fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

The balance list gave a tracked token a zero row while "Show tracked
tokens with zero balance" was on, even when the spoof rule refuses the
token. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds
that row.

AddToken and SettingsAddToken now refuse such a token after the contract
lookup, with a flash message that says why. The bundled-list buttons on
SettingsAddToken need no check, because the rule never refuses a bundled
token.

The README and docs/README.md now say that the balance list drops such a
token whatever the settings.

Model: opus-5-5

README.md

@@ -1473,21 +1473,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. A token claiming a symbol from the bundled list from any other
+more holders. The balance list always drops a token that claims a bundled-list
-contract address is always dropped, whatever the settings, and so is any token
+symbol from another contract address, whatever the settings. The list also drops
-claiming a symbol that belongs to the native asset and therefore has no
+every token that claims the native asset's symbol: `"ETH"`, or any network's
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
+`nativeCurrency`, such as `"SepoliaETH"`. That filter is unconditional — the
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+"Hide tokens with fewer than 1,000 holders" setting governs the transaction
-tokens with fewer than 1,000 holders" setting governs the transaction history
+history and the send-screen token selector, not this list. A token's holder
-and the send-screen token selector, not this list. A token's holder count is
+count is unknown when the explorer reports none, or reports anything other than
-unknown when the explorer reports none, or reports anything other than a whole
+a whole number written in digits alone, such as `1,000` or `1e3`
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+(`parseHoldersCount()` in `src/shared/holders.js`). This list does not take an
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+unknown count as 1,000 or more, so such a token is shown only when it is on the
-or more, so such a token is shown only when it is on the bundled list or
+bundled list or tracked. Every nonzero holding of a token shown is stored
-tracked. Every nonzero holding of a token shown is stored exactly, however
+exactly, however small, but a holding below 0.000001 is left out of the balance
-small, but a holding below 0.000001 is left out of the balance lists, the
+lists, the send-screen token selector, the address total and the remove-address
-send-screen token selector, the address total and the remove-address warning
+warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
-(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
 zero balance" is on.
@@ -2239,9 +2238,8 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
-    - "Add" with a token that the spoof rule refuses → nothing is tracked; "This
+    - "Add" with a token that the spoof rule refuses → nothing is tracked; "Not
-      is a fake token impersonating a known symbol, so it was not added." flash
+      added: this token fakes a known symbol." flash message, no screen change
-      message, no screen change
     - "Add", then the contract lookup answers while another screen shows, or
       after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2551,8 +2549,8 @@ view would leave a wallet one click from deletion.
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
     - "Add" by contract address with a token that the spoof rule refuses →
-      nothing is tracked; "This is a fake token impersonating a known symbol, so
+      nothing is tracked; "Not added: this token fakes a known symbol." flash
-      it was not added." flash message, no screen change
+      message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
       lookup answers → nothing is tracked; "The active network changed before
       the lookup finished, so the token was not added." flash message, no screen

src/popup/views/addToken.js

@@ -81,10 +81,7 @@ function init(ctx) {
             // The balance list never shows a token that the spoof rule
             // refuses, so such a token is not tracked.
             if (isSpoofedSymbol(info.symbol, contractAddr)) {
-                showFlash(
+                showFlash("Not added: this token fakes a known symbol.");
-                    "This is a fake token impersonating a known symbol," +
-                        " so it was not added.",
-                );
                 if (addTokenScreenOpenings !== opening) return;
                 infoEl.textContent = "";
                 infoEl.style.visibility = "hidden";

src/popup/views/settingsAddToken.js

@@ -161,10 +161,7 @@ function init(_ctx) {
             // a bundled token, so the "Top tokens:" buttons and the top 100
             // dropdown need no such check.
             if (isSpoofedSymbol(info.symbol, addr)) {
-                showFlash(
+                showFlash("Not added: this token fakes a known symbol.");
-                    "This is a fake token impersonating a known symbol," +
-                        " so it was not added.",
-                );
                 infoEl.textContent = "";
                 infoEl.style.visibility = "hidden";
                 return;

tests/spoofedTrackedToken.test.js

@@ -25,8 +25,7 @@ const TEST_TOKEN = {
     decimals: 18,
     name: "Test Token",
 };
-const REFUSED_FLASH =
+const REFUSED_FLASH = "Not added: this token fakes a known symbol.";
-    "This is a fake token impersonating a known symbol, so it was not added.";
 
 afterEach(() => {
     cleanupPopup();