fix: wipe the exported private key from the DOM on leaving the screen (closes #221)

The export screen registered no view-leave cleanup, so leaving it by any
route other than its own Back button — the settings gear, for instance —
left the decrypted private key in #export-privkey-value inside the hidden
view for the rest of the popup's life. The reveal path had the same
post-await hole the recovery phrase screen had: the write landed after
the wipe, with nothing scheduled to wipe it again.

The screen moves out of addressDetail.js into its own module shaped like
showPhrase.js: onViewLeave() cleanup that wipes the value node, the
password input and the closure state, and a revealGeneration liveness
guard captured before the decrypt. The guard sits in front of the key
derivation, so a decrypt that resolves after the screen was left does not
even derive the key.

The audit for the same bug class covered every other screen holding
secret material in the DOM. AddWallet (a generated or pasted recovery
phrase, an imported private key or extended private key, and the
password) and the password inputs on ConfirmTx, DeleteWallet, ApproveTx
and ApproveSign were all cleared on entry only, so each survived in its
hidden view after the screen navigated on. All five now register the same
cleanup. None of them writes a secret after an await, so none needs a
generation guard.

The load-bearing test leaves the screen mid-decrypt and asserts the key
never lands in the DOM, and that it still does not land once the user has
returned to the screen — which the generation counter catches and a
current-view check alone would not.

README.md

@@ -123,16 +123,17 @@ unavailable). The suite lives in `tests/e2e/` and is driven by
 `playwright-core`, whose version must stay matched to the container's Playwright
 version — the browsers ship inside the image.
 
-It covers popup load, wallet creation through the UI, the Add Token screen, the
-transaction detail screen for an ERC-20 transfer, and the recovery phrase screen
-— which wallet types are offered it, that it holds nothing before the password
-is accepted, that a wrong password reveals nothing, that leaving it by either
-route wipes it — including a leave taken while the decrypt is still running —
-and that reopening the popup does not land on it. All outbound network is
-intercepted at the browser level and served from fixtures in
-`tests/e2e/network.js`, so the run is deterministic and fully offline;
-unrecognised outbound requests are reported as failures rather than silently
-allowed.
+It covers popup load, WebAssembly compilation under the shipped CSP (see
+[Content Security Policy](#content-security-policy)), wallet creation through
+the UI, the Add Token screen, the transaction detail screen for an ERC-20
+transfer, and the recovery phrase screen — which wallet types are offered it,
+that it holds nothing before the password is accepted, that a wrong password
+reveals nothing, that leaving it by either route wipes it — including a leave
+taken while the decrypt is still running — and that reopening the popup does not
+land on it. All outbound network is intercepted at the browser level and served
+from fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
+offline; unrecognised outbound requests are reported as failures rather than
+silently allowed.
 
 That reporting has one bound worth knowing. Observation ends when the browser
 context is torn down, and nothing can watch traffic after that, so the run keeps
@@ -435,7 +436,11 @@ The core hierarchy is **Wallets → Addresses**:
       multi-address behavior as an HD wallet, including the "+" button and the
       address scan on import, but imported from an extended private key rather
       than a recovery phrase. It therefore has no recovery phrase to display or
-      back up.
+      back up. Only a master key may be imported; an xprv wallet already in
+      storage that was imported from a non-master key is detected from the depth
+      of its stored `xpub` by `src/shared/walletDefects.js`, explained in the
+      wallet list, and blocked from signing, sending and private-key export. It
+      is never deleted or rewritten.
 - An **address** holds ETH and ERC-20 tokens.
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
@@ -1081,6 +1086,36 @@ battle-tested.
 Exceptions require explicit authorization in a code comment referencing this
 policy, but as of now there are none.
 
+### Content Security Policy
+
+Both manifests declare the same policy for extension pages —
+`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
+`content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
+a bare string in `manifest/firefox.json` (MV2).
+
+`'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
+build and a `wasm2js` translation of it in one file, tries WASM first, and
+silently falls back to the translation if instantiation throws. Under a plain
+`script-src 'self'` the fallback was taken on every popup load, announced by
+nothing but an uncaught `CompileError`. Measured on the same Argon2id parameters
+the vault uses (`OPSLIMIT_INTERACTIVE`, `MEMLIMIT_INTERACTIVE`), WASM derives a
+key in 141-198ms and `wasm2js` in 3204-3660ms. The work factor is identical — it
+is set by the ops and memory parameters, not by wall time — so the fallback
+bought nothing and cost about three and a half seconds on every operation that
+asks for the password, which is every signature.
+
+The keyword permits compiling WebAssembly and nothing else: not `eval()` of
+strings, not inline script, not remote script. Using it requires already
+executing script in an extension page, which is complete compromise on its own.
+`'unsafe-eval'` is a different proposition and is not granted.
+
+The grant is pinned in both directions. `tests/manifest.test.js` asserts the
+exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
+20x regression on the key derivation) and adding anything beyond it both fail
+`make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
+backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
+under the real manifest.
+
 ### DEBUG Mode Policy
 
 The `DEBUG` constant in the popup JS enables a red "DEBUG / INSECURE" banner and

TODO.md

@@ -50,6 +50,15 @@ undefined identifiers, which is how
   cleanup was extended to every other screen holding secret material in the DOM
   (AddWallet, ConfirmTx, DeleteWallet, ApproveTx, ApproveSign)
   ([#221](https://git.eeqj.de/sneak/AutistMask/issues/221)).
+- 2026-08-12: An xprv wallet already in storage that was imported from a
+  non-master key is detected from the depth of its stored `xpub`, explained in
+  the wallet list, and blocked from signing, sending and private-key export
+  instead of throwing on the send screen
+  ([#234](https://git.eeqj.de/sneak/AutistMask/issues/234)).
+- 2026-08-12: An unreported `holders_count` is now parsed as `null` rather than
+  `0`, so the low-holder rule declines to judge an unknown count instead of
+  hiding a legitimate token as spam, in both the transaction history and the
+  Send token selector ([#230](https://git.eeqj.de/sneak/AutistMask/issues/230)).
 - 2026-08-12: Bundled token list documentation no longer states a count. The
   four "top 250" claims in `README.md` and the "roughly 500" claim in
   `docs/README.md` are replaced with a description of how the list is actually
@@ -57,6 +66,11 @@ undefined identifiers, which is how
   Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
   the authoritative set
   ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
+- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
+  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
+  fallback at 20x the Argon2id cost, pinned in both directions by
+  `tests/manifest.test.js` and observed in the real popup by the e2e suite
+  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
 - 2026-08-11: Known-symbol spoof verification became a Settings toggle
   (`hideSpoofedSymbols`), on by default, governing the transaction-history
   filter and the fraud-contract learning it feeds

manifest/chrome.json

@@ -5,6 +5,9 @@
     "description": "Minimal Ethereum wallet for Chrome",
     "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
+    "content_security_policy": {
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
+    },
     "action": {
         "default_popup": "src/popup/index.html"
     },

manifest/firefox.json

@@ -4,6 +4,7 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

src/popup/views/addressDetail.js

@@ -27,6 +27,16 @@ const {
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const exportPrivkey = require("./exportPrivkey");
+const { walletDefect } = require("../../shared/walletDefects");
+
+// The defect of the wallet the selected address belongs to, or null. Both the
+// send and the private-key export path check it before asking for a password,
+// so a wallet that cannot derive its keys says so instead of failing after the
+// user has typed one in.
+function selectedWalletDefect() {
+    if (state.selectedWallet === null) return null;
+    return walletDefect(state.wallets[state.selectedWallet]);
+}
 
 let ctx;
 
@@ -252,6 +262,11 @@ function init(_ctx) {
     });
 
     $("btn-send").addEventListener("click", () => {
+        const defect = selectedWalletDefect();
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress
@@ -296,6 +311,14 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
+        // There is no private key to export for an address this wallet
+        // cannot derive. Without this the export screen would take a
+        // password and then report it as wrong.
+        const defect = selectedWalletDefect();
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         // No pushCurrentView() here: exportPrivkey.show() can return
         // without navigating, so it does its own push.
         exportPrivkey.show(state.selectedWallet, state.selectedAddress);

src/popup/views/addressToken.js

@@ -35,6 +35,7 @@ const {
 } = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
+const { walletDefect } = require("../../shared/walletDefects");
 
 let ctx;
 
@@ -338,6 +339,11 @@ function init(_ctx) {
     });
 
     $("btn-address-token-send").addEventListener("click", () => {
+        const defect = walletDefect(state.wallets[state.selectedWallet]);
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr =
             state.wallets[state.selectedWallet].addresses[
                 state.selectedAddress

src/popup/views/approval.js

@@ -22,6 +22,7 @@ const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
+const { walletDefect } = require("../../shared/walletDefects");
 const { getProvider } = require("../../shared/balances");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
@@ -281,6 +282,7 @@ function showTxApproval(details) {
 
     showView("approve-tx");
     attachCopyHandlers("view-approve-tx");
+    gateOnWalletDefect("approve-tx-error", "btn-approve-tx");
 }
 
 function decodeHexMessage(hex) {
@@ -380,6 +382,7 @@ function showSignApproval(details) {
 
     showView("approve-sign");
     attachCopyHandlers("view-approve-sign");
+    gateOnWalletDefect("approve-sign-error", "btn-approve-sign");
 }
 
 function show(id) {
@@ -432,6 +435,20 @@ function setSignButtonBusy(busy) {
     $("btn-approve-sign").classList.toggle("text-muted", busy);
 }
 
+// Say so on the approval screen itself, and disable the approve button, when
+// the active address belongs to a wallet whose keys cannot be derived. Without
+// this the screen would take a password and fail after deriving it. Reject
+// stays available; the wallet is not touched. Returns true when it gated.
+function gateOnWalletDefect(errorId, buttonId) {
+    const active = findActiveWallet();
+    const defect = active ? walletDefect(active.wallet) : null;
+    if (!defect) return false;
+    showError(errorId, defect.shortMessage);
+    $(buttonId).disabled = true;
+    $(buttonId).classList.add("text-muted");
+    return true;
+}
+
 // Locate the wallet and the address index owning the currently active
 // address. Returns null when no wallet holds it.
 function findActiveWallet() {
@@ -510,6 +527,14 @@ function init(ctx) {
             return;
         }
 
+        const defect = walletDefect(active.wallet);
+        if (defect) {
+            password = null;
+            showError("approve-tx-error", defect.shortMessage);
+            setTxButtonBusy(false);
+            return;
+        }
+
         // Decrypt here, in the popup. The password must never cross the
         // extension messaging boundary; only the signed transaction does.
         let decryptedSecret;
@@ -601,6 +626,14 @@ function init(ctx) {
             return;
         }
 
+        const defect = walletDefect(active.wallet);
+        if (defect) {
+            password = null;
+            showError("approve-sign-error", defect.shortMessage);
+            setSignButtonBusy(false);
+            return;
+        }
+
         // Decrypt here, in the popup. The password must never cross the
         // extension messaging boundary; only the signature does.
         let decryptedSecret;

src/popup/views/home.js

@@ -21,6 +21,10 @@ const {
     resetSendValidation,
 } = require("./send");
 const { deriveAddressFromXpub } = require("../../shared/wallet");
+const {
+    walletDefect,
+    walletDefectHtml,
+} = require("../../shared/walletDefects");
 const {
     formatUsd,
     getPrice,
@@ -214,25 +218,23 @@ async function loadHomeTxs(ctx) {
     }
 }
 
-function render(ctx) {
-    const container = $("wallet-list");
-    if (state.wallets.length === 0) {
-        container.innerHTML =
-            '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
-        renderTotalValue();
-        renderActiveAddress();
-        return;
-    }
-
+// The wallet list markup. Pure: it reads state and returns a string, so the
+// list can be asserted on without a DOM.
+function walletListHtml() {
     let html = "";
     state.wallets.forEach((wallet, wi) => {
+        const defect = walletDefect(wallet);
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
         html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
-        if (wallet.type === "hd" || wallet.type === "xprv") {
+        // No "+" on a defective wallet: deriving another address from that
+        // xpub would only add one more address the key does not produce
+        // under the standard path.
+        if (!defect && (wallet.type === "hd" || wallet.type === "xprv")) {
             html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
         }
         html += `</div>`;
+        html += walletDefectHtml(wallet);
 
         wallet.addresses.forEach((addr, ai) => {
             html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
@@ -260,7 +262,20 @@ function render(ctx) {
 
         html += `</div>`;
     });
-    container.innerHTML = html;
+    return html;
+}
+
+function render(ctx) {
+    const container = $("wallet-list");
+    if (state.wallets.length === 0) {
+        container.innerHTML =
+            '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
+        renderTotalValue();
+        renderActiveAddress();
+        return;
+    }
+
+    container.innerHTML = walletListHtml();
 
     container.querySelectorAll(".address-row").forEach((row) => {
         row.addEventListener("click", async () => {
@@ -348,6 +363,13 @@ function render(ctx) {
     loadHomeTxs(ctx);
 }
 
+// The defect of the wallet the selected address belongs to, or null. Call
+// after selectActiveAddress().
+function selectedWalletDefect() {
+    if (state.selectedWallet === null) return null;
+    return walletDefect(state.wallets[state.selectedWallet]);
+}
+
 function selectActiveAddress() {
     for (let wi = 0; wi < state.wallets.length; wi++) {
         for (let ai = 0; ai < state.wallets[wi].addresses.length; ai++) {
@@ -371,6 +393,13 @@ function init(ctx) {
             showFlash("No active address selected.");
             return;
         }
+        // Before the balance check and before any password is asked for: this
+        // wallet cannot sign at all, so the send screen is a dead end.
+        const defect = selectedWalletDefect();
+        if (defect) {
+            showFlash(defect.shortMessage);
+            return;
+        }
         const addr = currentAddress();
         if (!addr.balance || parseFloat(addr.balance) === 0) {
             showFlash("Cannot send \u2014 zero balance.");
@@ -396,4 +425,4 @@ function init(ctx) {
     });
 }
 
-module.exports = { init, render };
+module.exports = { init, render, walletListHtml };

src/popup/views/send.js

@@ -13,6 +13,7 @@ const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
 const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
+const { isLowHolderCount } = require("../../shared/holders");
 const { getAddress } = require("ethers");
 
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
@@ -132,7 +133,10 @@ function renderSendTokenSelect(addr) {
     for (const t of addr.tokenBalances || []) {
         if (isSpoofedToken(t)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
-        if (state.hideLowHolderTokens && (t.holders || 0) < 1000) continue;
+        // An unknown holder count does not withhold a token the user holds:
+        // only a count the explorer actually reported as below the threshold
+        // does.  Otherwise a missing field makes a real asset unspendable.
+        if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
         const opt = document.createElement("option");
         opt.value = t.address;
         opt.textContent = t.symbol;

src/shared/balances.js

@@ -12,6 +12,7 @@ const { ERC20_ABI } = require("./constants");
 const { log, debugFetch } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
 const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -70,10 +71,20 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
             if (bal === "0.0") continue;
 
             const tokenAddr = (item.token.address_hash || "").toLowerCase();
-            const holders = parseInt(item.token.holders_count || "0", 10);
+            // null means the explorer reported no count, which is not the
+            // same as a count of zero.  This gate is not the low-holder
+            // display filter: it has no user-facing off switch and governs
+            // the whole balance list, so it stays strict and admits a token
+            // only on a reported count — an unreported one is no evidence.
+            // A legitimate token still reaches the list through the known
+            // token list or by the user tracking it, and the null is carried
+            // through to the views, where the two low-holder filters treat
+            // an unknown count as "do not judge" rather than as zero.
+            const holders = parseHoldersCount(item.token.holders_count);
             const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
-            const hasEnoughHolders = holders >= 1000;
+            const hasEnoughHolders =
+                holders !== null && holders >= LOW_HOLDER_THRESHOLD;
 
             // Skip spam tokens the user never asked to see
             if (!isKnown && !isTracked && !hasEnoughHolders) continue;
@@ -278,6 +289,7 @@ async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
 }
 
 module.exports = {
+    fetchTokenBalances,
     refreshBalances,
     lookupTokenInfo,
     getProvider,

src/shared/holders.js

@@ -0,0 +1,32 @@
+// Holder counts, and the one rule that decides whether a count is "low".
+//
+// The block explorer's holders_count is optional: it is absent on a token it
+// has only just indexed, and it goes missing on a degraded or changed API.
+// Absent means the count is unknown.  It does not mean the token has no
+// holders, and collapsing the two hides a token the user really holds as if
+// it were spam.  Every call site reads the count through here so the
+// distinction cannot be lost again in one place while holding in the others.
+
+const LOW_HOLDER_THRESHOLD = 1000;
+
+// Parse an explorer-supplied holders_count into a number, or null when the
+// explorer did not report one.  Anything unparseable is unknown too: a count
+// we cannot read is not a count of zero.
+function parseHoldersCount(raw) {
+    if (raw === null || raw === undefined || raw === "") return null;
+    const n = parseInt(raw, 10);
+    return Number.isFinite(n) ? n : null;
+}
+
+// True only for a token the explorer reported as having fewer holders than
+// the threshold.  An unknown count is never low: showing a spam token the
+// user can see is unusual costs less than hiding an asset they own.
+function isLowHolderCount(holders) {
+    return holders != null && holders < LOW_HOLDER_THRESHOLD;
+}
+
+module.exports = {
+    LOW_HOLDER_THRESHOLD,
+    parseHoldersCount,
+    isLowHolderCount,
+};

src/shared/transactions.js

@@ -9,6 +9,7 @@
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
 const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
+const { parseHoldersCount, isLowHolderCount } = require("./holders");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -116,7 +117,10 @@ function parseTokenTransfer(tt, addrLower) {
         contractAddress: normalizeAddress(
             tt.token?.address_hash || tt.token?.address || "",
         ),
-        holders: parseInt(tt.token?.holders_count || "0", 10),
+        // null when the explorer reported no count: unknown, not zero.  The
+        // low-holder filter declines to judge a null, so a legitimate token
+        // is not hidden because a field went missing upstream.
+        holders: parseHoldersCount(tt.token?.holders_count),
     };
 }
 
@@ -292,12 +296,13 @@ function filterTransactions(txs, filters = {}) {
             continue;
         }
 
-        // Filter low-holder tokens (<1000) if setting is on
+        // Filter low-holder tokens (<1000) if setting is on.  A token whose
+        // holder count the explorer did not report is kept: only a reported
+        // count below the threshold is "low".
         if (
             filters.hideLowHolderTokens &&
             tx.contractAddress &&
-            tx.holders !== null &&
-            tx.holders < 1000
+            isLowHolderCount(tx.holders)
         ) {
             continue;
         }

src/shared/vault.js

@@ -1,14 +1,80 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
+//
+// Backend: WebAssembly, deliberately (#182).
+//
+// libsodium ships one file containing both a WebAssembly build and a
+// wasm2js ("asm.js") translation of it. It tries WASM first and, if
+// instantiation throws, silently swaps in the translation. An extension
+// CSP of plain script-src 'self' refuses WASM, so every popup load used
+// to take that fallback — announced by nothing but an uncaught
+// CompileError in the console.
+//
+// Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
+// MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
+// WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
+// identical either way — it is set by the ops/mem parameters, not by wall
+// time — so the fallback bought no security, it only made every password
+// operation take three and a half seconds, and the wallet asks for the
+// password on every signature.
+//
+// So both manifests declare 'wasm-unsafe-eval' for extension pages. That
+// keyword permits compiling WebAssembly and nothing else: not eval() of
+// strings, not inline script, not remote script. Reaching it requires
+// already executing script in the extension page, which is total
+// compromise on its own. 'unsafe-eval' would be a different matter and is
+// not granted. tests/manifest.test.js pins both policies to exactly
+// "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
+// strictness can drift unnoticed.
+//
+// The fallback still exists, and a wallet that refuses to decrypt is
+// worse than a slow one, so it is not disabled — it is made loud:
+// cryptoBackend() reports which backend this realm can run, ensureReady()
+// logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
+// unit tests exercise the WASM backend, and the end-to-end suite asserts
+// it in the real popup under the real manifest.
 
 const sodium = require("libsodium-wrappers-sumo");
+const { log } = require("./log");
+
+// An empty WebAssembly module: the 8-byte magic number and version header,
+// no sections. Compiling it asks the cheapest possible form of the only
+// question that matters here — may this realm compile WebAssembly at all —
+// which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
+// exactly what decides which backend libsodium ends up on.
+const EMPTY_WASM_MODULE = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+]);
+
+// "wasm" or "asmjs": whether this realm may compile WebAssembly, which is
+// what decides libsodium's backend when the CSP is the reason it cannot —
+// the case this codebase guards. It probes the realm, not libsodium, so a
+// fallback taken for some other reason (allocation failure, corrupt module)
+// would not be caught here; tests/vaultBackend.test.js checks libsodium's
+// own marker directly.
+async function cryptoBackend() {
+    try {
+        await WebAssembly.compile(EMPTY_WASM_MODULE);
+        return "wasm";
+    } catch (_) {
+        return "asmjs";
+    }
+}
 
 let ready = false;
 
 async function ensureReady() {
     if (!ready) {
         await sodium.ready;
+        if ((await cryptoBackend()) !== "wasm") {
+            log.errorf(
+                "libsodium is running on the wasm2js fallback: this realm " +
+                    "refuses to compile WebAssembly, so every password " +
+                    "derivation costs roughly 20x what it should. See the " +
+                    "backend note in src/shared/vault.js.",
+            );
+        }
         ready = true;
     }
 }
@@ -59,4 +125,4 @@ async function decryptWithPassword(encrypted, password) {
     return sodium.to_string(plaintext);
 }
 
-module.exports = { encryptWithPassword, decryptWithPassword };
+module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };

src/shared/wallet.js

@@ -120,9 +120,24 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         return node.deriveChild(addrIndex);
     }
     if (walletData.type === "xprv") {
-        const node =
-            masterXprvOrThrow(decryptedSecret).derivePath(BIP44_ETH_PATH);
-        return node.deriveChild(addrIndex);
+        // Checked here rather than through masterXprvOrThrow so the message
+        // fits the situation: nobody is importing anything at signing time,
+        // and this wallet is already in storage. src/shared/walletDefects.js
+        // catches it at list-render time; this is the backstop behind that.
+        const node = parseExtendedKey(decryptedSecret);
+        if (!node || !node.privateKey) {
+            throw new Error(
+                "This wallet's stored key is not a valid extended private " +
+                    "key, so it cannot sign.",
+            );
+        }
+        if (node.depth !== MASTER_DEPTH) {
+            throw new Error(
+                "This wallet was imported from an extended private key that " +
+                    "is not a master key, so it cannot sign.",
+            );
+        }
+        return node.derivePath(BIP44_ETH_PATH).deriveChild(addrIndex);
     }
     return new Wallet(decryptedSecret);
 }
@@ -142,6 +157,7 @@ function walletHasRecoveryPhrase(walletData) {
 
 module.exports = {
     generateMnemonic,
+    parseExtendedKey,
     deriveAddressFromXpub,
     hdWalletFromMnemonic,
     hdWalletFromXprv,

src/shared/walletDefects.js

@@ -0,0 +1,86 @@
+// Wallets already in stored state whose key cannot be used, and the copy that
+// explains them.
+//
+// Refusing a non-master extended private key at import time does nothing for a
+// wallet imported before that refusal existed. Such a wallet is detected here,
+// at wallet-list render time, so the user meets the explanation on the list
+// screen rather than an exception on the send screen. Nothing here modifies or
+// removes a wallet: the record is the user's data.
+
+const { parseExtendedKey } = require("./wallet");
+
+const NON_MASTER_XPRV = "non-master-xprv";
+
+// An "xprv" wallet stores the neutered BIP-44 Ethereum node, four levels below
+// the key that was imported: the current import path derives the absolute
+// m/44'/60'/0'/0 from a depth-0 key, and the pre-#210 path derived the same
+// four levels as a relative path beneath whatever depth it was given. A master
+// import therefore stores a depth-4 xpub and a depth-d import stores depth
+// d + 4, which makes the stored xpub an exact read on the imported key's
+// depth — and it is readable without the password, unlike the key itself.
+const BIP44_ETH_XPUB_DEPTH = 4;
+
+const DEFECTS = {
+    [NON_MASTER_XPRV]: {
+        id: NON_MASTER_XPRV,
+        heading: "This wallet's addresses were derived incorrectly.",
+        paragraphs: [
+            "This wallet was imported from an extended private key that is " +
+                "not a master key. An earlier version applied the Ethereum " +
+                "derivation path beneath that key instead of from a master " +
+                "key, so the addresses listed here are not the ones that key " +
+                "produces under the standard path.",
+            "Signing and sending are disabled for this wallet. The addresses " +
+                "do descend from the extended private key you imported, so " +
+                "anything they hold is still reachable by software that " +
+                "repeats the same non-standard derivation. Check them in a " +
+                "block explorer before deciding what to do.",
+            "To see the addresses this key produces under the standard path, " +
+                "import the master extended private key, or the recovery " +
+                "phrase it came from, as a new wallet. Nothing here has been " +
+                "changed or removed, and this wallet stays until you delete " +
+                "it yourself.",
+        ],
+        // One sentence for the places that have room for one: the flash on a
+        // blocked Send, the inline error on the approval screens.
+        shortMessage:
+            "This wallet cannot sign, because it was imported from an " +
+            "extended private key that is not a master key. The wallet list " +
+            "explains what happened.",
+    },
+};
+
+// The defect record for a wallet, or null if there is nothing wrong with it
+// that this module can see. Read-only.
+//
+// A wallet whose xpub will not parse gets null rather than a defect: there is
+// no basis in that case to tell the user their key was not a master key, and a
+// wrong explanation is worse than none.
+function walletDefect(walletData) {
+    if (!walletData || walletData.type !== "xprv") return null;
+    const node = parseExtendedKey(walletData.xpub);
+    if (!node) return null;
+    if (node.depth === BIP44_ETH_XPUB_DEPTH) return null;
+    return DEFECTS[NON_MASTER_XPRV];
+}
+
+// The notice block for the wallet list, or "" for a wallet with no defect.
+// The copy is fixed text from this module, so it needs no escaping.
+function walletDefectHtml(walletData) {
+    const defect = walletDefect(walletData);
+    if (!defect) return "";
+    let html =
+        '<div class="border border-red-500 border-dashed p-2 my-1 text-xs text-red-500">';
+    html += `<div class="font-bold mb-1">${defect.heading}</div>`;
+    for (const p of defect.paragraphs) {
+        html += `<p class="mb-1">${p}</p>`;
+    }
+    html += "</div>";
+    return html;
+}
+
+module.exports = {
+    NON_MASTER_XPRV,
+    walletDefect,
+    walletDefectHtml,
+};

tests/e2e/harness.js

@@ -22,18 +22,12 @@ const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
 // entry must name the issue that will remove it. This list is the one
 // concession in an otherwise zero-tolerance policy: an uncaught error is
 // how this harness caught issue #150 in the first place.
-const ALLOWED_ERRORS = [
-    {
-        // libsodium ships a WASM build and an asm.js fallback. The
-        // extension CSP (script-src 'self', with no wasm-unsafe-eval)
-        // refuses the WASM module on every popup load; libsodium catches
-        // it and falls back to asm.js, so the wallet works. Deciding
-        // which backend actually ships is issue #182, and this entry gets
-        // deleted when that lands.
-        issue: "#182",
-        pattern: /Refused to compile or instantiate WebAssembly module/,
-    },
-];
+//
+// Empty, and worth keeping that way. Its only entry was the WASM
+// CompileError libsodium provoked on every popup load, deleted with #182
+// when both manifests started allowing WASM; the run that used to need it
+// is now the run that proves the fix.
+const ALLOWED_ERRORS = [];
 
 function isAllowed(text) {
     return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
@@ -247,6 +241,26 @@ async function visible(page, selector, timeout = 15000) {
     await page.waitForSelector(selector, { state: "visible", timeout });
 }
 
+// An empty WebAssembly module: magic number and version header, no
+// sections. Compiling it in the popup asks the one question that decides
+// libsodium's backend — may this realm compile WebAssembly — of the real
+// page under the real shipped manifest, which is the only place the
+// answer can be observed. Kept independent of src/shared/vault.js on
+// purpose: a bundle asked to grade itself proves less than an outside
+// observation of the same realm.
+const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
+
+async function pageCompilesWasm(page) {
+    return page.evaluate(async (bytes) => {
+        try {
+            await WebAssembly.compile(new Uint8Array(bytes));
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }, EMPTY_WASM_MODULE);
+}
+
 async function openPopup(ctx, popupUrl) {
     const page = await ctx.newPage();
     await page.goto(popupUrl);
@@ -293,5 +307,6 @@ module.exports = {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 };

tests/e2e/run.js

@@ -15,6 +15,7 @@ const {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 } = require("./harness");
 const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
@@ -60,6 +61,27 @@ test("popup loads and reaches the welcome view", async (env) => {
     assert(title === "AutistMask", "unexpected popup title: " + title);
 });
 
+// The empirical half of #182. The manifest change is only a claim about
+// what the CSP permits; this is the observation. Two things have to hold
+// together, and the run covers both: the popup realm compiles WASM (here),
+// and no WASM refusal or abort is recorded anywhere in the run — the
+// harness allowlist that used to excuse exactly that error is now empty,
+// so a recurrence fails whichever test it lands in rather than being
+// tolerated. Since libsodium's WASM module is embedded in the bundle and
+// needs no fetch, a realm that compiles WASM is a realm where libsodium
+// takes the WASM path, and the next test drives a real vault encryption
+// through it.
+test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
+    const ok = await pageCompilesWasm(env.page);
+    assert(
+        ok,
+        "the popup refused to compile WebAssembly. The shipped manifest CSP " +
+            "has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
+            "fallback and every password derivation costs roughly 20x what it " +
+            "should — see the backend note in src/shared/vault.js",
+    );
+});
+
 test("wallet creation through the UI reaches the main view", async (env) => {
     env.phrase = await createWallet(env.page);
     assert(

tests/holders.test.js

@@ -0,0 +1,166 @@
+// Tests for src/shared/holders.js and the balance-list spam gate that reads
+// it (issue #230).
+//
+// The rule these pin down: an explorer that reports no holders_count has told
+// us nothing, and "nothing" must not be recorded as "zero holders".  Zero is
+// the strongest spam signal the wallet has, so handing it out for free turns
+// a missing field into a hidden asset.
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: jest.fn(),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+global.chrome = { storage: { local: {} } };
+
+const {
+    LOW_HOLDER_THRESHOLD,
+    parseHoldersCount,
+    isLowHolderCount,
+} = require("../src/shared/holders");
+const { fetchTokenBalances } = require("../src/shared/balances");
+const { debugFetch } = require("../src/shared/log");
+
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+const HOLDER = "0x66133e8ea0f5d1d612d2502a968757d1048c214a";
+const USDC_CONTRACT = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+const NOVEL_TOKEN = "0x1111111111111111111111111111111111111111";
+
+describe("parseHoldersCount", () => {
+    test("a reported count parses to that number", () => {
+        expect(parseHoldersCount("3500000")).toBe(3500000);
+        expect(parseHoldersCount(3500000)).toBe(3500000);
+    });
+
+    test('a reported "0" parses to 0, which is not null', () => {
+        expect(parseHoldersCount("0")).toBe(0);
+        expect(parseHoldersCount(0)).toBe(0);
+    });
+
+    test("an omitted, null or empty count is unknown", () => {
+        expect(parseHoldersCount(undefined)).toBeNull();
+        expect(parseHoldersCount(null)).toBeNull();
+        expect(parseHoldersCount("")).toBeNull();
+    });
+
+    test("an unparseable count is unknown rather than zero", () => {
+        expect(parseHoldersCount("many")).toBeNull();
+        expect(parseHoldersCount(NaN)).toBeNull();
+    });
+});
+
+describe("isLowHolderCount", () => {
+    test("the threshold is the documented 1,000 holders", () => {
+        expect(LOW_HOLDER_THRESHOLD).toBe(1000);
+    });
+
+    test("a reported count below the threshold is low", () => {
+        expect(isLowHolderCount(0)).toBe(true);
+        expect(isLowHolderCount(999)).toBe(true);
+    });
+
+    test("a reported count at or above the threshold is not low", () => {
+        expect(isLowHolderCount(1000)).toBe(false);
+        expect(isLowHolderCount(1001)).toBe(false);
+    });
+
+    test("an unknown count is not low", () => {
+        expect(isLowHolderCount(null)).toBe(false);
+        expect(isLowHolderCount(undefined)).toBe(false);
+    });
+});
+
+// fetchTokenBalances applies its own spam gate, which is not the low-holder
+// display filter: it has no setting behind it and decides what the balance
+// list contains at all.  It stays strict on an unknown count — see the
+// comment at the gate — but must stop recording that unknown as zero.
+describe("the balance-list spam gate", () => {
+    function respondWith(items) {
+        debugFetch.mockImplementation(async () => ({
+            ok: true,
+            status: 200,
+            statusText: "OK",
+            json: async () => items,
+        }));
+    }
+
+    function item(overrides = {}) {
+        const { token, ...rest } = overrides;
+        return {
+            value: "12500000",
+            ...rest,
+            token: {
+                type: "ERC-20",
+                address_hash: NOVEL_TOKEN,
+                symbol: "SPAMTKN",
+                name: "Spam Token",
+                decimals: "6",
+                holders_count: "50000",
+                ...token,
+            },
+        };
+    }
+
+    beforeEach(() => {
+        debugFetch.mockReset();
+    });
+
+    test("a token with plenty of reported holders is listed", async () => {
+        respondWith([item()]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBe(50000);
+    });
+
+    test("a token reporting zero holders is still excluded", async () => {
+        respondWith([item({ token: { holders_count: "0" } })]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    test("an unknown holder count does not admit an unvouched token", async () => {
+        respondWith([item({ token: { holders_count: null } })]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+    });
+
+    // The path that reaches the send selector and the history filter: a token
+    // the user vouched for by tracking it is listed whatever the explorer
+    // says, and it must carry the unknown count through as null, not as the
+    // zero that would then hide it downstream.
+    test("a tracked token with an unknown count is listed with holders null", async () => {
+        respondWith([item({ token: { holders_count: undefined } })]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+            { address: NOVEL_TOKEN.toUpperCase() },
+        ]);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBeNull();
+    });
+
+    test("a known-list token with an unknown count is listed with holders null", async () => {
+        respondWith([
+            item({
+                token: {
+                    address_hash: USDC_CONTRACT,
+                    symbol: "USDC",
+                    holders_count: null,
+                },
+            }),
+        ]);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        expect(balances).toHaveLength(1);
+        expect(balances[0].holders).toBeNull();
+    });
+
+    test("no test in this file performed a network request", () => {
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});

tests/manifest.test.js

@@ -0,0 +1,105 @@
+// The shipped Content Security Policy, pinned in both directions.
+//
+// This is the anti-regression check for #182. libsodium decides its
+// backend by trying to compile WebAssembly and catching the failure, so a
+// CSP that refuses WASM demotes the vault to the wasm2js translation —
+// roughly 20x slower per Argon2id derivation — and says so only in a
+// console message nobody reads. Dropping 'wasm-unsafe-eval' from either
+// manifest therefore has to fail a check, not a log line.
+//
+// It is equally a check against loosening. 'wasm-unsafe-eval' is granted
+// deliberately and narrowly (see the backend note in src/shared/vault.js);
+// 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
+// an exact match on the token set is what keeps the next edit from
+// smuggling one in alongside.
+//
+// build.js copies these files to dist/<target>/manifest.json verbatim, so
+// what is asserted here is what ships.
+
+const fs = require("fs");
+const path = require("path");
+
+const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
+
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
+
+const FORBIDDEN_SOURCES = [
+    "'unsafe-eval'",
+    "'unsafe-inline'",
+    "http:",
+    "https:",
+    "data:",
+    "blob:",
+    "*",
+];
+
+function readManifest(name) {
+    return JSON.parse(
+        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
+    );
+}
+
+// "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
+function parseCsp(policy) {
+    const directives = {};
+    for (const part of policy.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length === 0) continue;
+        directives[tokens[0]] = tokens.slice(1);
+    }
+    return directives;
+}
+
+function assertPolicy(policy) {
+    const directives = parseCsp(policy);
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
+    );
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
+    }
+}
+
+describe("shipped Content Security Policy", () => {
+    // MV3 takes an object and applies extension_pages to the popup and the
+    // background service worker, which is where libsodium runs.
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("chrome").content_security_policy;
+        expect(typeof csp).toBe("object");
+        expect(Object.keys(csp)).toEqual(["extension_pages"]);
+        assertPolicy(csp.extension_pages);
+    });
+
+    // MV2 takes the policy as a bare string. Firefox does not require
+    // 'wasm-unsafe-eval' for MV2 today — enforcement is report-only and
+    // Bugzilla 1770909 is still open — so that token is future-proofing
+    // for when it lands, not a mandate, and it stays inside Firefox's MV2
+    // base-CSP ceiling. object-src 'self' is the load-bearing half: a
+    // Firefox before 106 rejects an MV2 policy string that omits
+    // object-src and falls back to its own default, discarding everything
+    // declared here. Same policy as Chrome, different manifest shape.
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("firefox").content_security_policy;
+        expect(typeof csp).toBe("string");
+        assertPolicy(csp);
+    });
+
+    // The two targets share one codebase and one crypto path; a policy
+    // that drifts apart between them means one of the two builds is
+    // running a backend nothing tests.
+    test("both targets ship the same policy", () => {
+        const chrome =
+            readManifest("chrome").content_security_policy.extension_pages;
+        const firefox = readManifest("firefox").content_security_policy;
+        expect(firefox).toBe(chrome);
+    });
+});

tests/sendTokenSelect.test.js

@@ -0,0 +1,123 @@
+// Tests for the token filtering in the Send view's token selector
+// (src/popup/views/send.js).
+//
+// The selector decides which of the user's tokens can be spent at all, so
+// over-filtering here is worse than in the history list: the asset is not
+// merely hidden, it becomes unspendable through the UI.  Issue #230: an
+// explorer that omits holders_count was read as "zero holders" and the token
+// disappeared from this list.
+//
+// renderSendTokenSelect only ever touches getElementById, createElement,
+// innerHTML, value, textContent and appendChild, so a small stub document is
+// enough to drive it; the real DOM behaviour of the view is covered by
+// tests/e2e/run.js.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const { renderSendTokenSelect } = require("../src/popup/views/send");
+
+const USDC_CONTRACT = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+const NOVEL_TOKEN = "0x1111111111111111111111111111111111111111";
+
+let select;
+
+function installStubDocument() {
+    select = { innerHTML: "", children: [] };
+    select.appendChild = (child) => select.children.push(child);
+    globalThis.document = {
+        getElementById: (id) => (id === "send-token" ? select : null),
+        createElement: () => ({ value: "", textContent: "" }),
+    };
+}
+
+// The symbols offered for sending, excluding the hardcoded ETH option that
+// renderSendTokenSelect writes straight into innerHTML.
+function offeredTokens() {
+    return select.children.map((opt) => opt.value.toLowerCase());
+}
+
+function tokenBalance(overrides) {
+    return {
+        address: NOVEL_TOKEN,
+        symbol: "SPAMTKN",
+        decimals: 18,
+        balance: "12.5",
+        holders: 50000,
+        ...overrides,
+    };
+}
+
+function render(tokenBalances) {
+    installStubDocument();
+    renderSendTokenSelect({ address: "0x" + "a".repeat(40), tokenBalances });
+}
+
+beforeEach(() => {
+    state.fraudContracts = [];
+    state.hideLowHolderTokens = true;
+});
+
+describe("the low-holder rule in the send token selector", () => {
+    test("ETH is always offered", () => {
+        render([]);
+        expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
+        expect(offeredTokens()).toEqual([]);
+    });
+
+    test("a token with plenty of holders is offered", () => {
+        render([tokenBalance()]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("a token reporting zero holders is withheld", () => {
+        render([tokenBalance({ holders: 0 })]);
+        expect(offeredTokens()).toEqual([]);
+    });
+
+    test("boundary: 999 holders is withheld, 1000 is offered", () => {
+        render([tokenBalance({ holders: 999 })]);
+        expect(offeredTokens()).toEqual([]);
+        render([tokenBalance({ holders: 1000 })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    // Issue #230: an unknown holder count must not read as zero.  A token the
+    // user demonstrably holds — it has a balance — cannot be made unspendable
+    // by a field the block explorer failed to report.
+    test("a token whose holder count is unknown is still offered", () => {
+        render([tokenBalance({ holders: null })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("a token balance carrying no holders field at all is offered", () => {
+        const t = tokenBalance();
+        delete t.holders;
+        render([t]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+
+    test("the rule is bypassed entirely when the setting is off", () => {
+        state.hideLowHolderTokens = false;
+        render([tokenBalance({ holders: 0 })]);
+        expect(offeredTokens()).toEqual([NOVEL_TOKEN]);
+    });
+});
+
+describe("the other send-selector rules are unaffected", () => {
+    test("a token spoofing a known symbol from a wrong address is withheld", () => {
+        render([
+            tokenBalance({ symbol: "USDC", holders: null }),
+            tokenBalance({ address: USDC_CONTRACT, symbol: "USDC" }),
+        ]);
+        expect(offeredTokens()).toEqual([USDC_CONTRACT.toLowerCase()]);
+    });
+
+    test("a blocklisted fraud contract is withheld even with an unknown count", () => {
+        state.fraudContracts = [NOVEL_TOKEN.toUpperCase()];
+        render([tokenBalance({ holders: null })]);
+        expect(offeredTokens()).toEqual([]);
+    });
+});

tests/transactions.test.js

@@ -1473,6 +1473,65 @@ describe("fetchRecentTransactions merge and dedup", () => {
         expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
     });
 
+    // Regression guards (#230): the explorer's holders_count is optional.  A
+    // missing field means the count is unknown; it does not mean the token
+    // has no holders.  Recording the two as the same number both hides a
+    // legitimate token and makes the `holders !== null` guard in
+    // filterTransactions unreachable for token transfers.
+    describe("an unreported holders_count is unknown, not zero", () => {
+        function spamTransferWithToken(token) {
+            return [
+                {
+                    transaction_hash: "0x" + "9".repeat(64),
+                    block_number: 21000070,
+                    timestamp: TS,
+                    from: { hash: ORDINARY_PEER },
+                    to: { hash: VICTIM },
+                    total: { value: "1500500000", decimals: "6" },
+                    token: token,
+                },
+            ];
+        }
+
+        const OMITTED = {
+            symbol: NOVEL_SPAM_SYMBOL,
+            address_hash: NOVEL_SPAM_CONTRACT,
+        };
+        const NULLED = { ...OMITTED, holders_count: null };
+        const ZERO = { ...OMITTED, holders_count: "0" };
+
+        test("an omitted holders_count parses to null", async () => {
+            respondWith([], spamTransferWithToken(OMITTED));
+            const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT);
+            expect(txs[0].holders).toBeNull();
+        });
+
+        test("a null holders_count parses to null", async () => {
+            respondWith([], spamTransferWithToken(NULLED));
+            const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT);
+            expect(txs[0].holders).toBeNull();
+        });
+
+        test("the transfer survives the low-holder filter", async () => {
+            respondWith([], spamTransferWithToken(OMITTED));
+            const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT);
+            expect(filterTransactions(txs, filters()).transactions).toEqual(
+                txs,
+            );
+        });
+
+        // The regression this fix could cause: a token that genuinely
+        // reports zero holders must keep being filtered.  Unlike the fake
+        // "ETH" fixture above, this symbol is not in the token list, so the
+        // holder count is the only rule that can catch it.
+        test('a reported holders_count of "0" still parses to 0 and is filtered', async () => {
+            respondWith([], spamTransferWithToken(ZERO));
+            const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT);
+            expect(txs[0].holders).toBe(0);
+            expect(filterTransactions(txs, filters()).transactions).toEqual([]);
+        });
+    });
+
     test("failed responses yield an empty list rather than throwing", async () => {
         debugFetch.mockImplementation(async () => ({
             ok: false,

tests/vaultBackend.test.js

@@ -0,0 +1,52 @@
+// The unit tests must exercise the libsodium backend that actually ships
+// (#182). Before this, they could not: node compiles WebAssembly happily,
+// the extension CSP refused it, and so the browser silently ran the
+// wasm2js translation while every test ran the WASM build.
+//
+// With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
+// hold that agreement in place from the node side. tests/manifest.test.js
+// holds up the CSP end of it, and the end-to-end suite observes the real
+// popup.
+
+const { cryptoBackend } = require("../src/shared/vault");
+
+// The module libsodium-wrappers-sumo itself requires and drives. Not a new
+// dependency: it is inspected here, never used to perform crypto, because
+// it is the only thing that can say which backend is loaded.
+const SODIUM_CORE = "libsodium-sumo";
+
+describe("libsodium backend", () => {
+    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
+        await expect(cryptoBackend()).resolves.toBe("wasm");
+    });
+
+    test("libsodium did not swap in the wasm2js fallback", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        // useBackupModule is the entry point to the fallback; taking it
+        // replaces the module's exports with the translation's, and the
+        // entry point goes with them. Still present after ready means the
+        // WASM module is the one in place. The test below is what keeps
+        // that inference honest.
+        expect(typeof core.useBackupModule).toBe("function");
+    });
+
+    // Deliberately last, and deliberately destructive: it takes the
+    // fallback, which replaces the loaded module for the rest of this
+    // file. Jest gives each test file its own module registry, so nothing
+    // outside sees it.
+    //
+    // Without this, the check above would be a claim about libsodium's
+    // internals with nothing holding it to account: if a future version
+    // kept useBackupModule on the fallback module too, the marker would
+    // quietly become true in both backends and the test would pass while
+    // measuring nothing. Forcing the fallback and watching the marker
+    // disappear is what makes its presence mean something.
+    test("the fallback marker distinguishes the two backends", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        expect(typeof core.useBackupModule).toBe("function");
+        await core.useBackupModule();
+        expect(typeof core.useBackupModule).toBe("undefined");
+    });
+});

tests/walletDefects.test.js

@@ -0,0 +1,290 @@
+// Tests for the stored-state half of the non-master extended key problem.
+//
+// Refusing a non-master xprv at import time does nothing for a wallet that is
+// already in storage: the import that created it ran before the refusal
+// existed. Such a wallet used to sign for the wrong tree and now throws on the
+// send screen instead. These tests pin down that it is named and explained in
+// the wallet list, that nothing on the way there throws, and that a wallet
+// imported from a real master key is untouched by any of it.
+
+const { HDNodeWallet, Mnemonic } = require("ethers");
+
+const wallet = require("../src/shared/wallet");
+const {
+    walletDefect,
+    walletDefectHtml,
+    NON_MASTER_XPRV,
+} = require("../src/shared/walletDefects");
+
+// BIP-39 test vector phrase, published; never used for real funds.
+const VECTOR_PHRASE =
+    "test test test test test test test test test test test junk";
+
+function seedNode(phrase) {
+    return HDNodeWallet.fromSeed(Mnemonic.fromPhrase(phrase, "").computeSeed());
+}
+
+// The master (depth-0) key, which is what the import flow accepts today.
+function masterXprv(phrase) {
+    return seedNode(phrase).extendedKey;
+}
+
+// The account-level (depth-3) key m/44'/60'/0'. A normal thing for a user to
+// hold, and what the import flow used to accept.
+function accountXprv(phrase) {
+    return seedNode(phrase).derivePath("m/44'/60'/0'").extendedKey;
+}
+
+// The wallet record the CURRENT import path writes for a master key: the
+// neutered m/44'/60'/0'/0 node, four levels below a depth-0 key.
+function healthyXprvWallet(name = "Master") {
+    const { xpub, firstAddress } = wallet.hdWalletFromXprv(
+        masterXprv(VECTOR_PHRASE),
+    );
+    return {
+        name,
+        type: "xprv",
+        xpub,
+        nextIndex: 1,
+        encryptedSecret: "irrelevant-to-these-tests",
+        addresses: [{ address: firstAddress, balance: "0.0000" }],
+    };
+}
+
+// The wallet record the PRE-#210 import path wrote for an account-level key:
+// the same four levels, but derived as a relative path *beneath* the key, so
+// the stored xpub sits at depth 3 + 4 = 7. Built here the way the old code
+// built it rather than by calling the module under test, which now refuses.
+function brokenXprvWallet(name = "Imported xprv") {
+    const node = HDNodeWallet.fromExtendedKey(
+        accountXprv(VECTOR_PHRASE),
+    ).derivePath("44'/60'/0'/0");
+    return {
+        name,
+        type: "xprv",
+        xpub: node.neuter().extendedKey,
+        nextIndex: 1,
+        encryptedSecret: "irrelevant-to-these-tests",
+        addresses: [
+            { address: node.deriveChild(0).address, balance: "0.0000" },
+        ],
+    };
+}
+
+describe("the fixtures are what the two import paths actually produced", () => {
+    test("a master import stores a depth-4 xpub", () => {
+        expect(
+            HDNodeWallet.fromExtendedKey(healthyXprvWallet().xpub).depth,
+        ).toBe(4);
+    });
+
+    test("the pre-fix account-level import stored a depth-7 xpub", () => {
+        expect(
+            HDNodeWallet.fromExtendedKey(brokenXprvWallet().xpub).depth,
+        ).toBe(7);
+    });
+});
+
+describe("walletDefect", () => {
+    test("names the defect on a stored non-master xprv wallet", () => {
+        const defect = walletDefect(brokenXprvWallet());
+
+        expect(defect).not.toBeNull();
+        expect(defect.id).toBe(NON_MASTER_XPRV);
+    });
+
+    test("a depth-0 xprv wallet has no defect", () => {
+        expect(walletDefect(healthyXprvWallet())).toBeNull();
+    });
+
+    test("hd and key wallets are never assessed", () => {
+        expect(
+            walletDefect({ type: "hd", xpub: brokenXprvWallet().xpub }),
+        ).toBe(null);
+        expect(walletDefect({ type: "key" })).toBeNull();
+    });
+
+    test("an xprv wallet whose xpub cannot be parsed makes no claim", () => {
+        // No basis to say the key was non-master, so nothing is asserted
+        // about it rather than guessing.
+        expect(walletDefect({ type: "xprv", xpub: "not-a-key" })).toBeNull();
+        expect(walletDefect({ type: "xprv" })).toBeNull();
+    });
+
+    test("nothing about the wallet record is modified by the check", () => {
+        const w = brokenXprvWallet();
+        const before = JSON.stringify(w);
+
+        walletDefect(w);
+
+        expect(JSON.stringify(w)).toBe(before);
+    });
+});
+
+describe("the explanatory copy", () => {
+    const defect = walletDefect(brokenXprvWallet());
+
+    test("every sentence of it is a full sentence", () => {
+        for (const text of [defect.heading, ...defect.paragraphs]) {
+            expect(text).toMatch(/^[A-Z]/);
+            expect(text.trimEnd()).toMatch(/\.$/);
+        }
+    });
+
+    test("it says what was derived wrongly and that these are not the standard addresses", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toContain("not a master key");
+        expect(body).toMatch(/standard path/);
+    });
+
+    test("it does not claim the funds are safe and does not claim a loss", () => {
+        const all = [defect.heading, ...defect.paragraphs].join(" ");
+
+        expect(all).not.toMatch(/\bsafe\b/i);
+        expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
+    });
+
+    test("it says the wallet is not deleted and what the user can do", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toMatch(/until you delete it yourself/);
+        expect(body).toMatch(/recovery phrase/);
+    });
+
+    test("it uses the project's vocabulary", () => {
+        const all = [
+            defect.heading,
+            ...defect.paragraphs,
+            defect.shortMessage,
+        ].join(" ");
+
+        expect(all).not.toMatch(/seed phrase|mnemonic|passphrase/i);
+        expect(all).not.toMatch(/\baccounts?\b/i);
+    });
+});
+
+describe("walletDefectHtml", () => {
+    test("renders the heading and every paragraph for a defective wallet", () => {
+        const defect = walletDefect(brokenXprvWallet());
+        const html = walletDefectHtml(brokenXprvWallet());
+
+        expect(html).toContain(defect.heading);
+        for (const p of defect.paragraphs) {
+            expect(html).toContain(p);
+        }
+    });
+
+    test("renders nothing at all for a healthy wallet", () => {
+        expect(walletDefectHtml(healthyXprvWallet())).toBe("");
+    });
+});
+
+describe("the wallet list", () => {
+    let home;
+    let state;
+
+    beforeAll(() => {
+        global.chrome = {
+            storage: { local: { get: async () => ({}), set: async () => {} } },
+            runtime: { sendMessage: () => {} },
+        };
+        home = require("../src/popup/views/home");
+        state = require("../src/shared/state").state;
+    });
+
+    afterEach(() => {
+        state.wallets = [];
+        state.activeAddress = null;
+    });
+
+    test("a stored depth-3 xprv wallet renders the explanation", () => {
+        state.wallets = [brokenXprvWallet("Imported xprv")];
+
+        const html = home.walletListHtml();
+
+        expect(html).toContain(walletDefect(state.wallets[0]).heading);
+        expect(html).toContain("Imported xprv");
+    });
+
+    test("it does not offer to derive further addresses from that wallet", () => {
+        state.wallets = [brokenXprvWallet()];
+
+        expect(home.walletListHtml()).not.toContain("btn-add-address");
+    });
+
+    test("a normal depth-0 xprv wallet renders exactly as it did before", () => {
+        state.wallets = [healthyXprvWallet("Master")];
+
+        const html = home.walletListHtml();
+
+        expect(html).not.toContain(walletDefect(brokenXprvWallet()).heading);
+        expect(html).toContain("btn-add-address");
+        expect(html).toContain(state.wallets[0].addresses[0].address);
+    });
+
+    test("the defective wallet's notice does not bleed onto a healthy one", () => {
+        state.wallets = [brokenXprvWallet("Broken"), healthyXprvWallet("Fine")];
+
+        const html = home.walletListHtml();
+        const healthyPart = html.slice(html.indexOf("Fine"));
+
+        expect(html).toContain(walletDefect(state.wallets[0]).heading);
+        expect(healthyPart).not.toContain(
+            walletDefect(state.wallets[0]).heading,
+        );
+        expect(healthyPart).toContain("btn-add-address");
+    });
+});
+
+describe("no path throws an unhandled error for a defective wallet", () => {
+    test("address derivation from the stored xpub still works", () => {
+        // The stored xpub is at a non-standard depth but is a valid extended
+        // key; deriving from it is what the list render already does.
+        const w = brokenXprvWallet();
+
+        expect(() => wallet.deriveAddressFromXpub(w.xpub, 0)).not.toThrow();
+        expect(wallet.deriveAddressFromXpub(w.xpub, 0)).toBe(
+            w.addresses[0].address,
+        );
+    });
+
+    test("the wallet list renders without throwing", () => {
+        const { state } = require("../src/shared/state");
+        const home = require("../src/popup/views/home");
+        state.wallets = [brokenXprvWallet()];
+
+        expect(() => home.walletListHtml()).not.toThrow();
+
+        state.wallets = [];
+    });
+
+    test("signing refuses with the named defect rather than a bare failure", () => {
+        // getSignerForAddress is the backstop behind the UI gate. It must
+        // still refuse, and it must say why in a sentence the user can read.
+        let thrown = null;
+        try {
+            wallet.getSignerForAddress(
+                { type: "xprv" },
+                0,
+                accountXprv(VECTOR_PHRASE),
+            );
+        } catch (e) {
+            thrown = e;
+        }
+
+        expect(thrown).not.toBeNull();
+        expect(thrown.message).toMatch(/master key/);
+        expect(thrown.message.trimEnd()).toMatch(/\.$/);
+    });
+
+    test("a healthy xprv wallet signs as it always did", () => {
+        const signer = wallet.getSignerForAddress(
+            { type: "xprv" },
+            0,
+            masterXprv(VECTOR_PHRASE),
+        );
+
+        expect(signer.address).toBe(healthyXprvWallet().addresses[0].address);
+    });
+});