BuildKit to run the lint stage before proceeding
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make test
|
||||
|
||||
ARG VERSION=dev
|
||||
RUN CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w -X main.Version=${VERSION}" \
|
||||
-o /app ./cmd/app/
|
||||
|
||||
# Runtime stage
|
||||
FROM alpine@sha256:...
|
||||
COPY --from=builder /app /usr/local/bin/app
|
||||
ENTRYPOINT ["app"]
|
||||
```
|
||||
|
||||
Key points:
|
||||
- The lint stage uses the `golangci/golangci-lint` image directly (it
|
||||
includes both Go and the linter), so there is no need to install the
|
||||
linter separately.
|
||||
- `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
|
||||
a stage dependency. BuildKit runs stages in parallel by default; without
|
||||
this line, the build stage would not wait for lint to finish and a lint
|
||||
failure might not fail the overall build.
|
||||
- If the project uses `//go:embed` directives that reference build artifacts
|
||||
(e.g. a web frontend compiled in a separate stage), the lint stage must
|
||||
create placeholder files so the embed directives resolve. Example:
|
||||
`RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
|
||||
The lint stage should not depend on the actual build output — it exists to
|
||||
fail fast.
|
||||
- If the project requires CGO or system libraries for linting (e.g.
|
||||
`vips-dev`), install them in the lint stage with `apk add`.
|
||||
- The build stage runs `make test` after compilation setup. Tests run in the
|
||||
build stage, not the lint stage, because they may require compiled
|
||||
artifacts or heavier dependencies.
|
||||
stage before the final image is assembled.
|
||||
|
||||
- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
|
||||
runs `script/cibuild` (which runs `docker build .`) on push. Since the
|
||||
Dockerfile already runs `make check`, a successful build implies all checks
|
||||
pass.
|
||||
runs `docker build .` on push. Since the Dockerfile already runs `make check`,
|
||||
a successful build implies all checks pass.
|
||||
|
||||
- Use platform-standard formatters: `black` for Python, `prettier` for
|
||||
JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
|
||||
@@ -177,11 +69,9 @@ style conventions are in separate documents:
|
||||
Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
|
||||
HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
|
||||
|
||||
- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
|
||||
testing is not possible in the repo, `script/precommit` may skip `script/test`
|
||||
and run only `script/lint` and `script/fmt-check`. The hook is installed by
|
||||
`script/install-precommit`; the Makefile must provide a `make hooks` target
|
||||
that shims to it.
|
||||
- Pre-commit hook: `make check` if local testing is possible, otherwise
|
||||
`make lint && make fmt-check`. The Makefile should provide a `make hooks`
|
||||
target to install the pre-commit hook.
|
||||
|
||||
- All repos with software must have tests that run via the platform-standard
|
||||
test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
|
||||
@@ -192,42 +82,6 @@ style conventions are in separate documents:
|
||||
- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
|
||||
Makefile.
|
||||
|
||||
- **`make test` should use the conditional verbose rerun pattern.** Run tests
|
||||
without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
|
||||
show full output. This keeps CI logs and `docker build` output clean on
|
||||
success (just package/suite summaries) while providing full diagnostic detail
|
||||
on failure (every test case, every assertion). The general shell pattern:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@<test-command> || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
<test-command-with-v>; exit 1; }
|
||||
```
|
||||
|
||||
Go example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@go test -timeout 30s -race -cover ./... || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
go test -timeout 30s -race -v ./...; exit 1; }
|
||||
```
|
||||
|
||||
Python example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@python -m pytest || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
python -m pytest -v; exit 1; }
|
||||
```
|
||||
|
||||
The `exit 1` ensures the target always fails after a rerun — the first run
|
||||
already proved the tests are broken, so the build must not pass even if a
|
||||
flaky test happens to succeed on the second attempt. The rerun exists solely
|
||||
for diagnostic output.
|
||||
|
||||
- Docker builds must complete in under 5 minutes.
|
||||
|
||||
- `make check` must not modify any files in the repo. Tests may use temporary
|
||||
@@ -244,13 +98,6 @@ style conventions are in separate documents:
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
|
||||
a new repo.
|
||||
|
||||
- **No build artifacts in version control.** Code-derived data (compiled
|
||||
bundles, minified output, generated assets) must never be committed to the
|
||||
repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
|
||||
should generate these at build time. Notable exception: Go protobuf generated
|
||||
files (`.pb.go`) ARE committed because repos need to work with `go get`, which
|
||||
downloads code but does not execute code generation.
|
||||
|
||||
- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
|
||||
|
||||
- Never force-push to `main`.
|
||||
@@ -274,76 +121,12 @@ style conventions are in separate documents:
|
||||
- Dockerized web services listen on port 8080 by default, overridable with
|
||||
`PORT`.
|
||||
|
||||
- **HTTP/web services must be hardened for production internet exposure before
|
||||
tagging 1.0.** This means full compliance with security best practices
|
||||
including, without limitation, all of the following:
|
||||
- **Security headers** on every response:
|
||||
- `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
|
||||
and `includeSubDomains`.
|
||||
- `Content-Security-Policy` (CSP) with a restrictive default policy
|
||||
(`default-src 'self'` as a baseline, tightened per-resource as
|
||||
needed). Never use `unsafe-inline` or `unsafe-eval` unless
|
||||
unavoidable, and document the reason.
|
||||
- `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
|
||||
Prefer the `frame-ancestors` CSP directive as the primary control.
|
||||
- `X-Content-Type-Options: nosniff`.
|
||||
- `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
|
||||
- `Permissions-Policy` restricting access to browser features the
|
||||
application does not use (camera, microphone, geolocation, etc.).
|
||||
- **Request and response limits:**
|
||||
- Maximum request body size enforced on all endpoints (e.g. Go
|
||||
`http.MaxBytesReader`). Choose a sane default per-route; never accept
|
||||
unbounded input.
|
||||
- Maximum response body size where applicable (e.g. paginated APIs).
|
||||
- `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
|
||||
against slowloris attacks.
|
||||
- `WriteTimeout` on the `http.Server`.
|
||||
- `IdleTimeout` on the `http.Server`.
|
||||
- Per-handler execution time limits via `context.WithTimeout` or
|
||||
chi/stdlib `middleware.Timeout`.
|
||||
- **Authentication and session security:**
|
||||
- Rate limiting on password-based authentication endpoints. API keys are
|
||||
high-entropy and not susceptible to brute force, so they are exempt.
|
||||
- CSRF tokens on all state-mutating HTML forms. API endpoints
|
||||
authenticated via `Authorization` header (Bearer token, API key) are
|
||||
exempt because the browser does not attach these automatically.
|
||||
- Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
|
||||
MD5, or SHA.
|
||||
- Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
|
||||
`Strict`) attributes.
|
||||
- **Reverse proxy awareness:**
|
||||
- True client IP detection when behind a reverse proxy
|
||||
(`X-Forwarded-For`, `X-Real-IP`). The application must accept
|
||||
forwarded headers only from a configured set of trusted proxy
|
||||
addresses — never trust `X-Forwarded-For` unconditionally.
|
||||
- **CORS:**
|
||||
- Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
|
||||
an explicit allowlist of known origins. Wildcard (`*`) is acceptable
|
||||
only for public, unauthenticated read-only APIs.
|
||||
- **Error handling:**
|
||||
- Internal errors must never leak stack traces, SQL queries, file paths,
|
||||
or other implementation details to the client. Return generic error
|
||||
messages in production; detailed errors only when `DEBUG` is enabled.
|
||||
- **TLS:**
|
||||
- Services never terminate TLS directly. They are always deployed behind
|
||||
a TLS-terminating reverse proxy. The service itself listens on plain
|
||||
HTTP. However, HSTS headers and `Secure` cookie flags must still be
|
||||
set by the application so that the browser enforces HTTPS end-to-end.
|
||||
|
||||
This list is non-exhaustive. Apply defense-in-depth: if a standard security
|
||||
hardening measure exists for HTTP services and is not listed here, it is
|
||||
still expected. When in doubt, harden.
|
||||
|
||||
- `README.md` is the primary documentation. Required sections:
|
||||
- **Description**: First line must include the project name, purpose,
|
||||
category (web server, SPA, CLI tool, etc.), license, and author. Example:
|
||||
"µPaaS is an MIT-licensed Go web application by @sneak that receives
|
||||
git-frontend webhooks and deploys applications via Docker in realtime."
|
||||
- **Getting Started**: Copy-pasteable install/usage code block.
|
||||
- **Entrypoints**: Opens by stating that the repo adheres to the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
standard (with that link), then documents each provided `script/`
|
||||
entrypoint and its purpose.
|
||||
- **Rationale**: Why does this exist?
|
||||
- **Design**: How is the program structured?
|
||||
- **TODO**: Update meticulously, even between commits. When planning, put
|
||||
@@ -361,14 +144,8 @@ style conventions are in separate documents:
|
||||
- Use SemVer.
|
||||
|
||||
- Database migrations live in `internal/db/migrations/` and must be embedded in
|
||||
the binary.
|
||||
- `000_migration.sql` — contains ONLY the creation of the migrations
|
||||
tracking table itself. Nothing else.
|
||||
- `001_schema.sql` — the full application schema.
|
||||
- **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
|
||||
There is no installed base to migrate. Edit `001_schema.sql` directly.
|
||||
- **Post-1.0.0:** add new numbered migration files for each schema change.
|
||||
Never edit existing migrations after release.
|
||||
the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
|
||||
Post-1.0.0: add new migration files.
|
||||
|
||||
- All repos should have an `.editorconfig` enforcing the project's indentation
|
||||
settings.
|
||||
@@ -398,9 +175,6 @@ style conventions are in separate documents:
|
||||
- `README.md`, `.git`, `.gitignore`, `.editorconfig`
|
||||
- `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
|
||||
- `Makefile`
|
||||
- `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
|
||||
`lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
|
||||
`install-precommit`)
|
||||
- `Dockerfile`, `.dockerignore`
|
||||
- `.gitea/workflows/check.yml`
|
||||
- Go: `go.mod`, `go.sum`, `.golangci.yml`
|
||||
|
||||
120
TODO.md
120
TODO.md
@@ -1,120 +0,0 @@
|
||||
# Workflow
|
||||
|
||||
- `git pull` `next` and cut a branch from it — one branch per issue, named
|
||||
`issue-<N>-<slug>`. Never branch from `main`.
|
||||
- Do the work as one commit whose title ends with ` (closes #N)`, with the
|
||||
`TODO.md` update in that same commit.
|
||||
- Move Next Step to the top of Completed Steps; move the top item of Future
|
||||
Steps into Next Step.
|
||||
- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
|
||||
`main` may not.
|
||||
- Rebase onto current `next` immediately before pushing — other branches land on
|
||||
`next` continuously — and re-run `make check` after resolving, because a clean
|
||||
textual merge can still break the build.
|
||||
- Push the branch and open one PR per issue with base `next`. Never base `main`.
|
||||
- An independent reviewer who did not write the change gates the merge. On a
|
||||
passed review the PR is squash-merged into `next`.
|
||||
- `next` is the branch for the next milestone. It is kept green and mergeable to
|
||||
`main` at any moment, without notice.
|
||||
- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
|
||||
from `main`.
|
||||
|
||||
# Status
|
||||
|
||||
pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
|
||||
milestone is in flight on `next`; its `next` -> `main` PR is
|
||||
[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
|
||||
green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
|
||||
`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
|
||||
compiled off.
|
||||
|
||||
The backlog lives on the
|
||||
[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
|
||||
authoritative; this file does not duplicate it. Full policy file set present. A
|
||||
real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
|
||||
which cannot see a runtime `ReferenceError` in a popup view.
|
||||
|
||||
# Next Step
|
||||
|
||||
Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
|
||||
`script/lint`. `make check` is `prettier --check` only today and cannot catch
|
||||
undefined identifiers, which is how
|
||||
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
||||
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
|
||||
into Display, next to the theme selector
|
||||
([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
|
||||
- 2026-08-11: README Screen Map rebuilt from the code — every screen, element
|
||||
and transition re-verified against `src/popup/`
|
||||
([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).
|
||||
- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
|
||||
all five network destinations documented, password/Settings/Add Wallet
|
||||
sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
|
||||
- 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
|
||||
remaining wallets, the selection only moves when it was deleted, and the
|
||||
active-address change is broadcast to connected sites
|
||||
([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
|
||||
- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
|
||||
on `next`, with Status and Next Step refreshed
|
||||
([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
|
||||
- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
|
||||
as the `__BUILD_DEBUG__` esbuild define and turned on with
|
||||
`AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
|
||||
created wallet the publicly committed test recovery phrase
|
||||
([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
|
||||
- 2026-08-09: dApp approval signing moved into the popup — the password no
|
||||
longer crosses the extension messaging boundary; the background broadcasts and
|
||||
resolves approvals only, and verifies the signed artifact against the approval
|
||||
it holds (#157).
|
||||
- 2026-08-09: Post-build assertion that every emitted bundle containing
|
||||
`constants.js` has `DEBUG` compiled off, via `script/verify-build` on the
|
||||
`make build` path (#170).
|
||||
- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
|
||||
`script/test-e2e`) driving the real popup with all network intercepted, plus
|
||||
the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
|
||||
and TransactionDetail broken for every ERC-20 transfer (#151). Harness
|
||||
demonstrated failing before the fixes and passing after (#181). Interception
|
||||
covers the MV3 background service worker, not just the popup page, and a
|
||||
launch-time canary aborts the suite if worker traffic starts escaping.
|
||||
- 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
|
||||
(#149-#168).
|
||||
- 2026-08-09: Test coverage for the address-poisoning defense in
|
||||
`src/shared/transactions.js` (#160)
|
||||
- 2026-07-26: About well in settings with build info, repo link and the version
|
||||
click easter egg (#145); proper view navigation stack (#146).
|
||||
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
||||
shims, README Entrypoints section (#148)
|
||||
- 2026-03-01: USD display suppressed on testnets (#142); estimated USD for ETH
|
||||
in approve-tx view (#141).
|
||||
- Sepolia testnet support (#137); etherscan links go to token-specific URLs
|
||||
(#136).
|
||||
- Transaction detail improvements: Type field and on-chain details (#130),
|
||||
txid-first reordering (#133), swap display corrections (#128), expanded
|
||||
confirm-tx warnings (#118).
|
||||
- Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
|
||||
timestamps include timezone offset (#120); layout shift audit, reserved space
|
||||
for error messages (#124).
|
||||
- Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
|
||||
duplicate detection (#115).
|
||||
- 2026-02-27: v0.1.0 tagged.
|
||||
- 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
|
||||
ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
|
||||
reverse resolution.
|
||||
|
||||
# Future Steps
|
||||
|
||||
Only work that has no issue of its own belongs here; everything else is on the
|
||||
tracker.
|
||||
|
||||
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of
|
||||
it, but the review is broader than any of them.
|
||||
- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
|
||||
workflow. Extending the suite itself is tracked as
|
||||
[#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
|
||||
[#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
|
||||
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
|
||||
land.
|
||||
183
build.js
183
build.js
@@ -3,168 +3,75 @@ const path = require("path");
|
||||
const { execSync } = require("child_process");
|
||||
const esbuild = require("esbuild");
|
||||
|
||||
const DIST = path.join(__dirname, "dist");
|
||||
const DIST_CHROME = path.join(DIST, "chrome");
|
||||
const DIST_FIREFOX = path.join(DIST, "firefox");
|
||||
const DIST_CHROME = path.join(__dirname, "dist", "chrome");
|
||||
const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
|
||||
const SRC = path.join(__dirname, "src");
|
||||
|
||||
// The module whose compiled DEBUG state script/verify-build asserts, and the
|
||||
// manifest naming every emitted bundle that ends up containing it. The
|
||||
// manifest is derived from esbuild's own dependency graph rather than from a
|
||||
// hardcoded list, so it tracks the bundle layout instead of rotting with it.
|
||||
const AUDITED_MODULE = "src/shared/constants.js";
|
||||
const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
|
||||
|
||||
function ensureDir(dir) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
|
||||
// Repo-relative, forward-slashed, so the manifest reads the same on every
|
||||
// platform and can be consumed by a POSIX shell script without further work.
|
||||
function repoRelative(p) {
|
||||
return path.relative(__dirname, p).split(path.sep).join("/");
|
||||
}
|
||||
|
||||
// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
|
||||
// reports every input that contributed to an output in the metafile, which is
|
||||
// the authoritative answer to "is constants.js in this bundle" — unlike
|
||||
// searching the minified text, it does not depend on what survived minification.
|
||||
function outputsContainingAuditedModule(metafile) {
|
||||
return Object.entries(metafile.outputs)
|
||||
.filter(([outFile, info]) => {
|
||||
if (!outFile.endsWith(".js")) return false;
|
||||
return Object.keys(info.inputs).some(
|
||||
(input) => repoRelative(input) === AUDITED_MODULE,
|
||||
);
|
||||
})
|
||||
.map(([outFile]) => repoRelative(outFile));
|
||||
}
|
||||
|
||||
// DEBUG is a build-time flag, off unless explicitly requested. It is the only
|
||||
// thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
|
||||
// exact: anything other than the literal "1" (unset, empty, "true", a typo)
|
||||
// produces a release build. Failing towards the safe mode is deliberate.
|
||||
function isDebugBuild() {
|
||||
return process.env.AUTISTMASK_DEBUG === "1";
|
||||
}
|
||||
|
||||
function getBuildInfo() {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
|
||||
);
|
||||
let commitHash = "unknown";
|
||||
try {
|
||||
commitHash = execSync("git rev-parse --short HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
let commitHashFull = "unknown";
|
||||
try {
|
||||
commitHashFull = execSync("git rev-parse HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
return {
|
||||
version: pkg.version,
|
||||
license: pkg.license,
|
||||
author: pkg.author,
|
||||
commitHash,
|
||||
commitHashFull,
|
||||
buildDate: new Date().toISOString().slice(0, 10),
|
||||
};
|
||||
}
|
||||
|
||||
async function build() {
|
||||
console.log("Building AutistMask extension...");
|
||||
|
||||
const buildInfo = getBuildInfo();
|
||||
console.log("Build info:", buildInfo);
|
||||
|
||||
const debugBuild = isDebugBuild();
|
||||
console.log(
|
||||
debugBuild
|
||||
? "Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)"
|
||||
: "Build mode: release (DEBUG off)",
|
||||
);
|
||||
|
||||
const define = {
|
||||
__BUILD_DEBUG__: JSON.stringify(debugBuild),
|
||||
__BUILD_VERSION__: JSON.stringify(buildInfo.version),
|
||||
__BUILD_LICENSE__: JSON.stringify(buildInfo.license),
|
||||
__BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
|
||||
__BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
|
||||
__BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
|
||||
__BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
|
||||
};
|
||||
|
||||
// Emitted bundles that contain constants.js, accumulated across every
|
||||
// esbuild run below and written out for script/verify-build.
|
||||
const auditedBundles = [];
|
||||
|
||||
// compile tailwind CSS
|
||||
console.log("Compiling Tailwind CSS...");
|
||||
const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
|
||||
const tailwindOutput = path.join(DIST, "styles.css");
|
||||
ensureDir(DIST);
|
||||
|
||||
// Drop any manifest from a previous build before emitting anything, so a
|
||||
// build that never gets around to writing one cannot be verified against
|
||||
// a stale list.
|
||||
fs.rmSync(BUNDLE_MANIFEST, { force: true });
|
||||
const tailwindOutput = path.join(__dirname, "dist", "styles.css");
|
||||
ensureDir(path.join(__dirname, "dist"));
|
||||
execSync(
|
||||
`npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
|
||||
{ stdio: "inherit" },
|
||||
);
|
||||
|
||||
// Every bundle goes through here, so metafile collection cannot be
|
||||
// forgotten when a new entry point is added.
|
||||
async function bundle(entryPoint, outfile) {
|
||||
const result = await esbuild.build({
|
||||
entryPoints: [entryPoint],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile,
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
metafile: true,
|
||||
define,
|
||||
});
|
||||
auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
|
||||
}
|
||||
|
||||
for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
|
||||
ensureDir(path.join(distDir, "src", "popup"));
|
||||
ensureDir(path.join(distDir, "src", "background"));
|
||||
ensureDir(path.join(distDir, "src", "content"));
|
||||
|
||||
// bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
|
||||
await bundle(
|
||||
path.join(SRC, "popup", "index.js"),
|
||||
path.join(distDir, "src", "popup", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "popup", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "popup", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle background script
|
||||
await bundle(
|
||||
path.join(SRC, "background", "index.js"),
|
||||
path.join(distDir, "src", "background", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "background", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "background", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle content script
|
||||
await bundle(
|
||||
path.join(SRC, "content", "index.js"),
|
||||
path.join(distDir, "src", "content", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "content", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "content", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle inpage script (injected into page context, separate file)
|
||||
await bundle(
|
||||
path.join(SRC, "content", "inpage.js"),
|
||||
path.join(distDir, "src", "content", "inpage.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "content", "inpage.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "content", "inpage.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// copy popup HTML
|
||||
fs.copyFileSync(
|
||||
@@ -189,16 +96,6 @@ async function build() {
|
||||
path.join(DIST_FIREFOX, "manifest.json"),
|
||||
);
|
||||
|
||||
// Written last so a build that died partway through leaves no manifest
|
||||
// at all, which script/verify-build treats as a hard failure rather than
|
||||
// as "nothing to check".
|
||||
const manifest = [...new Set(auditedBundles)].sort();
|
||||
fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
|
||||
console.log(
|
||||
`Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
|
||||
`(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
|
||||
);
|
||||
|
||||
console.log("Build complete: dist/chrome/ and dist/firefox/");
|
||||
}
|
||||
|
||||
|
||||
237
docs/README.md
237
docs/README.md
@@ -6,10 +6,10 @@ and ERC-20 tokens, and connects to web3 sites. Nothing else.
|
||||
|
||||
## Why AutistMask Exists
|
||||
|
||||
The most popular browser-based EVM wallet has become bloated with swap UIs,
|
||||
portfolio dashboards, analytics, tracking, and advertisements. It is no longer a
|
||||
simple wallet. The common alternatives only support Chromium browsers, leaving
|
||||
Firefox users without a usable option.
|
||||
MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
|
||||
tracking, and advertisements. It is no longer a simple wallet. Most alternatives
|
||||
(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
|
||||
without a usable option.
|
||||
|
||||
AutistMask exists because a wallet should be a wallet. You should be able to see
|
||||
your balances, send tokens, receive tokens, and connect to sites. That is all a
|
||||
@@ -27,10 +27,9 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
|
||||
|
||||
- **Encrypt your recovery phrase and private keys at rest.** Your secrets are
|
||||
encrypted on disk using Argon2id key derivation and XSalsa20-Poly1305
|
||||
authenticated encryption (via libsodium). Your password is required whenever a
|
||||
secret has to be decrypted: signing a transaction, signing a message or typed
|
||||
data, exporting a private key, and deleting a wallet. Viewing balances and
|
||||
addresses never requires a password.
|
||||
authenticated encryption (via libsodium). Your password is required only when
|
||||
signing a transaction. Viewing balances and addresses never requires a
|
||||
password.
|
||||
|
||||
- **Let you choose your own RPC endpoint.** The default is a public Ethereum
|
||||
RPC, but you can point it at your own node or any provider you trust. No
|
||||
@@ -57,25 +56,23 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
|
||||
|
||||
- **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
|
||||
|
||||
- **No third-party token list APIs.** Token balances come from the same block
|
||||
explorer you configure for transaction history, and the extension ships its
|
||||
own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
|
||||
detection. Any token you want tracked across all your addresses, you add
|
||||
yourself by contract address.
|
||||
- **No token auto-discovery.** AutistMask does not scan the blockchain for
|
||||
tokens you might hold. You add tokens manually by contract address. This
|
||||
prevents scam tokens from appearing in your wallet uninvited.
|
||||
|
||||
- **No backend servers operated by the developer.** Nothing is sent to any
|
||||
server run by AutistMask. Every network destination is listed below.
|
||||
- **No phishing blocklists from third parties.** AutistMask does not phone home
|
||||
to check URLs against a remote blocklist. It does maintain a local list of
|
||||
known scam addresses, but this is shipped with the extension, not fetched from
|
||||
a server.
|
||||
|
||||
## How It Works
|
||||
|
||||
AutistMask is a browser extension that runs entirely in your browser. It does
|
||||
not have a backend server. It communicates with five external destinations:
|
||||
three you configure yourself, and two fixed ones used for scam detection.
|
||||
not have a backend server. It communicates with three external services:
|
||||
|
||||
### External Services
|
||||
|
||||
**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`;
|
||||
`ethereum-sepolia-rpc.publicnode.com` on Sepolia)
|
||||
**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`)
|
||||
|
||||
This is how AutistMask talks to the Ethereum network. Every wallet needs an
|
||||
Ethereum node to check balances, estimate gas, broadcast transactions, and
|
||||
@@ -83,73 +80,27 @@ verify confirmations. The default is a free public RPC endpoint. You can change
|
||||
this in Settings to any Ethereum JSON-RPC endpoint, including your own local
|
||||
node.
|
||||
|
||||
When it is contacted: on every balance refresh (every 10 seconds while the popup
|
||||
is open, every 60 seconds in the background), when you type an ENS name into the
|
||||
Send screen, when a send is prepared and broadcast, while a pending transaction
|
||||
is polled for its receipt, and for the reverse ENS lookups used to label
|
||||
addresses (cached for 12 hours).
|
||||
|
||||
What gets sent: standard Ethereum JSON-RPC requests (balance queries,
|
||||
transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
|
||||
addresses are necessarily visible to the RPC provider when querying balances.
|
||||
transaction broadcasts, gas estimates, ENS lookups). Your addresses are
|
||||
necessarily visible to the RPC provider when querying balances.
|
||||
|
||||
**Blockscout API** (default: `eth.blockscout.com/api/v2`;
|
||||
`eth-sepolia.blockscout.com/api/v2` on Sepolia)
|
||||
**Blockscout API** (default: `eth.blockscout.com/api/v2`)
|
||||
|
||||
Used to fetch token balances and transaction history. Blockscout is an
|
||||
open-source blockchain explorer. AutistMask queries it for your ERC-20 token
|
||||
balances (including the holder counts used for spam filtering) and your recent
|
||||
transactions and token transfers. You can change this in Settings to a
|
||||
balances and recent transactions. You can change this in Settings to a
|
||||
self-hosted Blockscout instance.
|
||||
|
||||
When it is contacted: on every balance refresh, and whenever a screen showing
|
||||
transaction history is opened.
|
||||
|
||||
What gets sent: your Ethereum addresses (to look up balances and transactions).
|
||||
|
||||
**CoinDesk CADLI price API** (`data-api.coindesk.com`)
|
||||
|
||||
Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
|
||||
cached for 5 minutes. No API key is required. This endpoint is not
|
||||
user-configurable, and it is not contacted at all while you are on a testnet,
|
||||
where no USD values are shown.
|
||||
Used to fetch current USD prices for ETH and ERC-20 tokens. Prices are cached
|
||||
for 5 minutes. No API key is required. No user data is sent -- only a list of
|
||||
token symbols (e.g. "ETH", "USDC") to get their prices.
|
||||
|
||||
When it is contacted: while the popup is open, at most once every 5 minutes.
|
||||
|
||||
What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
|
||||
balances, no identifying information. As with any request, CoinDesk sees your IP
|
||||
address.
|
||||
|
||||
**Phishing domain blocklist** (`raw.githubusercontent.com`)
|
||||
|
||||
A community-maintained list of phishing domains, used to warn you when a site
|
||||
that asks to connect, or to have a transaction or signature approved, is a known
|
||||
scam. A copy is bundled into the extension at build time, so the protection
|
||||
works before any network request happens. At runtime the extension fetches the
|
||||
live list to pick up newly added domains, keeping only the entries not already
|
||||
in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
|
||||
user-configurable.
|
||||
|
||||
When it is contacted: once when the background script starts, and every 24 hours
|
||||
after that. It is a plain download of a public file — nothing about you is sent,
|
||||
but the host sees your IP address. If the fetch fails, the bundled copy is still
|
||||
used.
|
||||
|
||||
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
|
||||
|
||||
When you review a send, AutistMask fetches the recipient's public Etherscan
|
||||
address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
|
||||
warning, and shows a red warning if it finds one. This is a plain page fetch
|
||||
with no API key, made by your browser. It is best-effort: if it fails, it is
|
||||
silently ignored. This endpoint is not user-configurable.
|
||||
|
||||
When it is contacted: each time you reach the send confirmation screen.
|
||||
|
||||
What gets sent: the recipient address you are about to send to, and your IP
|
||||
address. Your own addresses are not sent.
|
||||
|
||||
Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
|
||||
contracts) are ordinary links. They contact nothing until you click them.
|
||||
What gets sent: token symbol names. No addresses, no balances, no identifying
|
||||
information.
|
||||
|
||||
### What Stays Local
|
||||
|
||||
@@ -172,11 +123,8 @@ word recovery phrase can restore your wallet on any device without your
|
||||
password. The password only protects the copy stored in this browser. If you
|
||||
lose your recovery phrase, your password cannot help you recover it.
|
||||
|
||||
Your password is requested whenever an encrypted secret must be decrypted: when
|
||||
you send a transaction, when a site asks you to sign a message or typed data,
|
||||
when you export an address's private key, and when you delete a wallet. Viewing
|
||||
balances, receiving funds, and browsing transaction history never require your
|
||||
password.
|
||||
Your password is only requested when you send a transaction. Viewing balances,
|
||||
receiving funds, and browsing transaction history never require your password.
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -199,46 +147,34 @@ password.
|
||||
### Creating a New Wallet
|
||||
|
||||
1. Click the AutistMask icon in your browser toolbar.
|
||||
2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
|
||||
3. On the "From Phrase" tab, click the die button to generate a random 12-word
|
||||
recovery phrase.
|
||||
2. Click "Add wallet".
|
||||
3. Click the die button to generate a random 12-word recovery phrase.
|
||||
4. **Write down the recovery phrase and store it safely.** Anyone with these
|
||||
words can take your funds. If you lose them, your wallet is gone. AutistMask
|
||||
cannot recover them for you.
|
||||
5. Choose a password and confirm it. This encrypts your recovery phrase on this
|
||||
device.
|
||||
6. Click "Import".
|
||||
5. Choose a password. This encrypts your recovery phrase on this device.
|
||||
6. Click "Add".
|
||||
|
||||
### Importing an Existing Wallet
|
||||
|
||||
The Add Wallet screen has three tabs:
|
||||
**From a recovery phrase:** Follow the same steps as creating a wallet, but
|
||||
paste your existing 12 or 24 word recovery phrase instead of generating a new
|
||||
one. AutistMask uses the same derivation path as MetaMask (`m/44'/60'/0'/0`), so
|
||||
your addresses will match.
|
||||
|
||||
**From Phrase:** Paste your existing 12 or 24 word recovery phrase instead of
|
||||
generating a new one. AutistMask uses the standard BIP-44 Ethereum derivation
|
||||
path (`m/44'/60'/0'/0`), which is what other wallets use by default, so your
|
||||
addresses will match and your phrase stays portable in both directions.
|
||||
|
||||
**From Key:** Paste a single private key. This creates a single-address wallet.
|
||||
|
||||
**From xprv:** Paste an extended private key. This imports the HD wallet and
|
||||
scans for used addresses.
|
||||
|
||||
All three tabs ask for the same password fields, and the "Import" button
|
||||
finishes the job.
|
||||
**From a private key:** On the Add Wallet screen, click "Have a private key
|
||||
instead?" and paste your private key. This creates a single-address wallet.
|
||||
|
||||
### Adding More Addresses
|
||||
|
||||
HD wallets (created from a recovery phrase or an xprv) can derive multiple
|
||||
addresses. On the home screen, click the "+" button next to a wallet name to add
|
||||
the next address. These are deterministic -- the same recovery phrase will
|
||||
always produce the same sequence of addresses.
|
||||
HD wallets (created from a recovery phrase) can derive multiple addresses. On
|
||||
the home screen, click the "+" button next to a wallet name to add the next
|
||||
address. These are deterministic -- the same recovery phrase will always produce
|
||||
the same sequence of addresses.
|
||||
|
||||
### Adding ERC-20 Tokens
|
||||
|
||||
Tokens you hold show up automatically only if they are in the extension's
|
||||
bundled list of well-known tokens or have at least 1,000 holders; everything
|
||||
else is treated as spam and hidden. To track a token explicitly (which also
|
||||
shows it at zero balance), add it by contract address:
|
||||
AutistMask does not auto-discover tokens. To track a token:
|
||||
|
||||
1. Go to an address detail view (click `[info]` on any address).
|
||||
2. Click "+ Token".
|
||||
@@ -247,13 +183,12 @@ shows it at zero balance), add it by contract address:
|
||||
4. Click "Add".
|
||||
|
||||
The token balance will appear on the address detail screen and on the home
|
||||
screen. Tokens can also be added from Settings, under "Tracked Tokens".
|
||||
screen.
|
||||
|
||||
## Sending
|
||||
|
||||
1. Click "Send" from the home screen or an address detail view.
|
||||
2. Select what to send (ETH, or any ERC-20 token with a balance on this address
|
||||
that survives the spam filters).
|
||||
2. Select what to send (ETH or any tracked ERC-20 token).
|
||||
3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
|
||||
4. Enter the amount.
|
||||
5. Click "Review" to see the confirmation screen.
|
||||
@@ -266,14 +201,11 @@ The confirmation screen shows:
|
||||
- **Amount** with USD estimate
|
||||
- **Your current balance** with USD estimate
|
||||
- **Estimated network fee** in ETH with USD estimate
|
||||
- **Warnings** if the recipient is a contract, a burn address, one of your own
|
||||
addresses, on the bundled scam-address list, or labelled as a phisher on
|
||||
Etherscan
|
||||
|
||||
After reviewing, enter your password and click "Sign & Send". The transaction
|
||||
will be broadcast to the network and you will see a waiting screen with a timer.
|
||||
Once confirmed (or after 60 seconds), you will see either a success or error
|
||||
screen with the transaction hash and an Etherscan link.
|
||||
After reviewing, click "Send" and enter your password. The transaction will be
|
||||
broadcast to the network and you will see a waiting screen with a timer. Once
|
||||
confirmed (or after 60 seconds), you will see either a success or error screen
|
||||
with the transaction hash and an Etherscan link.
|
||||
|
||||
### Sending a Specific Token
|
||||
|
||||
@@ -287,10 +219,10 @@ cannot accidentally switch to a different one.
|
||||
1. Click "Receive" from the home screen or an address detail view.
|
||||
2. Share the QR code or copy the address using the "Copy address" button.
|
||||
|
||||
When receiving ERC-20 tokens, make sure the sender is sending on the network you
|
||||
are using. AutistMask supports Ethereum mainnet and the Sepolia testnet. Tokens
|
||||
sent on other networks (Polygon, Arbitrum, BSC, etc.) to the same address will
|
||||
not appear and may be permanently lost.
|
||||
When receiving ERC-20 tokens, make sure the sender is sending on the Ethereum
|
||||
network. AutistMask is an Ethereum mainnet wallet. Tokens sent on other networks
|
||||
(Polygon, Arbitrum, BSC, etc.) to the same address will not appear and may be
|
||||
permanently lost.
|
||||
|
||||
## Connecting to Web3 Sites
|
||||
|
||||
@@ -305,12 +237,7 @@ pages. When a site requests access to your wallet:
|
||||
|
||||
When a connected site requests a transaction, a separate approval popup appears
|
||||
showing the transaction details (from, to, value, data). You must enter your
|
||||
password and click "Confirm" to authorize it. Message and typed-data signature
|
||||
requests work the same way, with a "Sign" button, and also require your
|
||||
password.
|
||||
|
||||
If the requesting site's domain is on the phishing blocklist, all three approval
|
||||
screens show a red phishing warning before you decide.
|
||||
password and click "Confirm" to authorize it.
|
||||
|
||||
You can manage site permissions in Settings. Allowed and denied sites can be
|
||||
individually removed to reset their permissions.
|
||||
@@ -320,16 +247,15 @@ individually removed to reset their permissions.
|
||||
AutistMask includes several defenses against common Ethereum scams, all enabled
|
||||
by default:
|
||||
|
||||
**Known token symbol verification.** AutistMask ships a list of roughly 500
|
||||
legitimate ERC-20 tokens with their contract addresses. If a transaction or
|
||||
balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
|
||||
an unrecognized contract, it is identified as a spoof and hidden.
|
||||
**Known token symbol verification.** AutistMask ships a list of ~250 legitimate
|
||||
ERC-20 tokens with their contract addresses. If a transaction claims to involve
|
||||
a known symbol (like "ETH" or "USDT") but comes from an unrecognized contract,
|
||||
it is identified as a spoof and hidden.
|
||||
|
||||
**Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
|
||||
from transaction history and the send token list, and are left out of your
|
||||
balances unless they are on the bundled known-token list or you added them
|
||||
yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
|
||||
for address poisoning typically have zero.
|
||||
from transaction history and the send token list. Legitimate tokens have
|
||||
substantial holder counts; scam tokens deployed for address poisoning typically
|
||||
have zero.
|
||||
|
||||
**Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
|
||||
adds the contract address to a local blocklist. Future transactions from that
|
||||
@@ -340,47 +266,31 @@ ETH by default) are hidden. Scammers send dust from look-alike addresses to
|
||||
plant them in your transaction history. The threshold is configurable in
|
||||
Settings.
|
||||
|
||||
**Scam address list.** A list of known fraud, drainer, and phishing addresses is
|
||||
shipped with the extension. Sending to one of them raises a warning on the
|
||||
confirmation screen. It contains only addresses involved in fraud -- it is not a
|
||||
sanctions list.
|
||||
|
||||
**Phishing domain warnings.** Sites asking to connect or to have something
|
||||
approved are checked against the phishing domain blocklist described under
|
||||
External Services, and flagged with a red banner if they match.
|
||||
|
||||
The first four filters can be individually disabled in Settings if you prefer to
|
||||
All of these filters can be individually disabled in Settings if you prefer to
|
||||
see everything unfiltered.
|
||||
|
||||
## Settings
|
||||
|
||||
Click the gear icon on the home screen to access settings:
|
||||
|
||||
- **Wallets**: Your wallets, and "+ Add wallet".
|
||||
- **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
|
||||
token".
|
||||
- **Display**: Toggle whether tracked tokens with zero balance are shown, and
|
||||
choose the theme (System, Light, or Dark).
|
||||
- **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
|
||||
resets the RPC and Blockscout endpoints to that network's defaults.
|
||||
- **Wallets**: Add a new wallet.
|
||||
- **Display**: Toggle whether tracked tokens with zero balance are shown.
|
||||
- **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
|
||||
You can use your own node for maximum privacy.
|
||||
- **Blockscout API**: Change the Blockscout instance used for token balances and
|
||||
transaction history. You can use a self-hosted instance.
|
||||
- **Token Spam Protection**: Toggle individual scam filters, set the dust
|
||||
transaction threshold, and switch timestamps to UTC.
|
||||
- **Token Spam Protection**: Toggle individual scam filters and set the dust
|
||||
transaction threshold.
|
||||
- **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
|
||||
- **About**: License, author, version, release date, and a link to the commit
|
||||
this build came from.
|
||||
|
||||
## Frequently Asked Questions
|
||||
|
||||
**Can I use AutistMask alongside another wallet?**
|
||||
**Is AutistMask compatible with MetaMask?**
|
||||
|
||||
Yes. AutistMask uses the standard `m/44'/60'/0'/0` derivation path, so importing
|
||||
the same recovery phrase gives you the same addresses as any other wallet using
|
||||
that path. Two wallet extensions can be installed side by side, though only one
|
||||
can be the active `window.ethereum` provider at a time.
|
||||
Yes. AutistMask uses the same derivation path (`m/44'/60'/0'/0`) as MetaMask. If
|
||||
you import the same recovery phrase, you will get the same addresses. You can
|
||||
use both wallets side by side, though only one can be the active
|
||||
`window.ethereum` provider at a time.
|
||||
|
||||
**Can I use AutistMask with a hardware wallet?**
|
||||
|
||||
@@ -388,9 +298,8 @@ Not yet. Hardware wallet support may be added in the future.
|
||||
|
||||
**Does AutistMask support networks other than Ethereum mainnet?**
|
||||
|
||||
Ethereum mainnet and the Sepolia testnet, selectable in Settings. No other
|
||||
networks are supported today. On Sepolia, USD values are not shown, because
|
||||
testnet tokens have no market value.
|
||||
Not currently. AutistMask is Ethereum mainnet only. Multi-chain support may be
|
||||
added in the future.
|
||||
|
||||
**Where is my data stored?**
|
||||
|
||||
@@ -403,7 +312,7 @@ to any server operated by AutistMask.
|
||||
|
||||
Your data is deleted. Make sure you have your recovery phrase backed up before
|
||||
uninstalling. With your recovery phrase, you can restore your wallet in
|
||||
AutistMask or any other wallet that uses the standard derivation path.
|
||||
AutistMask or any other compatible wallet (MetaMask, etc.) at any time.
|
||||
|
||||
**What happens if a transaction times out?**
|
||||
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
"@tailwindcss/cli": "^4.2.1",
|
||||
"esbuild": "^0.27.3",
|
||||
"jest": "^30.2.0",
|
||||
"playwright-core": "1.56.0",
|
||||
"prettier": "^3.8.1",
|
||||
"tailwindcss": "^4.2.1"
|
||||
},
|
||||
|
||||
143
script/bootstrap
143
script/bootstrap
@@ -1,143 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/bootstrap: install all dependencies needed to build and develop
|
||||
# this repo. Idempotent: every install is guarded by a check so already
|
||||
# installed tools are skipped. Base tooling comes from nix, apt, brew,
|
||||
# or apk (detected in that order); assumes nothing is present. Node is
|
||||
# used directly if installed; otherwise it is installed at a pinned
|
||||
# version via nvm (installing nvm itself first, from a hash-verified
|
||||
# release archive, never curl | sh).
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Pinned versions, 2026-07-07
|
||||
NODE_VERSION="22.17.0"
|
||||
NVM_VERSION="0.40.3"
|
||||
# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
|
||||
NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
|
||||
YARN_VERSION="1.22.22"
|
||||
|
||||
PKGMGR=""
|
||||
SUDO=""
|
||||
APT_UPDATED=""
|
||||
|
||||
detect_pkgmgr() {
|
||||
[ -n "$PKGMGR" ] && return 0
|
||||
if command -v nix-env >/dev/null 2>&1; then
|
||||
PKGMGR="nix"
|
||||
elif command -v apt-get >/dev/null 2>&1; then
|
||||
PKGMGR="apt"
|
||||
elif command -v brew >/dev/null 2>&1; then
|
||||
PKGMGR="brew"
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
PKGMGR="apk"
|
||||
else
|
||||
echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ "$PKGMGR" = "apt" ]; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
SUDO="sudo"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
|
||||
pkg_install() {
|
||||
detect_pkgmgr
|
||||
case "$PKGMGR" in
|
||||
nix) nix-env -iA "nixpkgs.$1" ;;
|
||||
apt)
|
||||
if [ -z "$APT_UPDATED" ]; then
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
APT_UPDATED=1
|
||||
fi
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
|
||||
;;
|
||||
brew) brew install "$3" ;;
|
||||
apk) apk add --no-cache "$4" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
missing() {
|
||||
! command -v "$1" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# verify_sha256 <file> <expected-hash>
|
||||
verify_sha256() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
actual="$(sha256sum "$1" | cut -d' ' -f1)"
|
||||
else
|
||||
actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
|
||||
fi
|
||||
if [ "$actual" != "$2" ]; then
|
||||
echo "bootstrap: sha256 mismatch for $1" >&2
|
||||
echo " expected: $2" >&2
|
||||
echo " actual: $actual" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# nvm is a bash script; run a command in a bash with nvm loaded
|
||||
nvm_sh() {
|
||||
bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
|
||||
}
|
||||
|
||||
ensure_nvm() {
|
||||
[ -s "$HOME/.nvm/nvm.sh" ] && return 0
|
||||
# nvm prerequisites; nvm itself requires bash
|
||||
if missing bash; then pkg_install bash bash bash bash; fi
|
||||
if missing curl; then pkg_install curl curl curl curl; fi
|
||||
if missing git; then pkg_install git git git git; fi
|
||||
tmp="$(mktemp -d)"
|
||||
curl -fsSL -o "$tmp/nvm.tar.gz" \
|
||||
"https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
|
||||
verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
|
||||
mkdir -p "$HOME/.nvm"
|
||||
tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
|
||||
rm -rf "$tmp"
|
||||
}
|
||||
|
||||
ensure_node() {
|
||||
if ! missing node; then return 0; fi
|
||||
ensure_nvm
|
||||
nvm_sh "nvm install $NODE_VERSION"
|
||||
}
|
||||
|
||||
ensure_yarn() {
|
||||
if ! missing yarn; then return 0; fi
|
||||
if ! missing corepack; then
|
||||
corepack enable
|
||||
corepack prepare "yarn@$YARN_VERSION" --activate
|
||||
elif [ -s "$HOME/.nvm/nvm.sh" ]; then
|
||||
nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
|
||||
corepack prepare yarn@$YARN_VERSION --activate"
|
||||
else
|
||||
npm install -g "yarn@$YARN_VERSION"
|
||||
fi
|
||||
}
|
||||
|
||||
install_js_deps() {
|
||||
if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
|
||||
nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
|
||||
yarn install --frozen-lockfile"
|
||||
else
|
||||
yarn install --frozen-lockfile
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if missing make; then pkg_install gnumake make make make; fi
|
||||
if missing git; then pkg_install git git git git; fi
|
||||
|
||||
ensure_node
|
||||
ensure_yarn
|
||||
install_js_deps
|
||||
|
||||
echo "bootstrap complete"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
14
script/check
14
script/check
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check: run all checks (test, lint, fmt-check). Our own
|
||||
# extension to scripts-to-rule-them-all. Must not modify any files.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/test"
|
||||
"$SCRIPT_DIR/lint"
|
||||
"$SCRIPT_DIR/fmt-check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/cibuild: run the CI build. The Dockerfile runs make check, so
|
||||
# a successful build implies all checks pass.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/docker: build the Docker image tagged with the project name.
|
||||
# Identical in all repos; the tag comes from script/projectname.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build -t "$("$SCRIPT_DIR/projectname")" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/fmt
13
script/fmt
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt: format all files (writes).
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Formatting..."
|
||||
yarn run fmt 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt-check: check formatting (read-only). Same scope as
|
||||
# script/fmt, but fails instead of writing.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Checking formatting..."
|
||||
yarn run fmt-check 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,16 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/install-precommit: install the git pre-commit hook that runs
|
||||
# script/precommit. Our own extension to scripts-to-rule-them-all.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
hook=".git/hooks/pre-commit"
|
||||
printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
|
||||
chmod +x "$hook"
|
||||
echo "pre-commit hook installed: runs script/precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/lint
13
script/lint
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/precommit: run by the git pre-commit hook; fails the commit if
|
||||
# checks fail. Our own extension to scripts-to-rule-them-all.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/projectname: output the name of this project. Our own
|
||||
# extension to scripts-to-rule-them-all. Other scripts that need the
|
||||
# name (e.g. script/docker) call this, so they can stay identical
|
||||
# across all repos.
|
||||
set -eu
|
||||
|
||||
main() {
|
||||
echo "autistmask"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/setup
13
script/setup
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/setup: set up the repo for development after a fresh clone:
|
||||
# installs dependencies and the git pre-commit hook.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/bootstrap"
|
||||
"$SCRIPT_DIR/install-precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/test
13
script/test
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Running tests..."
|
||||
timeout 30 yarn run test 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,64 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-e2e: build the extension and drive the real popup in a real
|
||||
# Chromium inside a pinned container. Our own extension to
|
||||
# scripts-to-rule-them-all.
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
|
||||
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
||||
# yourself before touching popup views; it is the only check that can see
|
||||
# a used-but-not-imported identifier blow up at runtime.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "test-e2e: docker is required to run the e2e suite" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Building extension for e2e..."
|
||||
yarn run build 2>&1
|
||||
|
||||
echo "Running e2e suite in the pinned Playwright container..."
|
||||
# --ipc=host: Chromium's shared-memory needs more than the default
|
||||
# 64MB /dev/shm or renderers crash.
|
||||
# --user: keep files the suite touches owned by the caller, not root.
|
||||
# HOME=/tmp: the mapped uid has no home directory in the image.
|
||||
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
||||
# ctx.route() intercepts page requests only, and every fetch made by
|
||||
# the MV3 background service worker — including the phishing
|
||||
# blocklist fetch that src/background/index.js issues at worker
|
||||
# startup — goes to the real internet. The flag is experimental and
|
||||
# Playwright may drop or rename it. It cannot break silently: the
|
||||
# harness probes service-worker interception at launch and aborts
|
||||
# the whole suite if it is not in effect (see the interception
|
||||
# canary in tests/e2e/harness.js). If a future Playwright removes
|
||||
# the flag, that probe is what will fail, and the fix is either a
|
||||
# replacement mechanism or an honest downgrade of the isolation
|
||||
# claim in tests/e2e/network.js and README.md — not deleting the
|
||||
# probe. The image is pinned by digest, so this can only ever bite
|
||||
# on a deliberate bump.
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-e HOME=/tmp \
|
||||
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
||||
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
||||
-v "$ROOT:/work" \
|
||||
-w /work \
|
||||
"$IMAGE" \
|
||||
node tests/e2e/run.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,136 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/verify-build: assert the compiled DEBUG state of the emitted
|
||||
# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
|
||||
# make build / make build-debug.
|
||||
#
|
||||
# Why this exists: DEBUG makes the publicly committed test recovery phrase the
|
||||
# output of wallet creation, so a release artifact built with it live hands
|
||||
# every new wallet to anyone who reads the repo. The test suite cannot see
|
||||
# this, because it loads src/shared/constants.js outside a bundle and takes
|
||||
# the fallback branch; the property only exists in the emitted output, so it
|
||||
# has to be asserted against the emitted output.
|
||||
#
|
||||
# What it reads: dist/constants-bundles.txt, written by build.js from
|
||||
# esbuild's metafile, naming every emitted bundle that contains
|
||||
# src/shared/constants.js. Each of those must carry exactly one of the two
|
||||
# BUILD_DEBUG_MARKER literals that constants.js folds down to.
|
||||
#
|
||||
# It fails rather than passes whenever it cannot determine a bundle's state.
|
||||
# Minified output is not a stable contract, so "matched neither form" is not
|
||||
# evidence of anything and must never read as green.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
MANIFEST="dist/constants-bundles.txt"
|
||||
MARKER_ON="autistmask-build-debug=on"
|
||||
MARKER_OFF="autistmask-build-debug=off"
|
||||
|
||||
# Set by read_marker.
|
||||
MARKER=""
|
||||
|
||||
fail() {
|
||||
echo "verify-build: FAIL: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
has_marker() {
|
||||
grep -q -F "$1" "$2" 2>/dev/null
|
||||
}
|
||||
|
||||
# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
|
||||
# present. Both means the ternary in constants.js was never folded, which is
|
||||
# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
|
||||
# DEBUG stops being known at build time and the debug branch is live again.
|
||||
# Neither means we are reading output we do not understand. Both are hard
|
||||
# failures; neither is ever treated as absence of a problem.
|
||||
read_marker() {
|
||||
_file="$1"
|
||||
_on=no
|
||||
_off=no
|
||||
if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
|
||||
if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
|
||||
|
||||
if [ "$_on" = yes ] && [ "$_off" = yes ]; then
|
||||
fail "$_file carries both debug markers, so the build-time DEBUG value
|
||||
was never resolved and the debug branch is still live. Check that build.js
|
||||
still defines __BUILD_DEBUG__."
|
||||
fi
|
||||
if [ "$_on" = no ] && [ "$_off" = no ]; then
|
||||
fail "$_file carries no debug marker, so its DEBUG state cannot be
|
||||
determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
|
||||
or the emitted output changed shape. Refusing to report success."
|
||||
fi
|
||||
|
||||
if [ "$_on" = yes ]; then
|
||||
MARKER="$MARKER_ON"
|
||||
else
|
||||
MARKER="$MARKER_OFF"
|
||||
fi
|
||||
}
|
||||
|
||||
# The manifest says which bundles must carry a marker. This says no other
|
||||
# emitted bundle may carry one, which catches a manifest that has gone stale
|
||||
# or short rather than trusting whatever it happens to list.
|
||||
check_unlisted_bundles() {
|
||||
_listing="$(find dist -type f -name '*.js' | sort)"
|
||||
while read -r _file; do
|
||||
[ -n "$_file" ] || continue
|
||||
if grep -q -x -F "$_file" "$MANIFEST"; then
|
||||
continue
|
||||
fi
|
||||
if has_marker "$MARKER_ON" "$_file" ||
|
||||
has_marker "$MARKER_OFF" "$_file"; then
|
||||
fail "$_file carries a debug marker but is absent from $MANIFEST,
|
||||
so the manifest no longer describes the emitted bundles."
|
||||
fi
|
||||
done <<EOF
|
||||
$_listing
|
||||
EOF
|
||||
}
|
||||
|
||||
# The requested mode, read from our own environment using build.js's exact
|
||||
# rule: only the literal 1 opts in. Deliberately not taken from anything
|
||||
# build.js records about itself, so build.js cannot vouch for build.js.
|
||||
expected_marker() {
|
||||
if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
|
||||
echo "$MARKER_ON"
|
||||
else
|
||||
echo "$MARKER_OFF"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
expected="$(expected_marker)"
|
||||
echo "Verifying emitted bundles (expecting $expected)..."
|
||||
|
||||
[ -f "$MANIFEST" ] ||
|
||||
fail "$MANIFEST is missing. build.js writes it at the end of a
|
||||
successful build; run make build first."
|
||||
[ -s "$MANIFEST" ] ||
|
||||
fail "$MANIFEST is empty, so no emitted bundle was found to contain
|
||||
src/shared/constants.js. That is never correct, so it is a failure and not
|
||||
a pass."
|
||||
|
||||
count=0
|
||||
while read -r file; do
|
||||
[ -n "$file" ] || continue
|
||||
[ -f "$file" ] ||
|
||||
fail "$MANIFEST lists $file, which does not exist."
|
||||
read_marker "$file"
|
||||
[ "$MARKER" = "$expected" ] ||
|
||||
fail "$file is $MARKER but this build expects $expected."
|
||||
echo " ok: $file ($MARKER)"
|
||||
count=$((count + 1))
|
||||
done <"$MANIFEST"
|
||||
|
||||
[ "$count" -gt 0 ] || fail "no bundles were inspected."
|
||||
|
||||
check_unlisted_bundles
|
||||
|
||||
echo "verify-build: $count bundle(s) verified $expected"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -2,23 +2,16 @@
|
||||
// Handles EIP-1193 RPC requests from content scripts and proxies
|
||||
// non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
|
||||
|
||||
const { DEFAULT_RPC_URL } = require("../shared/constants");
|
||||
const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
|
||||
const { onChainSwitch } = require("../shared/chainSwitch");
|
||||
const {
|
||||
state,
|
||||
loadState,
|
||||
saveState,
|
||||
currentNetwork,
|
||||
} = require("../shared/state");
|
||||
ETHEREUM_MAINNET_CHAIN_ID,
|
||||
DEFAULT_RPC_URL,
|
||||
} = require("../shared/constants");
|
||||
const { getBytes } = require("ethers");
|
||||
const { state, loadState, saveState } = require("../shared/state");
|
||||
const { refreshBalances, getProvider } = require("../shared/balances");
|
||||
const { debugFetch } = require("../shared/log");
|
||||
const { verifySignedTx, verifySignature } = require("../shared/approvalVerify");
|
||||
const {
|
||||
isPhishingDomain,
|
||||
updatePhishingList,
|
||||
startPeriodicRefresh,
|
||||
} = require("../shared/phishingDomains");
|
||||
const { decryptWithPassword } = require("../shared/vault");
|
||||
const { getSignerForAddress } = require("../shared/wallet");
|
||||
|
||||
const storageApi =
|
||||
typeof browser !== "undefined"
|
||||
@@ -331,43 +324,31 @@ async function handleRpc(method, params, origin) {
|
||||
}
|
||||
|
||||
if (method === "eth_chainId") {
|
||||
return { result: currentNetwork().chainId };
|
||||
return { result: ETHEREUM_MAINNET_CHAIN_ID };
|
||||
}
|
||||
|
||||
if (method === "net_version") {
|
||||
return { result: currentNetwork().networkVersion };
|
||||
return { result: "1" };
|
||||
}
|
||||
|
||||
if (method === "wallet_switchEthereumChain") {
|
||||
const chainId = params?.[0]?.chainId;
|
||||
if (chainId === currentNetwork().chainId) {
|
||||
return { result: null };
|
||||
}
|
||||
if (SUPPORTED_CHAIN_IDS.has(chainId)) {
|
||||
const target = networkByChainId(chainId);
|
||||
await onChainSwitch(target.id);
|
||||
broadcastChainChanged(target.chainId);
|
||||
if (chainId === ETHEREUM_MAINNET_CHAIN_ID) {
|
||||
return { result: null };
|
||||
}
|
||||
return {
|
||||
error: {
|
||||
code: 4902,
|
||||
message:
|
||||
"AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
|
||||
message: "AutistMask only supports Ethereum mainnet.",
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
if (method === "wallet_addEthereumChain") {
|
||||
const chainId = params?.[0]?.chainId;
|
||||
if (SUPPORTED_CHAIN_IDS.has(chainId)) {
|
||||
return { result: null };
|
||||
}
|
||||
return {
|
||||
error: {
|
||||
code: 4902,
|
||||
message:
|
||||
"AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
|
||||
message: "AutistMask only supports Ethereum mainnet.",
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -513,27 +494,6 @@ async function handleRpc(method, params, origin) {
|
||||
return { error: { message: "Unsupported method: " + method } };
|
||||
}
|
||||
|
||||
// Broadcast chainChanged to all tabs when the network is switched.
|
||||
function broadcastChainChanged(chainId) {
|
||||
tabsApi.query({}, (tabs) => {
|
||||
for (const tab of tabs) {
|
||||
tabsApi.sendMessage(
|
||||
tab.id,
|
||||
{
|
||||
type: "AUTISTMASK_EVENT",
|
||||
eventName: "chainChanged",
|
||||
data: chainId,
|
||||
},
|
||||
() => {
|
||||
if (runtime.lastError) {
|
||||
// expected for tabs without our content script
|
||||
}
|
||||
},
|
||||
);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Broadcast accountsChanged to all tabs, respecting per-address permissions
|
||||
async function broadcastAccountsChanged() {
|
||||
// Clear non-remembered approvals on address switch
|
||||
@@ -611,11 +571,6 @@ async function backgroundRefresh() {
|
||||
|
||||
setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL);
|
||||
|
||||
// Fetch the phishing domain blocklist delta on startup and refresh every 24h.
|
||||
// The vendored blocklist is bundled at build time; this fetches only new entries.
|
||||
updatePhishingList();
|
||||
startPeriodicRefresh();
|
||||
|
||||
// When approval window is closed without a response, treat as rejection
|
||||
if (windowsApi && windowsApi.onRemoved) {
|
||||
windowsApi.onRemoved.addListener((windowId) => {
|
||||
@@ -688,8 +643,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
resp.type = "sign";
|
||||
resp.signParams = approval.signParams;
|
||||
}
|
||||
// Flag if the requesting domain is on the phishing blocklist.
|
||||
resp.isPhishingDomain = isPhishingDomain(approval.hostname);
|
||||
sendResponse(resp);
|
||||
} else {
|
||||
sendResponse(null);
|
||||
@@ -723,28 +676,39 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
return true;
|
||||
}
|
||||
|
||||
// The popup signs; it reports back here when it could not. Fail the
|
||||
// request the same way this handler used to when it did the signing.
|
||||
if (msg.error) {
|
||||
approval.resolve({ error: { message: msg.error } });
|
||||
sendResponse({ error: msg.error });
|
||||
return false;
|
||||
}
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await loadState();
|
||||
const activeAddress = await getActiveAddress();
|
||||
// The popup holds the secret, but the background stays the
|
||||
// authority on what is broadcast: the raw transaction must be
|
||||
// the approved one, signed by the approved address.
|
||||
verifySignedTx(
|
||||
msg.rawSignedTx,
|
||||
approval.txParams,
|
||||
activeAddress,
|
||||
let wallet, addrIndex;
|
||||
for (const w of state.wallets) {
|
||||
for (let i = 0; i < w.addresses.length; i++) {
|
||||
if (w.addresses[i].address === activeAddress) {
|
||||
wallet = w;
|
||||
addrIndex = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (wallet) break;
|
||||
}
|
||||
if (!wallet) throw new Error("Wallet not found");
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
let decrypted = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
msg.password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
addrIndex,
|
||||
decrypted,
|
||||
);
|
||||
// Best-effort: clear decrypted secret after use.
|
||||
// Note: JS strings are immutable; this nulls the reference but
|
||||
// the original string may persist in memory until GC.
|
||||
decrypted = null;
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const tx = await provider.broadcastTransaction(msg.rawSignedTx);
|
||||
const connected = signer.connect(provider);
|
||||
const tx = await connected.sendTransaction(approval.txParams);
|
||||
approval.resolve({ txHash: tx.hash });
|
||||
sendResponse({ txHash: tx.hash });
|
||||
} catch (e) {
|
||||
@@ -771,23 +735,55 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
return true;
|
||||
}
|
||||
|
||||
// The popup signs; it reports back here when it could not. Fail the
|
||||
// request the same way this handler used to when it did the signing.
|
||||
if (msg.error) {
|
||||
approval.resolve({ error: { message: msg.error } });
|
||||
sendResponse({ error: msg.error });
|
||||
return false;
|
||||
}
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await loadState();
|
||||
const activeAddress = await getActiveAddress();
|
||||
// The popup holds the secret, but the background stays the
|
||||
// authority on what is handed back to the page: the signature
|
||||
// must cover the approved payload and recover to the approved
|
||||
// address.
|
||||
const signature = msg.signature;
|
||||
verifySignature(approval.signParams, signature, activeAddress);
|
||||
let wallet, addrIndex;
|
||||
for (const w of state.wallets) {
|
||||
for (let i = 0; i < w.addresses.length; i++) {
|
||||
if (w.addresses[i].address === activeAddress) {
|
||||
wallet = w;
|
||||
addrIndex = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (wallet) break;
|
||||
}
|
||||
if (!wallet) throw new Error("Wallet not found");
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
let decrypted = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
msg.password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
addrIndex,
|
||||
decrypted,
|
||||
);
|
||||
// Best-effort: clear decrypted secret after use.
|
||||
// Note: JS strings are immutable; this nulls the reference but
|
||||
// the original string may persist in memory until GC.
|
||||
decrypted = null;
|
||||
|
||||
const sp = approval.signParams;
|
||||
let signature;
|
||||
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") {
|
||||
signature = await signer.signMessage(getBytes(sp.message));
|
||||
} else {
|
||||
// eth_signTypedData_v4 / eth_signTypedData
|
||||
const typedData = JSON.parse(sp.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers handles EIP712Domain internally
|
||||
delete types.EIP712Domain;
|
||||
signature = await signer.signTypedData(
|
||||
domain,
|
||||
types,
|
||||
message,
|
||||
);
|
||||
}
|
||||
|
||||
approval.resolve({ signature });
|
||||
sendResponse({ signature });
|
||||
} catch (e) {
|
||||
|
||||
@@ -2,10 +2,7 @@
|
||||
// Creates window.ethereum (EIP-1193 provider) and announces via EIP-6963.
|
||||
|
||||
(function () {
|
||||
// Defaults to mainnet; updated dynamically via eth_chainId on init and
|
||||
// chainChanged events from the extension.
|
||||
let currentChainId = "0x1";
|
||||
let currentNetworkVersion = "1";
|
||||
const CHAIN_ID = "0x1"; // Ethereum mainnet
|
||||
|
||||
const listeners = {};
|
||||
let nextId = 1;
|
||||
@@ -31,12 +28,6 @@
|
||||
if (event.source !== window) return;
|
||||
if (event.data?.type !== "AUTISTMASK_EVENT") return;
|
||||
const { eventName, data } = event.data;
|
||||
if (eventName === "chainChanged") {
|
||||
currentChainId = data;
|
||||
currentNetworkVersion = String(parseInt(data, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
emit(eventName, data);
|
||||
});
|
||||
|
||||
@@ -66,8 +57,8 @@
|
||||
const provider = {
|
||||
isAutistMask: true,
|
||||
isMetaMask: true, // compatibility — many dApps check this
|
||||
chainId: currentChainId,
|
||||
networkVersion: currentNetworkVersion,
|
||||
chainId: CHAIN_ID,
|
||||
networkVersion: "1",
|
||||
selectedAddress: null,
|
||||
|
||||
async request(args) {
|
||||
@@ -84,12 +75,6 @@
|
||||
? result[0]
|
||||
: null;
|
||||
}
|
||||
if (args.method === "eth_chainId" && result) {
|
||||
currentChainId = result;
|
||||
currentNetworkVersion = String(parseInt(result, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
return result;
|
||||
},
|
||||
|
||||
@@ -204,19 +189,4 @@
|
||||
|
||||
window.addEventListener("eip6963:requestProvider", announceProvider);
|
||||
announceProvider();
|
||||
|
||||
// Fetch the current chain ID from the extension on load so the provider
|
||||
// reflects the selected network immediately (covers Sepolia etc.).
|
||||
sendRequest({ method: "eth_chainId", params: [] })
|
||||
.then((chainId) => {
|
||||
if (chainId) {
|
||||
currentChainId = chainId;
|
||||
currentNetworkVersion = String(parseInt(chainId, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
// Best-effort — keep defaults.
|
||||
});
|
||||
})();
|
||||
|
||||
@@ -56,105 +56,37 @@
|
||||
< Back
|
||||
</button>
|
||||
<h2 class="font-bold mb-2">Add Wallet</h2>
|
||||
|
||||
<!-- Mode selector tabs -->
|
||||
<p class="mb-2">
|
||||
Enter your 12 or 24 word recovery phrase below, or click the
|
||||
button to roll the die for a new one.
|
||||
</p>
|
||||
<div class="mb-1 flex justify-end">
|
||||
<button
|
||||
id="btn-generate-phrase"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
|
||||
title="Generate a random recovery phrase"
|
||||
>
|
||||
[⚀]
|
||||
</button>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<textarea
|
||||
id="wallet-mnemonic"
|
||||
rows="3"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg resize-y"
|
||||
placeholder="word word word ..."
|
||||
></textarea>
|
||||
</div>
|
||||
<div
|
||||
class="flex border-b border-border mb-3"
|
||||
id="add-wallet-tabs"
|
||||
id="add-wallet-phrase-warning"
|
||||
class="text-xs mb-2 border border-border border-dashed p-2 hidden"
|
||||
>
|
||||
<button
|
||||
id="tab-mnemonic"
|
||||
class="px-3 py-1.5 cursor-pointer text-xs font-bold border border-border border-b-bg bg-bg -mb-px"
|
||||
>
|
||||
From Phrase
|
||||
</button>
|
||||
<button
|
||||
id="tab-privkey"
|
||||
class="px-3 py-1.5 cursor-pointer text-xs text-muted border border-dashed border-border-light border-b-transparent -mb-px hover:bg-fg hover:text-bg"
|
||||
>
|
||||
From Key
|
||||
</button>
|
||||
<button
|
||||
id="tab-xprv"
|
||||
class="px-3 py-1.5 cursor-pointer text-xs text-muted border border-dashed border-border-light border-b-transparent -mb-px hover:bg-fg hover:text-bg"
|
||||
>
|
||||
From xprv
|
||||
</button>
|
||||
Write these words down and keep them safe. Anyone with them
|
||||
can take your funds; if you lose them, your wallet is gone.
|
||||
</div>
|
||||
|
||||
<!-- Mnemonic form section -->
|
||||
<div id="add-wallet-section-mnemonic">
|
||||
<p class="mb-2">
|
||||
Enter your 12 or 24 word recovery phrase below, or click
|
||||
the button to roll the die for a new one.
|
||||
</p>
|
||||
<div class="mb-1 flex justify-end">
|
||||
<button
|
||||
id="btn-generate-phrase"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
|
||||
title="Generate a random recovery phrase"
|
||||
>
|
||||
[⚀]
|
||||
</button>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<textarea
|
||||
id="wallet-mnemonic"
|
||||
rows="3"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg resize-y"
|
||||
placeholder="word word word ..."
|
||||
></textarea>
|
||||
</div>
|
||||
<div
|
||||
id="add-wallet-phrase-warning"
|
||||
class="text-xs mb-2 border border-border border-dashed p-2"
|
||||
style="visibility: hidden"
|
||||
>
|
||||
Write these words down and keep them safe. Anyone with
|
||||
them can take your funds; if you lose them, your wallet
|
||||
is gone.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Private key form section -->
|
||||
<div id="add-wallet-section-privkey" class="hidden">
|
||||
<p class="mb-2">
|
||||
Paste your private key below. This wallet will have a
|
||||
single address.
|
||||
</p>
|
||||
<div class="mb-2">
|
||||
<input
|
||||
type="password"
|
||||
id="import-private-key"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="0x..."
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Extended key (xprv) form section -->
|
||||
<div id="add-wallet-section-xprv" class="hidden">
|
||||
<p class="mb-2">
|
||||
Paste your extended private key (xprv) below. This will
|
||||
import the HD wallet and scan for used addresses.
|
||||
</p>
|
||||
<div class="mb-2">
|
||||
<input
|
||||
type="password"
|
||||
id="import-xprv-key"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="xprv..."
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Shared password fields -->
|
||||
<div class="mb-2" id="add-wallet-password-section">
|
||||
<label class="block mb-1">Choose a password</label>
|
||||
<p
|
||||
class="text-xs text-muted mb-1"
|
||||
id="add-wallet-password-hint"
|
||||
>
|
||||
<p class="text-xs text-muted mb-1">
|
||||
This password encrypts your recovery phrase on this
|
||||
device. You will need it to send funds.
|
||||
</p>
|
||||
@@ -175,6 +107,64 @@
|
||||
<button
|
||||
id="btn-add-wallet-confirm"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Add
|
||||
</button>
|
||||
<div class="mt-3 text-xs text-muted">
|
||||
Have a private key instead?
|
||||
<button
|
||||
id="btn-add-wallet-import-key"
|
||||
class="underline cursor-pointer bg-transparent border-none text-fg text-xs font-mono p-0"
|
||||
>
|
||||
Import private key
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ IMPORT PRIVATE KEY ============ -->
|
||||
<div id="view-import-key" class="view hidden">
|
||||
<button
|
||||
id="btn-import-key-back"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
|
||||
>
|
||||
< Back
|
||||
</button>
|
||||
<h2 class="font-bold mb-2">Import Private Key</h2>
|
||||
<p class="mb-2">
|
||||
Paste your private key below. This wallet will have a single
|
||||
address.
|
||||
</p>
|
||||
<div class="mb-2">
|
||||
<input
|
||||
type="password"
|
||||
id="import-private-key"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="0x..."
|
||||
/>
|
||||
</div>
|
||||
<div class="mb-2" id="import-key-password-section">
|
||||
<label class="block mb-1">Choose a password</label>
|
||||
<p class="text-xs text-muted mb-1">
|
||||
This password encrypts your private key on this device.
|
||||
You will need it to send funds.
|
||||
</p>
|
||||
<input
|
||||
type="password"
|
||||
id="import-key-password"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
/>
|
||||
</div>
|
||||
<div class="mb-2" id="import-key-password-confirm-section">
|
||||
<label class="block mb-1">Confirm password</label>
|
||||
<input
|
||||
type="password"
|
||||
id="import-key-password-confirm"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
/>
|
||||
</div>
|
||||
<button
|
||||
id="btn-import-key-confirm"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Import
|
||||
</button>
|
||||
@@ -185,7 +175,7 @@
|
||||
<!-- active address headline -->
|
||||
<div
|
||||
id="total-value"
|
||||
class="text-2xl font-bold min-h-[2rem] text-fg"
|
||||
class="text-2xl font-bold min-h-[2rem]"
|
||||
></div>
|
||||
<div
|
||||
id="total-value-sub"
|
||||
@@ -315,26 +305,6 @@
|
||||
>
|
||||
+ Token
|
||||
</button>
|
||||
<div class="relative">
|
||||
<button
|
||||
id="btn-more-menu"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
aria-label="More actions"
|
||||
>
|
||||
···
|
||||
</button>
|
||||
<div
|
||||
id="more-menu-dropdown"
|
||||
class="hidden absolute right-0 top-full mt-1 border border-border bg-bg z-50 whitespace-nowrap py-1"
|
||||
>
|
||||
<button
|
||||
id="btn-export-privkey"
|
||||
class="block w-full text-left px-4 py-1.5 text-xs font-light text-muted hover:bg-hover hover:text-fg cursor-pointer"
|
||||
>
|
||||
Export Private Key
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- transactions -->
|
||||
@@ -348,61 +318,6 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ EXPORT PRIVATE KEY VIEW ============ -->
|
||||
<div id="view-export-privkey" class="view hidden">
|
||||
<button
|
||||
id="btn-export-privkey-back"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
|
||||
>
|
||||
< Back
|
||||
</button>
|
||||
<div
|
||||
id="export-privkey-jazzicon"
|
||||
class="flex justify-center mt-1 mb-3"
|
||||
></div>
|
||||
<h2 class="font-bold mb-1">Export Private Key</h2>
|
||||
<p class="text-xs mb-1" id="export-privkey-title"></p>
|
||||
<p class="text-xs mb-3">
|
||||
<span id="export-privkey-dot"></span>
|
||||
<span
|
||||
id="export-privkey-address"
|
||||
class="cursor-pointer"
|
||||
title="Click to copy"
|
||||
></span>
|
||||
</p>
|
||||
<p class="text-xs mb-3 text-muted">
|
||||
Warning: anyone with this private key can access and
|
||||
transfer all funds from this address. Never share it.
|
||||
</p>
|
||||
<div
|
||||
id="export-privkey-flash"
|
||||
class="text-xs mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<div id="export-privkey-password-section" class="mb-2">
|
||||
<label class="block mb-1">Password</label>
|
||||
<input
|
||||
type="password"
|
||||
id="export-privkey-password"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="Enter your password to continue"
|
||||
/>
|
||||
<button
|
||||
id="btn-export-privkey-confirm"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mt-2"
|
||||
>
|
||||
Reveal
|
||||
</button>
|
||||
</div>
|
||||
<div id="export-privkey-result" class="hidden">
|
||||
<div
|
||||
id="export-privkey-value"
|
||||
class="bg-danger-well rounded p-2 font-mono text-xs break-all cursor-pointer mb-1"
|
||||
title="Click to copy"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ ADDRESS-TOKEN DETAIL VIEW ============ -->
|
||||
<div id="view-address-token" class="view hidden">
|
||||
<button
|
||||
@@ -507,11 +422,6 @@
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="Address (0x...) or ENS name"
|
||||
/>
|
||||
<div
|
||||
id="send-to-error"
|
||||
class="text-xs"
|
||||
style="min-height: 1.25rem; color: #cc0000"
|
||||
></div>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<div class="flex justify-between mb-1">
|
||||
@@ -581,90 +491,22 @@
|
||||
<div class="text-xs text-muted mb-1">Your balance</div>
|
||||
<div id="confirm-balance" class="text-xs"></div>
|
||||
</div>
|
||||
<div id="confirm-fee" class="mb-3" style="visibility: hidden">
|
||||
<div id="confirm-fee" class="mb-3 hidden">
|
||||
<div class="text-xs text-muted mb-1">
|
||||
Estimated network fee
|
||||
</div>
|
||||
<div id="confirm-fee-amount" class="text-xs"></div>
|
||||
</div>
|
||||
<div
|
||||
id="confirm-warnings"
|
||||
class="mb-2"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<div
|
||||
id="confirm-recipient-warning"
|
||||
class="mb-2"
|
||||
style="visibility: hidden"
|
||||
>
|
||||
<div
|
||||
class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
|
||||
>
|
||||
WARNING: The recipient address has ZERO transaction
|
||||
history. This may indicate a fresh or unused address.
|
||||
Double-check the address before sending.
|
||||
</div>
|
||||
</div>
|
||||
<div
|
||||
id="confirm-contract-warning"
|
||||
class="mb-2"
|
||||
style="visibility: hidden"
|
||||
>
|
||||
<div
|
||||
class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
|
||||
>
|
||||
WARNING: The recipient is a smart contract. Sending ETH
|
||||
or tokens directly to a contract may result in permanent
|
||||
loss of funds.
|
||||
</div>
|
||||
</div>
|
||||
<div
|
||||
id="confirm-burn-warning"
|
||||
class="mb-2"
|
||||
style="visibility: hidden"
|
||||
>
|
||||
<div
|
||||
class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
|
||||
>
|
||||
WARNING: This is a known null/burn address. Funds sent
|
||||
here are permanently destroyed and cannot be recovered.
|
||||
</div>
|
||||
</div>
|
||||
<div
|
||||
id="confirm-etherscan-warning"
|
||||
class="mb-2"
|
||||
style="visibility: hidden"
|
||||
>
|
||||
<div
|
||||
class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
|
||||
>
|
||||
WARNING: Etherscan has flagged this address as
|
||||
phishing/scam. Do not send funds to this address.
|
||||
</div>
|
||||
</div>
|
||||
<div id="confirm-warnings" class="mb-2 hidden"></div>
|
||||
<div
|
||||
id="confirm-errors"
|
||||
class="mb-2 border border-border border-dashed p-2"
|
||||
style="visibility: hidden; min-height: 1.25rem"
|
||||
></div>
|
||||
<div class="mb-2">
|
||||
<label class="block mb-1 text-xs">Password</label>
|
||||
<input
|
||||
type="password"
|
||||
id="confirm-tx-password"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
id="confirm-tx-password-error"
|
||||
class="text-xs mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
class="mb-2 border border-border border-dashed p-2 hidden"
|
||||
></div>
|
||||
<button
|
||||
id="btn-confirm-send"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Sign & Send
|
||||
Send
|
||||
</button>
|
||||
</div>
|
||||
|
||||
@@ -689,7 +531,6 @@
|
||||
<!-- ============ TX SUCCESS ============ -->
|
||||
<div id="view-success-tx" class="view hidden">
|
||||
<h2 class="font-bold mb-2">Transaction Confirmed</h2>
|
||||
<div id="success-tx-decoded" class="mb-3 hidden text-xs"></div>
|
||||
<div class="mb-3">
|
||||
<div class="text-xs text-muted mb-1">Amount</div>
|
||||
<div id="success-tx-summary" class="font-bold"></div>
|
||||
@@ -743,6 +584,42 @@
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<!-- ============ PASSWORD MODAL ============ -->
|
||||
<div
|
||||
id="password-modal"
|
||||
class="hidden fixed inset-0 bg-bg flex items-center justify-center z-50"
|
||||
>
|
||||
<div class="border border-border p-4 bg-bg w-80">
|
||||
<h2 class="font-bold mb-2">Enter Password</h2>
|
||||
<p class="text-xs text-muted mb-2">
|
||||
Your password is needed to authorize this transaction.
|
||||
</p>
|
||||
<input
|
||||
type="password"
|
||||
id="modal-password"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg mb-2"
|
||||
/>
|
||||
<div
|
||||
id="modal-password-error"
|
||||
class="text-xs mb-2 border border-border border-dashed p-1 hidden"
|
||||
></div>
|
||||
<div class="flex gap-2">
|
||||
<button
|
||||
id="btn-modal-confirm"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Confirm
|
||||
</button>
|
||||
<button
|
||||
id="btn-modal-cancel"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Cancel
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ RECEIVE ============ -->
|
||||
<div id="view-receive" class="view hidden">
|
||||
<button
|
||||
@@ -759,10 +636,9 @@
|
||||
<div class="flex justify-center mb-3">
|
||||
<canvas id="receive-qr"></canvas>
|
||||
</div>
|
||||
<div
|
||||
class="border border-border p-2 break-all mb-3 text-xs cursor-pointer"
|
||||
>
|
||||
<span id="receive-address-block" class="select-all"></span>
|
||||
<div class="border border-border p-2 break-all mb-3 text-xs">
|
||||
<span id="receive-dot"></span>
|
||||
<span id="receive-address" class="select-all"></span>
|
||||
<span id="receive-etherscan-link"></span>
|
||||
</div>
|
||||
<button
|
||||
@@ -773,8 +649,7 @@
|
||||
</button>
|
||||
<div
|
||||
id="receive-erc20-warning"
|
||||
class="text-xs border border-border border-dashed p-2 mt-3"
|
||||
style="visibility: hidden"
|
||||
class="text-xs border border-border border-dashed p-2 mt-3 hidden"
|
||||
></div>
|
||||
</div>
|
||||
|
||||
@@ -802,8 +677,7 @@
|
||||
</div>
|
||||
<div
|
||||
id="add-token-info"
|
||||
class="text-xs text-muted mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
class="text-xs text-muted mb-2 hidden"
|
||||
></div>
|
||||
<div class="mb-2">
|
||||
<label class="block mb-1 text-xs text-muted"
|
||||
@@ -861,7 +735,7 @@
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<h3 class="font-bold mb-1">Display</h3>
|
||||
<label
|
||||
class="text-xs flex items-center gap-1 cursor-pointer mb-2"
|
||||
class="text-xs flex items-center gap-1 cursor-pointer"
|
||||
>
|
||||
<input
|
||||
type="checkbox"
|
||||
@@ -869,41 +743,6 @@
|
||||
/>
|
||||
Show tracked tokens with zero balance
|
||||
</label>
|
||||
<label
|
||||
class="text-xs flex items-center gap-1 cursor-pointer mb-2"
|
||||
>
|
||||
<input type="checkbox" id="settings-utc-timestamps" />
|
||||
UTC Timestamps
|
||||
</label>
|
||||
<div class="text-xs flex items-center gap-1">
|
||||
<label for="settings-theme">Theme:</label>
|
||||
<select
|
||||
id="settings-theme"
|
||||
class="border border-border p-1 bg-bg text-fg text-xs cursor-pointer"
|
||||
>
|
||||
<option value="system">System</option>
|
||||
<option value="light">Light</option>
|
||||
<option value="dark">Dark</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<h3 class="font-bold mb-1">Network</h3>
|
||||
<p class="text-xs text-muted mb-1">
|
||||
Select the Ethereum network. Switching networks will
|
||||
update the RPC and Blockscout endpoints to their
|
||||
defaults.
|
||||
</p>
|
||||
<div class="text-xs flex items-center gap-1">
|
||||
<select
|
||||
id="settings-network"
|
||||
class="border border-border p-1 bg-bg text-fg text-xs cursor-pointer"
|
||||
>
|
||||
<option value="mainnet">Ethereum Mainnet</option>
|
||||
<option value="sepolia">Sepolia Testnet</option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
@@ -1002,64 +841,6 @@
|
||||
</p>
|
||||
<div id="settings-denied-sites"></div>
|
||||
</div>
|
||||
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<h3 class="font-bold mb-1">About</h3>
|
||||
<p class="text-xs mb-2">
|
||||
<a
|
||||
href="https://git.eeqj.de/sneak/AutistMask"
|
||||
class="underline decoration-dashed"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
>AutistMask</a
|
||||
>
|
||||
— Minimal Ethereum wallet browser extension.
|
||||
</p>
|
||||
<div class="text-xs">
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">License:</span>
|
||||
<span id="about-license"></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Author:</span>
|
||||
<span id="about-author"></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Version:</span>
|
||||
<span
|
||||
id="about-version"
|
||||
class="cursor-pointer select-none"
|
||||
></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Release date:</span>
|
||||
<span id="about-release-date"></span>
|
||||
</div>
|
||||
<div>
|
||||
<span class="text-muted">Commit:</span>
|
||||
<a
|
||||
id="about-commit-link"
|
||||
class="underline decoration-dashed"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
></a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div
|
||||
id="settings-debug-well"
|
||||
class="bg-well p-3 mx-1 mb-3"
|
||||
style="display: none"
|
||||
>
|
||||
<h3 class="font-bold mb-1">Debug</h3>
|
||||
<label
|
||||
class="text-xs flex items-center gap-1 cursor-pointer"
|
||||
>
|
||||
<input type="checkbox" id="settings-debug-mode" />
|
||||
Enable debug mode
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ DELETE WALLET CONFIRM ============ -->
|
||||
@@ -1078,8 +859,7 @@
|
||||
</p>
|
||||
<div
|
||||
id="delete-wallet-flash"
|
||||
class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
class="text-xs text-red-500 mb-2 hidden"
|
||||
></div>
|
||||
<div class="mb-2">
|
||||
<label class="block mb-1">Password</label>
|
||||
@@ -1154,8 +934,7 @@
|
||||
/>
|
||||
<div
|
||||
id="settings-addtoken-info"
|
||||
class="text-xs text-muted mt-1 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
class="text-xs text-muted mt-1 hidden"
|
||||
></div>
|
||||
<button
|
||||
id="btn-settings-addtoken-manual"
|
||||
@@ -1177,149 +956,66 @@
|
||||
<h2 id="tx-detail-heading" class="font-bold mb-2">
|
||||
Transaction
|
||||
</h2>
|
||||
|
||||
<!-- ── Identity ── -->
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">
|
||||
Transaction hash
|
||||
</div>
|
||||
<div
|
||||
id="tx-detail-hash"
|
||||
class="text-xs break-all"
|
||||
></div>
|
||||
</div>
|
||||
<div id="tx-detail-type-section" class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">Type</div>
|
||||
<div
|
||||
id="tx-detail-type"
|
||||
class="text-xs font-bold"
|
||||
></div>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">Status</div>
|
||||
<div id="tx-detail-status" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">From</div>
|
||||
<div
|
||||
id="tx-detail-from"
|
||||
class="text-xs break-all"
|
||||
></div>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">To</div>
|
||||
<div id="tx-detail-to" class="text-xs break-all"></div>
|
||||
</div>
|
||||
<div id="tx-detail-type-section" class="mb-4 hidden">
|
||||
<div class="text-xs text-muted mb-1">Type</div>
|
||||
<div id="tx-detail-type" class="text-xs font-bold"></div>
|
||||
</div>
|
||||
|
||||
<!-- ── Timing ── -->
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">Time</div>
|
||||
<div id="tx-detail-time" class="text-xs"></div>
|
||||
</div>
|
||||
<div id="tx-detail-block-section" class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">Block</div>
|
||||
<div id="tx-detail-block" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">Status</div>
|
||||
<div id="tx-detail-status" class="text-xs"></div>
|
||||
</div>
|
||||
|
||||
<!-- ── Value ── -->
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">Amount</div>
|
||||
<div id="tx-detail-value" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">
|
||||
Native quantity
|
||||
</div>
|
||||
<div id="tx-detail-native" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">Time</div>
|
||||
<div id="tx-detail-time" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">Amount</div>
|
||||
<div id="tx-detail-value" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-4 hidden">
|
||||
<div class="text-xs text-muted mb-1">Native quantity</div>
|
||||
<div id="tx-detail-native" class="text-xs"></div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">From</div>
|
||||
<div id="tx-detail-from" class="text-xs break-all"></div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">To</div>
|
||||
<div id="tx-detail-to" class="text-xs break-all"></div>
|
||||
</div>
|
||||
<div id="tx-detail-calldata-section" class="mb-4 hidden">
|
||||
<div
|
||||
id="tx-detail-token-contract-section"
|
||||
class="mb-2 hidden"
|
||||
id="tx-detail-calldata-well"
|
||||
class="mb-3 border border-border border-dashed p-2"
|
||||
>
|
||||
<div class="text-xs text-muted mb-1">
|
||||
Token contract
|
||||
</div>
|
||||
<div class="text-xs text-muted mb-1">Action</div>
|
||||
<div
|
||||
id="tx-detail-token-contract"
|
||||
class="text-xs break-all"
|
||||
id="tx-detail-calldata-action"
|
||||
class="text-xs font-bold mb-2"
|
||||
></div>
|
||||
<div
|
||||
id="tx-detail-calldata-details"
|
||||
class="text-xs"
|
||||
></div>
|
||||
</div>
|
||||
<div id="tx-detail-rawdata-section" class="hidden">
|
||||
<div class="text-xs text-muted mb-1">Raw data</div>
|
||||
<div
|
||||
id="tx-detail-rawdata"
|
||||
class="text-xs break-all font-mono border border-border border-dashed p-2"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ── Decoded details ── -->
|
||||
<div id="tx-detail-calldata-section" class="hidden">
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div id="tx-detail-calldata-well" class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">Action</div>
|
||||
<div
|
||||
id="tx-detail-calldata-action"
|
||||
class="text-xs font-bold mb-2"
|
||||
></div>
|
||||
<div
|
||||
id="tx-detail-calldata-details"
|
||||
class="text-xs"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ── Network details ── -->
|
||||
<div id="tx-detail-network-section" class="hidden">
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div id="tx-detail-nonce-section" class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">Nonce</div>
|
||||
<div id="tx-detail-nonce" class="text-xs"></div>
|
||||
</div>
|
||||
<div
|
||||
id="tx-detail-gasprice-section"
|
||||
class="mb-2 hidden"
|
||||
>
|
||||
<div class="text-xs text-muted mb-1">Gas price</div>
|
||||
<div id="tx-detail-gasprice" class="text-xs"></div>
|
||||
</div>
|
||||
<div id="tx-detail-gasused-section" class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">Gas used</div>
|
||||
<div id="tx-detail-gasused" class="text-xs"></div>
|
||||
</div>
|
||||
<div id="tx-detail-fee-section" class="mb-2 hidden">
|
||||
<div class="text-xs text-muted mb-1">
|
||||
Transaction fee
|
||||
</div>
|
||||
<div id="tx-detail-fee" class="text-xs"></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ── Raw data ── -->
|
||||
<div id="tx-detail-rawdata-section" class="hidden">
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<div class="mb-2">
|
||||
<div class="text-xs text-muted mb-1">Raw data</div>
|
||||
<div
|
||||
id="tx-detail-rawdata"
|
||||
class="text-xs break-all font-mono border border-border border-dashed p-2"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="mb-4">
|
||||
<div class="text-xs text-muted mb-1">Transaction hash</div>
|
||||
<div id="tx-detail-hash" class="text-xs break-all"></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ TRANSACTION APPROVAL ============ -->
|
||||
<div id="view-approve-tx" class="view hidden">
|
||||
<h2 class="font-bold mb-2">Transaction Request</h2>
|
||||
<div
|
||||
id="approve-tx-phishing-warning"
|
||||
class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
|
||||
>
|
||||
⚠️ PHISHING WARNING: This site is on a known phishing
|
||||
blocklist. This transaction may steal your funds. Proceed
|
||||
with extreme caution.
|
||||
</div>
|
||||
<p class="mb-2">
|
||||
<span id="approve-tx-hostname" class="font-bold"></span>
|
||||
wants to send a transaction.
|
||||
@@ -1362,11 +1058,7 @@
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
id="approve-tx-error"
|
||||
class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<div id="approve-tx-error" class="text-xs hidden mb-2"></div>
|
||||
<div class="flex justify-between">
|
||||
<button
|
||||
id="btn-approve-tx"
|
||||
@@ -1386,14 +1078,6 @@
|
||||
<!-- ============ SIGNATURE APPROVAL ============ -->
|
||||
<div id="view-approve-sign" class="view hidden">
|
||||
<h2 class="font-bold mb-2">Signature Request</h2>
|
||||
<div
|
||||
id="approve-sign-phishing-warning"
|
||||
class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
|
||||
>
|
||||
⚠️ PHISHING WARNING: This site is on a known phishing
|
||||
blocklist. Signing this message may authorize theft of your
|
||||
funds. Proceed with extreme caution.
|
||||
</div>
|
||||
<p class="mb-2">
|
||||
<span id="approve-sign-hostname" class="font-bold"></span>
|
||||
wants you to sign a message.
|
||||
@@ -1401,10 +1085,8 @@
|
||||
|
||||
<div
|
||||
id="approve-sign-danger-warning"
|
||||
class="mb-3 p-2 text-xs font-bold"
|
||||
class="hidden mb-3 p-2 text-xs font-bold"
|
||||
style="
|
||||
visibility: hidden;
|
||||
min-height: 1.25rem;
|
||||
background: #fee2e2;
|
||||
color: #991b1b;
|
||||
border: 2px solid #dc2626;
|
||||
@@ -1439,11 +1121,7 @@
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
id="approve-sign-error"
|
||||
class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<div id="approve-sign-error" class="text-xs hidden mb-2"></div>
|
||||
<div class="flex justify-between">
|
||||
<button
|
||||
id="btn-approve-sign"
|
||||
@@ -1463,14 +1141,6 @@
|
||||
<!-- ============ SITE APPROVAL ============ -->
|
||||
<div id="view-approve-site" class="view hidden">
|
||||
<h2 class="font-bold mb-2">Connection Request</h2>
|
||||
<div
|
||||
id="approve-site-phishing-warning"
|
||||
class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
|
||||
>
|
||||
⚠️ PHISHING WARNING: This site is on a known phishing
|
||||
blocklist. Connecting your wallet may result in loss of
|
||||
funds. Proceed with extreme caution.
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<p class="mb-2">
|
||||
<span id="approve-hostname" class="font-bold"></span>
|
||||
|
||||
@@ -1,24 +1,16 @@
|
||||
// AutistMask popup entry point.
|
||||
// Loads state, initializes views, triggers first render.
|
||||
|
||||
const { DEBUG } = require("../shared/constants");
|
||||
const { state, saveState, loadState } = require("../shared/state");
|
||||
const { setRuntimeDebug } = require("../shared/log");
|
||||
const { refreshPrices } = require("../shared/prices");
|
||||
const { refreshBalances } = require("../shared/balances");
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
} = require("./views/helpers");
|
||||
const { applyTheme } = require("./theme");
|
||||
const { $, showView } = require("./views/helpers");
|
||||
|
||||
const home = require("./views/home");
|
||||
const welcome = require("./views/welcome");
|
||||
const addWallet = require("./views/addWallet");
|
||||
const importKey = require("./views/importKey");
|
||||
const addressDetail = require("./views/addressDetail");
|
||||
const addressToken = require("./views/addressToken");
|
||||
const send = require("./views/send");
|
||||
@@ -61,42 +53,16 @@ async function doRefreshAndRender() {
|
||||
const ctx = {
|
||||
renderWalletList,
|
||||
doRefreshAndRender,
|
||||
showAddWalletView: () => {
|
||||
pushCurrentView();
|
||||
addWallet.show();
|
||||
},
|
||||
showAddressDetail: () => {
|
||||
pushCurrentView();
|
||||
addressDetail.show();
|
||||
},
|
||||
showAddressToken: () => {
|
||||
pushCurrentView();
|
||||
addressToken.show();
|
||||
},
|
||||
showAddTokenView: () => {
|
||||
pushCurrentView();
|
||||
addToken.show();
|
||||
},
|
||||
showConfirmTx: (txInfo) => {
|
||||
pushCurrentView();
|
||||
confirmTx.show(txInfo);
|
||||
},
|
||||
showReceive: () => {
|
||||
pushCurrentView();
|
||||
receive.show();
|
||||
},
|
||||
showTransactionDetail: (tx) => {
|
||||
pushCurrentView();
|
||||
transactionDetail.show(tx);
|
||||
},
|
||||
showSettingsView: () => {
|
||||
pushCurrentView();
|
||||
settings.show();
|
||||
},
|
||||
showSettingsAddTokenView: () => {
|
||||
pushCurrentView();
|
||||
settingsAddToken.show();
|
||||
},
|
||||
showAddWalletView: () => addWallet.show(),
|
||||
showImportKeyView: () => importKey.show(),
|
||||
showAddressDetail: () => addressDetail.show(),
|
||||
showAddressToken: () => addressToken.show(),
|
||||
showAddTokenView: () => addToken.show(),
|
||||
showConfirmTx: (txInfo) => confirmTx.show(txInfo),
|
||||
showReceive: () => receive.show(),
|
||||
showTransactionDetail: (tx) => transactionDetail.show(tx),
|
||||
showSettingsView: () => settings.show(),
|
||||
showSettingsAddTokenView: () => settingsAddToken.show(),
|
||||
};
|
||||
|
||||
// Views that can be fully re-rendered from persisted state.
|
||||
@@ -108,7 +74,6 @@ const RESTORABLE_VIEWS = new Set([
|
||||
"receive",
|
||||
"settings",
|
||||
"settings-addtoken",
|
||||
"confirm-tx",
|
||||
"transaction",
|
||||
"success-tx",
|
||||
"error-tx",
|
||||
@@ -162,13 +127,6 @@ function restoreView() {
|
||||
case "settings-addtoken":
|
||||
settingsAddToken.show();
|
||||
break;
|
||||
case "confirm-tx":
|
||||
if (state.viewData && state.viewData.pendingTx) {
|
||||
confirmTx.restore();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "transaction":
|
||||
if (state.viewData && state.viewData.tx) {
|
||||
transactionDetail.render();
|
||||
@@ -202,14 +160,16 @@ function fallbackView() {
|
||||
}
|
||||
|
||||
async function init() {
|
||||
if (DEBUG) {
|
||||
const banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
banner.textContent = "DEBUG / INSECURE";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
|
||||
await loadState();
|
||||
applyTheme(state.theme);
|
||||
|
||||
// Sync runtime debug flag from persisted state before first render
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
// Create the debug/testnet banner if needed (uses runtime debug state)
|
||||
updateDebugBanner();
|
||||
|
||||
// Auto-default active address
|
||||
if (
|
||||
@@ -240,17 +200,16 @@ async function init() {
|
||||
.getElementById("view-settings")
|
||||
.classList.contains("hidden")
|
||||
) {
|
||||
goBack();
|
||||
renderWalletList();
|
||||
showView("main");
|
||||
return;
|
||||
}
|
||||
pushCurrentView();
|
||||
settings.show();
|
||||
});
|
||||
|
||||
setRenderMain(renderWalletList);
|
||||
|
||||
welcome.init(ctx);
|
||||
addWallet.init(ctx);
|
||||
importKey.init(ctx);
|
||||
home.init(ctx);
|
||||
addressDetail.init(ctx);
|
||||
addressToken.init(ctx);
|
||||
|
||||
@@ -10,37 +10,11 @@
|
||||
--color-border: #000000;
|
||||
--color-border-light: #cccccc;
|
||||
--color-hover: #eeeeee;
|
||||
--color-well: #e8e8e8;
|
||||
--color-danger-well: #fef2f2;
|
||||
--color-well: #f5f5f5;
|
||||
--color-section: #dddddd;
|
||||
}
|
||||
|
||||
html.dark {
|
||||
--color-bg: #000000;
|
||||
--color-fg: #ffffff;
|
||||
--color-muted: #aaaaaa;
|
||||
--color-border: #ffffff;
|
||||
--color-border-light: #444444;
|
||||
--color-hover: #222222;
|
||||
--color-well: #1a1a1a;
|
||||
--color-danger-well: #2a0a0a;
|
||||
--color-section: #2a2a2a;
|
||||
}
|
||||
|
||||
body {
|
||||
width: 396px;
|
||||
overflow-x: hidden;
|
||||
}
|
||||
|
||||
/* Copy-flash feedback: inverts colors then fades back */
|
||||
.copy-flash-active {
|
||||
background-color: var(--color-fg) !important;
|
||||
color: var(--color-bg) !important;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.copy-flash-fade {
|
||||
transition:
|
||||
background-color 225ms ease-out,
|
||||
color 225ms ease-out;
|
||||
}
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
// Theme management: applies light/dark class to <html> based on preference.
|
||||
|
||||
let mediaQuery = null;
|
||||
let mediaHandler = null;
|
||||
|
||||
function applyTheme(theme) {
|
||||
// Clean up previous system listener
|
||||
if (mediaQuery && mediaHandler) {
|
||||
mediaQuery.removeEventListener("change", mediaHandler);
|
||||
mediaHandler = null;
|
||||
}
|
||||
|
||||
if (theme === "dark") {
|
||||
document.documentElement.classList.add("dark");
|
||||
} else if (theme === "light") {
|
||||
document.documentElement.classList.remove("dark");
|
||||
} else {
|
||||
// system
|
||||
mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
|
||||
const update = () => {
|
||||
if (mediaQuery.matches) {
|
||||
document.documentElement.classList.add("dark");
|
||||
} else {
|
||||
document.documentElement.classList.remove("dark");
|
||||
}
|
||||
};
|
||||
mediaHandler = update;
|
||||
mediaQuery.addEventListener("change", update);
|
||||
update();
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { applyTheme };
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -7,8 +7,7 @@ const { log } = require("../../shared/log");
|
||||
|
||||
function show() {
|
||||
$("add-token-address").value = "";
|
||||
$("add-token-info").textContent = "";
|
||||
$("add-token-info").style.visibility = "hidden";
|
||||
$("add-token-info").classList.add("hidden");
|
||||
const list = $("common-token-list");
|
||||
list.innerHTML = getTopTokens(25)
|
||||
.map(
|
||||
@@ -46,7 +45,7 @@ function init(ctx) {
|
||||
}
|
||||
const infoEl = $("add-token-info");
|
||||
infoEl.textContent = "Looking up token...";
|
||||
infoEl.style.visibility = "visible";
|
||||
infoEl.classList.remove("hidden");
|
||||
log.debugf("Looking up token contract", contractAddr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(contractAddr, state.rpcUrl);
|
||||
@@ -59,24 +58,16 @@ function init(ctx) {
|
||||
});
|
||||
await saveState();
|
||||
ctx.doRefreshAndRender();
|
||||
// Pop the stack (back to address detail) and re-render it
|
||||
// so the newly added token is visible immediately.
|
||||
if (state.viewStack.length > 0) {
|
||||
state.viewStack.pop();
|
||||
}
|
||||
require("./addressDetail").show();
|
||||
ctx.showAddressDetail();
|
||||
} catch (e) {
|
||||
const detail = e.shortMessage || e.message || String(e);
|
||||
log.errorf("Token lookup failed for", contractAddr, detail);
|
||||
showFlash(detail);
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-add-token-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
$("btn-add-token-back").addEventListener("click", ctx.showAddressDetail);
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -1,307 +1,129 @@
|
||||
const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const {
|
||||
generateMnemonic,
|
||||
hdWalletFromMnemonic,
|
||||
isValidMnemonic,
|
||||
addressFromPrivateKey,
|
||||
hdWalletFromXprv,
|
||||
isValidXprv,
|
||||
} = require("../../shared/wallet");
|
||||
const { encryptWithPassword } = require("../../shared/vault");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { scanForAddresses } = require("../../shared/balances");
|
||||
|
||||
/**
|
||||
* Check if an address already exists in ANY wallet (hd, xprv, or key).
|
||||
* Returns the wallet object if found, or undefined.
|
||||
*/
|
||||
function findWalletByAddress(addr) {
|
||||
const lower = addr.toLowerCase();
|
||||
return state.wallets.find((w) =>
|
||||
w.addresses.some((a) => a.address.toLowerCase() === lower),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if an xpub already exists in any HD-type wallet (hd or xprv).
|
||||
* Returns the wallet object if found, or undefined.
|
||||
*/
|
||||
function findWalletByXpub(xpub) {
|
||||
return state.wallets.find((w) => w.xpub && w.xpub === xpub);
|
||||
}
|
||||
|
||||
let currentMode = "mnemonic";
|
||||
|
||||
const MODES = ["mnemonic", "privkey", "xprv"];
|
||||
|
||||
const PASSWORD_HINTS = {
|
||||
mnemonic:
|
||||
"This password encrypts your recovery phrase on this device. You will need it to send funds.",
|
||||
privkey:
|
||||
"This password encrypts your private key on this device. You will need it to send funds.",
|
||||
xprv: "This password encrypts your key on this device. You will need it to send funds.",
|
||||
};
|
||||
|
||||
function switchMode(mode) {
|
||||
currentMode = mode;
|
||||
for (const m of MODES) {
|
||||
$("add-wallet-section-" + m).classList.toggle("hidden", m !== mode);
|
||||
const tab = $("tab-" + m);
|
||||
const isActive = m === mode;
|
||||
// Active: bold, solid border on top/sides, no bottom border (connects to content)
|
||||
tab.classList.toggle("font-bold", isActive);
|
||||
tab.classList.toggle("border-solid", isActive);
|
||||
tab.classList.toggle("border-border", isActive);
|
||||
tab.classList.toggle("border-b-bg", isActive);
|
||||
tab.classList.toggle("bg-bg", isActive);
|
||||
// Inactive: muted text, dashed border on top/sides, transparent bottom, hover invert
|
||||
tab.classList.toggle("text-muted", !isActive);
|
||||
tab.classList.toggle("border-dashed", !isActive);
|
||||
tab.classList.toggle("border-border-light", !isActive);
|
||||
tab.classList.toggle("border-b-transparent", !isActive);
|
||||
tab.classList.toggle("hover:bg-fg", !isActive);
|
||||
tab.classList.toggle("hover:text-bg", !isActive);
|
||||
}
|
||||
$("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
|
||||
}
|
||||
|
||||
function show() {
|
||||
$("wallet-mnemonic").value = "";
|
||||
$("import-private-key").value = "";
|
||||
$("import-xprv-key").value = "";
|
||||
$("add-wallet-password").value = "";
|
||||
$("add-wallet-password-confirm").value = "";
|
||||
$("add-wallet-phrase-warning").style.visibility = "hidden";
|
||||
switchMode("mnemonic");
|
||||
$("add-wallet-phrase-warning").classList.add("hidden");
|
||||
showView("add-wallet");
|
||||
}
|
||||
|
||||
function validatePassword() {
|
||||
const pw = $("add-wallet-password").value;
|
||||
const pw2 = $("add-wallet-password-confirm").value;
|
||||
if (!pw) {
|
||||
showFlash("Please choose a password.");
|
||||
return null;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showFlash("Password must be at least 12 characters.");
|
||||
return null;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showFlash("Passwords do not match.");
|
||||
return null;
|
||||
}
|
||||
return pw;
|
||||
}
|
||||
|
||||
async function importMnemonic(ctx) {
|
||||
const mnemonic = $("wallet-mnemonic").value.trim();
|
||||
if (!mnemonic) {
|
||||
showFlash("Enter a recovery phrase or press the die to generate one.");
|
||||
return;
|
||||
}
|
||||
const words = mnemonic.split(/\s+/);
|
||||
if (words.length !== 12 && words.length !== 24) {
|
||||
showFlash(
|
||||
"Recovery phrase must be 12 or 24 words. You entered " +
|
||||
words.length +
|
||||
".",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (!isValidMnemonic(mnemonic)) {
|
||||
showFlash("Invalid recovery phrase. Check for typos.");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
|
||||
const xpubDup = findWalletByXpub(xpub);
|
||||
if (xpubDup) {
|
||||
showFlash(
|
||||
"This recovery phrase is already added (" + xpubDup.name + ").",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const addrDup = findWalletByAddress(firstAddress);
|
||||
if (addrDup) {
|
||||
showFlash("Address already exists in wallet (" + addrDup.name + ").");
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(mnemonic, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
const wallet = {
|
||||
type: "hd",
|
||||
name: "Wallet " + walletNum,
|
||||
xpub: xpub,
|
||||
encryptedSecret: encrypted,
|
||||
nextIndex: 1,
|
||||
addresses: [
|
||||
{ address: firstAddress, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
};
|
||||
state.wallets.push(wallet);
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
balance: "0.0000",
|
||||
tokenBalances: [],
|
||||
}));
|
||||
wallet.nextIndex = scan.nextIndex;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showFlash("Found " + scan.addresses.length + " addresses.");
|
||||
} else {
|
||||
showFlash("Ready.", 1000);
|
||||
}
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
async function importPrivateKey(ctx) {
|
||||
const key = $("import-private-key").value.trim();
|
||||
if (!key) {
|
||||
showFlash("Please enter your private key.");
|
||||
return;
|
||||
}
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch (e) {
|
||||
showFlash("Invalid private key.");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const duplicate = findWalletByAddress(addr);
|
||||
if (duplicate) {
|
||||
showFlash(
|
||||
"This address already exists in wallet (" + duplicate.name + ").",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(key, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
state.wallets.push({
|
||||
type: "key",
|
||||
name: "Wallet " + walletNum,
|
||||
encryptedSecret: encrypted,
|
||||
addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
|
||||
});
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
async function importXprvKey(ctx) {
|
||||
const xprv = $("import-xprv-key").value.trim();
|
||||
if (!xprv) {
|
||||
showFlash("Please enter your extended private key.");
|
||||
return;
|
||||
}
|
||||
if (!isValidXprv(xprv)) {
|
||||
showFlash("Invalid extended private key.");
|
||||
return;
|
||||
}
|
||||
let result;
|
||||
try {
|
||||
result = hdWalletFromXprv(xprv);
|
||||
} catch (e) {
|
||||
showFlash("Invalid extended private key.");
|
||||
return;
|
||||
}
|
||||
const { xpub, firstAddress } = result;
|
||||
const xpubDup = findWalletByXpub(xpub);
|
||||
if (xpubDup) {
|
||||
showFlash("This key is already added (" + xpubDup.name + ").");
|
||||
return;
|
||||
}
|
||||
const addrDup = findWalletByAddress(firstAddress);
|
||||
if (addrDup) {
|
||||
showFlash("Address already exists in wallet (" + addrDup.name + ").");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const encrypted = await encryptWithPassword(xprv, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
const wallet = {
|
||||
type: "xprv",
|
||||
name: "Wallet " + walletNum,
|
||||
xpub: xpub,
|
||||
encryptedSecret: encrypted,
|
||||
nextIndex: 1,
|
||||
addresses: [
|
||||
{ address: firstAddress, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
};
|
||||
state.wallets.push(wallet);
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
balance: "0.0000",
|
||||
tokenBalances: [],
|
||||
}));
|
||||
wallet.nextIndex = scan.nextIndex;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showFlash("Found " + scan.addresses.length + " addresses.");
|
||||
} else {
|
||||
showFlash("Ready.", 1000);
|
||||
}
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
// Tab click handlers
|
||||
$("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
|
||||
$("tab-privkey").addEventListener("click", () => switchMode("privkey"));
|
||||
$("tab-xprv").addEventListener("click", () => switchMode("xprv"));
|
||||
|
||||
// Generate mnemonic
|
||||
$("btn-generate-phrase").addEventListener("click", () => {
|
||||
$("wallet-mnemonic").value = generateMnemonic();
|
||||
$("add-wallet-phrase-warning").style.visibility = "visible";
|
||||
$("add-wallet-phrase-warning").classList.remove("hidden");
|
||||
});
|
||||
|
||||
// Import / confirm
|
||||
$("btn-add-wallet-confirm").addEventListener("click", async () => {
|
||||
if (currentMode === "mnemonic") {
|
||||
await importMnemonic(ctx);
|
||||
} else if (currentMode === "privkey") {
|
||||
await importPrivateKey(ctx);
|
||||
} else if (currentMode === "xprv") {
|
||||
await importXprvKey(ctx);
|
||||
const mnemonic = $("wallet-mnemonic").value.trim();
|
||||
if (!mnemonic) {
|
||||
showFlash(
|
||||
"Enter a recovery phrase or press the die to generate one.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const words = mnemonic.split(/\s+/);
|
||||
if (words.length !== 12 && words.length !== 24) {
|
||||
showFlash(
|
||||
"Recovery phrase must be 12 or 24 words. You entered " +
|
||||
words.length +
|
||||
".",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (!isValidMnemonic(mnemonic)) {
|
||||
showFlash("Invalid recovery phrase. Check for typos.");
|
||||
return;
|
||||
}
|
||||
const pw = $("add-wallet-password").value;
|
||||
const pw2 = $("add-wallet-password-confirm").value;
|
||||
if (!pw) {
|
||||
showFlash("Please choose a password.");
|
||||
return;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showFlash("Password must be at least 12 characters.");
|
||||
return;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showFlash("Passwords do not match.");
|
||||
return;
|
||||
}
|
||||
const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
|
||||
const duplicate = state.wallets.find(
|
||||
(w) =>
|
||||
w.type === "hd" &&
|
||||
w.addresses[0] &&
|
||||
w.addresses[0].address.toLowerCase() ===
|
||||
firstAddress.toLowerCase(),
|
||||
);
|
||||
if (duplicate) {
|
||||
showFlash(
|
||||
"This recovery phrase is already added (" +
|
||||
duplicate.name +
|
||||
").",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(mnemonic, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
const wallet = {
|
||||
type: "hd",
|
||||
name: "Wallet " + walletNum,
|
||||
xpub: xpub,
|
||||
encryptedSecret: encrypted,
|
||||
nextIndex: 1,
|
||||
addresses: [
|
||||
{ address: firstAddress, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
};
|
||||
state.wallets.push(wallet);
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
balance: "0.0000",
|
||||
tokenBalances: [],
|
||||
}));
|
||||
wallet.nextIndex = scan.nextIndex;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showFlash("Found " + scan.addresses.length + " addresses.");
|
||||
} else {
|
||||
showFlash("Ready.", 1000);
|
||||
}
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
});
|
||||
|
||||
$("btn-add-wallet-back").addEventListener("click", () => {
|
||||
if (!state.hasWallet) {
|
||||
showView("welcome");
|
||||
} else {
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
}
|
||||
});
|
||||
|
||||
// Back button
|
||||
$("btn-add-wallet-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
$("btn-add-wallet-import-key").addEventListener(
|
||||
"click",
|
||||
ctx.showImportKeyView,
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -2,16 +2,11 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLinesForAddress,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
@@ -20,18 +15,23 @@ const {
|
||||
filterTransactions,
|
||||
} = require("../../shared/transactions");
|
||||
const { resolveEnsNames } = require("../../shared/ens");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
resetSendValidation,
|
||||
} = require("./send");
|
||||
const { updateSendBalance, renderSendTokenSelect } = require("./send");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
|
||||
let ctx;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function show() {
|
||||
state.selectedToken = null;
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
@@ -49,18 +49,22 @@ function show() {
|
||||
img.style.imageRendering = "pixelated";
|
||||
img.style.borderRadius = "50%";
|
||||
blockieEl.appendChild(img);
|
||||
const addrTitle = addressTitle(addr.address, state.wallets);
|
||||
$("address-line").innerHTML = renderAddressHtml(addr.address, {
|
||||
title: addrTitle,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
$("address-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-line"));
|
||||
$("address-dot").innerHTML = addressDotHtml(addr.address);
|
||||
$("address-full").dataset.full = addr.address;
|
||||
$("address-full").textContent = addr.address;
|
||||
const addrLink = etherscanAddressLink(addr.address);
|
||||
$("address-etherscan-link").innerHTML =
|
||||
`<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const usdTotal = formatUsd(getAddressValueUsd(addr));
|
||||
$("address-usd-total").innerHTML = usdTotal || " ";
|
||||
const ensEl = $("address-ens");
|
||||
// ENS is now shown inside renderAddressHtml, hide the separate element
|
||||
ensEl.classList.add("hidden");
|
||||
if (addr.ensName) {
|
||||
ensEl.innerHTML =
|
||||
addressDotHtml(addr.address) + escapeHtml(addr.ensName);
|
||||
ensEl.classList.remove("hidden");
|
||||
} else {
|
||||
ensEl.classList.add("hidden");
|
||||
}
|
||||
$("address-balances").innerHTML = balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
@@ -84,39 +88,18 @@ function show() {
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -203,12 +186,10 @@ function renderTransactions(txs) {
|
||||
let html = "";
|
||||
let i = 0;
|
||||
for (const tx of txs) {
|
||||
// For swap transactions, show the user's own labelled wallet
|
||||
// address instead of the contract address (see issue #55).
|
||||
const counterparty =
|
||||
tx.direction === "contract" && tx.directionLabel === "Swap"
|
||||
tx.direction === "contract"
|
||||
? tx.from
|
||||
: tx.direction === "sent" || tx.direction === "contract"
|
||||
: tx.direction === "sent"
|
||||
? tx.to
|
||||
: tx.from;
|
||||
const ensName = ensNameMap.get(counterparty) || null;
|
||||
@@ -247,9 +228,17 @@ function renderTransactions(txs) {
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("address-full").addEventListener("click", () => {
|
||||
const addr = $("address-full").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-address-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
});
|
||||
|
||||
$("btn-send").addEventListener("click", () => {
|
||||
@@ -266,8 +255,6 @@ function init(_ctx) {
|
||||
$("send-token").classList.remove("hidden");
|
||||
$("send-token-static").classList.add("hidden");
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
@@ -276,102 +263,6 @@ function init(_ctx) {
|
||||
});
|
||||
|
||||
$("btn-add-token").addEventListener("click", ctx.showAddTokenView);
|
||||
|
||||
// More menu dropdown
|
||||
const moreBtn = $("btn-more-menu");
|
||||
const moreDropdown = $("more-menu-dropdown");
|
||||
moreBtn.addEventListener("click", (e) => {
|
||||
e.stopPropagation();
|
||||
const isOpen = !moreDropdown.classList.toggle("hidden");
|
||||
moreBtn.classList.toggle("bg-fg", isOpen);
|
||||
moreBtn.classList.toggle("text-bg", isOpen);
|
||||
});
|
||||
document.addEventListener("click", () => {
|
||||
moreDropdown.classList.add("hidden");
|
||||
moreBtn.classList.remove("bg-fg", "text-bg");
|
||||
});
|
||||
moreDropdown.addEventListener("click", (e) => {
|
||||
e.stopPropagation();
|
||||
});
|
||||
|
||||
$("btn-export-privkey").addEventListener("click", () => {
|
||||
moreDropdown.classList.add("hidden");
|
||||
moreBtn.classList.remove("bg-fg", "text-bg");
|
||||
pushCurrentView();
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
const addr = wallet.addresses[state.selectedAddress];
|
||||
const blockieEl = $("export-privkey-jazzicon");
|
||||
blockieEl.innerHTML = "";
|
||||
const bImg = document.createElement("img");
|
||||
bImg.src = makeBlockie(addr.address);
|
||||
bImg.width = 48;
|
||||
bImg.height = 48;
|
||||
bImg.style.imageRendering = "pixelated";
|
||||
bImg.style.borderRadius = "50%";
|
||||
blockieEl.appendChild(bImg);
|
||||
$("export-privkey-title").textContent =
|
||||
wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
|
||||
const exportAddrContainer = $("export-privkey-dot").parentElement;
|
||||
exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
|
||||
attachCopyHandlers(exportAddrContainer);
|
||||
$("export-privkey-password").value = "";
|
||||
$("export-privkey-flash").textContent = "";
|
||||
$("export-privkey-flash").style.visibility = "hidden";
|
||||
$("export-privkey-password-section").classList.remove("hidden");
|
||||
$("export-privkey-result").classList.add("hidden");
|
||||
$("export-privkey-value").textContent = "";
|
||||
showView("export-privkey");
|
||||
});
|
||||
|
||||
$("btn-export-privkey-confirm").addEventListener("click", async () => {
|
||||
const password = $("export-privkey-password").value;
|
||||
if (!password) {
|
||||
$("export-privkey-flash").textContent = "Password is required.";
|
||||
$("export-privkey-flash").style.visibility = "visible";
|
||||
return;
|
||||
}
|
||||
const btn = $("btn-export-privkey-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
try {
|
||||
const secret = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
state.selectedAddress,
|
||||
secret,
|
||||
);
|
||||
const privateKey = signer.privateKey;
|
||||
$("export-privkey-password-section").classList.add("hidden");
|
||||
$("export-privkey-value").textContent = privateKey;
|
||||
$("export-privkey-result").classList.remove("hidden");
|
||||
$("export-privkey-flash").style.visibility = "hidden";
|
||||
} catch {
|
||||
$("export-privkey-flash").textContent = "Wrong password.";
|
||||
$("export-privkey-flash").style.visibility = "visible";
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
}
|
||||
});
|
||||
|
||||
$("export-privkey-value").addEventListener("click", () => {
|
||||
const key = $("export-privkey-value").textContent;
|
||||
if (key) {
|
||||
navigator.clipboard.writeText(key);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback($("export-privkey-value"));
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-export-privkey-back").addEventListener("click", () => {
|
||||
$("export-privkey-value").textContent = "";
|
||||
$("export-privkey-password").value = "";
|
||||
goBack();
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -5,19 +5,14 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
truncateMiddle,
|
||||
balanceLine,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
@@ -28,52 +23,38 @@ const {
|
||||
filterTransactions,
|
||||
} = require("../../shared/transactions");
|
||||
const { resolveEnsNames } = require("../../shared/ens");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
resetSendValidation,
|
||||
} = require("./send");
|
||||
const { updateSendBalance, renderSendTokenSelect } = require("./send");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
|
||||
let ctx;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -106,7 +87,6 @@ function show() {
|
||||
|
||||
// Determine token symbol and balance
|
||||
let symbol, amount, price;
|
||||
const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
|
||||
if (tokenId === "ETH") {
|
||||
symbol = "ETH";
|
||||
amount = parseFloat(addr.balance || "0");
|
||||
@@ -115,11 +95,7 @@ function show() {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === tokenId.toLowerCase(),
|
||||
);
|
||||
symbol = resolveSymbol(
|
||||
tokenId,
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
symbol = tb ? tb.symbol : "?";
|
||||
amount = tb ? parseFloat(tb.balance || "0") : 0;
|
||||
price = getPrice(symbol);
|
||||
}
|
||||
@@ -141,16 +117,15 @@ function show() {
|
||||
blockieEl.appendChild(img);
|
||||
|
||||
// Address line
|
||||
const addrTitle = addressTitle(addr.address, state.wallets);
|
||||
$("address-token-line").innerHTML = renderAddressHtml(addr.address, {
|
||||
title: addrTitle,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
$("address-token-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-token-line"));
|
||||
$("address-token-dot").innerHTML = addressDotHtml(addr.address);
|
||||
$("address-token-full").dataset.full = addr.address;
|
||||
$("address-token-full").textContent = addr.address;
|
||||
const addrLink = etherscanAddressLink(addr.address);
|
||||
$("address-token-etherscan-link").innerHTML =
|
||||
`<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
|
||||
// USD total for this token only
|
||||
const usdVal = price ? amount * price : null;
|
||||
const usdVal = price ? amount * price : 0;
|
||||
const usdStr = formatUsd(usdVal);
|
||||
$("address-token-usd-total").innerHTML = usdStr || " ";
|
||||
|
||||
@@ -163,33 +138,20 @@ function show() {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === tokenId.toLowerCase(),
|
||||
);
|
||||
const tracked = (state.trackedTokens || []).find(
|
||||
(t) => t.address.toLowerCase() === tokenId.toLowerCase(),
|
||||
);
|
||||
const rawName =
|
||||
(tb && tb.name) ||
|
||||
(tracked && tracked.name) ||
|
||||
(knownToken && knownToken.name) ||
|
||||
null;
|
||||
const rawSymbol =
|
||||
(tb && tb.symbol) ||
|
||||
(tracked && tracked.symbol) ||
|
||||
(knownToken && knownToken.symbol) ||
|
||||
null;
|
||||
const tokenName = rawName ? escapeHtml(rawName) : null;
|
||||
const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
|
||||
const tokenDecimals =
|
||||
tb && tb.decimals != null
|
||||
? tb.decimals
|
||||
: tracked && tracked.decimals != null
|
||||
? tracked.decimals
|
||||
: knownToken && knownToken.decimals != null
|
||||
? knownToken.decimals
|
||||
: null;
|
||||
const tokenName = tb && tb.name ? escapeHtml(tb.name) : null;
|
||||
const tokenSymbol = tb && tb.symbol ? escapeHtml(tb.symbol) : null;
|
||||
const tokenDecimals = tb && tb.decimals != null ? tb.decimals : null;
|
||||
const tokenHolders = tb && tb.holders != null ? tb.holders : null;
|
||||
const dot = addressDotHtml(tokenId);
|
||||
const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
|
||||
const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
|
||||
const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
|
||||
let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
|
||||
infoHtml += `<div class="mb-2">${renderAddressHtml(tokenId)}</div>`;
|
||||
infoHtml +=
|
||||
`<div class="flex items-center mb-2">${dot}` +
|
||||
`<span class="break-all underline decoration-dashed cursor-pointer" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
|
||||
`<a href="${tokenLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
|
||||
`</div>`;
|
||||
if (tokenName)
|
||||
infoHtml += `<div class="mb-1"><span class="text-muted">Name:</span> ${tokenName}</div>`;
|
||||
if (tokenSymbol)
|
||||
@@ -201,7 +163,6 @@ function show() {
|
||||
if (projectUrl)
|
||||
infoHtml += `<div class="mb-1"><span class="text-muted">Website:</span> <a href="${escapeHtml(projectUrl)}" target="_blank" rel="noopener" class="underline decoration-dashed">${escapeHtml(projectUrl)}</a></div>`;
|
||||
contractInfo.innerHTML = infoHtml;
|
||||
attachCopyHandlers(contractInfo);
|
||||
contractInfo.classList.remove("hidden");
|
||||
} else {
|
||||
contractInfo.innerHTML = "";
|
||||
@@ -323,17 +284,24 @@ function renderTransactions(txs) {
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("address-token-full").addEventListener("click", () => {
|
||||
const addr = $("address-token-full").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("address-token-contract-info").addEventListener("click", (e) => {
|
||||
const copyEl = e.target.closest("[data-copy]");
|
||||
if (copyEl) {
|
||||
navigator.clipboard.writeText(copyEl.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(copyEl);
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-address-token-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.showAddressDetail();
|
||||
});
|
||||
|
||||
$("btn-address-token-send").addEventListener("click", () => {
|
||||
@@ -360,14 +328,26 @@ function init(_ctx) {
|
||||
$("send-token").classList.add("hidden");
|
||||
let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
|
||||
if (tokenId !== "ETH") {
|
||||
staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
|
||||
const dot = addressDotHtml(tokenId);
|
||||
const link = `https://etherscan.io/token/${tokenId}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
staticHtml +=
|
||||
`<div class="flex items-center text-xs">${dot}` +
|
||||
`<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
|
||||
extLink +
|
||||
`</div>`;
|
||||
}
|
||||
$("send-token-static").innerHTML = staticHtml;
|
||||
$("send-token-static").classList.remove("hidden");
|
||||
attachCopyHandlers($("send-token-static"));
|
||||
// Attach copy handler for the contract address
|
||||
const copyEl = $("send-token-static").querySelector("[data-copy]");
|
||||
if (copyEl) {
|
||||
copyEl.addEventListener("click", () => {
|
||||
navigator.clipboard.writeText(copyEl.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
});
|
||||
}
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
|
||||
@@ -1,37 +1,42 @@
|
||||
const {
|
||||
$,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
showView,
|
||||
showError,
|
||||
hideError,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const {
|
||||
formatEther,
|
||||
formatUnits,
|
||||
getBytes,
|
||||
Interface,
|
||||
toUtf8String,
|
||||
} = require("ethers");
|
||||
const { getPrice, formatUsd } = require("../../shared/prices");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
const erc20Iface = new Interface(ERC20_ABI);
|
||||
|
||||
function approvalAddressHtml(address) {
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(address, state.wallets);
|
||||
return renderAddressHtml(address, { title });
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
html += `<div class="break-all">${escapeHtml(address)}${extLink}</div>`;
|
||||
} else {
|
||||
html += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
function formatTxValue(val) {
|
||||
@@ -46,6 +51,10 @@ function tokenLabel(address) {
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `https://etherscan.io/token/${address}`;
|
||||
}
|
||||
|
||||
// Try to decode calldata using known ABIs.
|
||||
// Returns { name, description, details } or null.
|
||||
function decodeCalldata(data, toAddress) {
|
||||
@@ -69,12 +78,10 @@ function decodeCalldata(data, toAddress) {
|
||||
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
|
||||
);
|
||||
const isUnlimited = rawAmount === maxUint;
|
||||
const amountRaw = isUnlimited
|
||||
? "Unlimited"
|
||||
: formatTxValue(formatUnits(rawAmount, tokenDecimals));
|
||||
const amountStr = isUnlimited
|
||||
? "Unlimited"
|
||||
: amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
: formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
|
||||
(tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Approval",
|
||||
@@ -93,11 +100,7 @@ function decodeCalldata(data, toAddress) {
|
||||
value: spender,
|
||||
address: spender,
|
||||
},
|
||||
{
|
||||
label: "Amount",
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
{ label: "Amount", value: amountStr },
|
||||
],
|
||||
};
|
||||
}
|
||||
@@ -105,11 +108,9 @@ function decodeCalldata(data, toAddress) {
|
||||
if (parsed.name === "transfer") {
|
||||
const to = parsed.args[0];
|
||||
const rawAmount = parsed.args[1];
|
||||
const amountRaw = formatTxValue(
|
||||
formatUnits(rawAmount, tokenDecimals),
|
||||
);
|
||||
const amountStr =
|
||||
amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
formatTxValue(formatUnits(rawAmount, tokenDecimals)) +
|
||||
(tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Transfer",
|
||||
@@ -124,11 +125,7 @@ function decodeCalldata(data, toAddress) {
|
||||
isToken: true,
|
||||
},
|
||||
{ label: "Recipient", value: to, address: to },
|
||||
{
|
||||
label: "Amount",
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
{ label: "Amount", value: amountStr },
|
||||
],
|
||||
};
|
||||
}
|
||||
@@ -144,26 +141,7 @@ function decodeCalldata(data, toAddress) {
|
||||
return null;
|
||||
}
|
||||
|
||||
function showPhishingWarning(elementId, isPhishing) {
|
||||
const el = $(elementId);
|
||||
if (!el) return;
|
||||
// The background script performs the authoritative phishing domain check
|
||||
// and passes the result via the isPhishingDomain flag.
|
||||
if (isPhishing) {
|
||||
el.classList.remove("hidden");
|
||||
} else {
|
||||
el.classList.add("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
function showTxApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-tx-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
pendingTxParams = details.txParams;
|
||||
|
||||
const toAddr = details.txParams.to;
|
||||
const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
|
||||
const ethValue = formatEther(details.txParams.value || "0");
|
||||
@@ -180,41 +158,20 @@ function showTxApproval(details) {
|
||||
// If this is an ERC-20 call, try to extract the real recipient and amount
|
||||
const decoded = decodeCalldata(details.txParams.data, toAddr || "");
|
||||
if (decoded && decoded.details) {
|
||||
let decodedTokenAddr = null;
|
||||
let decodedTokenSymbol = null;
|
||||
for (const d of decoded.details) {
|
||||
if (d.label === "Recipient" && d.address) {
|
||||
pendingTxDetails.to = d.address;
|
||||
}
|
||||
if (d.label === "Amount") {
|
||||
pendingTxDetails.amount = d.rawValue || d.value;
|
||||
}
|
||||
if (d.label === "Token In" && d.isToken && d.address) {
|
||||
const t = TOKEN_BY_ADDRESS.get(d.address.toLowerCase());
|
||||
if (t) {
|
||||
decodedTokenAddr = d.address;
|
||||
decodedTokenSymbol = t.symbol;
|
||||
}
|
||||
pendingTxDetails.amount = d.value;
|
||||
}
|
||||
}
|
||||
if (token) {
|
||||
pendingTxDetails.token = toAddr;
|
||||
pendingTxDetails.tokenSymbol = token.symbol;
|
||||
} else if (decodedTokenAddr) {
|
||||
pendingTxDetails.token = decodedTokenAddr;
|
||||
pendingTxDetails.tokenSymbol = decodedTokenSymbol;
|
||||
}
|
||||
}
|
||||
|
||||
// Carry decoded calldata info through to success/error views
|
||||
if (decoded) {
|
||||
pendingTxDetails.decoded = {
|
||||
name: decoded.name,
|
||||
description: decoded.description,
|
||||
details: decoded.details,
|
||||
};
|
||||
}
|
||||
|
||||
$("approve-tx-hostname").textContent = details.hostname;
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
|
||||
@@ -226,19 +183,17 @@ function showTxApproval(details) {
|
||||
toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
|
||||
}
|
||||
toHtml += approvalAddressHtml(toAddr);
|
||||
if (symbol) {
|
||||
const link = etherscanTokenLink(toAddr);
|
||||
toHtml = toHtml.replace("</div>", "") + ""; // approvalAddressHtml already has etherscan link
|
||||
}
|
||||
$("approve-tx-to").innerHTML = toHtml;
|
||||
} else {
|
||||
$("approve-tx-to").innerHTML = escapeHtml("(contract creation)");
|
||||
}
|
||||
|
||||
const ethValueFormatted = formatTxValue(
|
||||
formatEther(details.txParams.value || "0"),
|
||||
);
|
||||
const ethPrice = getPrice("ETH");
|
||||
const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
|
||||
const usdStr = formatUsd(ethUsd);
|
||||
$("approve-tx-value").textContent =
|
||||
ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
formatTxValue(formatEther(details.txParams.value || "0")) + " ETH";
|
||||
|
||||
// Decode calldata (reuse decoded from above)
|
||||
const decodedEl = $("approve-tx-decoded");
|
||||
@@ -253,9 +208,12 @@ function showTxApproval(details) {
|
||||
detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
|
||||
if (d.address) {
|
||||
if (d.isToken) {
|
||||
const tLink = etherscanTokenLink(d.address);
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
|
||||
detailsHtml += approvalAddressHtml(d.address);
|
||||
} else {
|
||||
detailsHtml += approvalAddressHtml(d.address);
|
||||
}
|
||||
detailsHtml += approvalAddressHtml(d.address);
|
||||
} else {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
|
||||
}
|
||||
@@ -275,11 +233,7 @@ function showTxApproval(details) {
|
||||
$("approve-tx-data-section").classList.add("hidden");
|
||||
}
|
||||
|
||||
$("approve-tx-password").value = "";
|
||||
hideError("approve-tx-error");
|
||||
|
||||
showView("approve-tx");
|
||||
attachCopyHandlers("view-approve-tx");
|
||||
}
|
||||
|
||||
function decodeHexMessage(hex) {
|
||||
@@ -331,13 +285,7 @@ function formatTypedDataHtml(jsonStr) {
|
||||
}
|
||||
|
||||
function showSignApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-sign-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
const sp = details.signParams;
|
||||
pendingSignParams = sp;
|
||||
|
||||
$("approve-sign-hostname").textContent = details.hostname;
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
|
||||
@@ -365,20 +313,19 @@ function showSignApproval(details) {
|
||||
if (warningEl) {
|
||||
if (sp.dangerWarning) {
|
||||
warningEl.textContent = sp.dangerWarning;
|
||||
warningEl.style.visibility = "visible";
|
||||
warningEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningEl.textContent = "";
|
||||
warningEl.style.visibility = "hidden";
|
||||
warningEl.classList.add("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
$("approve-sign-password").value = "";
|
||||
hideError("approve-sign-error");
|
||||
$("approve-sign-error").classList.add("hidden");
|
||||
$("btn-approve-sign").disabled = false;
|
||||
$("btn-approve-sign").classList.remove("text-muted");
|
||||
|
||||
showView("approve-sign");
|
||||
attachCopyHandlers("view-approve-sign");
|
||||
}
|
||||
|
||||
function show(id) {
|
||||
@@ -397,52 +344,16 @@ function show(id) {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(
|
||||
state.activeAddress,
|
||||
);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
});
|
||||
}
|
||||
|
||||
let approvalId = null;
|
||||
let pendingTxDetails = null;
|
||||
// The exact parameters shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching anything at approval time. Both are
|
||||
// repopulated by show() when the popup is closed and reopened.
|
||||
let pendingTxParams = null;
|
||||
let pendingSignParams = null;
|
||||
|
||||
// Approve buttons stay disabled and muted while the popup derives the key and
|
||||
// signs, which is slow enough (Argon2id) that a double click is likely.
|
||||
function setTxButtonBusy(busy) {
|
||||
$("btn-approve-tx").disabled = busy;
|
||||
$("btn-approve-tx").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
function setSignButtonBusy(busy) {
|
||||
$("btn-approve-sign").disabled = busy;
|
||||
$("btn-approve-sign").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
// Locate the wallet and the address index owning the currently active
|
||||
// address. Returns null when no wallet holds it.
|
||||
function findActiveWallet() {
|
||||
for (const wallet of state.wallets) {
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
if (wallet.addresses[i].address === state.activeAddress) {
|
||||
return { wallet, addrIndex: i };
|
||||
}
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("approve-remember").addEventListener("change", async () => {
|
||||
@@ -472,86 +383,35 @@ function init(ctx) {
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-tx").addEventListener("click", async () => {
|
||||
let password = $("approve-tx-password").value;
|
||||
$("btn-approve-tx").addEventListener("click", () => {
|
||||
const password = $("approve-tx-password").value;
|
||||
if (!password) {
|
||||
showError("approve-tx-error", "Please enter your password.");
|
||||
$("approve-tx-error").textContent = "Please enter your password.";
|
||||
$("approve-tx-error").classList.remove("hidden");
|
||||
return;
|
||||
}
|
||||
hideError("approve-tx-error");
|
||||
setTxButtonBusy(true);
|
||||
$("approve-tx-error").classList.add("hidden");
|
||||
$("btn-approve-tx").disabled = true;
|
||||
$("btn-approve-tx").classList.add("text-muted");
|
||||
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signed transaction does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connected = signer.connect(provider);
|
||||
// This is the sequence ethers' own sendTransaction() runs
|
||||
// internally, so nonce, gas, fee and chain id population are
|
||||
// identical to when the background did the signing.
|
||||
const populated =
|
||||
await connected.populateTransaction(pendingTxParams);
|
||||
delete populated.from;
|
||||
payload.rawSignedTx = await connected.signTransaction(populated);
|
||||
} catch (e) {
|
||||
payload.error =
|
||||
e.shortMessage || e.message || "Transaction signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
} else {
|
||||
const msg =
|
||||
(response && response.error) || "Transaction failed.";
|
||||
txStatus.showError(pendingTxDetails, null, msg);
|
||||
}
|
||||
});
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
} else {
|
||||
const msg =
|
||||
(response && response.error) || "Transaction failed.";
|
||||
txStatus.showError(pendingTxDetails, null, msg);
|
||||
}
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
$("btn-reject-tx").addEventListener("click", () => {
|
||||
@@ -563,93 +423,38 @@ function init(ctx) {
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-sign").addEventListener("click", async () => {
|
||||
let password = $("approve-sign-password").value;
|
||||
$("btn-approve-sign").addEventListener("click", () => {
|
||||
const password = $("approve-sign-password").value;
|
||||
if (!password) {
|
||||
showError("approve-sign-error", "Please enter your password.");
|
||||
$("approve-sign-error").textContent = "Please enter your password.";
|
||||
$("approve-sign-error").classList.remove("hidden");
|
||||
return;
|
||||
}
|
||||
hideError("approve-sign-error");
|
||||
setSignButtonBusy(true);
|
||||
$("approve-sign-error").classList.add("hidden");
|
||||
$("btn-approve-sign").disabled = true;
|
||||
$("btn-approve-sign").classList.add("text-muted");
|
||||
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signature does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
const sp = pendingSignParams;
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") {
|
||||
payload.signature = await signer.signMessage(
|
||||
getBytes(sp.message),
|
||||
);
|
||||
} else {
|
||||
// eth_signTypedData_v4 / eth_signTypedData
|
||||
const typedData = JSON.parse(sp.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers handles EIP712Domain internally
|
||||
delete types.EIP712Domain;
|
||||
payload.signature = await signer.signTypedData(
|
||||
domain,
|
||||
types,
|
||||
message,
|
||||
);
|
||||
}
|
||||
} catch (e) {
|
||||
payload.error = e.shortMessage || e.message || "Signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
} else {
|
||||
const msg = (response && response.error) || "Signing failed.";
|
||||
showError("approve-sign-error", msg);
|
||||
setSignButtonBusy(false);
|
||||
}
|
||||
});
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
} else {
|
||||
const msg =
|
||||
(response && response.error) || "Signing failed.";
|
||||
$("approve-sign-error").textContent = msg;
|
||||
$("approve-sign-error").classList.remove("hidden");
|
||||
$("btn-approve-sign").disabled = false;
|
||||
$("btn-approve-sign").classList.remove("text-muted");
|
||||
}
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
$("btn-reject-sign").addEventListener("click", () => {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
// Transaction confirmation view with inline password.
|
||||
// Shows transaction details, warnings, errors. On Sign & Send,
|
||||
// reads inline password, decrypts secret, signs and broadcasts.
|
||||
// Transaction confirmation view + password modal.
|
||||
// Shows transaction details, warnings, errors. On proceed, opens
|
||||
// password modal, decrypts secret, signs and broadcasts.
|
||||
|
||||
const {
|
||||
parseEther,
|
||||
@@ -14,35 +14,36 @@ const {
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressTitle,
|
||||
addressDotHtml,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { state } = require("../../shared/state");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const {
|
||||
getLocalWarnings,
|
||||
getFullWarnings,
|
||||
} = require("../../shared/addressWarnings");
|
||||
const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
|
||||
const { isScamAddress } = require("../../shared/scamlist");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const txStatus = require("./txStatus");
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
let pendingTx = null;
|
||||
|
||||
function restore() {
|
||||
const d = state.viewData;
|
||||
if (d && d.pendingTx) {
|
||||
show(d.pendingTx);
|
||||
}
|
||||
function etherscanTokenLink(address) {
|
||||
return `https://etherscan.io/token/${address}`;
|
||||
}
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function blockieHtml(address) {
|
||||
@@ -52,10 +53,22 @@ function blockieHtml(address) {
|
||||
|
||||
function confirmAddressHtml(address, ensName, title) {
|
||||
const blockie = blockieHtml(address);
|
||||
return (
|
||||
`<div class="mb-1">${blockie}</div>` +
|
||||
renderAddressHtml(address, { title, ensName })
|
||||
);
|
||||
const dot = addressDotHtml(address);
|
||||
const link = etherscanAddressLink(address);
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
let html = `<div class="mb-1">${blockie}</div>`;
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
html +=
|
||||
`<div class="flex items-center">${title || ensName ? "" : dot}` +
|
||||
`<span class="break-all">${escapeHtml(address)}</span>` +
|
||||
extLink +
|
||||
`</div>`;
|
||||
return html;
|
||||
}
|
||||
|
||||
function valueWithUsd(text, usdAmount) {
|
||||
@@ -82,12 +95,11 @@ function show(txInfo) {
|
||||
// Token contract section (ERC-20 only)
|
||||
const tokenSection = $("confirm-token-section");
|
||||
if (isErc20) {
|
||||
$("confirm-token-contract").innerHTML = renderAddressHtml(
|
||||
txInfo.token,
|
||||
{},
|
||||
);
|
||||
const link = etherscanTokenLink(txInfo.token);
|
||||
$("confirm-token-contract").innerHTML =
|
||||
escapeHtml(txInfo.token) +
|
||||
` <a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
tokenSection.classList.remove("hidden");
|
||||
attachCopyHandlers(tokenSection);
|
||||
} else {
|
||||
tokenSection.classList.add("hidden");
|
||||
}
|
||||
@@ -134,23 +146,28 @@ function show(txInfo) {
|
||||
$("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
|
||||
}
|
||||
|
||||
// Check for warnings (synchronous local checks)
|
||||
const localWarnings = getLocalWarnings(txInfo.to, {
|
||||
fromAddress: txInfo.from,
|
||||
});
|
||||
// Check for warnings
|
||||
const warnings = [];
|
||||
if (isScamAddress(txInfo.to)) {
|
||||
warnings.push(
|
||||
"This address is on a known scam/fraud list. Do not send funds to this address.",
|
||||
);
|
||||
}
|
||||
if (txInfo.to.toLowerCase() === txInfo.from.toLowerCase()) {
|
||||
warnings.push("You are sending to your own address.");
|
||||
}
|
||||
|
||||
const warningsEl = $("confirm-warnings");
|
||||
if (localWarnings.length > 0) {
|
||||
warningsEl.innerHTML = localWarnings
|
||||
if (warnings.length > 0) {
|
||||
warningsEl.innerHTML = warnings
|
||||
.map(
|
||||
(w) =>
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
|
||||
)
|
||||
.join("");
|
||||
warningsEl.style.visibility = "visible";
|
||||
warningsEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningsEl.innerHTML = "";
|
||||
warningsEl.style.visibility = "hidden";
|
||||
warningsEl.classList.add("hidden");
|
||||
}
|
||||
|
||||
// Check for errors
|
||||
@@ -188,40 +205,21 @@ function show(txInfo) {
|
||||
errorsEl.innerHTML = errors
|
||||
.map((e) => `<div class="text-xs">${e}</div>`)
|
||||
.join("");
|
||||
errorsEl.style.visibility = "visible";
|
||||
errorsEl.classList.remove("hidden");
|
||||
sendBtn.disabled = true;
|
||||
sendBtn.classList.add("text-muted");
|
||||
} else {
|
||||
errorsEl.innerHTML = "";
|
||||
errorsEl.style.visibility = "hidden";
|
||||
errorsEl.classList.add("hidden");
|
||||
sendBtn.disabled = false;
|
||||
sendBtn.classList.remove("text-muted");
|
||||
}
|
||||
|
||||
// Reset password field and error
|
||||
$("confirm-tx-password").value = "";
|
||||
hideError("confirm-tx-password-error");
|
||||
|
||||
// Gas estimate — show placeholder then fetch async
|
||||
$("confirm-fee").style.visibility = "visible";
|
||||
$("confirm-fee").classList.remove("hidden");
|
||||
$("confirm-fee-amount").textContent = "Estimating...";
|
||||
state.viewData = { pendingTx: txInfo };
|
||||
showView("confirm-tx");
|
||||
attachCopyHandlers("view-confirm-tx");
|
||||
|
||||
// Reset async warnings to hidden (space always reserved, no layout shift)
|
||||
$("confirm-recipient-warning").style.visibility = "hidden";
|
||||
$("confirm-contract-warning").style.visibility = "hidden";
|
||||
$("confirm-burn-warning").style.visibility = "hidden";
|
||||
$("confirm-etherscan-warning").style.visibility = "hidden";
|
||||
|
||||
// Show burn warning via reserved element (in addition to inline warning)
|
||||
if (isBurnAddress(txInfo.to)) {
|
||||
$("confirm-burn-warning").style.visibility = "visible";
|
||||
}
|
||||
|
||||
estimateGas(txInfo);
|
||||
checkRecipientHistory(txInfo);
|
||||
}
|
||||
|
||||
async function estimateGas(txInfo) {
|
||||
@@ -264,42 +262,39 @@ async function estimateGas(txInfo) {
|
||||
}
|
||||
}
|
||||
|
||||
async function checkRecipientHistory(txInfo) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
|
||||
fromAddress: txInfo.from,
|
||||
});
|
||||
for (const w of asyncWarnings) {
|
||||
if (w.type === "contract") {
|
||||
$("confirm-contract-warning").style.visibility = "visible";
|
||||
}
|
||||
if (w.type === "new-address") {
|
||||
$("confirm-recipient-warning").style.visibility = "visible";
|
||||
}
|
||||
if (w.type === "etherscan-phishing") {
|
||||
$("confirm-etherscan-warning").style.visibility = "visible";
|
||||
}
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("recipient history check failed:", e.message);
|
||||
}
|
||||
function showPasswordModal() {
|
||||
$("modal-password").value = "";
|
||||
hideError("modal-password-error");
|
||||
$("password-modal").classList.remove("hidden");
|
||||
}
|
||||
|
||||
function hidePasswordModal() {
|
||||
$("password-modal").classList.add("hidden");
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("btn-confirm-send").addEventListener("click", async () => {
|
||||
const password = $("confirm-tx-password").value;
|
||||
$("btn-confirm-send").addEventListener("click", () => {
|
||||
showPasswordModal();
|
||||
});
|
||||
|
||||
$("btn-confirm-back").addEventListener("click", () => {
|
||||
showView("send");
|
||||
});
|
||||
|
||||
$("btn-modal-cancel").addEventListener("click", () => {
|
||||
hidePasswordModal();
|
||||
});
|
||||
|
||||
$("btn-modal-confirm").addEventListener("click", async () => {
|
||||
const password = $("modal-password").value;
|
||||
if (!password) {
|
||||
showError(
|
||||
"confirm-tx-password-error",
|
||||
"Please enter your password.",
|
||||
);
|
||||
showError("modal-password-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
let decryptedSecret;
|
||||
hideError("confirm-tx-password-error");
|
||||
hideError("modal-password-error");
|
||||
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
@@ -307,12 +302,11 @@ function init(ctx) {
|
||||
password,
|
||||
);
|
||||
} catch (e) {
|
||||
showError("confirm-tx-password-error", "Wrong password.");
|
||||
showError("modal-password-error", "Wrong password.");
|
||||
return;
|
||||
}
|
||||
|
||||
$("btn-confirm-send").disabled = true;
|
||||
$("btn-confirm-send").classList.add("text-muted");
|
||||
hidePasswordModal();
|
||||
|
||||
let tx;
|
||||
try {
|
||||
@@ -349,15 +343,8 @@ function init(ctx) {
|
||||
decryptedSecret = null;
|
||||
const hash = tx ? tx.hash : null;
|
||||
txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
|
||||
} finally {
|
||||
$("btn-confirm-send").disabled = false;
|
||||
$("btn-confirm-send").classList.remove("text-muted");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-confirm-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show, restore };
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -1,10 +1,6 @@
|
||||
const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const {
|
||||
removeWalletFromState,
|
||||
broadcastActiveChanged,
|
||||
} = require("../../shared/walletDelete");
|
||||
|
||||
let deleteWalletIndex = null;
|
||||
let ctx = null;
|
||||
@@ -16,7 +12,7 @@ function show(walletIdx) {
|
||||
wallet.name || "Wallet " + (walletIdx + 1);
|
||||
$("delete-wallet-password").value = "";
|
||||
$("delete-wallet-flash").textContent = "";
|
||||
$("delete-wallet-flash").style.visibility = "hidden";
|
||||
$("delete-wallet-flash").classList.add("hidden");
|
||||
showView("delete-wallet-confirm");
|
||||
}
|
||||
|
||||
@@ -25,7 +21,7 @@ function init(_ctx) {
|
||||
|
||||
$("btn-delete-wallet-back").addEventListener("click", () => {
|
||||
deleteWalletIndex = null;
|
||||
goBack();
|
||||
ctx.showSettingsView();
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-confirm").addEventListener("click", async () => {
|
||||
@@ -33,21 +29,17 @@ function init(_ctx) {
|
||||
if (!pw) {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"Please enter your password.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
$("delete-wallet-flash").classList.remove("hidden");
|
||||
return;
|
||||
}
|
||||
|
||||
if (deleteWalletIndex === null) {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"No wallet selected for deletion.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
$("delete-wallet-flash").classList.remove("hidden");
|
||||
return;
|
||||
}
|
||||
|
||||
const btn = $("btn-delete-wallet-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
|
||||
const walletIdx = deleteWalletIndex;
|
||||
const wallet = state.wallets[walletIdx];
|
||||
|
||||
@@ -56,38 +48,40 @@ function init(_ctx) {
|
||||
await decryptWithPassword(wallet.encryptedSecret, pw);
|
||||
} catch (_e) {
|
||||
$("delete-wallet-flash").textContent = "Wrong password.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
$("delete-wallet-flash").classList.remove("hidden");
|
||||
return;
|
||||
}
|
||||
|
||||
// Remove the wallet and repair selection, permissions and hasWallet
|
||||
const { activeAddressChanged } = removeWalletFromState(
|
||||
state,
|
||||
walletIdx,
|
||||
);
|
||||
// Collect addresses to clean up from allowedSites/deniedSites
|
||||
const addresses = (wallet.addresses || []).map((a) => a.address);
|
||||
|
||||
// Remove wallet
|
||||
state.wallets.splice(walletIdx, 1);
|
||||
|
||||
// Clean up site permissions for deleted addresses
|
||||
for (const addr of addresses) {
|
||||
delete state.allowedSites[addr];
|
||||
delete state.deniedSites[addr];
|
||||
}
|
||||
|
||||
deleteWalletIndex = null;
|
||||
|
||||
if (!state.hasWallet) {
|
||||
clearViewStack();
|
||||
if (state.wallets.length === 0) {
|
||||
// No wallets left — reset selection and show welcome
|
||||
state.selectedWallet = null;
|
||||
state.selectedAddress = null;
|
||||
state.activeAddress = null;
|
||||
await saveState();
|
||||
// Save before broadcasting: the background reads the active
|
||||
// address back out of storage to build accountsChanged.
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
showView("welcome");
|
||||
} else {
|
||||
// Switch to first wallet if deleted wallet was active
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
state.activeAddress =
|
||||
state.wallets[0].addresses[0]?.address || null;
|
||||
await saveState();
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
// Reset stack to [main] so Settings back goes home.
|
||||
// Use require() lazily to avoid circular dependency
|
||||
// (settings.js requires deleteWallet.js).
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
ctx.renderWalletList();
|
||||
const settings = require("./settings");
|
||||
settings.show();
|
||||
ctx.showSettingsView();
|
||||
showFlash("Wallet deleted.");
|
||||
}
|
||||
});
|
||||
|
||||
@@ -1,18 +1,19 @@
|
||||
// Shared DOM helpers used by all views.
|
||||
|
||||
const { isDebug } = require("../../shared/log");
|
||||
const { DEBUG } = require("../../shared/constants");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
|
||||
// When views are added, removed, or transitions between them change,
|
||||
// update the view-navigation documentation in README.md to match.
|
||||
const VIEWS = [
|
||||
"welcome",
|
||||
"add-wallet",
|
||||
"import-key",
|
||||
"main",
|
||||
"address",
|
||||
"address-token",
|
||||
@@ -30,7 +31,6 @@ const VIEWS = [
|
||||
"approve-site",
|
||||
"approve-tx",
|
||||
"approve-sign",
|
||||
"export-privkey",
|
||||
];
|
||||
|
||||
function $(id) {
|
||||
@@ -40,13 +40,11 @@ function $(id) {
|
||||
function showError(id, msg) {
|
||||
const el = $(id);
|
||||
el.textContent = msg;
|
||||
el.style.visibility = "visible";
|
||||
el.classList.remove("hidden");
|
||||
}
|
||||
|
||||
function hideError(id) {
|
||||
const el = $(id);
|
||||
el.textContent = "";
|
||||
el.style.visibility = "hidden";
|
||||
$(id).classList.add("hidden");
|
||||
}
|
||||
|
||||
function showView(name) {
|
||||
@@ -59,77 +57,14 @@ function showView(name) {
|
||||
clearFlash();
|
||||
state.currentView = name;
|
||||
saveState();
|
||||
updateDebugBanner(name);
|
||||
}
|
||||
|
||||
// Create or update the debug/insecure warning banner.
|
||||
// Called on every view switch and after the settings debug toggle changes.
|
||||
// The banner is shown when the compile-time DEBUG constant is true OR when
|
||||
// the user has enabled runtime debug mode via the settings easter egg, OR
|
||||
// when the active network is a testnet.
|
||||
function updateDebugBanner(viewName) {
|
||||
const debug = isDebug();
|
||||
const net = currentNetwork();
|
||||
const show = debug || net.isTestnet;
|
||||
let banner = document.getElementById("debug-banner");
|
||||
if (show) {
|
||||
if (!banner) {
|
||||
banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
if (DEBUG) {
|
||||
const banner = document.getElementById("debug-banner");
|
||||
if (banner) {
|
||||
banner.textContent = "DEBUG / INSECURE (" + name + ")";
|
||||
}
|
||||
const suffix = viewName ? " (" + viewName + ")" : "";
|
||||
if (debug && net.isTestnet) {
|
||||
banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
|
||||
} else if (net.isTestnet) {
|
||||
banner.textContent = "[TESTNET]" + suffix;
|
||||
} else {
|
||||
banner.textContent = "DEBUG / INSECURE" + suffix;
|
||||
}
|
||||
} else if (banner) {
|
||||
banner.remove();
|
||||
}
|
||||
}
|
||||
|
||||
// Callback to re-render the main/home view when navigating back to it.
|
||||
// Set once by index.js via setRenderMain().
|
||||
let _renderMain = null;
|
||||
|
||||
function setRenderMain(fn) {
|
||||
_renderMain = fn;
|
||||
}
|
||||
|
||||
// Push the current view onto the navigation stack so goBack() can
|
||||
// return to it. Call this before any forward navigation.
|
||||
function pushCurrentView() {
|
||||
if (state.currentView) {
|
||||
state.viewStack.push(state.currentView);
|
||||
}
|
||||
}
|
||||
|
||||
// Pop the navigation stack and show the previous view. If the stack
|
||||
// is empty, fall back to the main (home) view.
|
||||
function goBack() {
|
||||
let target;
|
||||
if (state.viewStack.length > 0) {
|
||||
target = state.viewStack.pop();
|
||||
} else {
|
||||
target = "main";
|
||||
}
|
||||
if (target === "main" && _renderMain) {
|
||||
_renderMain();
|
||||
}
|
||||
showView(target);
|
||||
}
|
||||
|
||||
// Clear the entire navigation stack (used when resetting to root,
|
||||
// e.g. after adding or deleting a wallet).
|
||||
function clearViewStack() {
|
||||
state.viewStack = [];
|
||||
}
|
||||
|
||||
let flashTimer = null;
|
||||
|
||||
function clearFlash() {
|
||||
@@ -271,47 +206,38 @@ function addressTitle(address, wallets) {
|
||||
// Render an address with color dot, optional ENS name, optional title,
|
||||
// and optional truncation. Title and ENS are shown as bold labels above
|
||||
// the full address.
|
||||
// Delegates to renderAddressHtml for consistent output.
|
||||
function formatAddressHtml(address, ensName, maxLen, title) {
|
||||
return renderAddressHtml(address, { title, ensName, maxLen });
|
||||
const dot = addressDotHtml(address);
|
||||
const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
|
||||
if (title || ensName) {
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
html += `<div class="break-all">${escapeHtml(displayAddr)}</div>`;
|
||||
return html;
|
||||
}
|
||||
return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(displayAddr)}</span></div>`;
|
||||
}
|
||||
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -332,116 +258,12 @@ function timeAgo(timestamp) {
|
||||
return years + " year" + (years !== 1 ? "s" : "") + " ago";
|
||||
}
|
||||
|
||||
// Shared external-link icon SVG used across all views.
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function etherscanAddressUrl(address) {
|
||||
return `${currentNetwork().explorerUrl}/address/${address}`;
|
||||
}
|
||||
|
||||
function etherscanLinkHtml(url) {
|
||||
return (
|
||||
`<a href="${url}" target="_blank" rel="noopener" ` +
|
||||
`class="inline-flex items-center">${EXT_ICON}</a>`
|
||||
);
|
||||
}
|
||||
|
||||
// Render a copyable text span with dashed underline affordance.
|
||||
// The caller must attach click handlers via attachCopyHandlers() or
|
||||
// manually wire up [data-copy] elements after inserting the HTML.
|
||||
function copyableHtml(text, extraClass) {
|
||||
const cls =
|
||||
"underline decoration-dashed cursor-pointer" +
|
||||
(extraClass ? " " + extraClass : "");
|
||||
return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
|
||||
}
|
||||
|
||||
// Attach click-to-copy handlers to all [data-copy] elements within
|
||||
// a container. Safe to call multiple times on the same container.
|
||||
function attachCopyHandlers(container) {
|
||||
const root =
|
||||
typeof container === "string"
|
||||
? document.getElementById(container)
|
||||
: container;
|
||||
if (!root) return;
|
||||
root.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(el);
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
// Unified address rendering.
|
||||
//
|
||||
// Produces consistent HTML for any Ethereum address:
|
||||
// • Color dot
|
||||
// • Optional title (e.g. "Wallet 1 — Address 2") shown bold above address
|
||||
// • Optional ENS name shown bold above address
|
||||
// • Full address (or truncated via maxLen) with dashed-underline click-to-copy
|
||||
// • Etherscan external link icon
|
||||
//
|
||||
// Options object:
|
||||
// title — wallet title string (from addressTitle)
|
||||
// ensName — ENS name string
|
||||
// maxLen — if set, truncate address display (min 32 chars enforced)
|
||||
// noLink — if true, omit etherscan link
|
||||
//
|
||||
// After inserting the returned HTML into the DOM, call
|
||||
// attachCopyHandlers() on the parent to wire up click-to-copy.
|
||||
function renderAddressHtml(address, opts) {
|
||||
const { title, ensName, maxLen, noLink } = opts || {};
|
||||
const dot = addressDotHtml(address);
|
||||
const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
|
||||
const link = etherscanAddressUrl(address);
|
||||
const extLink = noLink ? "" : etherscanLinkHtml(link);
|
||||
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
if (title || ensName) {
|
||||
html += `<div class="flex items-center">${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
|
||||
} else {
|
||||
html += `<div class="flex items-center">${dot}${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
function flashCopyFeedback(el) {
|
||||
if (!el) return;
|
||||
el.classList.remove("copy-flash-fade");
|
||||
el.classList.add("copy-flash-active");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-active");
|
||||
el.classList.add("copy-flash-fade");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-fade");
|
||||
}, 275);
|
||||
}, 75);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
$,
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLine,
|
||||
balanceLinesForAddress,
|
||||
addressColor,
|
||||
@@ -449,12 +271,6 @@ module.exports = {
|
||||
escapeHtml,
|
||||
addressTitle,
|
||||
formatAddressHtml,
|
||||
renderAddressHtml,
|
||||
copyableHtml,
|
||||
attachCopyHandlers,
|
||||
etherscanAddressUrl,
|
||||
etherscanLinkHtml,
|
||||
EXT_ICON,
|
||||
truncateMiddle,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
|
||||
@@ -2,7 +2,6 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLinesForAddress,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
@@ -10,16 +9,9 @@ const {
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentAddress } = require("../../shared/state");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
resetSendValidation,
|
||||
} = require("./send");
|
||||
const { updateSendBalance, renderSendTokenSelect } = require("./send");
|
||||
const { deriveAddressFromXpub } = require("../../shared/wallet");
|
||||
const {
|
||||
formatUsd,
|
||||
@@ -72,12 +64,27 @@ function renderTotalValue() {
|
||||
}
|
||||
}
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function renderActiveAddress() {
|
||||
const el = $("active-address-display");
|
||||
if (!el) return;
|
||||
if (state.activeAddress) {
|
||||
el.innerHTML = renderAddressHtml(state.activeAddress);
|
||||
attachCopyHandlers(el);
|
||||
const addr = state.activeAddress;
|
||||
const dot = addressDotHtml(addr);
|
||||
const link = `https://etherscan.io/address/${addr}`;
|
||||
el.innerHTML =
|
||||
`<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
|
||||
`<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
$("active-addr-copy").addEventListener("click", () => {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
});
|
||||
} else {
|
||||
el.textContent = "";
|
||||
}
|
||||
@@ -96,15 +103,10 @@ function renderHomeTxList(ctx) {
|
||||
let html = "";
|
||||
let i = 0;
|
||||
for (const tx of homeTxs) {
|
||||
// For swap transactions, show the user's own labelled wallet
|
||||
// address (the one that initiated the swap) instead of the
|
||||
// contract address which is not useful in the list view.
|
||||
const counterparty =
|
||||
tx.direction === "contract" && tx.directionLabel === "Swap"
|
||||
? tx.from
|
||||
: tx.direction === "sent" || tx.direction === "contract"
|
||||
? tx.to
|
||||
: tx.from;
|
||||
tx.direction === "sent" || tx.direction === "contract"
|
||||
? tx.to
|
||||
: tx.from;
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
@@ -228,7 +230,7 @@ function render(ctx) {
|
||||
html += `<div>`;
|
||||
html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
|
||||
html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
|
||||
if (wallet.type === "hd" || wallet.type === "xprv") {
|
||||
if (wallet.type === "hd") {
|
||||
html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
@@ -381,8 +383,6 @@ function init(ctx) {
|
||||
$("send-token-static").classList.add("hidden");
|
||||
renderSendTokenSelect(addr);
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
|
||||
69
src/popup/views/importKey.js
Normal file
69
src/popup/views/importKey.js
Normal file
@@ -0,0 +1,69 @@
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { addressFromPrivateKey } = require("../../shared/wallet");
|
||||
const { encryptWithPassword } = require("../../shared/vault");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
|
||||
function show() {
|
||||
$("import-private-key").value = "";
|
||||
$("import-key-password").value = "";
|
||||
$("import-key-password-confirm").value = "";
|
||||
showView("import-key");
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("btn-import-key-confirm").addEventListener("click", async () => {
|
||||
const key = $("import-private-key").value.trim();
|
||||
if (!key) {
|
||||
showFlash("Please enter your private key.");
|
||||
return;
|
||||
}
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch (e) {
|
||||
showFlash("Invalid private key.");
|
||||
return;
|
||||
}
|
||||
const pw = $("import-key-password").value;
|
||||
const pw2 = $("import-key-password-confirm").value;
|
||||
if (!pw) {
|
||||
showFlash("Please choose a password.");
|
||||
return;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showFlash("Password must be at least 12 characters.");
|
||||
return;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showFlash("Passwords do not match.");
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(key, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
state.wallets.push({
|
||||
type: "key",
|
||||
name: "Wallet " + walletNum,
|
||||
encryptedSecret: encrypted,
|
||||
addresses: [
|
||||
{ address: addr, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
});
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
});
|
||||
|
||||
$("btn-import-key-back").addEventListener("click", () => {
|
||||
if (!state.hasWallet) {
|
||||
showView("welcome");
|
||||
} else {
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
@@ -1,27 +1,23 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
formatAddressHtml,
|
||||
addressTitle,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress, currentNetwork } = require("../../shared/state");
|
||||
const { $, showView, showFlash, addressDotHtml } = require("./helpers");
|
||||
const { state, currentAddress } = require("../../shared/state");
|
||||
const QRCode = require("qrcode");
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function show() {
|
||||
const addr = currentAddress();
|
||||
const address = addr ? addr.address : "";
|
||||
const title = address ? addressTitle(address, state.wallets) : null;
|
||||
const ensName = addr ? addr.ensName || null : null;
|
||||
$("receive-address-block").innerHTML = address
|
||||
? formatAddressHtml(address, ensName, null, title)
|
||||
$("receive-dot").innerHTML = address ? addressDotHtml(address) : "";
|
||||
$("receive-address").textContent = address;
|
||||
const link = address ? `https://etherscan.io/address/${address}` : "";
|
||||
$("receive-etherscan-link").innerHTML = link
|
||||
? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
|
||||
: "";
|
||||
$("receive-address-block").dataset.full = address;
|
||||
// Etherscan link is now included in formatAddressHtml via renderAddressHtml
|
||||
$("receive-etherscan-link").innerHTML = "";
|
||||
if (address) {
|
||||
QRCode.toCanvas($("receive-qr"), address, {
|
||||
width: 200,
|
||||
@@ -45,30 +41,29 @@ function show() {
|
||||
warningEl.textContent =
|
||||
"This is an ERC-20 token. Only send " +
|
||||
symbol +
|
||||
" on " +
|
||||
currentNetwork().name +
|
||||
" to this address. Sending tokens on other networks will result in permanent loss.";
|
||||
warningEl.style.visibility = "visible";
|
||||
" on the Ethereum network to this address. Sending tokens on other networks will result in permanent loss.";
|
||||
warningEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningEl.textContent = "";
|
||||
warningEl.style.visibility = "hidden";
|
||||
warningEl.classList.add("hidden");
|
||||
}
|
||||
showView("receive");
|
||||
attachCopyHandlers("view-receive");
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("btn-receive-copy").addEventListener("click", () => {
|
||||
const addr = $("receive-address-block").dataset.full;
|
||||
const addr = $("receive-address").textContent;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback($("receive-address-block"));
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-receive-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -3,117 +3,21 @@
|
||||
const {
|
||||
$,
|
||||
showFlash,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress } = require("../../shared/state");
|
||||
let ctx;
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { getAddress } = require("ethers");
|
||||
const { KNOWN_SYMBOLS } = require("../../shared/tokenList");
|
||||
|
||||
const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
|
||||
|
||||
/**
|
||||
* Validate a destination address string.
|
||||
* Returns { valid: true } or { valid: false, error: "..." }.
|
||||
*/
|
||||
function validateToAddress(value) {
|
||||
const v = value.trim();
|
||||
if (!v) return { valid: false, error: "" };
|
||||
|
||||
// ENS names: contains a dot and doesn't start with 0x
|
||||
if (v.includes(".") && !v.startsWith("0x")) {
|
||||
// Basic ENS format check: at least one label before and after dot
|
||||
if (/^[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+$/.test(v)) {
|
||||
return { valid: true };
|
||||
}
|
||||
return {
|
||||
valid: false,
|
||||
error: "Please enter a valid ENS name.",
|
||||
};
|
||||
}
|
||||
|
||||
// Must look like an Ethereum address
|
||||
if (!/^0x[0-9a-fA-F]{40}$/.test(v)) {
|
||||
return {
|
||||
valid: false,
|
||||
error: "Please enter a valid Ethereum address.",
|
||||
};
|
||||
}
|
||||
|
||||
// Reject zero address
|
||||
if (v.toLowerCase() === ZERO_ADDRESS) {
|
||||
return {
|
||||
valid: false,
|
||||
error: "Sending to the zero address is not allowed.",
|
||||
};
|
||||
}
|
||||
|
||||
// EIP-55 checksum validation: all-lowercase is ok, otherwise must match checksum
|
||||
if (v !== v.toLowerCase()) {
|
||||
try {
|
||||
const checksummed = getAddress(v);
|
||||
if (checksummed !== v) {
|
||||
return {
|
||||
valid: false,
|
||||
error: "Address checksum is invalid. Please double-check the address.",
|
||||
};
|
||||
}
|
||||
} catch {
|
||||
return {
|
||||
valid: false,
|
||||
error: "Address checksum is invalid. Please double-check the address.",
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Warn if sending to own address
|
||||
const addr = currentAddress();
|
||||
if (addr && v.toLowerCase() === addr.address.toLowerCase()) {
|
||||
// Allow but will warn — we return valid with a warning
|
||||
return {
|
||||
valid: true,
|
||||
warning: "This is your own address. Are you sure?",
|
||||
};
|
||||
}
|
||||
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
function updateToValidation() {
|
||||
const input = $("send-to");
|
||||
const errorEl = $("send-to-error");
|
||||
const btn = $("btn-send-review");
|
||||
const value = input.value.trim();
|
||||
|
||||
if (!value) {
|
||||
errorEl.textContent = "";
|
||||
btn.disabled = true;
|
||||
btn.classList.add("opacity-50");
|
||||
return;
|
||||
}
|
||||
|
||||
const result = validateToAddress(value);
|
||||
if (!result.valid) {
|
||||
errorEl.textContent = result.error;
|
||||
errorEl.style.color = "#cc0000";
|
||||
btn.disabled = true;
|
||||
btn.classList.add("opacity-50");
|
||||
} else if (result.warning) {
|
||||
errorEl.textContent = result.warning;
|
||||
errorEl.style.color = "#b8860b";
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("opacity-50");
|
||||
} else {
|
||||
errorEl.textContent = "";
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("opacity-50");
|
||||
}
|
||||
}
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function isSpoofedToken(t) {
|
||||
const upper = (t.symbol || "").toUpperCase();
|
||||
@@ -143,12 +47,24 @@ function renderSendTokenSelect(addr) {
|
||||
function updateSendBalance() {
|
||||
const addr = currentAddress();
|
||||
if (!addr) return;
|
||||
const dot = addressDotHtml(addr.address);
|
||||
const link = `https://etherscan.io/address/${addr.address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(addr.address, state.wallets);
|
||||
$("send-from").innerHTML = renderAddressHtml(addr.address, {
|
||||
title,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
attachCopyHandlers($("send-from"));
|
||||
let fromHtml = "";
|
||||
if (title) {
|
||||
fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
if (addr.ensName) {
|
||||
fromHtml += `<div>${escapeHtml(addr.ensName)}</div>`;
|
||||
}
|
||||
fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
|
||||
} else if (addr.ensName) {
|
||||
fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(addr.ensName)}</div>`;
|
||||
fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
|
||||
} else {
|
||||
fromHtml += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(addr.address)}</span>${extLink}</div>`;
|
||||
}
|
||||
$("send-from").innerHTML = fromHtml;
|
||||
const token = state.selectedToken || $("send-token").value;
|
||||
if (token === "ETH") {
|
||||
$("send-balance").textContent =
|
||||
@@ -157,11 +73,7 @@ function updateSendBalance() {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === token.toLowerCase(),
|
||||
);
|
||||
const symbol = resolveSymbol(
|
||||
token,
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
const symbol = tb ? tb.symbol : "?";
|
||||
const bal = tb ? tb.balance || "0" : "0";
|
||||
$("send-balance").textContent =
|
||||
"Current balance: " + bal + " " + symbol;
|
||||
@@ -172,13 +84,6 @@ function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("send-token").addEventListener("change", updateSendBalance);
|
||||
|
||||
// Initial state: disable review button until address is entered
|
||||
$("btn-send-review").disabled = true;
|
||||
$("btn-send-review").classList.add("opacity-50");
|
||||
|
||||
// Validate address on input
|
||||
$("send-to").addEventListener("input", updateToValidation);
|
||||
|
||||
$("btn-send-review").addEventListener("click", async () => {
|
||||
const to = $("send-to").value.trim();
|
||||
const amount = $("send-amount").value.trim();
|
||||
@@ -186,15 +91,6 @@ function init(_ctx) {
|
||||
showFlash("Please enter a recipient address.");
|
||||
return;
|
||||
}
|
||||
|
||||
// Re-validate before proceeding
|
||||
const validation = validateToAddress(to);
|
||||
if (!validation.valid) {
|
||||
showFlash(
|
||||
validation.error || "Please enter a valid Ethereum address.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (!amount || isNaN(parseFloat(amount)) || parseFloat(amount) <= 0) {
|
||||
showFlash("Please enter a valid amount.");
|
||||
return;
|
||||
@@ -228,11 +124,7 @@ function init(_ctx) {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === token.toLowerCase(),
|
||||
);
|
||||
tokenSymbol = resolveSymbol(
|
||||
token,
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
tokenSymbol = tb ? tb.symbol : "?";
|
||||
tokenBalance = tb ? tb.balance || "0" : "0";
|
||||
}
|
||||
|
||||
@@ -251,23 +143,12 @@ function init(_ctx) {
|
||||
$("btn-send-back").addEventListener("click", () => {
|
||||
$("send-token").classList.remove("hidden");
|
||||
$("send-token-static").classList.add("hidden");
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
function resetSendValidation() {
|
||||
const errorEl = $("send-to-error");
|
||||
const btn = $("btn-send-review");
|
||||
if (errorEl) errorEl.textContent = "";
|
||||
if (btn) {
|
||||
btn.disabled = true;
|
||||
btn.classList.add("opacity-50");
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
init,
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
resetSendValidation,
|
||||
};
|
||||
module.exports = { init, updateSendBalance, renderSendTokenSelect };
|
||||
|
||||
@@ -1,34 +1,12 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { applyTheme } = require("../theme");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
|
||||
const { onChainSwitch } = require("../../shared/chainSwitch");
|
||||
const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
|
||||
const { $, showView, showFlash, escapeHtml } = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const deleteWallet = require("./deleteWallet");
|
||||
const {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
} = require("../../shared/buildInfo");
|
||||
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
let versionClickCount = 0;
|
||||
let versionClickTimer = null;
|
||||
|
||||
function renderSiteList(containerId, siteMap, stateKey) {
|
||||
const container = $(containerId);
|
||||
const hostnames = [...new Set(Object.values(siteMap).flat())];
|
||||
@@ -106,7 +84,6 @@ function renderWalletListSettings() {
|
||||
container.querySelectorAll(".btn-delete-wallet").forEach((btn) => {
|
||||
btn.addEventListener("click", () => {
|
||||
const idx = parseInt(btn.dataset.idx, 10);
|
||||
pushCurrentView();
|
||||
deleteWallet.show(idx);
|
||||
});
|
||||
});
|
||||
@@ -147,36 +124,10 @@ function renderWalletListSettings() {
|
||||
function show() {
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
const networkSelect = $("settings-network");
|
||||
if (networkSelect) {
|
||||
networkSelect.value = state.networkId;
|
||||
}
|
||||
renderTrackedTokens();
|
||||
renderSiteLists();
|
||||
renderWalletListSettings();
|
||||
|
||||
// Populate About well
|
||||
$("about-license").textContent = BUILD_LICENSE;
|
||||
// Show only the name part of the author field (strip email)
|
||||
const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
|
||||
$("about-author").textContent = authorName;
|
||||
$("about-version").textContent = BUILD_VERSION;
|
||||
$("about-release-date").textContent = BUILD_DATE;
|
||||
$("about-commit-link").textContent = BUILD_COMMIT;
|
||||
$("about-commit-link").href = GITEA_COMMIT_URL;
|
||||
|
||||
// Reset version click counter each time settings opens
|
||||
versionClickCount = 0;
|
||||
|
||||
// Show debug well if debug mode is already enabled
|
||||
const debugWell = $("settings-debug-well");
|
||||
if (state.debugMode) {
|
||||
debugWell.style.display = "";
|
||||
} else {
|
||||
debugWell.style.display = "none";
|
||||
}
|
||||
$("settings-debug-mode").checked = state.debugMode;
|
||||
|
||||
showView("settings");
|
||||
}
|
||||
|
||||
@@ -216,12 +167,9 @@ function init(ctx) {
|
||||
showFlash("Endpoint returned error: " + json.error.message);
|
||||
return;
|
||||
}
|
||||
const net = currentNetwork();
|
||||
if (json.result !== net.chainId) {
|
||||
if (json.result !== ETHEREUM_MAINNET_CHAIN_ID) {
|
||||
showFlash(
|
||||
"Wrong network (expected " +
|
||||
net.name +
|
||||
", got chain " +
|
||||
"Wrong network (expected mainnet, got chain " +
|
||||
json.result +
|
||||
").",
|
||||
);
|
||||
@@ -260,30 +208,12 @@ function init(ctx) {
|
||||
showFlash("Saved.");
|
||||
});
|
||||
|
||||
const networkSelect = $("settings-network");
|
||||
if (networkSelect) {
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
}
|
||||
|
||||
$("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
|
||||
$("settings-show-zero-balances").addEventListener("change", async () => {
|
||||
state.showZeroBalanceTokens = $("settings-show-zero-balances").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("settings-theme").value = state.theme;
|
||||
$("settings-theme").addEventListener("change", async () => {
|
||||
state.theme = $("settings-theme").value;
|
||||
await saveState();
|
||||
applyTheme(state.theme);
|
||||
});
|
||||
|
||||
$("settings-hide-low-holders").checked = state.hideLowHolderTokens;
|
||||
$("settings-hide-low-holders").addEventListener("change", async () => {
|
||||
state.hideLowHolderTokens = $("settings-hide-low-holders").checked;
|
||||
@@ -311,12 +241,6 @@ function init(ctx) {
|
||||
}
|
||||
});
|
||||
|
||||
$("settings-utc-timestamps").checked = state.utcTimestamps;
|
||||
$("settings-utc-timestamps").addEventListener("change", async () => {
|
||||
state.utcTimestamps = $("settings-utc-timestamps").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView);
|
||||
|
||||
$("btn-settings-add-token").addEventListener(
|
||||
@@ -324,68 +248,9 @@ function init(ctx) {
|
||||
ctx.showSettingsAddTokenView,
|
||||
);
|
||||
|
||||
// Bright saturated colors for easter egg flashes (clicks 6–10)
|
||||
const easterEggColors = [
|
||||
"#ff0055", // hot pink
|
||||
"#00cc44", // vivid green
|
||||
"#3366ff", // electric blue
|
||||
"#ff9900", // bright orange
|
||||
"#aa00ff", // vivid purple
|
||||
];
|
||||
|
||||
// Easter egg: click version 10 times to reveal the debug well.
|
||||
// Each click does a copy-flash animation. After 5 clicks, each
|
||||
// additional click flashes a different bright saturated color.
|
||||
$("about-version").addEventListener("click", () => {
|
||||
versionClickCount++;
|
||||
clearTimeout(versionClickTimer);
|
||||
// Reset counter if user stops clicking for 3 seconds
|
||||
versionClickTimer = setTimeout(() => {
|
||||
versionClickCount = 0;
|
||||
}, 3000);
|
||||
|
||||
const el = $("about-version");
|
||||
|
||||
if (versionClickCount > 5) {
|
||||
// Colored flash for clicks 6–10
|
||||
const colorIdx = versionClickCount - 6;
|
||||
const color = easterEggColors[colorIdx % easterEggColors.length];
|
||||
el.classList.remove("copy-flash-fade");
|
||||
el.style.backgroundColor = color;
|
||||
el.style.color = "#ffffff";
|
||||
setTimeout(() => {
|
||||
el.style.backgroundColor = "";
|
||||
el.style.color = "";
|
||||
el.classList.add("copy-flash-fade");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-fade");
|
||||
}, 275);
|
||||
}, 75);
|
||||
} else {
|
||||
// Standard copy-flash for clicks 1–5
|
||||
flashCopyFeedback(el);
|
||||
}
|
||||
|
||||
if (versionClickCount >= 10) {
|
||||
versionClickCount = 0;
|
||||
clearTimeout(versionClickTimer);
|
||||
$("settings-debug-well").style.display = "";
|
||||
}
|
||||
});
|
||||
|
||||
// Debug mode toggle — update runtime flag, persist, and re-render banner
|
||||
$("settings-debug-mode").addEventListener("change", async () => {
|
||||
state.debugMode = $("settings-debug-mode").checked;
|
||||
setRuntimeDebug(state.debugMode);
|
||||
await saveState();
|
||||
updateDebugBanner(state.currentView);
|
||||
});
|
||||
|
||||
// Sync runtime debug flag on init
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
$("btn-settings-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -73,8 +73,7 @@ function renderDropdown() {
|
||||
|
||||
function show() {
|
||||
$("settings-addtoken-address").value = "";
|
||||
$("settings-addtoken-info").textContent = "";
|
||||
$("settings-addtoken-info").style.visibility = "hidden";
|
||||
$("settings-addtoken-info").classList.add("hidden");
|
||||
renderTop10();
|
||||
renderDropdown();
|
||||
showView("settings-addtoken");
|
||||
@@ -84,7 +83,7 @@ function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
|
||||
$("btn-settings-addtoken-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.showSettingsView();
|
||||
});
|
||||
|
||||
$("btn-settings-addtoken-select").addEventListener("click", async () => {
|
||||
@@ -130,7 +129,7 @@ function init(_ctx) {
|
||||
}
|
||||
const infoEl = $("settings-addtoken-info");
|
||||
infoEl.textContent = "Looking up token...";
|
||||
infoEl.style.visibility = "visible";
|
||||
infoEl.classList.remove("hidden");
|
||||
log.debugf("Looking up token contract", addr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(addr, state.rpcUrl);
|
||||
@@ -144,8 +143,7 @@ function init(_ctx) {
|
||||
await saveState();
|
||||
showFlash("Added " + info.symbol);
|
||||
$("settings-addtoken-address").value = "";
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
renderTop10();
|
||||
renderDropdown();
|
||||
ctx.doRefreshAndRender();
|
||||
@@ -153,8 +151,7 @@ function init(_ctx) {
|
||||
const detail = e.shortMessage || e.message || String(e);
|
||||
log.errorf("Token lookup failed for", addr, detail);
|
||||
showFlash(detail);
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
@@ -5,43 +5,31 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressTitle,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { formatEther, formatUnits } = require("ethers");
|
||||
const { state } = require("../../shared/state");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const { decodeCalldata } = require("./approval");
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
let ctx;
|
||||
|
||||
/**
|
||||
* Determine a human-readable transaction type string from tx fields.
|
||||
*/
|
||||
function getTransactionType(tx) {
|
||||
if (!tx.to) return "Contract Creation";
|
||||
if (tx.direction === "contract") {
|
||||
if (tx.directionLabel === "Swap") return "Swap";
|
||||
if (
|
||||
tx.method === "approve" ||
|
||||
tx.directionLabel === "Approve" ||
|
||||
tx.method === "setApprovalForAll"
|
||||
)
|
||||
return "Token Approval";
|
||||
return "Contract Call";
|
||||
}
|
||||
if (tx.symbol && tx.symbol !== "ETH") return "ERC-20 Token Transfer";
|
||||
return "Native ETH Transfer";
|
||||
function copyableHtml(text, extraClass) {
|
||||
const cls =
|
||||
"underline decoration-dashed cursor-pointer" +
|
||||
(extraClass ? " " + extraClass : "");
|
||||
return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
|
||||
}
|
||||
|
||||
function blockieHtml(address) {
|
||||
@@ -51,15 +39,35 @@ function blockieHtml(address) {
|
||||
|
||||
function txAddressHtml(address, ensName, title) {
|
||||
const blockie = blockieHtml(address);
|
||||
return (
|
||||
`<div class="mb-1">${blockie}</div>` +
|
||||
renderAddressHtml(address, { title, ensName })
|
||||
);
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
let html = `<div class="mb-1">${blockie}</div>`;
|
||||
if (title) {
|
||||
html += `<div class="font-bold">${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html +=
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(ensName, "") +
|
||||
extLink +
|
||||
`</div>` +
|
||||
`<div class="break-all">` +
|
||||
copyableHtml(address, "break-all") +
|
||||
`</div>`;
|
||||
} else {
|
||||
html +=
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(address, "break-all") +
|
||||
extLink +
|
||||
`</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
|
||||
const extLink = etherscanLinkHtml(link);
|
||||
const link = `https://etherscan.io/tx/${hash}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
return copyableHtml(hash, "break-all") + extLink;
|
||||
}
|
||||
|
||||
@@ -82,10 +90,12 @@ function show(tx) {
|
||||
direction: tx.direction || null,
|
||||
isContractCall: tx.isContractCall || false,
|
||||
method: tx.method || null,
|
||||
contractAddress: tx.contractAddress || null,
|
||||
},
|
||||
};
|
||||
render();
|
||||
if (tx.isContractCall || tx.direction === "contract") {
|
||||
loadCalldata(tx.hash, tx.to);
|
||||
}
|
||||
}
|
||||
|
||||
function render() {
|
||||
@@ -119,162 +129,42 @@ function render() {
|
||||
nativeEl.parentElement.classList.add("hidden");
|
||||
}
|
||||
|
||||
// Always show transaction type as the first field
|
||||
// Show type label for contract interactions (Swap, Execute, etc.)
|
||||
const typeSection = $("tx-detail-type-section");
|
||||
const typeEl = $("tx-detail-type");
|
||||
const headingEl = $("tx-detail-heading");
|
||||
if (typeSection && typeEl) {
|
||||
typeEl.textContent = getTransactionType(tx);
|
||||
typeSection.classList.remove("hidden");
|
||||
}
|
||||
if (headingEl) headingEl.textContent = "Transaction";
|
||||
|
||||
// Token contract address (for ERC-20 transfers)
|
||||
const tokenContractSection = $("tx-detail-token-contract-section");
|
||||
const tokenContractEl = $("tx-detail-token-contract");
|
||||
if (tokenContractSection && tokenContractEl) {
|
||||
if (tx.contractAddress) {
|
||||
const dot = addressDotHtml(tx.contractAddress);
|
||||
const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
|
||||
tokenContractEl.innerHTML =
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(tx.contractAddress, "break-all") +
|
||||
etherscanLinkHtml(link) +
|
||||
`</div>`;
|
||||
tokenContractSection.classList.remove("hidden");
|
||||
} else {
|
||||
tokenContractSection.classList.add("hidden");
|
||||
if (tx.direction === "contract" && tx.directionLabel) {
|
||||
if (typeSection) {
|
||||
typeEl.textContent = tx.directionLabel;
|
||||
typeSection.classList.remove("hidden");
|
||||
}
|
||||
if (headingEl) headingEl.textContent = tx.directionLabel;
|
||||
} else {
|
||||
if (typeSection) typeSection.classList.add("hidden");
|
||||
if (headingEl) headingEl.textContent = "Transaction";
|
||||
}
|
||||
|
||||
// Hide calldata and raw data sections; always fetch full tx details
|
||||
// Hide calldata section by default; loadCalldata will show it if needed
|
||||
const calldataSection = $("tx-detail-calldata-section");
|
||||
if (calldataSection) calldataSection.classList.add("hidden");
|
||||
const rawDataSection = $("tx-detail-rawdata-section");
|
||||
if (rawDataSection) rawDataSection.classList.add("hidden");
|
||||
|
||||
// Hide on-chain detail sections until populated
|
||||
for (const id of [
|
||||
"tx-detail-block-section",
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
"tx-detail-network-section",
|
||||
]) {
|
||||
const el = $(id);
|
||||
if (el) el.classList.add("hidden");
|
||||
}
|
||||
|
||||
loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
|
||||
|
||||
const isoStr = isoDate(tx.timestamp);
|
||||
$("tx-detail-time").innerHTML =
|
||||
copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
|
||||
$("tx-detail-time").textContent =
|
||||
isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
|
||||
$("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
|
||||
showView("transaction");
|
||||
attachCopyHandlers("view-transaction");
|
||||
}
|
||||
|
||||
function showDetailField(sectionId, contentId, value) {
|
||||
const section = $(sectionId);
|
||||
const el = $(contentId);
|
||||
if (!section || !el) return;
|
||||
el.innerHTML = copyableHtml(value, "");
|
||||
section.classList.remove("hidden");
|
||||
}
|
||||
|
||||
function populateOnChainDetails(txData) {
|
||||
// Block number
|
||||
if (txData.block_number != null) {
|
||||
const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
|
||||
const blockSection = $("tx-detail-block-section");
|
||||
const blockEl = $("tx-detail-block");
|
||||
if (blockSection && blockEl) {
|
||||
blockEl.innerHTML =
|
||||
copyableHtml(String(txData.block_number), "") +
|
||||
etherscanLinkHtml(blockLink);
|
||||
blockSection.classList.remove("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
// Nonce
|
||||
if (txData.nonce != null) {
|
||||
showDetailField(
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-nonce",
|
||||
String(txData.nonce),
|
||||
);
|
||||
}
|
||||
|
||||
// Transaction fee
|
||||
const feeWei = txData.fee?.value || txData.tx_fee;
|
||||
if (feeWei) {
|
||||
const feeEth = formatEther(String(feeWei));
|
||||
showDetailField(
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-fee",
|
||||
feeEth + " ETH",
|
||||
);
|
||||
}
|
||||
|
||||
// Gas price
|
||||
const gasPrice = txData.gas_price;
|
||||
if (gasPrice) {
|
||||
const gwei = formatUnits(String(gasPrice), "gwei");
|
||||
showDetailField(
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasprice",
|
||||
gwei + " Gwei",
|
||||
);
|
||||
}
|
||||
|
||||
// Gas used
|
||||
const gasUsed = txData.gas_used;
|
||||
if (gasUsed) {
|
||||
showDetailField(
|
||||
"tx-detail-gasused-section",
|
||||
"tx-detail-gasused",
|
||||
String(gasUsed),
|
||||
);
|
||||
}
|
||||
|
||||
// Show the network details wrapper if any child section is visible
|
||||
const networkWrapper = $("tx-detail-network-section");
|
||||
if (networkWrapper) {
|
||||
const hasVisible = [
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
].some((id) => {
|
||||
const el = $(id);
|
||||
return el && !el.classList.contains("hidden");
|
||||
});
|
||||
if (hasVisible) networkWrapper.classList.remove("hidden");
|
||||
}
|
||||
|
||||
// Bind copy handlers for newly added elements
|
||||
for (const id of [
|
||||
"tx-detail-block-section",
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
]) {
|
||||
const section = $(id);
|
||||
if (!section) continue;
|
||||
section.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
document
|
||||
.getElementById("view-transaction")
|
||||
.querySelectorAll("[data-copy]")
|
||||
.forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(el);
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
async function loadCalldata(txHash, toAddress) {
|
||||
const section = $("tx-detail-calldata-section");
|
||||
const actionEl = $("tx-detail-calldata-action");
|
||||
const detailsEl = $("tx-detail-calldata-details");
|
||||
@@ -289,10 +179,6 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
);
|
||||
if (!resp.ok) return;
|
||||
const txData = await resp.json();
|
||||
|
||||
// Populate on-chain detail fields (block, nonce, gas, fee)
|
||||
populateOnChainDetails(txData);
|
||||
|
||||
const inputData = txData.raw_input || txData.input || null;
|
||||
if (!inputData || inputData === "0x") return;
|
||||
|
||||
@@ -307,15 +193,9 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
for (const d of decoded.details || []) {
|
||||
detailsHtml += `<div class="mb-2">`;
|
||||
detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
|
||||
if (d.address && d.isToken) {
|
||||
// Token entry: show symbol on its own line, then address via shared renderer
|
||||
const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
|
||||
if (tokenSymbol) {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
|
||||
}
|
||||
detailsHtml += renderAddressHtml(d.address);
|
||||
} else if (d.address) {
|
||||
detailsHtml += renderAddressHtml(d.address);
|
||||
if (d.address) {
|
||||
const dot = addressDotHtml(d.address);
|
||||
detailsHtml += `<div>${dot}${copyableHtml(d.value, "break-all")}</div>`;
|
||||
} else {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
|
||||
}
|
||||
@@ -339,11 +219,13 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
|
||||
section.classList.remove("hidden");
|
||||
|
||||
// Bind copy handlers for new elements (including raw data now outside section)
|
||||
const copyTargets = [section, rawSection].filter(Boolean);
|
||||
for (const container of copyTargets) {
|
||||
attachCopyHandlers(container);
|
||||
}
|
||||
// Bind copy handlers for new elements
|
||||
section.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
};
|
||||
});
|
||||
} catch (e) {
|
||||
log.errorf("loadCalldata failed:", e.message);
|
||||
}
|
||||
@@ -352,7 +234,11 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("btn-tx-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -3,19 +3,22 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
clearViewStack,
|
||||
} = require("./helpers");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
let ctx;
|
||||
let elapsedTimer = null;
|
||||
let pollTimer = null;
|
||||
@@ -32,19 +35,38 @@ function clearTimers() {
|
||||
}
|
||||
|
||||
function toAddressHtml(address) {
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(address, state.wallets);
|
||||
return renderAddressHtml(address, { title });
|
||||
if (title) {
|
||||
return (
|
||||
`<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>` +
|
||||
`<div class="break-all">${escapeHtml(address)}${extLink}</div>`
|
||||
);
|
||||
}
|
||||
return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
|
||||
return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
|
||||
const link = `https://etherscan.io/tx/${hash}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
return (
|
||||
`<span class="underline decoration-dashed cursor-pointer break-all" data-copy="${escapeHtml(hash)}">${escapeHtml(hash)}</span>` +
|
||||
extLink
|
||||
);
|
||||
}
|
||||
|
||||
function blockNumberHtml(blockNumber) {
|
||||
const num = String(blockNumber);
|
||||
const link = `${currentNetwork().explorerUrl}/block/${num}`;
|
||||
return copyableHtml(num) + etherscanLinkHtml(link);
|
||||
function attachCopyHandlers(viewId) {
|
||||
document
|
||||
.getElementById(viewId)
|
||||
.querySelectorAll("[data-copy]")
|
||||
.forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
function showWait(txInfo, txHash) {
|
||||
@@ -99,84 +121,18 @@ function showSuccess(txInfo, txHash, blockNumber) {
|
||||
to: txInfo.to,
|
||||
hash: txHash,
|
||||
blockNumber: blockNumber,
|
||||
decoded: txInfo.decoded || null,
|
||||
};
|
||||
renderSuccess();
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
function tokenLabel(address) {
|
||||
const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `${currentNetwork().explorerUrl}/token/${address}`;
|
||||
}
|
||||
|
||||
function decodedDetailsHtml(decoded) {
|
||||
if (!decoded || !decoded.details) return "";
|
||||
let html = `<div class="border border-border border-dashed p-2 mb-3">`;
|
||||
if (decoded.name) {
|
||||
html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
|
||||
html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
|
||||
}
|
||||
if (decoded.description) {
|
||||
html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Description</div>`;
|
||||
html += `<div>${escapeHtml(decoded.description)}</div></div>`;
|
||||
}
|
||||
for (const d of decoded.details) {
|
||||
html += `<div class="mb-2">`;
|
||||
html += `<div class="text-xs text-muted mb-1">${escapeHtml(d.label)}</div>`;
|
||||
if (d.address) {
|
||||
if (d.isToken) {
|
||||
const sym = tokenLabel(d.address) || "Unknown token";
|
||||
html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
|
||||
html += toAddressHtml(d.address);
|
||||
} else {
|
||||
html += toAddressHtml(d.address);
|
||||
}
|
||||
} else {
|
||||
html += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
return html;
|
||||
}
|
||||
|
||||
function renderSuccess() {
|
||||
const d = state.viewData;
|
||||
if (!d || !d.hash) return;
|
||||
|
||||
const hasDecoded = d.decoded && d.decoded.details;
|
||||
|
||||
// When decoded details are present, the Amount and To are already
|
||||
// shown inside the decoded well — hide the top-level duplicates.
|
||||
const summarySection = $("success-tx-summary").parentElement;
|
||||
const toSection = $("success-tx-to").parentElement;
|
||||
if (hasDecoded) {
|
||||
summarySection.classList.add("hidden");
|
||||
toSection.classList.add("hidden");
|
||||
} else {
|
||||
summarySection.classList.remove("hidden");
|
||||
toSection.classList.remove("hidden");
|
||||
$("success-tx-summary").textContent = d.amount + " " + d.symbol;
|
||||
$("success-tx-to").innerHTML = toAddressHtml(d.to);
|
||||
}
|
||||
|
||||
$("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
|
||||
$("success-tx-summary").textContent = d.amount + " " + d.symbol;
|
||||
$("success-tx-to").innerHTML = toAddressHtml(d.to);
|
||||
$("success-tx-block").textContent = String(d.blockNumber);
|
||||
$("success-tx-hash").innerHTML = txHashHtml(d.hash);
|
||||
|
||||
// Show decoded calldata details if present
|
||||
const decodedEl = $("success-tx-decoded");
|
||||
if (decodedEl && hasDecoded) {
|
||||
decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
|
||||
decodedEl.classList.remove("hidden");
|
||||
} else if (decodedEl) {
|
||||
decodedEl.classList.add("hidden");
|
||||
}
|
||||
|
||||
attachCopyHandlers("view-success-tx");
|
||||
showView("success-tx");
|
||||
}
|
||||
@@ -222,16 +178,10 @@ function navigateBack() {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// After a completed transaction, reset the navigation stack
|
||||
// and go directly to the address view (token or detail).
|
||||
// Use require() lazily to call show() without the ctx push wrapper.
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
if (state.selectedToken) {
|
||||
state.viewStack.push("address");
|
||||
require("./addressToken").show();
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
require("./addressDetail").show();
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
// Address warning module.
|
||||
// Provides local and async (RPC-based) warning checks for Ethereum addresses.
|
||||
// Returns arrays of {type, message, severity} objects.
|
||||
|
||||
const { isScamAddress } = require("./scamlist");
|
||||
const { isBurnAddress } = require("./constants");
|
||||
const { checkEtherscanLabel } = require("./etherscanLabels");
|
||||
const { log } = require("./log");
|
||||
|
||||
/**
|
||||
* Check an address against local-only lists (scam, burn, self-send).
|
||||
* Synchronous — no network calls.
|
||||
*
|
||||
* @param {string} address - The target address to check.
|
||||
* @param {object} [options] - Optional context.
|
||||
* @param {string} [options.fromAddress] - Sender address (for self-send check).
|
||||
* @returns {Array<{type: string, message: string, severity: string}>}
|
||||
*/
|
||||
function getLocalWarnings(address, options = {}) {
|
||||
const warnings = [];
|
||||
const addr = address.toLowerCase();
|
||||
|
||||
if (isScamAddress(addr)) {
|
||||
warnings.push({
|
||||
type: "scam",
|
||||
message:
|
||||
"This address is on a known scam/fraud list. Do not send funds to this address.",
|
||||
severity: "critical",
|
||||
});
|
||||
}
|
||||
|
||||
if (isBurnAddress(addr)) {
|
||||
warnings.push({
|
||||
type: "burn",
|
||||
message:
|
||||
"This is a known null/burn address. Funds sent here are permanently destroyed and cannot be recovered.",
|
||||
severity: "critical",
|
||||
});
|
||||
}
|
||||
|
||||
if (options.fromAddress && addr === options.fromAddress.toLowerCase()) {
|
||||
warnings.push({
|
||||
type: "self-send",
|
||||
message: "You are sending to your own address.",
|
||||
severity: "warning",
|
||||
});
|
||||
}
|
||||
|
||||
return warnings;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check an address against local lists AND via RPC queries.
|
||||
* Async — performs network calls to check contract status and tx history.
|
||||
*
|
||||
* @param {string} address - The target address to check.
|
||||
* @param {object} provider - An ethers.js provider instance.
|
||||
* @param {object} [options] - Optional context.
|
||||
* @param {string} [options.fromAddress] - Sender address (for self-send check).
|
||||
* @returns {Promise<Array<{type: string, message: string, severity: string}>>}
|
||||
*/
|
||||
async function getFullWarnings(address, provider, options = {}) {
|
||||
const warnings = getLocalWarnings(address, options);
|
||||
|
||||
let isContract = false;
|
||||
try {
|
||||
const code = await provider.getCode(address);
|
||||
if (code && code !== "0x") {
|
||||
isContract = true;
|
||||
warnings.push({
|
||||
type: "contract",
|
||||
message:
|
||||
"This address is a smart contract, not a regular wallet.",
|
||||
severity: "warning",
|
||||
});
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("contract check failed:", e.message);
|
||||
}
|
||||
|
||||
// Skip tx count check for contracts — they may legitimately have
|
||||
// zero inbound EOA transactions.
|
||||
if (!isContract) {
|
||||
try {
|
||||
const txCount = await provider.getTransactionCount(address);
|
||||
if (txCount === 0) {
|
||||
warnings.push({
|
||||
type: "new-address",
|
||||
message:
|
||||
"This address has never sent a transaction. Double-check it is correct.",
|
||||
severity: "info",
|
||||
});
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("tx count check failed:", e.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Etherscan label check (best-effort async — network failures are silent).
|
||||
// Runs for ALL addresses including contracts, since many dangerous
|
||||
// flagged addresses on Etherscan (drainers, phishing contracts) are contracts.
|
||||
try {
|
||||
const etherscanWarning = await checkEtherscanLabel(address);
|
||||
if (etherscanWarning) {
|
||||
warnings.push(etherscanWarning);
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("etherscan label check failed:", e.message);
|
||||
}
|
||||
|
||||
return warnings;
|
||||
}
|
||||
|
||||
module.exports = { getLocalWarnings, getFullWarnings };
|
||||
@@ -1,124 +0,0 @@
|
||||
// Verification of the signed artifacts produced by the approval popup.
|
||||
//
|
||||
// Signing happens in the popup, where the password is entered; the background
|
||||
// only broadcasts the raw transaction and resolves the pending approval back
|
||||
// to the requesting page. So that moving the signing out of the background
|
||||
// does not turn the background into a blind relay, the background re-derives
|
||||
// the signer from the artifact and checks it against the approval it is
|
||||
// holding before acting on it. All recovery is delegated to ethers.
|
||||
//
|
||||
// Every failure message is a full sentence, because these strings are shown to
|
||||
// the user and returned to the dApp.
|
||||
|
||||
const {
|
||||
Transaction,
|
||||
getAddress,
|
||||
getBytes,
|
||||
verifyMessage,
|
||||
verifyTypedData,
|
||||
} = require("ethers");
|
||||
|
||||
// Case-insensitive address comparison that tolerates absent values on either
|
||||
// side. Two absent addresses compare equal (contract creation has no `to`).
|
||||
function sameAddress(a, b) {
|
||||
const aMissing = a === null || a === undefined || a === "";
|
||||
const bMissing = b === null || b === undefined || b === "";
|
||||
if (aMissing || bMissing) return aMissing && bMissing;
|
||||
try {
|
||||
return getAddress(a) === getAddress(b);
|
||||
} catch {
|
||||
return String(a).toLowerCase() === String(b).toLowerCase();
|
||||
}
|
||||
}
|
||||
|
||||
// Normalize a transaction value (hex string, decimal string, number or
|
||||
// bigint) to a bigint. An absent value is zero, matching ethers.
|
||||
function normalizeValue(v) {
|
||||
if (v === null || v === undefined || v === "") return 0n;
|
||||
return BigInt(v);
|
||||
}
|
||||
|
||||
// Normalize call data to a lowercase hex string. Absent data is "0x".
|
||||
function normalizeData(v) {
|
||||
if (v === null || v === undefined || v === "" || v === "0x") return "0x";
|
||||
return String(v).toLowerCase();
|
||||
}
|
||||
|
||||
// Assert that a raw signed transaction is the transaction the user approved,
|
||||
// signed by the address the approval was raised for. Returns the parsed
|
||||
// ethers Transaction on success, throws otherwise.
|
||||
function verifySignedTx(rawSignedTx, txParams, expectedFrom) {
|
||||
if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
|
||||
throw new Error("The signed transaction is missing or malformed.");
|
||||
}
|
||||
|
||||
let parsed;
|
||||
try {
|
||||
parsed = Transaction.from(rawSignedTx);
|
||||
} catch {
|
||||
throw new Error("The signed transaction could not be decoded.");
|
||||
}
|
||||
|
||||
if (!parsed.from) {
|
||||
throw new Error("The signed transaction carries no valid signature.");
|
||||
}
|
||||
if (!sameAddress(parsed.from, expectedFrom)) {
|
||||
throw new Error(
|
||||
"The signed transaction was signed by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
if (!sameAddress(parsed.to, txParams.to)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
);
|
||||
}
|
||||
if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not carry the approved value.",
|
||||
);
|
||||
}
|
||||
if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
);
|
||||
}
|
||||
|
||||
return parsed;
|
||||
}
|
||||
|
||||
// Assert that a signature over the approved message or typed data was
|
||||
// produced by the address the approval was raised for. Returns the recovered
|
||||
// address on success, throws otherwise.
|
||||
function verifySignature(signParams, signature, expectedFrom) {
|
||||
if (typeof signature !== "string" || !signature.startsWith("0x")) {
|
||||
throw new Error("The signature is missing or malformed.");
|
||||
}
|
||||
|
||||
let recovered;
|
||||
try {
|
||||
if (
|
||||
signParams.method === "personal_sign" ||
|
||||
signParams.method === "eth_sign"
|
||||
) {
|
||||
recovered = verifyMessage(getBytes(signParams.message), signature);
|
||||
} else {
|
||||
const typedData = JSON.parse(signParams.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers derives EIP712Domain itself and rejects it as an input.
|
||||
delete types.EIP712Domain;
|
||||
recovered = verifyTypedData(domain, types, message, signature);
|
||||
}
|
||||
} catch {
|
||||
throw new Error("The signature could not be verified.");
|
||||
}
|
||||
|
||||
if (!sameAddress(recovered, expectedFrom)) {
|
||||
throw new Error(
|
||||
"The signature was produced by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
return recovered;
|
||||
}
|
||||
|
||||
module.exports = { verifySignedTx, verifySignature, sameAddress };
|
||||
@@ -15,15 +15,10 @@ const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
|
||||
// Use a static network to skip auto-detection (which can fail and cause
|
||||
// "could not coalesce error" on some RPC endpoints like Cloudflare).
|
||||
// Accepts an optional networkName ("mainnet" or "sepolia") for the static
|
||||
// network hint so ethers picks the right chain parameters. When omitted,
|
||||
// reads the currently selected network from extension state.
|
||||
function getProvider(rpcUrl, networkName) {
|
||||
// Lazy require to avoid circular dependency issues at module scope.
|
||||
const { currentNetwork } = require("./state");
|
||||
const name = networkName || currentNetwork().id;
|
||||
const net = Network.from(name);
|
||||
return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
|
||||
const mainnet = Network.from("mainnet");
|
||||
|
||||
function getProvider(rpcUrl) {
|
||||
return new JsonRpcProvider(rpcUrl, mainnet, { staticNetwork: mainnet });
|
||||
}
|
||||
|
||||
function formatBalance(wei) {
|
||||
@@ -90,7 +85,6 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
|
||||
balances.push({
|
||||
address: item.token.address_hash,
|
||||
name: item.token.name || "",
|
||||
symbol: item.token.symbol || "???",
|
||||
decimals: decimals,
|
||||
balance: bal,
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
// Build-time constants injected by esbuild define in build.js.
|
||||
// These globals are replaced at bundle time with string literals.
|
||||
|
||||
/* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
|
||||
__BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
|
||||
|
||||
const BUILD_VERSION =
|
||||
typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
|
||||
const BUILD_LICENSE =
|
||||
typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
|
||||
const BUILD_AUTHOR =
|
||||
typeof __BUILD_AUTHOR__ !== "undefined"
|
||||
? __BUILD_AUTHOR__
|
||||
: "sneak <sneak@sneak.berlin>";
|
||||
const BUILD_COMMIT =
|
||||
typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
|
||||
const BUILD_COMMIT_FULL =
|
||||
typeof __BUILD_COMMIT_FULL__ !== "undefined"
|
||||
? __BUILD_COMMIT_FULL__
|
||||
: "unknown";
|
||||
const BUILD_DATE =
|
||||
typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
|
||||
|
||||
const GITEA_COMMIT_URL =
|
||||
"https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
|
||||
|
||||
module.exports = {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_COMMIT_FULL,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
};
|
||||
@@ -1,57 +0,0 @@
|
||||
// Consolidated chain-switch handler.
|
||||
//
|
||||
// Every state change required when the active network changes is
|
||||
// performed here so that callers (settings UI, background
|
||||
// wallet_switchEthereumChain, future chain additions) all go
|
||||
// through a single code path.
|
||||
//
|
||||
// Adding a new chain (e.g. ETC) requires only a new entry in
|
||||
// networks.js — no per-caller wiring is needed.
|
||||
|
||||
const { networkById } = require("./networks");
|
||||
const { clearPrices } = require("./prices");
|
||||
|
||||
// Switch the active chain and reset all chain-specific cached state.
|
||||
// Returns the network configuration object for the new chain.
|
||||
async function onChainSwitch(newNetworkId) {
|
||||
const { state, saveState } = require("./state");
|
||||
|
||||
const net = networkById(newNetworkId);
|
||||
|
||||
// --- core identity ---
|
||||
state.networkId = net.id;
|
||||
state.rpcUrl = net.defaultRpcUrl;
|
||||
state.blockscoutUrl = net.defaultBlockscoutUrl;
|
||||
|
||||
// --- price cache ---
|
||||
// Prices are chain-specific (testnet tokens are worthless,
|
||||
// ETC has different pricing, etc.).
|
||||
clearPrices();
|
||||
|
||||
// --- balance / refresh state ---
|
||||
// Reset last-refresh timestamp so the next polling cycle
|
||||
// triggers an immediate balance refresh on the new chain.
|
||||
state.lastBalanceRefresh = 0;
|
||||
|
||||
// Clear per-address balances and token balances so stale data
|
||||
// from the previous chain is never displayed while the first
|
||||
// refresh on the new chain is in flight.
|
||||
for (const wallet of state.wallets) {
|
||||
for (const addr of wallet.addresses) {
|
||||
addr.balance = "0";
|
||||
addr.tokenBalances = [];
|
||||
}
|
||||
}
|
||||
|
||||
// --- chain-specific caches ---
|
||||
// Token holder counts and fraud contract lists are
|
||||
// chain-specific and must not carry over.
|
||||
state.tokenHolderCache = {};
|
||||
state.fraudContracts = [];
|
||||
|
||||
await saveState();
|
||||
|
||||
return net;
|
||||
}
|
||||
|
||||
module.exports = { onChainSwitch };
|
||||
@@ -1,32 +1,8 @@
|
||||
// DEBUG is a build-time constant injected by esbuild's define in build.js
|
||||
// (see src/shared/buildInfo.js for the same pattern). It is false unless the
|
||||
// bundle was produced with AUTISTMASK_DEBUG=1, and it is false whenever the
|
||||
// module is loaded outside a bundle (tests, plain require). It must never be
|
||||
// derived from anything the user can change at runtime: it is what gates the
|
||||
// hardcoded test mnemonic below.
|
||||
/* global __BUILD_DEBUG__ */
|
||||
const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
|
||||
|
||||
// Machine-readable record of the compiled DEBUG state, read out of the emitted
|
||||
// bundles by script/verify-build. It is derived from DEBUG itself so the two
|
||||
// cannot disagree, and it is a plain string literal rather than a minifier
|
||||
// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
|
||||
// staying byte-stable across versions.
|
||||
//
|
||||
// The ambiguity is the point. When DEBUG is known at build time the bundler
|
||||
// folds this to exactly one of the two literals. When it is not — which is
|
||||
// exactly what happens if the __BUILD_DEBUG__ define goes missing from
|
||||
// build.js — the ternary survives, both literals appear in the bundle, and
|
||||
// verify-build fails rather than guessing.
|
||||
const BUILD_DEBUG_MARKER = DEBUG
|
||||
? "autistmask-build-debug=on"
|
||||
: "autistmask-build-debug=off";
|
||||
|
||||
const DEBUG = true;
|
||||
const DEBUG_MNEMONIC =
|
||||
"cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
|
||||
|
||||
const ETHEREUM_MAINNET_CHAIN_ID = "0x1";
|
||||
const ETHEREUM_SEPOLIA_CHAIN_ID = "0xaa36a7";
|
||||
|
||||
const DEFAULT_RPC_URL = "https://ethereum-rpc.publicnode.com";
|
||||
|
||||
@@ -44,29 +20,12 @@ const ERC20_ABI = [
|
||||
"function approve(address spender, uint256 amount) returns (bool)",
|
||||
];
|
||||
|
||||
// Known null/burn addresses that permanently destroy funds.
|
||||
const BURN_ADDRESSES = new Set([
|
||||
"0x0000000000000000000000000000000000000000",
|
||||
"0x0000000000000000000000000000000000000001",
|
||||
"0x000000000000000000000000000000000000dead",
|
||||
"0xdead000000000000000000000000000000000000",
|
||||
"0x00000000000000000000000000000000deadbeef",
|
||||
]);
|
||||
|
||||
function isBurnAddress(address) {
|
||||
return BURN_ADDRESSES.has(address.toLowerCase());
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
DEBUG,
|
||||
BUILD_DEBUG_MARKER,
|
||||
DEBUG_MNEMONIC,
|
||||
ETHEREUM_MAINNET_CHAIN_ID,
|
||||
ETHEREUM_SEPOLIA_CHAIN_ID,
|
||||
DEFAULT_RPC_URL,
|
||||
DEFAULT_BLOCKSCOUT_URL,
|
||||
BIP44_ETH_PATH,
|
||||
ERC20_ABI,
|
||||
BURN_ADDRESSES,
|
||||
isBurnAddress,
|
||||
};
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
// Etherscan address label lookup via page scraping.
|
||||
// Extension users make the requests directly to Etherscan — no proxy needed.
|
||||
// This is a best-effort enrichment: network failures return null silently.
|
||||
|
||||
// Patterns in the page title that indicate a flagged address.
|
||||
// Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
|
||||
const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
|
||||
|
||||
// Patterns in the page body that indicate a scam/phishing warning.
|
||||
const SCAM_BODY_PATTERNS = [
|
||||
/used in a\s+(?:\w+\s+)?phishing scam/i,
|
||||
/used in a\s+(?:\w+\s+)?scam/i,
|
||||
/wallet\s+drainer/i,
|
||||
];
|
||||
|
||||
/**
|
||||
* Parse the Etherscan address page HTML to extract label info.
|
||||
* Exported for unit testing (no fetch needed).
|
||||
*
|
||||
* @param {string} html - Raw HTML of the Etherscan address page.
|
||||
* @returns {{ label: string|null, isPhishing: boolean, warning: string|null }}
|
||||
*/
|
||||
function parseEtherscanPage(html) {
|
||||
// Extract <title> content
|
||||
const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
|
||||
let label = null;
|
||||
let isPhishing = false;
|
||||
let warning = null;
|
||||
|
||||
if (titleMatch) {
|
||||
const title = titleMatch[1].trim();
|
||||
// Title: "LABEL | Address: 0x... | Etherscan" or "Address: 0x... | Etherscan"
|
||||
const labelMatch = title.match(/^(.+?)\s*\|\s*Address:/);
|
||||
if (labelMatch) {
|
||||
const candidate = labelMatch[1].trim();
|
||||
// Only treat as a label if it's not just "Address" (unlabeled addresses)
|
||||
if (candidate.toLowerCase() !== "address") {
|
||||
label = candidate;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check label against phishing patterns
|
||||
if (label) {
|
||||
for (const pat of PHISHING_LABEL_PATTERNS) {
|
||||
if (pat.test(label)) {
|
||||
isPhishing = true;
|
||||
warning = `Etherscan labels this address as "${label}" (Phish/Hack).`;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check page body for scam warning banners
|
||||
if (!isPhishing) {
|
||||
for (const pat of SCAM_BODY_PATTERNS) {
|
||||
if (pat.test(html)) {
|
||||
isPhishing = true;
|
||||
warning = label
|
||||
? `Etherscan labels this address as "${label}" and reports it was used in a scam.`
|
||||
: "Etherscan reports this address was flagged for phishing/scam activity.";
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return { label, isPhishing, warning };
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch an address page from Etherscan and check for scam/phishing labels.
|
||||
* Returns a warning object if the address is flagged, or null.
|
||||
* Network failures return null silently (best-effort check).
|
||||
*
|
||||
* Uses the current network's explorer URL so the lookup works on both
|
||||
* mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
|
||||
*
|
||||
* @param {string} address - Ethereum address to check.
|
||||
* @returns {Promise<{type: string, message: string, severity: string}|null>}
|
||||
*/
|
||||
async function checkEtherscanLabel(address) {
|
||||
try {
|
||||
// Lazy require to avoid pulling in chrome.storage at module scope
|
||||
// (which breaks unit tests that only exercise parseEtherscanPage).
|
||||
const { currentNetwork } = require("./state");
|
||||
const etherscanBase = currentNetwork().explorerUrl + "/address/";
|
||||
const resp = await fetch(etherscanBase + address, {
|
||||
headers: { Accept: "text/html" },
|
||||
});
|
||||
if (!resp.ok) return null;
|
||||
const html = await resp.text();
|
||||
const result = parseEtherscanPage(html);
|
||||
if (result.isPhishing) {
|
||||
return {
|
||||
type: "etherscan-phishing",
|
||||
message: result.warning,
|
||||
severity: "critical",
|
||||
};
|
||||
}
|
||||
return null;
|
||||
} catch {
|
||||
// Network errors are expected — Etherscan may rate-limit or block.
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { parseEtherscanPage, checkEtherscanLabel };
|
||||
@@ -1,27 +1,12 @@
|
||||
// Leveled logger. Outputs to console with [AutistMask] prefix.
|
||||
// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
|
||||
// debugMode state flag is enabled. The runtime flag is checked lazily so it
|
||||
// responds immediately when toggled in settings.
|
||||
// Level is DEBUG when the DEBUG constant is true, INFO otherwise.
|
||||
|
||||
const { DEBUG } = require("./constants");
|
||||
|
||||
const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
|
||||
|
||||
// Runtime debug mode flag — set by settings.js when the user toggles debug
|
||||
// mode via the easter egg. Kept here as a simple mutable reference so it can
|
||||
// be updated without circular dependency issues with state.js.
|
||||
let _runtimeDebug = false;
|
||||
|
||||
function setRuntimeDebug(enabled) {
|
||||
_runtimeDebug = enabled;
|
||||
}
|
||||
|
||||
function isDebug() {
|
||||
return DEBUG || _runtimeDebug;
|
||||
}
|
||||
const threshold = DEBUG ? LEVELS.debug : LEVELS.info;
|
||||
|
||||
function emit(level, method, args) {
|
||||
const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
|
||||
if (LEVELS[level] >= threshold) {
|
||||
console[method]("[AutistMask]", ...args);
|
||||
}
|
||||
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
|
||||
return resp;
|
||||
}
|
||||
|
||||
module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
|
||||
module.exports = { log, debugFetch };
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
// Network definitions for supported Ethereum networks.
|
||||
// Each network specifies its chain ID, default RPC and Blockscout endpoints,
|
||||
// and the block explorer base URL used for address/tx/token/block links.
|
||||
|
||||
const NETWORKS = {
|
||||
mainnet: {
|
||||
id: "mainnet",
|
||||
name: "Ethereum Mainnet",
|
||||
chainId: "0x1",
|
||||
networkVersion: "1",
|
||||
nativeCurrency: "ETH",
|
||||
defaultRpcUrl: "https://ethereum-rpc.publicnode.com",
|
||||
defaultBlockscoutUrl: "https://eth.blockscout.com/api/v2",
|
||||
explorerUrl: "https://etherscan.io",
|
||||
isTestnet: false,
|
||||
},
|
||||
sepolia: {
|
||||
id: "sepolia",
|
||||
name: "Sepolia Testnet",
|
||||
chainId: "0xaa36a7",
|
||||
networkVersion: "11155111",
|
||||
nativeCurrency: "SepoliaETH",
|
||||
defaultRpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
|
||||
defaultBlockscoutUrl: "https://eth-sepolia.blockscout.com/api/v2",
|
||||
explorerUrl: "https://sepolia.etherscan.io",
|
||||
isTestnet: true,
|
||||
},
|
||||
};
|
||||
|
||||
const SUPPORTED_CHAIN_IDS = new Set(
|
||||
Object.values(NETWORKS).map((n) => n.chainId),
|
||||
);
|
||||
|
||||
function networkById(id) {
|
||||
return NETWORKS[id] || NETWORKS.mainnet;
|
||||
}
|
||||
|
||||
function networkByChainId(chainId) {
|
||||
for (const net of Object.values(NETWORKS)) {
|
||||
if (net.chainId === chainId) return net;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// Build a block explorer link for the given path type and value.
|
||||
// type: "address" | "tx" | "token" | "block"
|
||||
function explorerLink(network, type, value) {
|
||||
return `${network.explorerUrl}/${type}/${value}`;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
NETWORKS,
|
||||
SUPPORTED_CHAIN_IDS,
|
||||
networkById,
|
||||
networkByChainId,
|
||||
explorerLink,
|
||||
};
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,215 +0,0 @@
|
||||
// Domain-based phishing detection using a vendored blocklist with delta updates.
|
||||
//
|
||||
// A community-maintained phishing domain blocklist is vendored in
|
||||
// phishingBlocklist.json and bundled at build time. At runtime, we fetch
|
||||
// the live list periodically and keep only the delta (new entries not in
|
||||
// the vendored list) in memory. This keeps runtime memory usage small.
|
||||
//
|
||||
// The domain-checker checks the in-memory delta first (fresh/recent scam
|
||||
// sites), then falls back to the vendored list.
|
||||
//
|
||||
// If the delta is under 256 KiB it is persisted to localStorage so it
|
||||
// survives extension/service-worker restarts.
|
||||
|
||||
const vendoredConfig = require("./phishingBlocklist.json");
|
||||
|
||||
const BLOCKLIST_URL =
|
||||
"https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
|
||||
|
||||
const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
const DELTA_STORAGE_KEY = "phishing-delta";
|
||||
const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
|
||||
|
||||
// Vendored set — built once from the bundled JSON.
|
||||
const vendoredBlacklist = new Set(
|
||||
(vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
|
||||
);
|
||||
|
||||
// Delta set — only entries from live list that are NOT in vendored.
|
||||
let deltaBlacklist = new Set();
|
||||
let lastFetchTime = 0;
|
||||
let fetchPromise = null;
|
||||
let refreshTimer = null;
|
||||
|
||||
/**
|
||||
* Load delta entries from localStorage on startup.
|
||||
* Called once during module initialization in the background script.
|
||||
*/
|
||||
function loadDeltaFromStorage() {
|
||||
try {
|
||||
const raw = localStorage.getItem(DELTA_STORAGE_KEY);
|
||||
if (!raw) return;
|
||||
const data = JSON.parse(raw);
|
||||
if (data.blacklist && Array.isArray(data.blacklist)) {
|
||||
deltaBlacklist = new Set(
|
||||
data.blacklist.map((d) => d.toLowerCase()),
|
||||
);
|
||||
}
|
||||
} catch {
|
||||
// localStorage unavailable or corrupt — start empty
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
|
||||
*/
|
||||
function saveDeltaToStorage() {
|
||||
try {
|
||||
const data = {
|
||||
blacklist: Array.from(deltaBlacklist),
|
||||
};
|
||||
const json = JSON.stringify(data);
|
||||
if (json.length < MAX_DELTA_BYTES) {
|
||||
localStorage.setItem(DELTA_STORAGE_KEY, json);
|
||||
} else {
|
||||
// Too large — remove stale key if present
|
||||
localStorage.removeItem(DELTA_STORAGE_KEY);
|
||||
}
|
||||
} catch {
|
||||
// localStorage unavailable — skip silently
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Load a pre-parsed config and compute the delta against the vendored list.
|
||||
* Used for both live fetches and testing.
|
||||
*
|
||||
* @param {{ blacklist?: string[] }} config
|
||||
*/
|
||||
function loadConfig(config) {
|
||||
const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
|
||||
|
||||
// Delta = entries in the live list that are NOT in the vendored list
|
||||
deltaBlacklist = new Set(
|
||||
liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
|
||||
);
|
||||
|
||||
lastFetchTime = Date.now();
|
||||
saveDeltaToStorage();
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate hostname variants for subdomain matching.
|
||||
* "sub.evil.com" yields ["sub.evil.com", "evil.com"].
|
||||
*
|
||||
* @param {string} hostname
|
||||
* @returns {string[]}
|
||||
*/
|
||||
function hostnameVariants(hostname) {
|
||||
const h = hostname.toLowerCase();
|
||||
const variants = [h];
|
||||
const parts = h.split(".");
|
||||
// Parent domains: a.b.c.d -> b.c.d, c.d
|
||||
for (let i = 1; i < parts.length - 1; i++) {
|
||||
variants.push(parts.slice(i).join("."));
|
||||
}
|
||||
return variants;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a hostname is on the phishing blocklist.
|
||||
* Checks delta first (fresh/recent scam sites), then vendored list.
|
||||
*
|
||||
* @param {string} hostname - The hostname to check.
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function isPhishingDomain(hostname) {
|
||||
if (!hostname) return false;
|
||||
const variants = hostnameVariants(hostname);
|
||||
|
||||
// Check delta blacklist first (fresh/recent scam sites), then vendored
|
||||
for (const v of variants) {
|
||||
if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch the latest blocklist and compute delta against vendored data.
|
||||
* De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function updatePhishingList() {
|
||||
// Skip if recently fetched
|
||||
if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
// De-duplicate concurrent calls
|
||||
if (fetchPromise) return fetchPromise;
|
||||
|
||||
fetchPromise = (async () => {
|
||||
try {
|
||||
const resp = await fetch(BLOCKLIST_URL);
|
||||
if (!resp.ok) throw new Error("HTTP " + resp.status);
|
||||
const config = await resp.json();
|
||||
loadConfig(config);
|
||||
} catch {
|
||||
// Silently fail — vendored list still provides coverage.
|
||||
// We'll retry next time.
|
||||
} finally {
|
||||
fetchPromise = null;
|
||||
}
|
||||
})();
|
||||
|
||||
return fetchPromise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Start periodic refresh of the phishing list.
|
||||
* Should be called once from the background script on startup.
|
||||
*/
|
||||
function startPeriodicRefresh() {
|
||||
if (refreshTimer) return;
|
||||
refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the total blocklist size (vendored + delta) for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getBlocklistSize() {
|
||||
return vendoredBlacklist.size + deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the delta blocklist size for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getDeltaSize() {
|
||||
return deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset internal state (for testing).
|
||||
*/
|
||||
function _reset() {
|
||||
deltaBlacklist = new Set();
|
||||
lastFetchTime = 0;
|
||||
fetchPromise = null;
|
||||
if (refreshTimer) {
|
||||
clearInterval(refreshTimer);
|
||||
refreshTimer = null;
|
||||
}
|
||||
}
|
||||
|
||||
// Load persisted delta on module initialization
|
||||
loadDeltaFromStorage();
|
||||
|
||||
module.exports = {
|
||||
isPhishingDomain,
|
||||
updatePhishingList,
|
||||
startPeriodicRefresh,
|
||||
loadConfig,
|
||||
getBlocklistSize,
|
||||
getDeltaSize,
|
||||
hostnameVariants,
|
||||
_reset,
|
||||
// Exposed for testing only
|
||||
_getVendoredBlacklistSize: () => vendoredBlacklist.size,
|
||||
_getDeltaBlacklist: () => deltaBlacklist,
|
||||
};
|
||||
@@ -8,13 +8,6 @@ const prices = {};
|
||||
let lastFetchedAt = 0;
|
||||
|
||||
async function refreshPrices() {
|
||||
// Testnet tokens have no real market value — skip price fetching
|
||||
// and clear any stale mainnet prices so the UI shows no USD values.
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) {
|
||||
clearPrices();
|
||||
return;
|
||||
}
|
||||
const now = Date.now();
|
||||
if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
|
||||
try {
|
||||
@@ -26,19 +19,7 @@ async function refreshPrices() {
|
||||
}
|
||||
}
|
||||
|
||||
// Clear all cached prices and reset the fetch timestamp so the
|
||||
// next refreshPrices() call will fetch fresh data.
|
||||
function clearPrices() {
|
||||
for (const key of Object.keys(prices)) {
|
||||
delete prices[key];
|
||||
}
|
||||
lastFetchedAt = 0;
|
||||
}
|
||||
|
||||
// Return the USD price for a symbol, or null on testnet / unknown.
|
||||
function getPrice(symbol) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
return prices[symbol] || null;
|
||||
}
|
||||
|
||||
@@ -56,8 +37,6 @@ function formatUsd(amount) {
|
||||
}
|
||||
|
||||
function getAddressValueUsd(addr) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
const ethBal = parseFloat(addr.balance || "0");
|
||||
@@ -72,8 +51,6 @@ function getAddressValueUsd(addr) {
|
||||
}
|
||||
|
||||
function getWalletValueUsd(wallet) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const addr of wallet.addresses) {
|
||||
@@ -83,8 +60,6 @@ function getWalletValueUsd(wallet) {
|
||||
}
|
||||
|
||||
function getTotalValueUsd(wallets) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const wallet of wallets) {
|
||||
@@ -96,7 +71,6 @@ function getTotalValueUsd(wallets) {
|
||||
module.exports = {
|
||||
prices,
|
||||
refreshPrices,
|
||||
clearPrices,
|
||||
getPrice,
|
||||
formatUsd,
|
||||
getAddressValueUsd,
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,7 +1,6 @@
|
||||
// State management and extension storage persistence.
|
||||
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
const { networkById } = require("./networks");
|
||||
|
||||
const storageApi =
|
||||
typeof browser !== "undefined"
|
||||
@@ -12,7 +11,6 @@ const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
wallets: [],
|
||||
trackedTokens: [],
|
||||
networkId: "mainnet",
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
lastBalanceRefresh: 0,
|
||||
@@ -25,11 +23,8 @@ const DEFAULT_STATE = {
|
||||
hideFraudContracts: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
utcTimestamps: false,
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
theme: "system",
|
||||
debugMode: false,
|
||||
};
|
||||
|
||||
const state = {
|
||||
@@ -39,20 +34,13 @@ const state = {
|
||||
selectedAddress: null,
|
||||
selectedToken: null,
|
||||
viewData: {},
|
||||
viewStack: [],
|
||||
};
|
||||
|
||||
// Return the network configuration for the currently selected network.
|
||||
function currentNetwork() {
|
||||
return networkById(state.networkId);
|
||||
}
|
||||
|
||||
async function saveState() {
|
||||
const persisted = {
|
||||
hasWallet: state.hasWallet,
|
||||
wallets: state.wallets,
|
||||
trackedTokens: state.trackedTokens,
|
||||
networkId: state.networkId,
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
lastBalanceRefresh: state.lastBalanceRefresh,
|
||||
@@ -65,17 +53,13 @@ async function saveState() {
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
dustThresholdGwei: state.dustThresholdGwei,
|
||||
utcTimestamps: state.utcTimestamps,
|
||||
fraudContracts: state.fraudContracts,
|
||||
tokenHolderCache: state.tokenHolderCache,
|
||||
theme: state.theme,
|
||||
debugMode: state.debugMode,
|
||||
currentView: state.currentView,
|
||||
selectedWallet: state.selectedWallet,
|
||||
selectedAddress: state.selectedAddress,
|
||||
selectedToken: state.selectedToken,
|
||||
viewData: state.viewData,
|
||||
viewStack: state.viewStack,
|
||||
};
|
||||
await storageApi.set({ autistmask: persisted });
|
||||
}
|
||||
@@ -87,7 +71,6 @@ async function loadState() {
|
||||
state.hasWallet = saved.hasWallet;
|
||||
state.wallets = saved.wallets || [];
|
||||
state.trackedTokens = saved.trackedTokens || [];
|
||||
state.networkId = saved.networkId || DEFAULT_STATE.networkId;
|
||||
state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
|
||||
state.blockscoutUrl =
|
||||
saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
|
||||
@@ -125,13 +108,8 @@ async function loadState() {
|
||||
saved.dustThresholdGwei !== undefined
|
||||
? saved.dustThresholdGwei
|
||||
: 100000;
|
||||
state.utcTimestamps =
|
||||
saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
|
||||
state.fraudContracts = saved.fraudContracts || [];
|
||||
state.tokenHolderCache = saved.tokenHolderCache || {};
|
||||
state.theme = saved.theme || "system";
|
||||
state.debugMode =
|
||||
saved.debugMode !== undefined ? saved.debugMode : false;
|
||||
state.currentView = saved.currentView || null;
|
||||
state.selectedWallet =
|
||||
saved.selectedWallet !== undefined ? saved.selectedWallet : null;
|
||||
@@ -139,7 +117,6 @@ async function loadState() {
|
||||
saved.selectedAddress !== undefined ? saved.selectedAddress : null;
|
||||
state.selectedToken = saved.selectedToken || null;
|
||||
state.viewData = saved.viewData || {};
|
||||
state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -150,10 +127,4 @@ function currentAddress() {
|
||||
return state.wallets[state.selectedWallet].addresses[state.selectedAddress];
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
state,
|
||||
saveState,
|
||||
loadState,
|
||||
currentAddress,
|
||||
currentNetwork,
|
||||
};
|
||||
module.exports = { state, saveState, loadState, currentAddress };
|
||||
|
||||
@@ -3645,27 +3645,10 @@ async function getTopTokenPrices(n) {
|
||||
return prices;
|
||||
}
|
||||
|
||||
// Resolve a token symbol from multiple sources, never returning "?".
|
||||
function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
|
||||
const lower = (tokenAddress || "").toLowerCase();
|
||||
const tb = (tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === lower,
|
||||
);
|
||||
if (tb && tb.symbol) return tb.symbol;
|
||||
const known = TOKEN_BY_ADDRESS.get(lower);
|
||||
if (known && known.symbol) return known.symbol;
|
||||
const tracked = (trackedTokens || []).find(
|
||||
(t) => t.address.toLowerCase() === lower,
|
||||
);
|
||||
if (tracked && tracked.symbol) return tracked.symbol;
|
||||
return lower.slice(0, 10) + "\u2026";
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
TOKENS,
|
||||
TOKEN_BY_ADDRESS,
|
||||
KNOWN_SYMBOLS,
|
||||
getTopTokens,
|
||||
getTopTokenPrices,
|
||||
resolveSymbol,
|
||||
};
|
||||
|
||||
@@ -153,40 +153,19 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
|
||||
|
||||
// When a token transfer shares a hash with a normal tx, the normal tx
|
||||
// is the contract call (0 ETH) and the token transfer has the real
|
||||
// amount and symbol. For contract calls (swaps), a single transaction
|
||||
// can produce multiple token transfers (input, intermediates, output).
|
||||
// We consolidate these into the original tx entry using the token
|
||||
// transfer where the user *receives* tokens (the swap output), so
|
||||
// the transaction list shows the final result rather than confusing
|
||||
// intermediate hops. We preserve the original tx's from/to so the
|
||||
// user sees their own address, not a router or Permit2 contract.
|
||||
// amount and symbol. Replace the normal tx with the token transfer,
|
||||
// but preserve contract call metadata (direction, label, method) so
|
||||
// swaps and other contract interactions display correctly.
|
||||
for (const tt of ttJson.items || []) {
|
||||
const parsed = parseTokenTransfer(tt, addrLower);
|
||||
const existing = txsByHash.get(parsed.hash);
|
||||
if (existing && existing.direction === "contract") {
|
||||
// For contract calls (swaps), consolidate into the original
|
||||
// tx entry. Prefer the "received" transfer (swap output)
|
||||
// for the display amount. If no received transfer exists,
|
||||
// fall back to the first "sent" transfer (swap input).
|
||||
const isReceived = parsed.direction === "received";
|
||||
const needsAmount = !existing.exactValue;
|
||||
if (isReceived || needsAmount) {
|
||||
existing.value = parsed.value;
|
||||
existing.exactValue = parsed.exactValue;
|
||||
existing.rawAmount = parsed.rawAmount;
|
||||
existing.rawUnit = parsed.rawUnit;
|
||||
existing.symbol = parsed.symbol;
|
||||
existing.contractAddress = parsed.contractAddress;
|
||||
existing.holders = parsed.holders;
|
||||
}
|
||||
// Keep the original tx's from/to (the user's address and the
|
||||
// contract they called), not the token transfer's from/to
|
||||
// which may be a router or Permit2 contract.
|
||||
continue;
|
||||
parsed.direction = "contract";
|
||||
parsed.directionLabel = existing.directionLabel;
|
||||
parsed.isContractCall = true;
|
||||
parsed.method = existing.method;
|
||||
}
|
||||
// Non-contract token transfers get their own entries.
|
||||
const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
|
||||
txsByHash.set(ttKey, parsed);
|
||||
txsByHash.set(parsed.hash, parsed);
|
||||
}
|
||||
|
||||
const txs = [...txsByHash.values()];
|
||||
|
||||
@@ -161,157 +161,6 @@ function decodeWrapEth(input) {
|
||||
}
|
||||
}
|
||||
|
||||
// V4 inner action IDs
|
||||
const V4_SWAP_EXACT_IN_SINGLE = 0x06;
|
||||
const V4_SWAP_EXACT_IN = 0x07;
|
||||
const V4_SWAP_EXACT_OUT_SINGLE = 0x08;
|
||||
const V4_SWAP_EXACT_OUT = 0x09;
|
||||
const V4_SETTLE = 0x0b;
|
||||
const V4_TAKE = 0x0e;
|
||||
|
||||
// Decode V4_SWAP (command 0x10) input bytes.
|
||||
// The input is ABI-encoded as (bytes actions, bytes[] params).
|
||||
// We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
|
||||
// and swap amounts from the swap sub-actions.
|
||||
function decodeV4Swap(input) {
|
||||
try {
|
||||
const d = coder.decode(["bytes", "bytes[]"], input);
|
||||
const actions = getBytes(d[0]);
|
||||
const params = d[1];
|
||||
|
||||
let settleToken = null;
|
||||
let takeToken = null;
|
||||
let amountIn = null;
|
||||
let amountOutMin = null;
|
||||
|
||||
for (let i = 0; i < actions.length; i++) {
|
||||
const actionId = actions[i];
|
||||
try {
|
||||
if (actionId === V4_SETTLE) {
|
||||
// SETTLE: (address currency, uint256 maxAmount, bool payerIsUser)
|
||||
const s = coder.decode(
|
||||
["address", "uint256", "bool"],
|
||||
params[i],
|
||||
);
|
||||
settleToken = s[0];
|
||||
} else if (actionId === V4_TAKE) {
|
||||
// TAKE: (address currency, address recipient, uint256 amount)
|
||||
const t = coder.decode(
|
||||
["address", "address", "uint256"],
|
||||
params[i],
|
||||
);
|
||||
takeToken = t[0];
|
||||
} else if (
|
||||
actionId === V4_SWAP_EXACT_IN ||
|
||||
actionId === V4_SWAP_EXACT_IN_SINGLE
|
||||
) {
|
||||
// Extract amounts from exact-in swap actions
|
||||
if (actionId === V4_SWAP_EXACT_IN) {
|
||||
// ExactInputParams: (address currencyIn,
|
||||
// tuple(address,uint24,int24,address,bytes)[] path,
|
||||
// uint128 amountIn, uint128 amountOutMin)
|
||||
try {
|
||||
const s = coder.decode(
|
||||
[
|
||||
"tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
if (!settleToken) settleToken = s[0][0];
|
||||
const path = s[0][1];
|
||||
if (path.length > 0 && !takeToken) {
|
||||
takeToken = path[path.length - 1][0];
|
||||
}
|
||||
if (!amountIn) amountIn = s[0][2];
|
||||
if (!amountOutMin) amountOutMin = s[0][3];
|
||||
} catch {
|
||||
// Fall through — SETTLE/TAKE will provide tokens
|
||||
}
|
||||
} else {
|
||||
// ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
|
||||
// bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
|
||||
try {
|
||||
const s = coder.decode(
|
||||
[
|
||||
"tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
const poolKey = s[0][0];
|
||||
const zeroForOne = s[0][1];
|
||||
if (!settleToken)
|
||||
settleToken = zeroForOne
|
||||
? poolKey[0]
|
||||
: poolKey[1];
|
||||
if (!takeToken)
|
||||
takeToken = zeroForOne
|
||||
? poolKey[1]
|
||||
: poolKey[0];
|
||||
if (!amountIn) amountIn = s[0][2];
|
||||
if (!amountOutMin) amountOutMin = s[0][3];
|
||||
} catch {
|
||||
// Fall through
|
||||
}
|
||||
}
|
||||
} else if (
|
||||
actionId === V4_SWAP_EXACT_OUT ||
|
||||
actionId === V4_SWAP_EXACT_OUT_SINGLE
|
||||
) {
|
||||
if (actionId === V4_SWAP_EXACT_OUT) {
|
||||
try {
|
||||
const s = coder.decode(
|
||||
[
|
||||
"tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
if (!takeToken) takeToken = s[0][0];
|
||||
const path = s[0][1];
|
||||
if (path.length > 0 && !settleToken) {
|
||||
settleToken = path[path.length - 1][0];
|
||||
}
|
||||
} catch {
|
||||
// Fall through
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
const s = coder.decode(
|
||||
[
|
||||
"tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
const poolKey = s[0][0];
|
||||
const zeroForOne = s[0][1];
|
||||
if (!settleToken)
|
||||
settleToken = zeroForOne
|
||||
? poolKey[0]
|
||||
: poolKey[1];
|
||||
if (!takeToken)
|
||||
takeToken = zeroForOne
|
||||
? poolKey[1]
|
||||
: poolKey[0];
|
||||
} catch {
|
||||
// Fall through
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// Skip sub-actions we can't decode
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
tokenIn: settleToken,
|
||||
tokenOut: takeToken,
|
||||
amountIn,
|
||||
amountOutMin,
|
||||
};
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// Try to decode a Universal Router execute() call.
|
||||
// Returns { name, description, details } matching the format used by
|
||||
// the approval UI, or null if the calldata is not a recognised execute().
|
||||
@@ -359,12 +208,9 @@ function decode(data, toAddress) {
|
||||
const s = decodeV3SwapExactIn(inputs[i]);
|
||||
if (s) {
|
||||
if (!inputToken) inputToken = s.tokenIn;
|
||||
if (!outputToken) outputToken = s.tokenOut;
|
||||
if (!inputAmount) inputAmount = s.amountIn;
|
||||
// Always update output: in multi-step swaps (V3 → V4),
|
||||
// the last swap step determines the final output token
|
||||
// and minimum received amount.
|
||||
outputToken = s.tokenOut;
|
||||
minOutput = s.amountOutMin;
|
||||
if (!minOutput) minOutput = s.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -372,9 +218,9 @@ function decode(data, toAddress) {
|
||||
const s = decodeV2SwapExactIn(inputs[i]);
|
||||
if (s) {
|
||||
if (!inputToken) inputToken = s.tokenIn;
|
||||
if (!outputToken) outputToken = s.tokenOut;
|
||||
if (!inputAmount) inputAmount = s.amountIn;
|
||||
outputToken = s.tokenOut;
|
||||
minOutput = s.amountOutMin;
|
||||
if (!minOutput) minOutput = s.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -387,18 +233,6 @@ function decode(data, toAddress) {
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x10) {
|
||||
const v4 = decodeV4Swap(inputs[i]);
|
||||
if (v4) {
|
||||
if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
|
||||
if (!inputAmount && v4.amountIn)
|
||||
inputAmount = v4.amountIn;
|
||||
// Always update output: last swap step wins
|
||||
if (v4.tokenOut) outputToken = v4.tokenOut;
|
||||
if (v4.amountOutMin) minOutput = v4.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x0c) {
|
||||
hasUnwrapWeth = true;
|
||||
}
|
||||
@@ -447,18 +281,12 @@ function decode(data, toAddress) {
|
||||
const maxUint160 = BigInt(
|
||||
"0xffffffffffffffffffffffffffffffffffffffff",
|
||||
);
|
||||
const isUnlimited = inputAmount >= maxUint160;
|
||||
const amountRaw = isUnlimited
|
||||
? "Unlimited"
|
||||
: formatAmount(inputAmount, inInfo.decimals);
|
||||
const amountStr = isUnlimited
|
||||
? "Unlimited"
|
||||
: amountRaw + (inSymbol ? " " + inSymbol : "");
|
||||
details.push({
|
||||
label: "Amount",
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
});
|
||||
const amountStr =
|
||||
inputAmount >= maxUint160
|
||||
? "Unlimited"
|
||||
: formatAmount(inputAmount, inInfo.decimals) +
|
||||
(inSymbol ? " " + inSymbol : "");
|
||||
details.push({ label: "Amount", value: amountStr });
|
||||
}
|
||||
|
||||
if (outSymbol) {
|
||||
|
||||
@@ -5,10 +5,6 @@ const { Mnemonic, HDNodeWallet, Wallet } = require("ethers");
|
||||
const { DEBUG, DEBUG_MNEMONIC, BIP44_ETH_PATH } = require("./constants");
|
||||
|
||||
function generateMnemonic() {
|
||||
// This must stay the compile-time DEBUG constant. Do NOT switch it to
|
||||
// isDebug() from log.js: that also ORs in the runtime debugMode flag the
|
||||
// settings toggle drives, which would let a user of a release build turn
|
||||
// the hardcoded, publicly known test phrase back on for real wallets.
|
||||
if (DEBUG) return DEBUG_MNEMONIC;
|
||||
const m = Mnemonic.fromEntropy(
|
||||
globalThis.crypto.getRandomValues(new Uint8Array(16)),
|
||||
@@ -28,26 +24,6 @@ function hdWalletFromMnemonic(mnemonic) {
|
||||
return { xpub, firstAddress };
|
||||
}
|
||||
|
||||
function hdWalletFromXprv(xprv) {
|
||||
const root = HDNodeWallet.fromExtendedKey(xprv);
|
||||
if (!root.privateKey) {
|
||||
throw new Error("Not an extended private key (xprv).");
|
||||
}
|
||||
const node = root.derivePath("44'/60'/0'/0");
|
||||
const xpub = node.neuter().extendedKey;
|
||||
const firstAddress = node.deriveChild(0).address;
|
||||
return { xpub, firstAddress };
|
||||
}
|
||||
|
||||
function isValidXprv(key) {
|
||||
try {
|
||||
const node = HDNodeWallet.fromExtendedKey(key);
|
||||
return !!node.privateKey;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function addressFromPrivateKey(key) {
|
||||
const w = new Wallet(key);
|
||||
return w.address;
|
||||
@@ -62,11 +38,6 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
|
||||
);
|
||||
return node.deriveChild(addrIndex);
|
||||
}
|
||||
if (walletData.type === "xprv") {
|
||||
const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
|
||||
const node = root.derivePath("44'/60'/0'/0");
|
||||
return node.deriveChild(addrIndex);
|
||||
}
|
||||
return new Wallet(decryptedSecret);
|
||||
}
|
||||
|
||||
@@ -78,8 +49,6 @@ module.exports = {
|
||||
generateMnemonic,
|
||||
deriveAddressFromXpub,
|
||||
hdWalletFromMnemonic,
|
||||
hdWalletFromXprv,
|
||||
isValidXprv,
|
||||
addressFromPrivateKey,
|
||||
getSignerForAddress,
|
||||
isValidMnemonic,
|
||||
|
||||
@@ -1,70 +0,0 @@
|
||||
// Wallet deletion state transition, kept out of the view so the selection
|
||||
// and broadcast rules are testable without a DOM.
|
||||
|
||||
// Remove wallet `walletIdx` from `state` and repair the derived state.
|
||||
//
|
||||
// Rules:
|
||||
// - `hasWallet` tracks whether any wallet remains.
|
||||
// - Site permissions are dropped for every address of the deleted wallet.
|
||||
// - `selectedWallet` follows the splice: it is decremented when a wallet
|
||||
// before it was removed, and falls back to the first remaining wallet's
|
||||
// first address only when the selection itself was deleted.
|
||||
// - `activeAddress` is only moved when it belonged to the deleted wallet;
|
||||
// the fallback is the first remaining wallet's first address, or null
|
||||
// when no wallet remains.
|
||||
//
|
||||
// Returns whether `activeAddress` changed, so the caller can broadcast it.
|
||||
function removeWalletFromState(state, walletIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
const addresses = (wallet.addresses || []).map((a) => a.address);
|
||||
const previousActive = state.activeAddress;
|
||||
const activeWasDeleted =
|
||||
previousActive !== null &&
|
||||
previousActive !== undefined &&
|
||||
addresses.some(
|
||||
(a) => a.toLowerCase() === String(previousActive).toLowerCase(),
|
||||
);
|
||||
|
||||
state.wallets.splice(walletIdx, 1);
|
||||
|
||||
for (const addr of addresses) {
|
||||
delete state.allowedSites[addr];
|
||||
delete state.deniedSites[addr];
|
||||
}
|
||||
|
||||
state.hasWallet = state.wallets.length > 0;
|
||||
|
||||
const fallbackAddress = state.hasWallet
|
||||
? state.wallets[0].addresses[0]?.address || null
|
||||
: null;
|
||||
|
||||
if (!state.hasWallet) {
|
||||
state.selectedWallet = null;
|
||||
state.selectedAddress = null;
|
||||
} else if (state.selectedWallet === walletIdx) {
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
} else if (
|
||||
typeof state.selectedWallet === "number" &&
|
||||
state.selectedWallet > walletIdx
|
||||
) {
|
||||
state.selectedWallet -= 1;
|
||||
}
|
||||
|
||||
if (activeWasDeleted || !state.hasWallet) {
|
||||
state.activeAddress = fallbackAddress;
|
||||
}
|
||||
|
||||
return { activeAddressChanged: state.activeAddress !== previousActive };
|
||||
}
|
||||
|
||||
// Tell the background the active address changed, so it re-emits
|
||||
// accountsChanged to connected sites. Same call shape as the address
|
||||
// switch in the home view.
|
||||
function broadcastActiveChanged() {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
|
||||
module.exports = { removeWalletFromState, broadcastActiveChanged };
|
||||
@@ -1,355 +0,0 @@
|
||||
const { Network, Transaction, Wallet } = require("ethers");
|
||||
const {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
sameAddress,
|
||||
} = require("../src/shared/approvalVerify");
|
||||
const { getSignerForAddress } = require("../src/shared/wallet");
|
||||
|
||||
// Fixed test keys — never used for anything but these tests.
|
||||
const SIGNER_KEY =
|
||||
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
|
||||
const OTHER_KEY =
|
||||
"0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a";
|
||||
|
||||
const signer = new Wallet(SIGNER_KEY);
|
||||
const other = new Wallet(OTHER_KEY);
|
||||
|
||||
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
const OTHER_RECIPIENT = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
|
||||
|
||||
// Approved parameters as a dApp would supply them over eth_sendTransaction.
|
||||
const TX_PARAMS = {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0xdeadbeef",
|
||||
gas: "0x5208",
|
||||
};
|
||||
|
||||
// Build a signable transaction from approved params. The popup does the same
|
||||
// thing through populateTransaction(); here the fields are fixed so the test
|
||||
// needs no provider.
|
||||
function txFor(params) {
|
||||
return {
|
||||
chainId: 1,
|
||||
nonce: 7,
|
||||
gasLimit: 100000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
type: 2,
|
||||
to: params.to,
|
||||
value: params.value === undefined ? 0n : BigInt(params.value),
|
||||
data: params.data || "0x",
|
||||
};
|
||||
}
|
||||
|
||||
async function signedFor(params, withWallet) {
|
||||
return (withWallet || signer).signTransaction(txFor(params));
|
||||
}
|
||||
|
||||
describe("sameAddress", () => {
|
||||
test("compares checksummed and lowercase forms as equal", () => {
|
||||
expect(sameAddress(RECIPIENT, RECIPIENT.toLowerCase())).toBe(true);
|
||||
});
|
||||
|
||||
test("treats two absent addresses as equal (contract creation)", () => {
|
||||
expect(sameAddress(null, undefined)).toBe(true);
|
||||
expect(sameAddress("", null)).toBe(true);
|
||||
});
|
||||
|
||||
test("treats one absent address as unequal", () => {
|
||||
expect(sameAddress(RECIPIENT, null)).toBe(false);
|
||||
expect(sameAddress(null, RECIPIENT)).toBe(false);
|
||||
});
|
||||
|
||||
test("does not throw on values that are not addresses", () => {
|
||||
expect(sameAddress("not-an-address", RECIPIENT)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("verifySignedTx", () => {
|
||||
test("accepts the approved transaction signed by the approved address", async () => {
|
||||
const raw = await signedFor(TX_PARAMS);
|
||||
const parsed = verifySignedTx(raw, TX_PARAMS, signer.address);
|
||||
expect(parsed.from).toBe(signer.address);
|
||||
expect(parsed.hash).toBe(Transaction.from(raw).hash);
|
||||
});
|
||||
|
||||
test("accepts a contract creation with no recipient", async () => {
|
||||
const params = { to: undefined, value: "0x0", data: "0x600160005500" };
|
||||
const raw = await signedFor(params);
|
||||
expect(() => verifySignedTx(raw, params, signer.address)).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts an absent value as zero", async () => {
|
||||
const approved = { to: RECIPIENT, data: "0x" };
|
||||
const raw = await signedFor(approved);
|
||||
expect(() =>
|
||||
verifySignedTx(raw, approved, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts call data whose case differs from the approval", async () => {
|
||||
const approved = { to: RECIPIENT, value: "0x0", data: "0xDEADBEEF" };
|
||||
const raw = await signedFor(approved);
|
||||
expect(() =>
|
||||
verifySignedTx(raw, approved, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("rejects a swapped recipient", async () => {
|
||||
const raw = await signedFor({
|
||||
...TX_PARAMS,
|
||||
to: OTHER_RECIPIENT,
|
||||
});
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved recipient/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects an inflated value", async () => {
|
||||
const raw = await signedFor({
|
||||
...TX_PARAMS,
|
||||
value: "0x4563918244f40000",
|
||||
});
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved value/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects substituted call data", async () => {
|
||||
const raw = await signedFor({ ...TX_PARAMS, data: "0xc0ffee" });
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved call data/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects a transaction signed by a different address", async () => {
|
||||
const raw = await signedFor(TX_PARAMS, other);
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/different address/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects an unsigned transaction", () => {
|
||||
const unsigned = Transaction.from(txFor(TX_PARAMS)).unsignedSerialized;
|
||||
expect(() =>
|
||||
verifySignedTx(unsigned, TX_PARAMS, signer.address),
|
||||
).toThrow(/no valid signature/);
|
||||
});
|
||||
|
||||
test("rejects a missing or malformed payload", () => {
|
||||
expect(() =>
|
||||
verifySignedTx(undefined, TX_PARAMS, signer.address),
|
||||
).toThrow(/missing or malformed/);
|
||||
expect(() => verifySignedTx("nope", TX_PARAMS, signer.address)).toThrow(
|
||||
/missing or malformed/,
|
||||
);
|
||||
expect(() =>
|
||||
verifySignedTx("0xc0ffee", TX_PARAMS, signer.address),
|
||||
).toThrow(/could not be decoded/);
|
||||
});
|
||||
|
||||
test("every rejection message is a full sentence", async () => {
|
||||
const raw = await signedFor({ ...TX_PARAMS, to: OTHER_RECIPIENT });
|
||||
try {
|
||||
verifySignedTx(raw, TX_PARAMS, signer.address);
|
||||
throw new Error("expected a rejection");
|
||||
} catch (e) {
|
||||
expect(e.message).toMatch(/^[A-Z].*\.$/);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
const TYPED_DATA = JSON.stringify({
|
||||
domain: {
|
||||
name: "AutistMask Test",
|
||||
version: "1",
|
||||
chainId: 1,
|
||||
verifyingContract: OTHER_RECIPIENT,
|
||||
},
|
||||
primaryType: "Mail",
|
||||
types: {
|
||||
EIP712Domain: [
|
||||
{ name: "name", type: "string" },
|
||||
{ name: "version", type: "string" },
|
||||
{ name: "chainId", type: "uint256" },
|
||||
{ name: "verifyingContract", type: "address" },
|
||||
],
|
||||
Mail: [
|
||||
{ name: "from", type: "address" },
|
||||
{ name: "to", type: "address" },
|
||||
{ name: "contents", type: "string" },
|
||||
],
|
||||
},
|
||||
message: {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
contents: "hello",
|
||||
},
|
||||
});
|
||||
|
||||
describe("verifySignature", () => {
|
||||
// "Hello AutistMask" as the hex string a dApp passes to personal_sign.
|
||||
const MESSAGE = "0x48656c6c6f204175746973744d61736b";
|
||||
const personalParams = {
|
||||
method: "personal_sign",
|
||||
message: MESSAGE,
|
||||
from: signer.address,
|
||||
};
|
||||
const typedParams = {
|
||||
method: "eth_signTypedData_v4",
|
||||
typedData: TYPED_DATA,
|
||||
from: signer.address,
|
||||
};
|
||||
|
||||
async function signPersonal(withWallet) {
|
||||
return (withWallet || signer).signMessage(
|
||||
Buffer.from(MESSAGE.slice(2), "hex"),
|
||||
);
|
||||
}
|
||||
|
||||
async function signTyped(withWallet) {
|
||||
const { domain, types, message } = JSON.parse(TYPED_DATA);
|
||||
delete types.EIP712Domain;
|
||||
return (withWallet || signer).signTypedData(domain, types, message);
|
||||
}
|
||||
|
||||
test("accepts a personal_sign signature from the approved address", async () => {
|
||||
const signature = await signPersonal();
|
||||
expect(verifySignature(personalParams, signature, signer.address)).toBe(
|
||||
signer.address,
|
||||
);
|
||||
});
|
||||
|
||||
test("accepts an eth_sign signature the same way", async () => {
|
||||
const signature = await signPersonal();
|
||||
const params = { ...personalParams, method: "eth_sign" };
|
||||
expect(() =>
|
||||
verifySignature(params, signature, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts a typed data signature from the approved address", async () => {
|
||||
const signature = await signTyped();
|
||||
expect(verifySignature(typedParams, signature, signer.address)).toBe(
|
||||
signer.address,
|
||||
);
|
||||
});
|
||||
|
||||
test("does not mutate the approved typed data while verifying", async () => {
|
||||
const signature = await signTyped();
|
||||
const before = typedParams.typedData;
|
||||
verifySignature(typedParams, signature, signer.address);
|
||||
expect(typedParams.typedData).toBe(before);
|
||||
expect(
|
||||
JSON.parse(typedParams.typedData).types.EIP712Domain,
|
||||
).toBeDefined();
|
||||
});
|
||||
|
||||
test("rejects a personal_sign signature from a different address", async () => {
|
||||
const signature = await signPersonal(other);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a typed data signature from a different address", async () => {
|
||||
const signature = await signTyped(other);
|
||||
expect(() =>
|
||||
verifySignature(typedParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a signature over a different message", async () => {
|
||||
const signature = await signer.signMessage(
|
||||
Buffer.from("00112233", "hex"),
|
||||
);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a missing or malformed signature", async () => {
|
||||
expect(() =>
|
||||
verifySignature(personalParams, undefined, signer.address),
|
||||
).toThrow(/missing or malformed/);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, "0x1234", signer.address),
|
||||
).toThrow(/could not be verified/);
|
||||
});
|
||||
});
|
||||
|
||||
// End-to-end over the messaging boundary, without a browser: run the exact
|
||||
// sequence the approval popup runs, then hand the artifact to the exact check
|
||||
// the background runs before it broadcasts or resolves. Only what the popup
|
||||
// puts on the wire is passed along, so this also pins down that the wire
|
||||
// payload is sufficient on its own.
|
||||
describe("popup signing sequence to background verification", () => {
|
||||
// Stand-in for the JSON-RPC provider. populateTransaction only needs the
|
||||
// nonce, the gas estimate, the network and the fee data.
|
||||
const fakeProvider = {
|
||||
getNetwork: async () => Network.from(1),
|
||||
getTransactionCount: async () => 7,
|
||||
estimateGas: async () => 21000n,
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
};
|
||||
|
||||
// A private-key wallet as it is persisted in state, so the test goes
|
||||
// through getSignerForAddress() the way the popup does.
|
||||
const walletData = { type: "privkey" };
|
||||
|
||||
async function popupSignsTx(txParams) {
|
||||
const localSigner = getSignerForAddress(walletData, 0, SIGNER_KEY);
|
||||
const connected = localSigner.connect(fakeProvider);
|
||||
const populated = await connected.populateTransaction(txParams);
|
||||
delete populated.from;
|
||||
return connected.signTransaction(populated);
|
||||
}
|
||||
|
||||
test("a populated, signed transaction is accepted and broadcastable", async () => {
|
||||
const rawSignedTx = await popupSignsTx(TX_PARAMS);
|
||||
const parsed = verifySignedTx(rawSignedTx, TX_PARAMS, signer.address);
|
||||
expect(parsed.nonce).toBe(7);
|
||||
expect(parsed.chainId).toBe(1n);
|
||||
expect(parsed.gasLimit).toBe(21000n);
|
||||
expect(parsed.to).toBe(RECIPIENT);
|
||||
expect(parsed.value).toBe(BigInt(TX_PARAMS.value));
|
||||
expect(parsed.data).toBe(TX_PARAMS.data);
|
||||
expect(parsed.signature).not.toBeNull();
|
||||
});
|
||||
|
||||
test("the wire payload carries no password and no secret", async () => {
|
||||
const rawSignedTx = await popupSignsTx(TX_PARAMS);
|
||||
const payload = {
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: "test-approval-id",
|
||||
approved: true,
|
||||
rawSignedTx,
|
||||
};
|
||||
expect(Object.keys(payload).sort()).toEqual([
|
||||
"approved",
|
||||
"id",
|
||||
"rawSignedTx",
|
||||
"type",
|
||||
]);
|
||||
const wire = JSON.stringify(payload).toLowerCase();
|
||||
expect(wire).not.toContain("password");
|
||||
expect(wire).not.toContain(SIGNER_KEY.slice(2).toLowerCase());
|
||||
});
|
||||
|
||||
test("the background rejects a transaction the popup did not approve", async () => {
|
||||
const rawSignedTx = await popupSignsTx({
|
||||
...TX_PARAMS,
|
||||
to: OTHER_RECIPIENT,
|
||||
});
|
||||
expect(() =>
|
||||
verifySignedTx(rawSignedTx, TX_PARAMS, signer.address),
|
||||
).toThrow(/approved recipient/);
|
||||
});
|
||||
});
|
||||
@@ -1,6 +1,4 @@
|
||||
const {
|
||||
DEBUG,
|
||||
BUILD_DEBUG_MARKER,
|
||||
ETHEREUM_MAINNET_CHAIN_ID,
|
||||
DEFAULT_RPC_URL,
|
||||
BIP44_ETH_PATH,
|
||||
@@ -21,24 +19,6 @@ describe("constants", () => {
|
||||
expect(BIP44_ETH_PATH).toBe("m/44'/60'/0'/0");
|
||||
});
|
||||
|
||||
// This does not replace script/verify-build, which is the only thing that
|
||||
// can see the compiled DEBUG state of a real bundle. It pins the source
|
||||
// invariant that the marker tracks DEBUG, so the two cannot be edited
|
||||
// apart and leave verify-build asserting something that is no longer the
|
||||
// flag the code branches on.
|
||||
test("build debug marker is derived from DEBUG", () => {
|
||||
expect(BUILD_DEBUG_MARKER).toBe(
|
||||
DEBUG ? "autistmask-build-debug=on" : "autistmask-build-debug=off",
|
||||
);
|
||||
});
|
||||
|
||||
// Outside a bundle there is no __BUILD_DEBUG__ define, and the fallback
|
||||
// must be the safe one.
|
||||
test("DEBUG is off when loaded outside a bundle", () => {
|
||||
expect(DEBUG).toBe(false);
|
||||
expect(BUILD_DEBUG_MARKER).toBe("autistmask-build-debug=off");
|
||||
});
|
||||
|
||||
test("exports ERC-20 ABI with expected functions", () => {
|
||||
expect(Array.isArray(ERC20_ABI)).toBe(true);
|
||||
expect(ERC20_ABI.length).toBeGreaterThan(0);
|
||||
|
||||
@@ -1,289 +0,0 @@
|
||||
// End-to-end harness: launches a real Chromium with the unpacked MV3
|
||||
// build loaded, collects every uncaught page error and console.error, and
|
||||
// exposes the popup flows the tests drive.
|
||||
//
|
||||
// This runs inside the pinned Playwright container; see script/test-e2e.
|
||||
// It is deliberately NOT part of make check — REPO_POLICIES.md caps
|
||||
// make test at 20 seconds and a browser suite does not fit.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
const os = require("os");
|
||||
const path = require("path");
|
||||
|
||||
const { chromium } = require("playwright-core");
|
||||
const { installNetworkStubs } = require("./network");
|
||||
|
||||
const REPO_ROOT = path.resolve(__dirname, "..", "..");
|
||||
const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
|
||||
|
||||
// Page errors that are known, tracked, and deliberately tolerated. Every
|
||||
// entry must name the issue that will remove it. This list is the one
|
||||
// concession in an otherwise zero-tolerance policy: an uncaught error is
|
||||
// how this harness caught issue #150 in the first place.
|
||||
const ALLOWED_ERRORS = [
|
||||
{
|
||||
// libsodium ships a WASM build and an asm.js fallback. The
|
||||
// extension CSP (script-src 'self', with no wasm-unsafe-eval)
|
||||
// refuses the WASM module on every popup load; libsodium catches
|
||||
// it and falls back to asm.js, so the wallet works. Deciding
|
||||
// which backend actually ships is issue #182, and this entry gets
|
||||
// deleted when that lands.
|
||||
issue: "#182",
|
||||
pattern: /Refused to compile or instantiate WebAssembly module/,
|
||||
},
|
||||
];
|
||||
|
||||
function isAllowed(text) {
|
||||
return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
|
||||
}
|
||||
|
||||
// Collects every uncaught page error, console.error and unstubbed
|
||||
// request, and hands each one to exactly one reporter.
|
||||
//
|
||||
// This deliberately has NO window API. It used to expose mark()/since()
|
||||
// so a test could ask for "the errors since I started", and that shape
|
||||
// produced a green run that proved nothing twice over: first the mark
|
||||
// started after test 1, so everything recorded during launch was
|
||||
// discarded, then the tail after the final test was never read at all. In
|
||||
// both cases a record fell outside somebody's window and vanished, which
|
||||
// is the precise failure this harness exists to prevent.
|
||||
//
|
||||
// So there is no window left to fall outside of. take() is the only
|
||||
// reader and it always takes everything outstanding, so successive takes
|
||||
// partition the entire record stream with no gaps, and the runner turns
|
||||
// every record it reads into a failure.
|
||||
//
|
||||
// Observation ends when the browser context is closed. Nothing records
|
||||
// after that — the route handler and the console listeners are gone with
|
||||
// the context — so there is no post-teardown phase to collect, and this
|
||||
// class deliberately offers no mechanism pretending to cover one.
|
||||
class ErrorCollector {
|
||||
constructor() {
|
||||
this.entries = [];
|
||||
this.taken = 0;
|
||||
}
|
||||
|
||||
record(kind, text) {
|
||||
const line = kind + ": " + String(text).split("\n")[0];
|
||||
if (isAllowed(line)) return;
|
||||
this.entries.push(line);
|
||||
}
|
||||
|
||||
// Everything recorded since the previous take(). Never yields a
|
||||
// record twice and never skips one.
|
||||
take() {
|
||||
const out = this.entries.slice(this.taken);
|
||||
this.taken = this.entries.length;
|
||||
return out;
|
||||
}
|
||||
}
|
||||
|
||||
function attachErrorListeners(ctx, errors) {
|
||||
const attachPage = (page) => {
|
||||
page.on("pageerror", (err) => {
|
||||
errors.record("pageerror", err.message || String(err));
|
||||
});
|
||||
page.on("console", (msg) => {
|
||||
if (msg.type() === "error") {
|
||||
errors.record("console.error", msg.text());
|
||||
}
|
||||
});
|
||||
};
|
||||
ctx.pages().forEach(attachPage);
|
||||
ctx.on("page", attachPage);
|
||||
// Per-page listeners only: the context-level "weberror" event covers
|
||||
// the same page exceptions and would double-report them. Playwright
|
||||
// exposes no error EVENT for service workers, so an uncaught
|
||||
// exception in the background worker is not visible here — everything
|
||||
// this suite drives lives in the popup page. That is an error-channel
|
||||
// gap only: worker NETWORK traffic is intercepted and reported like
|
||||
// any other, and assertWorkerTrafficIntercepted() below fails the run
|
||||
// if it ever stops being.
|
||||
}
|
||||
|
||||
async function serviceWorker(ctx) {
|
||||
const [existing] = ctx.serviceWorkers();
|
||||
if (existing) return existing;
|
||||
return ctx.waitForEvent("serviceworker", { timeout: 30000 });
|
||||
}
|
||||
|
||||
// How long to wait for the background worker's first outbound request.
|
||||
//
|
||||
// The margin that actually decides whether this check is sound is not
|
||||
// this timeout — it is whether the route handler is installed before the
|
||||
// worker fetches. Measured over several runs: route installation
|
||||
// completes 11-23ms after the context comes up, and the worker's
|
||||
// blocklist fetch arrives 525-883ms after that, so the route wins by
|
||||
// roughly 25-50x. This 30s figure is only slack for a loaded machine on
|
||||
// top of that; losing the race fails the run rather than passing it
|
||||
// quietly, which was verified by forcing a 3s delay before route
|
||||
// installation.
|
||||
const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
|
||||
|
||||
// ctx.route() only sees service-worker requests when Playwright runs with
|
||||
// PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
|
||||
// sets. Without it the worker's traffic — notably the phishing blocklist
|
||||
// fetch src/background/index.js issues at startup — goes to the real
|
||||
// internet, and nothing says so, because src/shared/phishingDomains.js
|
||||
// swallows fetch failures. A harness whose isolation can lapse in silence
|
||||
// is worthless, so this does not take the flag on trust: the background
|
||||
// worker's own startup fetch has to show up in the route handler, or the
|
||||
// suite refuses to run.
|
||||
//
|
||||
// Deliberately NOT a synthetic probe fetched through worker.evaluate():
|
||||
// evaluating in an extension worker this early kills it (the call fails
|
||||
// with "Target page, context or browser has been closed" and the worker
|
||||
// disappears), which would break the very thing being measured. Observing
|
||||
// traffic the extension already generates costs nothing and cannot
|
||||
// perturb it.
|
||||
async function assertWorkerTrafficIntercepted(stubs) {
|
||||
const seen = await stubs.waitForServiceWorkerTraffic(
|
||||
WORKER_TRAFFIC_TIMEOUT_MS,
|
||||
);
|
||||
if (seen) return seen;
|
||||
|
||||
// State the observation, not a conclusion. This fires for at least
|
||||
// two quite different causes and the harness cannot tell them apart
|
||||
// from here, so guessing one of them in the message sends the reader
|
||||
// the wrong way.
|
||||
throw new Error(
|
||||
"observed no service-worker request in the route handler within " +
|
||||
WORKER_TRAFFIC_TIMEOUT_MS +
|
||||
"ms. Under working interception the background worker's " +
|
||||
"startup blocklist fetch (src/background/index.js) reaches the " +
|
||||
"handler about half a second after the route is installed. " +
|
||||
"Two causes are plausible and this check cannot distinguish " +
|
||||
"them: (1) service-worker interception is not in effect, so " +
|
||||
"that traffic went to the real internet unobserved — the suite " +
|
||||
"must be run through script/test-e2e, which sets " +
|
||||
"PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
|
||||
"Playwright upgrade may have dropped or renamed that flag; " +
|
||||
"(2) no worker request was made in the first place — the route " +
|
||||
"lost the startup race, or the worker no longer fetches at " +
|
||||
"startup, in which case this check needs a new anchor because " +
|
||||
"there is no longer any worker traffic to observe. Either way " +
|
||||
"the fix is a replacement mechanism or an honest downgrade of " +
|
||||
"the isolation claims in tests/e2e/network.js and README.md — " +
|
||||
"not deleting this check",
|
||||
);
|
||||
}
|
||||
|
||||
async function launch(routeOpts) {
|
||||
if (!fs.existsSync(path.join(EXT_PATH, "manifest.json"))) {
|
||||
throw new Error(
|
||||
"no unpacked build at " +
|
||||
EXT_PATH +
|
||||
" — run make build before the e2e suite",
|
||||
);
|
||||
}
|
||||
|
||||
const userDir = fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-e2e-"));
|
||||
const ctx = await chromium.launchPersistentContext(userDir, {
|
||||
// channel: "chromium" is load-bearing. The default headless mode
|
||||
// uses the headless shell, which silently refuses to load
|
||||
// extensions: there is no error at all, the service worker simply
|
||||
// never appears. This cost real debugging time once already.
|
||||
channel: "chromium",
|
||||
headless: true,
|
||||
args: [
|
||||
"--disable-extensions-except=" + EXT_PATH,
|
||||
"--load-extension=" + EXT_PATH,
|
||||
// The container runs unprivileged; Chrome's sandbox needs
|
||||
// capabilities the harness deliberately does not grant it.
|
||||
"--no-sandbox",
|
||||
// Belt to the interception braces: nothing that slips past
|
||||
// the route handler can resolve a name, so a request that
|
||||
// escapes cannot actually reach the internet. Detection is
|
||||
// still assertWorkerTrafficIntercepted()'s job — this only
|
||||
// bounds the damage while a gap goes unnoticed. Playwright
|
||||
// fulfils routed requests without touching the resolver, and
|
||||
// it drives the browser over a pipe, so neither is affected.
|
||||
"--host-resolver-rules=MAP * ~NOTFOUND",
|
||||
],
|
||||
});
|
||||
|
||||
const cleanup = async () => {
|
||||
await ctx.close().catch(() => {});
|
||||
fs.rmSync(userDir, { recursive: true, force: true });
|
||||
};
|
||||
|
||||
try {
|
||||
const errors = new ErrorCollector();
|
||||
attachErrorListeners(ctx, errors);
|
||||
routeOpts.report = (text) => errors.record("network", text);
|
||||
const stubs = await installNetworkStubs(ctx, routeOpts);
|
||||
|
||||
await assertWorkerTrafficIntercepted(stubs);
|
||||
|
||||
// The extension id is derived from the unpacked path, so it
|
||||
// changes and must never be hardcoded. It is the host part of the
|
||||
// service worker URL.
|
||||
const sw = await serviceWorker(ctx);
|
||||
const id = new URL(sw.url()).host;
|
||||
|
||||
return {
|
||||
ctx,
|
||||
errors,
|
||||
extensionId: id,
|
||||
popupUrl: "chrome-extension://" + id + "/src/popup/index.html",
|
||||
close: cleanup,
|
||||
};
|
||||
} catch (e) {
|
||||
// Anything that fails after the browser is up has to tear it down
|
||||
// on the way out: an orphaned context keeps node alive forever,
|
||||
// turning a clean failure into a hung run.
|
||||
await cleanup();
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------- flows
|
||||
|
||||
const PASSWORD = "e2e-harness-password";
|
||||
|
||||
async function visible(page, selector, timeout = 15000) {
|
||||
await page.waitForSelector(selector, { state: "visible", timeout });
|
||||
}
|
||||
|
||||
async function openPopup(ctx, popupUrl) {
|
||||
const page = await ctx.newPage();
|
||||
await page.goto(popupUrl);
|
||||
return page;
|
||||
}
|
||||
|
||||
// Full wallet creation through the real UI: BIP-39 generation, libsodium
|
||||
// vault encryption and extension storage persistence, for real.
|
||||
async function createWallet(page) {
|
||||
await page.click("#btn-welcome-add");
|
||||
await visible(page, "#view-add-wallet");
|
||||
await page.click("#btn-generate-phrase");
|
||||
await page.waitForFunction(() => {
|
||||
const el = document.getElementById("wallet-mnemonic");
|
||||
return el && el.value.trim().split(/\s+/).length >= 12;
|
||||
});
|
||||
await page.fill("#add-wallet-password", PASSWORD);
|
||||
await page.fill("#add-wallet-password-confirm", PASSWORD);
|
||||
await page.click("#btn-add-wallet-confirm");
|
||||
await visible(page, "#view-main", 60000);
|
||||
}
|
||||
|
||||
// Reach the address detail screen from wherever the popup restored to.
|
||||
// Clicking .address-row does not open it; the [info] button does.
|
||||
async function openAddressDetail(page) {
|
||||
const onAddress = await page.isVisible("#view-address");
|
||||
if (!onAddress) {
|
||||
await visible(page, "#view-main");
|
||||
await page.click("#wallet-list .btn-addr-info");
|
||||
}
|
||||
await visible(page, "#view-address");
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
createWallet,
|
||||
launch,
|
||||
openAddressDetail,
|
||||
openPopup,
|
||||
visible,
|
||||
};
|
||||
@@ -1,334 +0,0 @@
|
||||
// Browser-level network interception for the end-to-end suite.
|
||||
//
|
||||
// Every http(s) request the extension makes — from the popup page AND
|
||||
// from the MV3 background service worker — is fulfilled from these
|
||||
// fixtures, so the suite is deterministic and runs entirely offline. The
|
||||
// probe that motivated this harness (see issue #181) observed live calls
|
||||
// to Blockscout returning 401 inside the container, which would make any
|
||||
// assertion about rendered transaction data worthless.
|
||||
//
|
||||
// Service-worker coverage is not free: ctx.route() only sees worker
|
||||
// traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
|
||||
// the environment, which script/test-e2e does. Without it the phishing
|
||||
// blocklist fetch that src/background/index.js issues at worker startup
|
||||
// silently reaches raw.githubusercontent.com on the open internet, and
|
||||
// src/shared/phishingDomains.js swallows the failure so nothing surfaces
|
||||
// it. That is not left to trust: waitForServiceWorkerTraffic() below
|
||||
// backs the launch-time canary in harness.js, which fails the entire
|
||||
// suite if worker requests stop being visible here.
|
||||
//
|
||||
// Anything not explicitly stubbed here is aborted AND reported to the
|
||||
// error collector, so a newly added outbound call shows up as a test
|
||||
// failure rather than as intermittent flakiness.
|
||||
|
||||
"use strict";
|
||||
|
||||
// Fictional ERC-20 used to seed the transaction-detail test. The symbol
|
||||
// must not collide with any entry in src/shared/tokenList.js, or
|
||||
// isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
|
||||
// symbol-spoofing attempt; holders_count must be >= 1000 or the default
|
||||
// hideLowHolderTokens filter drops it. Either would make the test pass
|
||||
// vacuously by never rendering a row at all.
|
||||
const STUB_TOKEN = {
|
||||
address: "0xe2e0000000000000000000000000000000000e2e",
|
||||
symbol: "E2E",
|
||||
name: "End To End Test Token",
|
||||
decimals: "6",
|
||||
holders: "12345",
|
||||
};
|
||||
|
||||
const STUB_COUNTERPARTY = "0xc0ffee0000000000000000000000000000c0ffee";
|
||||
|
||||
const STUB_TX_HASH =
|
||||
"0xe2e0000000000000000000000000000000000000000000000000000000000e2e";
|
||||
|
||||
const STUB_BLOCK_NUMBER = 21000000;
|
||||
|
||||
// Fixed instant so timeAgo() output is stable across runs.
|
||||
const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
|
||||
|
||||
// A 32-byte zero word. Returned for every eth_call, which is what makes
|
||||
// ethers' ENS reverse lookup resolve to "no resolver set" and return null
|
||||
// instead of throwing. A throw would be logged by src/shared/ens.js via
|
||||
// log.errorf(), i.e. console.error, which fails the run on its own.
|
||||
const ZERO_WORD = "0x" + "0".repeat(64);
|
||||
|
||||
const RPC_RESULTS = {
|
||||
eth_chainId: "0x1",
|
||||
net_version: "1",
|
||||
eth_blockNumber: "0x1406f40",
|
||||
eth_getBalance: "0x0",
|
||||
eth_call: ZERO_WORD,
|
||||
eth_gasPrice: "0x3b9aca00",
|
||||
eth_estimateGas: "0x5208",
|
||||
eth_getTransactionCount: "0x0",
|
||||
eth_maxPriorityFeePerGas: "0x3b9aca00",
|
||||
};
|
||||
|
||||
function tokenObject() {
|
||||
return {
|
||||
address_hash: STUB_TOKEN.address,
|
||||
address: STUB_TOKEN.address,
|
||||
symbol: STUB_TOKEN.symbol,
|
||||
name: STUB_TOKEN.name,
|
||||
decimals: STUB_TOKEN.decimals,
|
||||
holders_count: STUB_TOKEN.holders,
|
||||
type: "ERC-20",
|
||||
};
|
||||
}
|
||||
|
||||
// One received ERC-20 transfer of 1.5 E2E to the address under test.
|
||||
function tokenTransferItems(address) {
|
||||
return [
|
||||
{
|
||||
transaction_hash: STUB_TX_HASH,
|
||||
block_number: STUB_BLOCK_NUMBER,
|
||||
timestamp: STUB_TX_TIMESTAMP,
|
||||
from: { hash: STUB_COUNTERPARTY },
|
||||
to: { hash: address },
|
||||
total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
|
||||
token: tokenObject(),
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
|
||||
// decoder short-circuits; the on-chain detail fields still populate.
|
||||
function transactionDetails() {
|
||||
return {
|
||||
hash: STUB_TX_HASH,
|
||||
block_number: STUB_BLOCK_NUMBER,
|
||||
nonce: 7,
|
||||
gas_used: "51000",
|
||||
gas_price: "1000000000",
|
||||
fee: { value: "51000000000000" },
|
||||
raw_input: "0x",
|
||||
status: "ok",
|
||||
};
|
||||
}
|
||||
|
||||
function jsonResponse(route, body) {
|
||||
return route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
}
|
||||
|
||||
// Extract the address from a Blockscout /addresses/<addr>/... path.
|
||||
function blockscoutAddress(pathname) {
|
||||
const m = pathname.match(/\/addresses\/(0x[0-9a-fA-F]{40})\//);
|
||||
return m ? m[1] : null;
|
||||
}
|
||||
|
||||
function handleRpc(route, postData, report) {
|
||||
let payload;
|
||||
try {
|
||||
payload = JSON.parse(postData || "null");
|
||||
} catch {
|
||||
report("unstubbed RPC: unparseable body " + String(postData));
|
||||
return route.abort();
|
||||
}
|
||||
// ethers batches by default, so the body may be an array.
|
||||
const batch = Array.isArray(payload) ? payload : [payload];
|
||||
|
||||
// Anything that is not a JSON-RPC object, or a batch of them, is not
|
||||
// RPC at all and must be reported like any other unrecognised
|
||||
// outbound traffic rather than dereferenced. request.postData()
|
||||
// returns null both for a bodyless POST and for a body Playwright
|
||||
// cannot decode as UTF-8 (sendBeacon with a Blob, or any binary
|
||||
// payload), so this is not an empty-string special case: it rejects
|
||||
// every non-object payload, exactly as the catch above rejects every
|
||||
// unparseable one.
|
||||
if (
|
||||
payload === null ||
|
||||
typeof payload !== "object" ||
|
||||
!batch.every((req) => req !== null && typeof req === "object")
|
||||
) {
|
||||
report("unstubbed request: POST " + route.request().url());
|
||||
return route.abort();
|
||||
}
|
||||
const replies = batch.map((req) => {
|
||||
const result = RPC_RESULTS[req.method];
|
||||
if (result === undefined) {
|
||||
report("unstubbed RPC method: " + req.method);
|
||||
return {
|
||||
jsonrpc: "2.0",
|
||||
id: req.id,
|
||||
error: { code: -32601, message: "unstubbed in e2e harness" },
|
||||
};
|
||||
}
|
||||
return { jsonrpc: "2.0", id: req.id, result };
|
||||
});
|
||||
return jsonResponse(route, Array.isArray(payload) ? replies : replies[0]);
|
||||
}
|
||||
|
||||
const TRACE_TRUE = ["1", "true", "yes", "on"];
|
||||
const TRACE_FALSE = ["", "0", "false", "no", "off"];
|
||||
|
||||
// Whether E2E_TRACE_NETWORK asks for the request trace.
|
||||
//
|
||||
// A set-but-unrecognised value is a hard error rather than a quiet
|
||||
// "off": E2E_TRACE_NETWORK=true asking for a trace and getting silence
|
||||
// is the operator being lied to about what the harness is doing, which
|
||||
// is the whole failure mode this suite exists to eliminate. Refusing to
|
||||
// guess costs one line and one obvious error message.
|
||||
function traceEnabled(raw) {
|
||||
if (raw === undefined || raw === null) return false;
|
||||
const v = String(raw).trim().toLowerCase();
|
||||
if (TRACE_TRUE.includes(v)) return true;
|
||||
if (TRACE_FALSE.includes(v)) return false;
|
||||
throw new Error(
|
||||
"E2E_TRACE_NETWORK is set to " +
|
||||
JSON.stringify(String(raw)) +
|
||||
", which is not a recognised on/off value. Use one of " +
|
||||
TRACE_TRUE.join(", ") +
|
||||
" to enable the request trace, or one of " +
|
||||
TRACE_FALSE.slice(1).join(", ") +
|
||||
" to disable it. Refusing to guess: a diagnostic that silently " +
|
||||
"does nothing is worse than one that is not there",
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Route every http(s) request through local fixtures.
|
||||
*
|
||||
* @param {import("playwright-core").BrowserContext} ctx
|
||||
* @param {object} opts
|
||||
* @param {(text: string) => void} opts.report called for unstubbed traffic
|
||||
* @param {boolean} [opts.seedTokenTransfer] serve the stubbed ERC-20
|
||||
* transfer. Read at request time, so a test can flip it on the same
|
||||
* options object without re-registering the route.
|
||||
* @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
|
||||
* Promise<string|null>}>}
|
||||
*/
|
||||
async function installNetworkStubs(ctx, opts) {
|
||||
const report = opts.report;
|
||||
|
||||
// First request seen that originated in a service worker, and the
|
||||
// resolver waiting for it. This is what proves worker interception is
|
||||
// actually in force; see waitForServiceWorkerTraffic below.
|
||||
let firstWorkerRequest = null;
|
||||
let announceWorkerRequest = null;
|
||||
|
||||
// E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
|
||||
// tagged [sw] when it originated in the background service worker.
|
||||
// It exists so the isolation claim above can be re-checked by anyone
|
||||
// in one command, without editing files: the phishing blocklist fetch
|
||||
// showing up with an [sw] tag is the proof that the worker really is
|
||||
// intercepted and that the raw.githubusercontent.com stub below is
|
||||
// live code rather than decoration.
|
||||
const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
|
||||
|
||||
// Regex rather than a glob so chrome-extension:// resource loads are
|
||||
// never touched — routing those would break the popup itself.
|
||||
await ctx.route(/^https?:\/\//, async (route) => {
|
||||
const req = route.request();
|
||||
const url = new URL(req.url());
|
||||
const p = url.pathname;
|
||||
const fromWorker = !!req.serviceWorker();
|
||||
|
||||
if (fromWorker && !firstWorkerRequest) {
|
||||
firstWorkerRequest = req.method() + " " + req.url();
|
||||
if (announceWorkerRequest)
|
||||
announceWorkerRequest(firstWorkerRequest);
|
||||
}
|
||||
|
||||
if (trace) {
|
||||
const origin = fromWorker ? "[sw] " : "[page] ";
|
||||
console.log("# routed " + origin + req.method() + " " + req.url());
|
||||
}
|
||||
|
||||
// JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
|
||||
if (req.method() === "POST") {
|
||||
return handleRpc(route, req.postData(), report);
|
||||
}
|
||||
|
||||
// Blockscout v2
|
||||
if (p.includes("/api/v2/")) {
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
|
||||
return jsonResponse(route, { items: [] });
|
||||
}
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
|
||||
const addr = blockscoutAddress(p);
|
||||
return jsonResponse(route, {
|
||||
items:
|
||||
opts.seedTokenTransfer && addr
|
||||
? tokenTransferItems(addr)
|
||||
: [],
|
||||
});
|
||||
}
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
|
||||
return jsonResponse(route, []);
|
||||
}
|
||||
if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
|
||||
return jsonResponse(route, transactionDetails());
|
||||
}
|
||||
}
|
||||
|
||||
// CoinDesk price tick
|
||||
if (url.hostname.endsWith("coindesk.com")) {
|
||||
return jsonResponse(route, { Data: {} });
|
||||
}
|
||||
|
||||
// MetaMask phishing blocklist
|
||||
if (
|
||||
url.hostname === "raw.githubusercontent.com" ||
|
||||
p.endsWith("/eth-phishing-detect/main/src/config.json")
|
||||
) {
|
||||
return jsonResponse(route, {
|
||||
version: 2,
|
||||
tolerance: 2,
|
||||
fuzzylist: [],
|
||||
whitelist: [],
|
||||
blacklist: [],
|
||||
});
|
||||
}
|
||||
|
||||
// Best-effort Etherscan address labels: served as an empty page.
|
||||
if (url.hostname.endsWith("etherscan.io")) {
|
||||
return route.fulfill({
|
||||
status: 200,
|
||||
contentType: "text/html",
|
||||
body: "<html><body></body></html>",
|
||||
});
|
||||
}
|
||||
|
||||
report("unstubbed request: " + req.method() + " " + req.url());
|
||||
return route.abort();
|
||||
});
|
||||
|
||||
return {
|
||||
/**
|
||||
* Resolve with the first service-worker-originated request this
|
||||
* handler saw, or null if none arrives within `ms`.
|
||||
*
|
||||
* The background worker fetches the phishing blocklist at
|
||||
* startup, unconditionally, within about a second of the context
|
||||
* coming up — so under working interception this resolves almost
|
||||
* immediately. Nothing arriving means worker traffic is bypassing
|
||||
* the handler entirely and going to the real internet, which the
|
||||
* caller turns into a hard failure of the whole suite.
|
||||
*/
|
||||
waitForServiceWorkerTraffic(ms) {
|
||||
if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
|
||||
return new Promise((resolve) => {
|
||||
const timer = setTimeout(() => {
|
||||
announceWorkerRequest = null;
|
||||
resolve(null);
|
||||
}, ms);
|
||||
announceWorkerRequest = (req) => {
|
||||
clearTimeout(timer);
|
||||
announceWorkerRequest = null;
|
||||
resolve(req);
|
||||
};
|
||||
});
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
installNetworkStubs,
|
||||
STUB_TOKEN,
|
||||
STUB_TX_HASH,
|
||||
};
|
||||
264
tests/e2e/run.js
264
tests/e2e/run.js
@@ -1,264 +0,0 @@
|
||||
// End-to-end suite entrypoint. Run via script/test-e2e (which builds
|
||||
// dist/chrome/ and starts the pinned container); running it directly
|
||||
// requires a Chromium that playwright-core can find.
|
||||
//
|
||||
// A plain runner rather than jest on purpose: jest's default testMatch
|
||||
// would pull these files into script/test, and browser tests do not fit
|
||||
// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
|
||||
// here is named *.test.js for the same reason.
|
||||
|
||||
"use strict";
|
||||
|
||||
const {
|
||||
createWallet,
|
||||
launch,
|
||||
openAddressDetail,
|
||||
openPopup,
|
||||
visible,
|
||||
} = require("./harness");
|
||||
const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
|
||||
|
||||
const TEST_TIMEOUT_MS = 120000;
|
||||
|
||||
// How long to keep collecting after the final test returns; see the
|
||||
// trailing drain in main().
|
||||
const TRAILING_WATCH_MS = 1500;
|
||||
|
||||
const tests = [];
|
||||
|
||||
function test(name, fn) {
|
||||
tests.push({ name, fn });
|
||||
}
|
||||
|
||||
function assert(cond, message) {
|
||||
if (!cond) throw new Error(message);
|
||||
}
|
||||
|
||||
function withTimeout(promise, name) {
|
||||
let timer;
|
||||
const timeout = new Promise((_, reject) => {
|
||||
timer = setTimeout(
|
||||
() =>
|
||||
reject(new Error("timed out after " + TEST_TIMEOUT_MS + "ms")),
|
||||
TEST_TIMEOUT_MS,
|
||||
);
|
||||
});
|
||||
return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------- tests
|
||||
|
||||
test("popup loads and reaches the welcome view", async (env) => {
|
||||
env.page = await openPopup(env.ctx, env.popupUrl);
|
||||
await visible(env.page, "#view-welcome");
|
||||
const title = await env.page.title();
|
||||
assert(title === "AutistMask", "unexpected popup title: " + title);
|
||||
});
|
||||
|
||||
test("wallet creation through the UI reaches the main view", async (env) => {
|
||||
await createWallet(env.page);
|
||||
const addrCount = await env.page
|
||||
.locator("#wallet-list .btn-addr-info")
|
||||
.count();
|
||||
assert(addrCount > 0, "no addresses rendered in the wallet list");
|
||||
});
|
||||
|
||||
test("add token screen opens from address detail (#150)", async (env) => {
|
||||
await openAddressDetail(env.page);
|
||||
await env.page.click("#btn-add-token");
|
||||
await visible(env.page, "#view-add-token");
|
||||
const quickPicks = await env.page
|
||||
.locator("#common-token-list .common-token")
|
||||
.count();
|
||||
assert(quickPicks > 0, "no common-token quick-pick buttons rendered");
|
||||
});
|
||||
|
||||
test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
|
||||
// Serve the stubbed token transfer from here on, then reload so the
|
||||
// address detail screen refetches its transaction list.
|
||||
env.routeOpts.seedTokenTransfer = true;
|
||||
await env.page.reload();
|
||||
await openAddressDetail(env.page);
|
||||
|
||||
await visible(env.page, "#tx-list .tx-row");
|
||||
const rowText = await env.page
|
||||
.locator("#tx-list .tx-row")
|
||||
.first()
|
||||
.innerText();
|
||||
assert(
|
||||
rowText.includes(STUB_TOKEN.symbol),
|
||||
"token transfer row missing symbol " +
|
||||
STUB_TOKEN.symbol +
|
||||
", got: " +
|
||||
JSON.stringify(rowText),
|
||||
);
|
||||
|
||||
await env.page.locator("#tx-list .tx-row").first().click();
|
||||
await visible(env.page, "#view-transaction");
|
||||
|
||||
const hash = await env.page.locator("#tx-detail-hash").innerText();
|
||||
assert(
|
||||
hash.includes(STUB_TX_HASH),
|
||||
"transaction detail shows the wrong hash: " + hash,
|
||||
);
|
||||
|
||||
// The token contract row is the field that crashes when
|
||||
// addressDotHtml is not imported: it renders only for transfers with
|
||||
// a contractAddress, which is every ERC-20 transfer.
|
||||
await visible(env.page, "#tx-detail-token-contract-section");
|
||||
const contract = env.page.locator("#tx-detail-token-contract");
|
||||
const contractText = await contract.innerText();
|
||||
assert(
|
||||
contractText.toLowerCase().includes(STUB_TOKEN.address),
|
||||
"token contract row missing the contract address, got: " +
|
||||
JSON.stringify(contractText),
|
||||
);
|
||||
const dots = await contract.locator('span[style*="border-radius"]').count();
|
||||
assert(dots > 0, "token contract row rendered without its colour dot");
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------- runner
|
||||
|
||||
async function main() {
|
||||
// A suite that runs nothing must never report success. If a refactor
|
||||
// drops the registrations above, or a require() of this file stops
|
||||
// reaching them, the only honest outcome is a red run — reporting
|
||||
// "0/0 passed" and exiting 0 is the same vacuous-check failure this
|
||||
// whole harness exists to prevent.
|
||||
if (tests.length === 0) {
|
||||
console.log("1..0");
|
||||
console.log("# FAILED: the e2e suite registered no tests");
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
const routeOpts = { seedTokenTransfer: false };
|
||||
|
||||
let session;
|
||||
try {
|
||||
session = await launch(routeOpts);
|
||||
} catch (e) {
|
||||
// Never skip and report success: a browser we cannot start, or
|
||||
// one whose network interception is not in force, is a failure of
|
||||
// the suite, not an absent one.
|
||||
console.error("e2e: cannot run the suite: " + e.message);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
console.log("# extension id: " + session.extensionId);
|
||||
console.log("1.." + tests.length);
|
||||
|
||||
const env = {
|
||||
ctx: session.ctx,
|
||||
popupUrl: session.popupUrl,
|
||||
routeOpts,
|
||||
page: null,
|
||||
};
|
||||
|
||||
// Attribution of collected errors is total. session.errors has no
|
||||
// window API at all: take() always drains everything outstanding, so
|
||||
// successive takes partition the whole stream, and the phases below
|
||||
// cover the entire life of the run. Nothing the collector holds can
|
||||
// go unread.
|
||||
//
|
||||
// launch .. end of test 1 -> test 1 (so the worker's startup
|
||||
// fetches land on a test, not
|
||||
// nowhere)
|
||||
// end of test k .. end of k+1 -> test k+1
|
||||
// last test .. teardown -> the suite, via the trailing drain
|
||||
//
|
||||
// Those three phases cover the entire life of the browser context.
|
||||
// There is no fourth: once the context is closed nothing can record,
|
||||
// because the route handler and the console listeners died with it.
|
||||
// Traffic that a test defers past the trailing drain is therefore
|
||||
// never observed at all — a real limit of this design, stated in the
|
||||
// README, and not one any post-teardown hook could close.
|
||||
//
|
||||
// Two green-but-vacuous runs on this harness were the same shape: a
|
||||
// record falling outside somebody's window and being dropped. First
|
||||
// the mark started after test 1, discarding launch-time records;
|
||||
// then the tail after the last test was never read. Patching a
|
||||
// second boundary would have invited a third, so the window concept
|
||||
// is gone rather than fixed.
|
||||
let failed = 0;
|
||||
let n = 0;
|
||||
for (const t of tests) {
|
||||
n += 1;
|
||||
let failure = null;
|
||||
try {
|
||||
await withTimeout(t.fn(env), t.name);
|
||||
} catch (e) {
|
||||
failure = e.message;
|
||||
}
|
||||
|
||||
// Any uncaught page error, console.error or unstubbed request
|
||||
// fails the test that provoked it, whether or not its assertions
|
||||
// passed. This is the mechanism that caught #150.
|
||||
const newErrors = session.errors.take();
|
||||
if (!failure && newErrors.length > 0) {
|
||||
failure = "uncaught browser errors during this test";
|
||||
}
|
||||
|
||||
if (failure) {
|
||||
failed += 1;
|
||||
console.log("not ok " + n + " - " + t.name);
|
||||
console.log(" " + failure);
|
||||
for (const line of newErrors) {
|
||||
console.log(" " + line);
|
||||
}
|
||||
} else {
|
||||
console.log("ok " + n + " - " + t.name);
|
||||
}
|
||||
}
|
||||
|
||||
// Keep watching after the last test returns, before tearing the
|
||||
// browser down. A request a test fires without awaiting is still in
|
||||
// flight when its function resolves; measured here it reaches the
|
||||
// route handler about 10ms later, but closing the context does not
|
||||
// wait for it — with no window at all the request dies unobserved
|
||||
// and the run goes green, which is exactly how escaping traffic
|
||||
// stays invisible.
|
||||
//
|
||||
// A fixed bounded window rather than a quiescence poll on purpose:
|
||||
// the collector being quiet is not evidence, because a request that
|
||||
// has not been dispatched yet has recorded nothing to be quiet
|
||||
// about. Playwright offers no "is anything in flight" question to
|
||||
// ask either — the route handler is the only observation point — so
|
||||
// a grace period is the mechanism available, and this one is ~150x
|
||||
// the measured latency for 1.5s on a ~25s suite.
|
||||
await new Promise((resolve) => setTimeout(resolve, TRAILING_WATCH_MS));
|
||||
|
||||
await session.close();
|
||||
|
||||
// The tail. These cannot be blamed on any single test, so they are
|
||||
// reported against the suite rather than guessed at — but they are
|
||||
// reported, and they fail the run.
|
||||
const trailing = session.errors.take();
|
||||
|
||||
console.log(
|
||||
"# " + (tests.length - failed) + "/" + tests.length + " tests passed",
|
||||
);
|
||||
|
||||
if (trailing.length > 0) {
|
||||
console.log(
|
||||
"# " +
|
||||
trailing.length +
|
||||
" browser error(s) recorded after the last test finished, " +
|
||||
"not attributable to any single test:",
|
||||
);
|
||||
for (const line of trailing) {
|
||||
console.log("# " + line);
|
||||
}
|
||||
}
|
||||
|
||||
if (failed > 0 || trailing.length > 0) {
|
||||
console.log("# FAILED");
|
||||
process.exitCode = 1;
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((e) => {
|
||||
console.error("e2e: " + (e && e.stack ? e.stack : e));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
@@ -1,100 +0,0 @@
|
||||
const { parseEtherscanPage } = require("../src/shared/etherscanLabels");
|
||||
|
||||
describe("etherscanLabels", () => {
|
||||
describe("parseEtherscanPage", () => {
|
||||
test("detects Fake_Phishing label in title", () => {
|
||||
const html = `<html><head><title>Fake_Phishing184810 | Address: 0x00000c07...3ea470000 | Etherscan</title></head><body></body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("Fake_Phishing184810");
|
||||
expect(result.isPhishing).toBe(true);
|
||||
expect(result.warning).toContain("Fake_Phishing184810");
|
||||
expect(result.warning).toContain("Phish/Hack");
|
||||
});
|
||||
|
||||
test("detects Fake_Phishing with different number", () => {
|
||||
const html = `<html><head><title>Fake_Phishing5169 | Address: 0x3e0defb8...99a7a8a74 | Etherscan</title></head><body></body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("Fake_Phishing5169");
|
||||
expect(result.isPhishing).toBe(true);
|
||||
});
|
||||
|
||||
test("detects Exploiter label", () => {
|
||||
const html = `<html><head><title>Exploiter 42 | Address: 0xabcdef...1234 | Etherscan</title></head><body></body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("Exploiter 42");
|
||||
expect(result.isPhishing).toBe(true);
|
||||
});
|
||||
|
||||
test("detects scam warning in body text", () => {
|
||||
const html =
|
||||
`<html><head><title>Address: 0xabcdef...1234 | Etherscan</title></head>` +
|
||||
`<body>There are reports that this address was used in a Phishing scam.</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBeNull();
|
||||
expect(result.isPhishing).toBe(true);
|
||||
expect(result.warning).toContain("phishing/scam");
|
||||
});
|
||||
|
||||
test("detects scam warning with label in body", () => {
|
||||
const html =
|
||||
`<html><head><title>SomeScammer | Address: 0xabcdef...1234 | Etherscan</title></head>` +
|
||||
`<body>There are reports that this address was used in a scam.</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("SomeScammer");
|
||||
expect(result.isPhishing).toBe(true);
|
||||
expect(result.warning).toContain("SomeScammer");
|
||||
});
|
||||
|
||||
test("returns clean result for legitimate address", () => {
|
||||
const html = `<html><head><title>vitalik.eth | Address: 0xd8dA6BF2...37aA96045 | Etherscan</title></head><body>Overview</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("vitalik.eth");
|
||||
expect(result.isPhishing).toBe(false);
|
||||
expect(result.warning).toBeNull();
|
||||
});
|
||||
|
||||
test("returns clean result for unlabeled address", () => {
|
||||
const html = `<html><head><title>Address: 0x1234567890...abcdef | Etherscan</title></head><body>Overview</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBeNull();
|
||||
expect(result.isPhishing).toBe(false);
|
||||
expect(result.warning).toBeNull();
|
||||
});
|
||||
|
||||
test("handles exchange labels correctly (not phishing)", () => {
|
||||
const html = `<html><head><title>Coinbase 10 | Address: 0xa9d1e08c...b81d3e43 | Etherscan</title></head><body>Overview</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("Coinbase 10");
|
||||
expect(result.isPhishing).toBe(false);
|
||||
});
|
||||
|
||||
test("handles contract names correctly (not phishing)", () => {
|
||||
const html = `<html><head><title>Beacon Deposit Contract | Address: 0x00000000...03d7705Fa | Etherscan</title></head><body>Overview</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBe("Beacon Deposit Contract");
|
||||
expect(result.isPhishing).toBe(false);
|
||||
});
|
||||
|
||||
test("handles empty HTML gracefully", () => {
|
||||
const result = parseEtherscanPage("");
|
||||
expect(result.label).toBeNull();
|
||||
expect(result.isPhishing).toBe(false);
|
||||
expect(result.warning).toBeNull();
|
||||
});
|
||||
|
||||
test("handles malformed title tag", () => {
|
||||
const html = `<html><head><title></title></head><body></body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.label).toBeNull();
|
||||
expect(result.isPhishing).toBe(false);
|
||||
});
|
||||
|
||||
test("detects wallet drainer warning", () => {
|
||||
const html =
|
||||
`<html><head><title>Address: 0xabc...def | Etherscan</title></head>` +
|
||||
`<body>This is a known wallet drainer contract.</body></html>`;
|
||||
const result = parseEtherscanPage(html);
|
||||
expect(result.isPhishing).toBe(true);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,205 +0,0 @@
|
||||
// Provide a localStorage mock for Node.js test environment.
|
||||
// Must be set before requiring the module since it calls loadDeltaFromStorage()
|
||||
// at module load time.
|
||||
const localStorageStore = {};
|
||||
global.localStorage = {
|
||||
getItem: (key) =>
|
||||
Object.prototype.hasOwnProperty.call(localStorageStore, key)
|
||||
? localStorageStore[key]
|
||||
: null,
|
||||
setItem: (key, value) => {
|
||||
localStorageStore[key] = String(value);
|
||||
},
|
||||
removeItem: (key) => {
|
||||
delete localStorageStore[key];
|
||||
},
|
||||
};
|
||||
|
||||
const {
|
||||
isPhishingDomain,
|
||||
loadConfig,
|
||||
getBlocklistSize,
|
||||
getDeltaSize,
|
||||
hostnameVariants,
|
||||
_reset,
|
||||
_getVendoredBlacklistSize,
|
||||
_getDeltaBlacklist,
|
||||
} = require("../src/shared/phishingDomains");
|
||||
|
||||
// Reset delta state before each test to avoid cross-test contamination.
|
||||
// Note: vendored sets are immutable and always present.
|
||||
beforeEach(() => {
|
||||
_reset();
|
||||
// Clear localStorage mock between tests
|
||||
for (const key of Object.keys(localStorageStore)) {
|
||||
delete localStorageStore[key];
|
||||
}
|
||||
});
|
||||
|
||||
describe("phishingDomains", () => {
|
||||
describe("vendored blocklist", () => {
|
||||
test("vendored blacklist is loaded from bundled JSON", () => {
|
||||
// The vendored blocklist should have a large number of entries
|
||||
expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
|
||||
});
|
||||
|
||||
test("detects domains from vendored blacklist", () => {
|
||||
// These are well-known phishing domains in the vendored list
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
|
||||
});
|
||||
|
||||
test("getBlocklistSize includes vendored entries", () => {
|
||||
expect(getBlocklistSize()).toBeGreaterThan(100000);
|
||||
});
|
||||
});
|
||||
|
||||
describe("hostnameVariants", () => {
|
||||
test("returns exact hostname plus parent domains", () => {
|
||||
const variants = hostnameVariants("sub.evil.com");
|
||||
expect(variants).toEqual(["sub.evil.com", "evil.com"]);
|
||||
});
|
||||
|
||||
test("returns just the hostname for a bare domain", () => {
|
||||
const variants = hostnameVariants("example.com");
|
||||
expect(variants).toEqual(["example.com"]);
|
||||
});
|
||||
|
||||
test("handles deep subdomain chains", () => {
|
||||
const variants = hostnameVariants("a.b.c.d.com");
|
||||
expect(variants).toEqual([
|
||||
"a.b.c.d.com",
|
||||
"b.c.d.com",
|
||||
"c.d.com",
|
||||
"d.com",
|
||||
]);
|
||||
});
|
||||
|
||||
test("lowercases hostnames", () => {
|
||||
const variants = hostnameVariants("Evil.COM");
|
||||
expect(variants).toEqual(["evil.com"]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("delta computation via loadConfig", () => {
|
||||
test("loadConfig computes delta of new entries not in vendored list", () => {
|
||||
loadConfig({
|
||||
blacklist: [
|
||||
"brand-new-scam-site-xyz123.com",
|
||||
"hopprotocol.pro", // already in vendored
|
||||
],
|
||||
});
|
||||
// Only the new domain should be in the delta
|
||||
expect(
|
||||
_getDeltaBlacklist().has("brand-new-scam-site-xyz123.com"),
|
||||
).toBe(true);
|
||||
expect(_getDeltaBlacklist().has("hopprotocol.pro")).toBe(false);
|
||||
expect(getDeltaSize()).toBe(1);
|
||||
});
|
||||
|
||||
test("re-loading config replaces previous delta", () => {
|
||||
loadConfig({
|
||||
blacklist: ["first-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
|
||||
|
||||
loadConfig({
|
||||
blacklist: ["second-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
|
||||
expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("getBlocklistSize includes both vendored and delta", () => {
|
||||
const baseSize = getBlocklistSize();
|
||||
loadConfig({
|
||||
blacklist: ["delta-only-scam-xyz.com"],
|
||||
});
|
||||
expect(getBlocklistSize()).toBe(baseSize + 1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("isPhishingDomain with delta + vendored", () => {
|
||||
test("detects domain from delta blacklist", () => {
|
||||
loadConfig({
|
||||
blacklist: ["fresh-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("detects domain from vendored blacklist", () => {
|
||||
// No delta loaded — vendored still works
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
|
||||
test("returns false for clean domains", () => {
|
||||
expect(isPhishingDomain("etherscan.io")).toBe(false);
|
||||
expect(isPhishingDomain("example.com")).toBe(false);
|
||||
});
|
||||
|
||||
test("detects subdomain of blacklisted domain (vendored)", () => {
|
||||
expect(isPhishingDomain("app.hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
|
||||
test("detects subdomain of blacklisted domain (delta)", () => {
|
||||
loadConfig({
|
||||
blacklist: ["delta-phish-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("case-insensitive matching", () => {
|
||||
loadConfig({
|
||||
blacklist: ["Delta-Scam-XYZ.COM"],
|
||||
});
|
||||
expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
|
||||
expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
|
||||
});
|
||||
|
||||
test("returns false for empty/null hostname", () => {
|
||||
expect(isPhishingDomain("")).toBe(false);
|
||||
expect(isPhishingDomain(null)).toBe(false);
|
||||
});
|
||||
|
||||
test("handles config with no blacklist key", () => {
|
||||
loadConfig({});
|
||||
expect(getDeltaSize()).toBe(0);
|
||||
// Vendored list still works
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe("localStorage persistence", () => {
|
||||
test("saveDeltaToStorage persists delta under 256KiB", () => {
|
||||
loadConfig({
|
||||
blacklist: ["persisted-scam-xyz.com"],
|
||||
});
|
||||
const stored = localStorage.getItem("phishing-delta");
|
||||
expect(stored).not.toBeNull();
|
||||
const data = JSON.parse(stored);
|
||||
expect(data.blacklist).toContain("persisted-scam-xyz.com");
|
||||
});
|
||||
|
||||
test("delta is cleared on _reset", () => {
|
||||
loadConfig({
|
||||
blacklist: ["temp-scam-xyz.com"],
|
||||
});
|
||||
expect(getDeltaSize()).toBe(1);
|
||||
_reset();
|
||||
expect(getDeltaSize()).toBe(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe("real-world blocklist patterns", () => {
|
||||
test("detects known phishing domains from vendored list", () => {
|
||||
expect(isPhishingDomain("uniswap-trade.web.app")).toBe(true);
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
|
||||
});
|
||||
|
||||
test("does not flag legitimate domains", () => {
|
||||
expect(isPhishingDomain("opensea.io")).toBe(false);
|
||||
expect(isPhishingDomain("etherscan.io")).toBe(false);
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -1,111 +0,0 @@
|
||||
// Tests for the UTC Timestamps setting.
|
||||
//
|
||||
// The checkbox was moved out of the Token Spam Protection well and into the
|
||||
// Display well next to the theme selector. It is wired by id through the $()
|
||||
// helper, so the move cannot break the handler — but nothing in the suite said
|
||||
// so. These tests pin both halves down: the markup lives in Display and
|
||||
// nowhere else, and the value still round-trips through storage.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const POPUP_HTML = fs.readFileSync(
|
||||
path.join(__dirname, "..", "src", "popup", "index.html"),
|
||||
"utf8",
|
||||
);
|
||||
|
||||
// The body of one `<div class="bg-well ...">` well, selected by its heading.
|
||||
function wellWithHeading(html, heading) {
|
||||
const headingIndex = html.indexOf(
|
||||
'<h3 class="font-bold mb-1">' + heading + "</h3>",
|
||||
);
|
||||
expect(headingIndex).toBeGreaterThan(-1);
|
||||
const start = html.lastIndexOf('<div class="bg-well', headingIndex);
|
||||
const end = html.indexOf('<div class="bg-well', headingIndex);
|
||||
return html.slice(start, end === -1 ? html.length : end);
|
||||
}
|
||||
|
||||
describe("the UTC Timestamps checkbox placement", () => {
|
||||
test("the checkbox appears exactly once in the popup markup", () => {
|
||||
const matches = POPUP_HTML.match(/id="settings-utc-timestamps"/g);
|
||||
expect(matches).toHaveLength(1);
|
||||
});
|
||||
|
||||
test("it renders in the Display well, alongside the theme selector", () => {
|
||||
const display = wellWithHeading(POPUP_HTML, "Display");
|
||||
|
||||
expect(display).toContain('id="settings-utc-timestamps"');
|
||||
expect(display).toContain('id="settings-theme"');
|
||||
});
|
||||
|
||||
test("it does not render in the Token Spam Protection well", () => {
|
||||
const spam = wellWithHeading(POPUP_HTML, "Token Spam Protection");
|
||||
|
||||
expect(spam).not.toContain('id="settings-utc-timestamps"');
|
||||
// The filters that do belong there are untouched.
|
||||
expect(spam).toContain('id="settings-hide-low-holders"');
|
||||
expect(spam).toContain('id="settings-hide-fraud-contracts"');
|
||||
expect(spam).toContain('id="settings-hide-dust"');
|
||||
expect(spam).toContain('id="settings-dust-threshold"');
|
||||
});
|
||||
});
|
||||
|
||||
describe("the UTC Timestamps setting round-trips through storage", () => {
|
||||
let store;
|
||||
|
||||
function loadStateModule() {
|
||||
store = {};
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: async (key) =>
|
||||
key in store ? { [key]: store[key] } : {},
|
||||
set: async (obj) => Object.assign(store, obj),
|
||||
},
|
||||
},
|
||||
};
|
||||
jest.resetModules();
|
||||
return require("../src/shared/state");
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
test("defaults to off with nothing persisted", async () => {
|
||||
const { state, loadState } = loadStateModule();
|
||||
|
||||
await loadState();
|
||||
|
||||
expect(state.utcTimestamps).toBe(false);
|
||||
});
|
||||
|
||||
test("an enabled checkbox is persisted and read back", async () => {
|
||||
const first = loadStateModule();
|
||||
|
||||
// What the change handler in views/settings.js does.
|
||||
first.state.utcTimestamps = true;
|
||||
await first.saveState();
|
||||
expect(store.autistmask.utcTimestamps).toBe(true);
|
||||
|
||||
// A fresh popup load sees it.
|
||||
jest.resetModules();
|
||||
const second = require("../src/shared/state");
|
||||
expect(second.state.utcTimestamps).toBe(false);
|
||||
await second.loadState();
|
||||
expect(second.state.utcTimestamps).toBe(true);
|
||||
});
|
||||
|
||||
test("turning it back off is persisted too", async () => {
|
||||
const { state, saveState, loadState } = loadStateModule();
|
||||
|
||||
state.utcTimestamps = true;
|
||||
await saveState();
|
||||
state.utcTimestamps = false;
|
||||
await saveState();
|
||||
|
||||
state.utcTimestamps = true;
|
||||
await loadState();
|
||||
expect(state.utcTimestamps).toBe(false);
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,10 +1,9 @@
|
||||
const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
|
||||
const { AbiCoder, Interface, solidityPacked } = require("ethers");
|
||||
const uniswap = require("../src/shared/uniswap");
|
||||
|
||||
const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
|
||||
const USDT_ADDR = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
|
||||
const WETH_ADDR = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2";
|
||||
const USDC_ADDR = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
|
||||
const USER_ADDR = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
// AutistMask's first-ever swap, 2026-02-27.
|
||||
@@ -257,87 +256,6 @@ describe("uniswap decoder", () => {
|
||||
expect(amount.value).toBe("5.0000 USDT");
|
||||
});
|
||||
|
||||
// This test validates the decodeV4Swap() fix: a V4 ERC20→ERC20 swap
|
||||
// (USDT→USDC) where the token addresses are ONLY discoverable inside
|
||||
// the V4_SWAP sub-actions (SETTLE/TAKE). Before decodeV4Swap() was added,
|
||||
// command 0x10 was opaque and this would decode as "Uniswap Swap" with
|
||||
// no token info (or "ETH → ETH"). Now it correctly shows "USDT → USDC".
|
||||
test("decodes V4_SWAP ERC20→ERC20 tokens via SETTLE/TAKE (regression: #59)", () => {
|
||||
// Build a V4_SWAP input with SETTLE(USDT) + SWAP_EXACT_IN_SINGLE + TAKE(USDC)
|
||||
const V4_SETTLE = 0x0b;
|
||||
const V4_SWAP_EXACT_IN_SINGLE = 0x06;
|
||||
const V4_TAKE = 0x0e;
|
||||
|
||||
// actions: SETTLE, SWAP_EXACT_IN_SINGLE, TAKE
|
||||
const actions = new Uint8Array([
|
||||
V4_SETTLE,
|
||||
V4_SWAP_EXACT_IN_SINGLE,
|
||||
V4_TAKE,
|
||||
]);
|
||||
|
||||
// SETTLE params: (address currency, uint256 maxAmount, bool payerIsUser)
|
||||
const settleParam = coder.encode(
|
||||
["address", "uint256", "bool"],
|
||||
[USDT_ADDR, 5000000n, true],
|
||||
);
|
||||
|
||||
// SWAP_EXACT_IN_SINGLE params:
|
||||
// (tuple(address,address,uint24,int24,address) poolKey, bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
|
||||
const swapParam = coder.encode(
|
||||
[
|
||||
"tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
|
||||
],
|
||||
[
|
||||
[
|
||||
[
|
||||
USDT_ADDR,
|
||||
USDC_ADDR,
|
||||
100, // fee
|
||||
1, // tickSpacing
|
||||
"0x0000000000000000000000000000000000000000", // hooks
|
||||
],
|
||||
true, // zeroForOne
|
||||
5000000n, // amountIn (5 USDT)
|
||||
4900000n, // amountOutMin (4.9 USDC)
|
||||
"0x", // hookData
|
||||
],
|
||||
],
|
||||
);
|
||||
|
||||
// TAKE params: (address currency, address recipient, uint256 amount)
|
||||
const takeParam = coder.encode(
|
||||
["address", "address", "uint256"],
|
||||
[USDC_ADDR, USER_ADDR, 0n],
|
||||
);
|
||||
|
||||
// Encode the V4_SWAP input: (bytes actions, bytes[] params)
|
||||
const v4Input = coder.encode(
|
||||
["bytes", "bytes[]"],
|
||||
[actions, [settleParam, swapParam, takeParam]],
|
||||
);
|
||||
|
||||
// Build execute() with PERMIT2_PERMIT (0x0a) + V4_SWAP (0x10)
|
||||
// The permit provides the input token, but V4_SWAP must provide
|
||||
// the OUTPUT token — without decodeV4Swap, output would be unknown.
|
||||
const data = buildExecute(
|
||||
solidityPacked(["uint8", "uint8"], [0x0a, 0x10]),
|
||||
[encodePermit2(USDT_ADDR, 5000000n, ROUTER_ADDR), v4Input],
|
||||
9999999999n,
|
||||
);
|
||||
|
||||
const result = uniswap.decode(data, ROUTER_ADDR);
|
||||
expect(result).not.toBeNull();
|
||||
// Before decodeV4Swap fix: name would be "Swap USDT → ETH" or "Uniswap Swap"
|
||||
// After fix: correctly identifies both tokens from V4 sub-actions
|
||||
expect(result.name).toBe("Swap USDT \u2192 USDC");
|
||||
|
||||
const tokenIn = result.details.find((d) => d.label === "Token In");
|
||||
expect(tokenIn.value).toContain("USDT");
|
||||
|
||||
const steps = result.details.find((d) => d.label === "Steps");
|
||||
expect(steps.value).toContain("V4 Swap");
|
||||
});
|
||||
|
||||
test("handles unknown tokens gracefully", () => {
|
||||
const fakeToken = "0x1111111111111111111111111111111111111111";
|
||||
const data = buildExecute(
|
||||
|
||||
@@ -1,94 +0,0 @@
|
||||
// Tests for the DEBUG build flag as it gates mnemonic generation.
|
||||
//
|
||||
// The modules read the __BUILD_DEBUG__ global that esbuild replaces at bundle
|
||||
// time. Under jest the global is absent, which is exactly the release-build
|
||||
// case; the debug-build case is exercised by defining the global and
|
||||
// re-requiring the modules with a fresh registry.
|
||||
|
||||
const WORDS_IN_12_WORD_PHRASE = 12;
|
||||
|
||||
function loadWallet() {
|
||||
const constants = require("../src/shared/constants");
|
||||
const wallet = require("../src/shared/wallet");
|
||||
const log = require("../src/shared/log");
|
||||
return { constants, wallet, log };
|
||||
}
|
||||
|
||||
describe("generateMnemonic in a release build", () => {
|
||||
beforeEach(() => {
|
||||
jest.resetModules();
|
||||
delete globalThis.__BUILD_DEBUG__;
|
||||
});
|
||||
|
||||
test("DEBUG defaults to false when the build define is absent", () => {
|
||||
const { constants } = loadWallet();
|
||||
expect(constants.DEBUG).toBe(false);
|
||||
});
|
||||
|
||||
test("returns fresh, valid 12-word phrases that are not the test phrase", () => {
|
||||
const { constants, wallet } = loadWallet();
|
||||
|
||||
const first = wallet.generateMnemonic();
|
||||
const second = wallet.generateMnemonic();
|
||||
|
||||
expect(first).not.toBe(second);
|
||||
for (const phrase of [first, second]) {
|
||||
expect(wallet.isValidMnemonic(phrase)).toBe(true);
|
||||
expect(phrase.split(" ")).toHaveLength(WORDS_IN_12_WORD_PHRASE);
|
||||
expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
|
||||
}
|
||||
});
|
||||
|
||||
test("derives a usable HD wallet from the generated phrase", () => {
|
||||
const { wallet } = loadWallet();
|
||||
|
||||
const { xpub, firstAddress } = wallet.hdWalletFromMnemonic(
|
||||
wallet.generateMnemonic(),
|
||||
);
|
||||
|
||||
expect(xpub.startsWith("xpub")).toBe(true);
|
||||
expect(firstAddress).toMatch(/^0x[0-9a-fA-F]{40}$/);
|
||||
});
|
||||
|
||||
test("the runtime debug toggle cannot re-enable the test phrase", () => {
|
||||
const { constants, wallet, log } = loadWallet();
|
||||
|
||||
// What the settings easter-egg toggle does at runtime.
|
||||
log.setRuntimeDebug(true);
|
||||
expect(log.isDebug()).toBe(true);
|
||||
|
||||
const phrase = wallet.generateMnemonic();
|
||||
expect(phrase).not.toBe(constants.DEBUG_MNEMONIC);
|
||||
expect(wallet.isValidMnemonic(phrase)).toBe(true);
|
||||
expect(phrase).not.toBe(wallet.generateMnemonic());
|
||||
|
||||
log.setRuntimeDebug(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("generateMnemonic in a debug build", () => {
|
||||
beforeEach(() => {
|
||||
jest.resetModules();
|
||||
globalThis.__BUILD_DEBUG__ = true;
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
delete globalThis.__BUILD_DEBUG__;
|
||||
});
|
||||
|
||||
test("DEBUG is true and the test phrase is returned", () => {
|
||||
const { constants, wallet } = loadWallet();
|
||||
|
||||
expect(constants.DEBUG).toBe(true);
|
||||
expect(wallet.generateMnemonic()).toBe(constants.DEBUG_MNEMONIC);
|
||||
});
|
||||
|
||||
test("the test phrase is itself a valid 12-word BIP-39 phrase", () => {
|
||||
const { constants, wallet } = loadWallet();
|
||||
|
||||
expect(wallet.isValidMnemonic(constants.DEBUG_MNEMONIC)).toBe(true);
|
||||
expect(constants.DEBUG_MNEMONIC.split(" ")).toHaveLength(
|
||||
WORDS_IN_12_WORD_PHRASE,
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -1,129 +0,0 @@
|
||||
const {
|
||||
removeWalletFromState,
|
||||
broadcastActiveChanged,
|
||||
} = require("../src/shared/walletDelete");
|
||||
|
||||
// Fixed addresses — never used for anything but these tests.
|
||||
const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
|
||||
const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
|
||||
const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
|
||||
|
||||
function wallet(name, addresses) {
|
||||
return {
|
||||
name,
|
||||
addresses: addresses.map((address) => ({ address })),
|
||||
};
|
||||
}
|
||||
|
||||
// A three-wallet state; wallet A is an HD wallet with two addresses.
|
||||
function makeState(overrides = {}) {
|
||||
return {
|
||||
hasWallet: true,
|
||||
wallets: [wallet("A", [A0, A1]), wallet("B", [B0]), wallet("C", [C0])],
|
||||
selectedWallet: 0,
|
||||
selectedAddress: 0,
|
||||
activeAddress: A0,
|
||||
allowedSites: {
|
||||
[A0]: ["a.example"],
|
||||
[A1]: ["b.example"],
|
||||
[B0]: ["c.example"],
|
||||
},
|
||||
deniedSites: { [A1]: ["d.example"], [C0]: ["e.example"] },
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
describe("removeWalletFromState", () => {
|
||||
test("deleting the last wallet clears hasWallet", () => {
|
||||
const state = makeState({
|
||||
wallets: [wallet("A", [A0])],
|
||||
allowedSites: { [A0]: ["a.example"] },
|
||||
deniedSites: {},
|
||||
});
|
||||
|
||||
const { activeAddressChanged } = removeWalletFromState(state, 0);
|
||||
|
||||
expect(state.hasWallet).toBe(false);
|
||||
expect(state.wallets).toEqual([]);
|
||||
expect(state.selectedWallet).toBeNull();
|
||||
expect(state.selectedAddress).toBeNull();
|
||||
expect(state.activeAddress).toBeNull();
|
||||
expect(activeAddressChanged).toBe(true);
|
||||
});
|
||||
|
||||
test("deleting a non-selected wallet leaves the selection intact", () => {
|
||||
const state = makeState({
|
||||
selectedWallet: 2,
|
||||
selectedAddress: 0,
|
||||
activeAddress: C0,
|
||||
});
|
||||
|
||||
const { activeAddressChanged } = removeWalletFromState(state, 1);
|
||||
|
||||
// Wallet C moved from index 2 to index 1 by the splice.
|
||||
expect(state.wallets.map((w) => w.name)).toEqual(["A", "C"]);
|
||||
expect(state.selectedWallet).toBe(1);
|
||||
expect(state.selectedAddress).toBe(0);
|
||||
expect(state.activeAddress).toBe(C0);
|
||||
expect(activeAddressChanged).toBe(false);
|
||||
expect(state.hasWallet).toBe(true);
|
||||
});
|
||||
|
||||
test("deleting a wallet after the selection does not shift it", () => {
|
||||
const state = makeState({
|
||||
selectedWallet: 1,
|
||||
selectedAddress: 0,
|
||||
activeAddress: B0,
|
||||
});
|
||||
|
||||
const { activeAddressChanged } = removeWalletFromState(state, 2);
|
||||
|
||||
expect(state.selectedWallet).toBe(1);
|
||||
expect(state.activeAddress).toBe(B0);
|
||||
expect(activeAddressChanged).toBe(false);
|
||||
});
|
||||
|
||||
test("deleting the active wallet falls back to the first remaining address", () => {
|
||||
const state = makeState({
|
||||
selectedWallet: 0,
|
||||
selectedAddress: 1,
|
||||
activeAddress: A1,
|
||||
});
|
||||
|
||||
const { activeAddressChanged } = removeWalletFromState(state, 0);
|
||||
|
||||
expect(state.wallets.map((w) => w.name)).toEqual(["B", "C"]);
|
||||
expect(state.selectedWallet).toBe(0);
|
||||
expect(state.selectedAddress).toBe(0);
|
||||
expect(state.activeAddress).toBe(B0);
|
||||
expect(activeAddressChanged).toBe(true);
|
||||
expect(state.hasWallet).toBe(true);
|
||||
});
|
||||
|
||||
test("site permissions are dropped for every address of the wallet", () => {
|
||||
const state = makeState();
|
||||
|
||||
removeWalletFromState(state, 0);
|
||||
|
||||
expect(state.allowedSites).toEqual({ [B0]: ["c.example"] });
|
||||
expect(state.deniedSites).toEqual({ [C0]: ["e.example"] });
|
||||
});
|
||||
});
|
||||
|
||||
describe("broadcastActiveChanged", () => {
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
test("sends AUTISTMASK_ACTIVE_CHANGED to the background", () => {
|
||||
const sendMessage = jest.fn();
|
||||
global.chrome = { runtime: { sendMessage } };
|
||||
|
||||
broadcastActiveChanged();
|
||||
|
||||
expect(sendMessage).toHaveBeenCalledWith({
|
||||
type: "AUTISTMASK_ACTIVE_CHANGED",
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user