feat: show red warning when sending to address with zero tx history

On the confirm-tx screen, asynchronously check the recipient address
via Blockscout API. If the address has never sent or received any
transactions (normal or ERC-20), display a prominent red warning.

Fails open: network errors silently skip the warning to avoid
blocking legitimate sends.

Closes #82

src/popup/styles/main.css

@@ -19,16 +19,3 @@ body {
     width: 396px;
     overflow-x: hidden;
 }
-
-/* Copy-flash feedback: inverts colors then fades back */
-.copy-flash-active {
-    background-color: var(--color-fg) !important;
-    color: var(--color-bg) !important;
-    transition: none;
-}
-
-.copy-flash-fade {
-    transition:
-        background-color 300ms ease-out,
-        color 300ms ease-out;
-}

src/popup/views/addressDetail.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     addressDotHtml,
     addressTitle,
@@ -242,7 +241,6 @@ function init(_ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("address-full"));
         }
     });
 
@@ -360,7 +358,6 @@ function init(_ctx) {
         if (key) {
             navigator.clipboard.writeText(key);
             showFlash("Copied!");
-            flashCopyFeedback($("export-privkey-value"));
         }
     });
 
@@ -369,7 +366,6 @@ function init(_ctx) {
         if (full) {
             navigator.clipboard.writeText(full);
             showFlash("Copied!");
-            flashCopyFeedback($("export-privkey-address"));
         }
     });
 

src/popup/views/addressToken.js

@@ -5,7 +5,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -318,7 +317,6 @@ function init(_ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("address-token-full"));
         }
     });
 
@@ -327,7 +325,6 @@ function init(_ctx) {
         if (copyEl) {
             navigator.clipboard.writeText(copyEl.dataset.copy);
             showFlash("Copied!");
-            flashCopyFeedback(copyEl);
         }
     });
 
@@ -376,7 +373,6 @@ function init(_ctx) {
             copyEl.addEventListener("click", () => {
                 navigator.clipboard.writeText(copyEl.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(copyEl);
             });
         }
         updateSendBalance();

src/popup/views/confirmTx.js

@@ -15,7 +15,6 @@ const {
     hideError,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressTitle,
     addressDotHtml,
     escapeHtml,
@@ -26,6 +25,7 @@ const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { hasZeroTransactionHistory } = require("../../shared/transactions");
 const { ERC20_ABI } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
@@ -118,7 +118,6 @@ function show(txInfo) {
             copyEl.onclick = () => {
                 navigator.clipboard.writeText(copyEl.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(copyEl);
             };
         }
     } else {
@@ -246,6 +245,7 @@ function show(txInfo) {
     showView("confirm-tx");
 
     estimateGas(txInfo);
+    checkRecipientHistory(txInfo);
 }
 
 async function estimateGas(txInfo) {
@@ -288,6 +288,23 @@ async function estimateGas(txInfo) {
     }
 }
 
+async function checkRecipientHistory(txInfo) {
+    const isNew = await hasZeroTransactionHistory(
+        txInfo.to,
+        state.blockscoutUrl,
+    );
+    if (!isNew) return;
+
+    const warningsEl = $("confirm-warnings");
+    const warningHtml =
+        `<div class="border border-red-500 border-dashed p-2 mb-1 text-xs font-bold text-red-500">` +
+        `WARNING: This address has ZERO transaction history. ` +
+        `It has never sent or received any funds. ` +
+        `Double-check the address before sending.</div>`;
+    warningsEl.innerHTML = warningHtml + warningsEl.innerHTML;
+    warningsEl.classList.remove("hidden");
+}
+
 function init(ctx) {
     $("btn-confirm-send").addEventListener("click", async () => {
         const password = $("confirm-tx-password").value;

src/popup/views/helpers.js

@@ -259,26 +259,12 @@ function timeAgo(timestamp) {
     return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 
-function flashCopyFeedback(el) {
-    if (!el) return;
-    el.classList.remove("copy-flash-fade");
-    el.classList.add("copy-flash-active");
-    setTimeout(() => {
-        el.classList.remove("copy-flash-active");
-        el.classList.add("copy-flash-fade");
-        setTimeout(() => {
-            el.classList.remove("copy-flash-fade");
-        }, 350);
-    }, 100);
-}
-
 module.exports = {
     $,
     showError,
     hideError,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
     addressColor,

src/popup/views/home.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     isoDate,
     timeAgo,
@@ -86,10 +85,9 @@ function renderActiveAddress() {
         el.innerHTML =
             `<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
             `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-        $("active-addr-copy").addEventListener("click", (e) => {
+        $("active-addr-copy").addEventListener("click", () => {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback(e.currentTarget);
         });
     } else {
         el.textContent = "";

src/popup/views/receive.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
 } = require("./helpers");
@@ -61,12 +60,11 @@ function show() {
 }
 
 function init(ctx) {
-    $("receive-address-block").addEventListener("click", (e) => {
+    $("receive-address-block").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback(e.currentTarget);
         }
     });
 
@@ -75,7 +73,6 @@ function init(ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("receive-address-block"));
         }
     });
 

src/popup/views/transactionDetail.js

@@ -5,7 +5,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -159,9 +158,8 @@ function render() {
         loadCalldata(tx.hash, tx.to);
     }
 
-    const isoStr = isoDate(tx.timestamp);
-    $("tx-detail-time").innerHTML =
-        copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
+    $("tx-detail-time").textContent =
+        isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
     $("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
     showView("transaction");
 
@@ -172,7 +170,6 @@ function render() {
             el.onclick = () => {
                 navigator.clipboard.writeText(el.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(el);
             };
         });
 }
@@ -250,7 +247,6 @@ async function loadCalldata(txHash, toAddress) {
                 el.onclick = () => {
                     navigator.clipboard.writeText(el.dataset.copy);
                     showFlash("Copied!");
-                    flashCopyFeedback(el);
                 };
             });
         }

src/popup/views/txStatus.js

@@ -4,7 +4,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -60,16 +59,6 @@ function txHashHtml(hash) {
     );
 }
 
-function blockNumberHtml(blockNumber) {
-    const num = String(blockNumber);
-    const link = `https://etherscan.io/block/${num}`;
-    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    return (
-        `<span class="underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(num)}">${escapeHtml(num)}</span>` +
-        extLink
-    );
-}
-
 function attachCopyHandlers(viewId) {
     document
         .getElementById(viewId)
@@ -78,7 +67,6 @@ function attachCopyHandlers(viewId) {
             el.onclick = () => {
                 navigator.clipboard.writeText(el.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(el);
             };
         });
 }
@@ -201,7 +189,7 @@ function renderSuccess() {
         $("success-tx-to").innerHTML = toAddressHtml(d.to);
     }
 
-    $("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
+    $("success-tx-block").textContent = String(d.blockNumber);
     $("success-tx-hash").innerHTML = txHashHtml(d.hash);
 
     // Show decoded calldata details if present

src/shared/transactions.js

@@ -251,4 +251,40 @@ function filterTransactions(txs, filters = {}) {
     return { transactions: filtered, newFraudContracts: newFraud };
 }
 
-module.exports = { fetchRecentTransactions, filterTransactions };
+/**
+ * Check whether an address has any on-chain transaction history.
+ * Returns true if the address has zero normal transactions AND zero
+ * token transfers on the configured Blockscout instance.
+ * Returns false on network errors (fail-open: don't block sends).
+ */
+async function hasZeroTransactionHistory(address, blockscoutUrl) {
+    try {
+        const resp = await debugFetch(
+            blockscoutUrl + "/addresses/" + address + "/transactions?limit=1",
+        );
+        if (!resp.ok) return false;
+        const json = await resp.json();
+        if ((json.items || []).length > 0) return false;
+
+        // Also check token transfers — an address may have only received
+        // ERC-20 tokens without any native ETH transactions.
+        const ttResp = await debugFetch(
+            blockscoutUrl +
+                "/addresses/" +
+                address +
+                "/token-transfers?type=ERC-20&limit=1",
+        );
+        if (!ttResp.ok) return false;
+        const ttJson = await ttResp.json();
+        return (ttJson.items || []).length === 0;
+    } catch (e) {
+        log.errorf("hasZeroTransactionHistory check failed:", e.message);
+        return false;
+    }
+}
+
+module.exports = {
+    fetchRecentTransactions,
+    filterTransactions,
+    hasZeroTransactionHistory,
+};