fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

The balance list gave a tracked token a zero row while "Show tracked
tokens with zero balance" was on, even when the spoof rule refuses the
token. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds
that row.

AddToken and SettingsAddToken now refuse such a token after the contract
lookup, with a flash message that says why. The bundled-list buttons on
SettingsAddToken need no check, because the rule never refuses a bundled
token.

The README and docs/README.md now say that the balance list drops such a
token whatever the settings.

Model: opus-5-5

README.md

@@ -1473,21 +1473,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. A token claiming a symbol from the bundled list from any other
-contract address is always dropped, whatever the settings, and so is any token
-claiming a symbol that belongs to the native asset and therefore has no
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
-tokens with fewer than 1,000 holders" setting governs the transaction history
-and the send-screen token selector, not this list. A token's holder count is
-unknown when the explorer reports none, or reports anything other than a whole
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
-or more, so such a token is shown only when it is on the bundled list or
-tracked. Every nonzero holding of a token shown is stored exactly, however
-small, but a holding below 0.000001 is left out of the balance lists, the
-send-screen token selector, the address total and the remove-address warning
-(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
+more holders. The balance list always drops a token that claims a bundled-list
+symbol from another contract address, whatever the settings. The list also drops
+every token that claims the native asset's symbol: `"ETH"`, or any network's
+`nativeCurrency`, such as `"SepoliaETH"`. That filter is unconditional — the
+"Hide tokens with fewer than 1,000 holders" setting governs the transaction
+history and the send-screen token selector, not this list. A token's holder
+count is unknown when the explorer reports none, or reports anything other than
+a whole number written in digits alone, such as `1,000` or `1e3`
+(`parseHoldersCount()` in `src/shared/holders.js`). This list does not take an
+unknown count as 1,000 or more, so such a token is shown only when it is on the
+bundled list or tracked. Every nonzero holding of a token shown is stored
+exactly, however small, but a holding below 0.000001 is left out of the balance
+lists, the send-screen token selector, the address total and the remove-address
+warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
 zero balance" is on.
@@ -2239,9 +2238,8 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
-    - "Add" with a token that the spoof rule refuses → nothing is tracked; "This
-      is a fake token impersonating a known symbol, so it was not added." flash
-      message, no screen change
+    - "Add" with a token that the spoof rule refuses → nothing is tracked; "Not
+      added: this token fakes a known symbol." flash message, no screen change
     - "Add", then the contract lookup answers while another screen shows, or
       after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2551,8 +2549,8 @@ view would leave a wallet one click from deletion.
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
     - "Add" by contract address with a token that the spoof rule refuses →
-      nothing is tracked; "This is a fake token impersonating a known symbol, so
-      it was not added." flash message, no screen change
+      nothing is tracked; "Not added: this token fakes a known symbol." flash
+      message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
       lookup answers → nothing is tracked; "The active network changed before
       the lookup finished, so the token was not added." flash message, no screen

src/popup/views/addToken.js

@@ -81,10 +81,7 @@ function init(ctx) {
             // The balance list never shows a token that the spoof rule
             // refuses, so such a token is not tracked.
             if (isSpoofedSymbol(info.symbol, contractAddr)) {
-                showFlash(
-                    "This is a fake token impersonating a known symbol," +
-                        " so it was not added.",
-                );
+                showFlash("Not added: this token fakes a known symbol.");
                 if (addTokenScreenOpenings !== opening) return;
                 infoEl.textContent = "";
                 infoEl.style.visibility = "hidden";

src/popup/views/settingsAddToken.js

@@ -161,10 +161,7 @@ function init(_ctx) {
             // a bundled token, so the "Top tokens:" buttons and the top 100
             // dropdown need no such check.
             if (isSpoofedSymbol(info.symbol, addr)) {
-                showFlash(
-                    "This is a fake token impersonating a known symbol," +
-                        " so it was not added.",
-                );
+                showFlash("Not added: this token fakes a known symbol.");
                 infoEl.textContent = "";
                 infoEl.style.visibility = "hidden";
                 return;

tests/spoofedTrackedToken.test.js

@@ -25,8 +25,7 @@ const TEST_TOKEN = {
     decimals: 18,
     name: "Test Token",
 };
-const REFUSED_FLASH =
-    "This is a fake token impersonating a known symbol, so it was not added.";
+const REFUSED_FLASH = "Not added: this token fakes a known symbol.";
 
 afterEach(() => {
     cleanupPopup();