harden: verify all approval fields and make failed signing retryable (closes #174)

verifySignedTx compared only from, to, value and data, so a signed
transaction could differ from the approval in chain id, nonce, gas limit
or any fee field and still be broadcast. It now compares every
consequential field and refuses outright on any mismatch: the chain id
against the selected network (and against the approval when the page
fixed one), plus nonce, gas limit, gasPrice, maxFeePerGas and
maxPriorityFeePerGas wherever the approval carries a value, together
with the fee mechanism the approval implies. Fields the approval does
not carry are populated locally by the popup and have no approved value
to compare against, so they are held to absolute ceilings instead.

A failed signing attempt also left a button that could not succeed: the
background deleted the approval before it broadcast, so a retry found
nothing to sign. The approval is now retired only once the request has
an outcome, and the background tells the popup whether the failure is
retryable, so the button comes back for a failure the user can correct
and stays down with an explanation when the approval is spent.

TODO.md

@@ -49,9 +49,6 @@ undefined identifiers, which is how
   and the legacy gas price — with a failed signing attempt made retryable
   instead of leaving a dead button
   ([#174](https://git.eeqj.de/sneak/AutistMask/issues/174)).
-- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
-  all five network destinations documented, password/Settings/Add Wallet
-  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
 - 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
   remaining wallets, the selection only moves when it was deleted, and the
   active-address change is broadcast to connected sites

docs/README.md

@@ -6,10 +6,10 @@ and ERC-20 tokens, and connects to web3 sites. Nothing else.
 
 ## Why AutistMask Exists
 
-The most popular browser-based EVM wallet has become bloated with swap UIs,
+MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
-portfolio dashboards, analytics, tracking, and advertisements. It is no longer a
+tracking, and advertisements. It is no longer a simple wallet. Most alternatives
-simple wallet. The common alternatives only support Chromium browsers, leaving
+(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
-Firefox users without a usable option.
+without a usable option.
 
 AutistMask exists because a wallet should be a wallet. You should be able to see
 your balances, send tokens, receive tokens, and connect to sites. That is all a
@@ -27,10 +27,9 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **Encrypt your recovery phrase and private keys at rest.** Your secrets are
   encrypted on disk using Argon2id key derivation and XSalsa20-Poly1305
-  authenticated encryption (via libsodium). Your password is required whenever a
+  authenticated encryption (via libsodium). Your password is required only when
-  secret has to be decrypted: signing a transaction, signing a message or typed
+  signing a transaction. Viewing balances and addresses never requires a
-  data, exporting a private key, and deleting a wallet. Viewing balances and
+  password.
-  addresses never requires a password.
 
 - **Let you choose your own RPC endpoint.** The default is a public Ethereum
   RPC, but you can point it at your own node or any provider you trust. No
@@ -57,25 +56,23 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No third-party token list APIs.** Token balances come from the same block
+- **No token auto-discovery.** AutistMask does not scan the blockchain for
-  explorer you configure for transaction history, and the extension ships its
+  tokens you might hold. You add tokens manually by contract address. This
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
+  prevents scam tokens from appearing in your wallet uninvited.
-  detection. Any token you want tracked across all your addresses, you add
-  yourself by contract address.
 
-- **No backend servers operated by the developer.** Nothing is sent to any
+- **No phishing blocklists from third parties.** AutistMask does not phone home
-  server run by AutistMask. Every network destination is listed below.
+  to check URLs against a remote blocklist. It does maintain a local list of
+  known scam addresses, but this is shipped with the extension, not fetched from
+  a server.
 
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
+not have a backend server. It communicates with three external services:
-three you configure yourself, and two fixed ones used for scam detection.
 
 ### External Services
 
-**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`;
+**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`)
-`ethereum-sepolia-rpc.publicnode.com` on Sepolia)
 
 This is how AutistMask talks to the Ethereum network. Every wallet needs an
 Ethereum node to check balances, estimate gas, broadcast transactions, and
@@ -83,73 +80,27 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-When it is contacted: on every balance refresh (every 10 seconds while the popup
-is open, every 60 seconds in the background), when you type an ENS name into the
-Send screen, when a send is prepared and broadcast, while a pending transaction
-is polled for its receipt, and for the reverse ENS lookups used to label
-addresses (cached for 12 hours).
-
 What gets sent: standard Ethereum JSON-RPC requests (balance queries,
-transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
+transaction broadcasts, gas estimates, ENS lookups). Your addresses are
-addresses are necessarily visible to the RPC provider when querying balances.
+necessarily visible to the RPC provider when querying balances.
 
-**Blockscout API** (default: `eth.blockscout.com/api/v2`;
+**Blockscout API** (default: `eth.blockscout.com/api/v2`)
-`eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
 Used to fetch token balances and transaction history. Blockscout is an
 open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
+balances and recent transactions. You can change this in Settings to a
-transactions and token transfers. You can change this in Settings to a
 self-hosted Blockscout instance.
 
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
-
 What gets sent: your Ethereum addresses (to look up balances and transactions).
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
-Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
+Used to fetch current USD prices for ETH and ERC-20 tokens. Prices are cached
-cached for 5 minutes. No API key is required. This endpoint is not
+for 5 minutes. No API key is required. No user data is sent -- only a list of
-user-configurable, and it is not contacted at all while you are on a testnet,
+token symbols (e.g. "ETH", "USDC") to get their prices.
-where no USD values are shown.
 
-When it is contacted: while the popup is open, at most once every 5 minutes.
+What gets sent: token symbol names. No addresses, no balances, no identifying
-
+information.
-What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
-balances, no identifying information. As with any request, CoinDesk sees your IP
-address.
-
-**Phishing domain blocklist** (`raw.githubusercontent.com`)
-
-A community-maintained list of phishing domains, used to warn you when a site
-that asks to connect, or to have a transaction or signature approved, is a known
-scam. A copy is bundled into the extension at build time, so the protection
-works before any network request happens. At runtime the extension fetches the
-live list to pick up newly added domains, keeping only the entries not already
-in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
-user-configurable.
-
-When it is contacted: once when the background script starts, and every 24 hours
-after that. It is a plain download of a public file — nothing about you is sent,
-but the host sees your IP address. If the fetch fails, the bundled copy is still
-used.
-
-**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
-
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
-
-When it is contacted: each time you reach the send confirmation screen.
-
-What gets sent: the recipient address you are about to send to, and your IP
-address. Your own addresses are not sent.
-
-Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
-contracts) are ordinary links. They contact nothing until you click them.
 
 ### What Stays Local
 
@@ -172,11 +123,8 @@ word recovery phrase can restore your wallet on any device without your
 password. The password only protects the copy stored in this browser. If you
 lose your recovery phrase, your password cannot help you recover it.
 
-Your password is requested whenever an encrypted secret must be decrypted: when
+Your password is only requested when you send a transaction. Viewing balances,
-you send a transaction, when a site asks you to sign a message or typed data,
+receiving funds, and browsing transaction history never require your password.
-when you export an address's private key, and when you delete a wallet. Viewing
-balances, receiving funds, and browsing transaction history never require your
-password.
 
 ## Installation
 
@@ -199,46 +147,34 @@ password.
 ### Creating a New Wallet
 
 1. Click the AutistMask icon in your browser toolbar.
-2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+2. Click "Add wallet".
-3. On the "From Phrase" tab, click the die button to generate a random 12-word
+3. Click the die button to generate a random 12-word recovery phrase.
-   recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
    words can take your funds. If you lose them, your wallet is gone. AutistMask
    cannot recover them for you.
-5. Choose a password and confirm it. This encrypts your recovery phrase on this
+5. Choose a password. This encrypts your recovery phrase on this device.
-   device.
+6. Click "Add".
-6. Click "Import".
 
 ### Importing an Existing Wallet
 
-The Add Wallet screen has three tabs:
+**From a recovery phrase:** Follow the same steps as creating a wallet, but
+paste your existing 12 or 24 word recovery phrase instead of generating a new
+one. AutistMask uses the same derivation path as MetaMask (`m/44'/60'/0'/0`), so
+your addresses will match.
 
-**From Phrase:** Paste your existing 12 or 24 word recovery phrase instead of
+**From a private key:** On the Add Wallet screen, click "Have a private key
-generating a new one. AutistMask uses the standard BIP-44 Ethereum derivation
+instead?" and paste your private key. This creates a single-address wallet.
-path (`m/44'/60'/0'/0`), which is what other wallets use by default, so your
-addresses will match and your phrase stays portable in both directions.
-
-**From Key:** Paste a single private key. This creates a single-address wallet.
-
-**From xprv:** Paste an extended private key. This imports the HD wallet and
-scans for used addresses.
-
-All three tabs ask for the same password fields, and the "Import" button
-finishes the job.
 
 ### Adding More Addresses
 
-HD wallets (created from a recovery phrase or an xprv) can derive multiple
+HD wallets (created from a recovery phrase) can derive multiple addresses. On
-addresses. On the home screen, click the "+" button next to a wallet name to add
+the home screen, click the "+" button next to a wallet name to add the next
-the next address. These are deterministic -- the same recovery phrase will
+address. These are deterministic -- the same recovery phrase will always produce
-always produce the same sequence of addresses.
+the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-Tokens you hold show up automatically only if they are in the extension's
+AutistMask does not auto-discover tokens. To track a token:
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -247,13 +183,12 @@ shows it at zero balance), add it by contract address:
 4. Click "Add".
 
 The token balance will appear on the address detail screen and on the home
-screen. Tokens can also be added from Settings, under "Tracked Tokens".
+screen.
 
 ## Sending
 
 1. Click "Send" from the home screen or an address detail view.
-2. Select what to send (ETH, or any ERC-20 token with a balance on this address
+2. Select what to send (ETH or any tracked ERC-20 token).
-   that survives the spam filters).
 3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
 4. Enter the amount.
 5. Click "Review" to see the confirmation screen.
@@ -266,14 +201,11 @@ The confirmation screen shows:
 - **Amount** with USD estimate
 - **Your current balance** with USD estimate
 - **Estimated network fee** in ETH with USD estimate
-- **Warnings** if the recipient is a contract, a burn address, one of your own
-  addresses, on the bundled scam-address list, or labelled as a phisher on
-  Etherscan
 
-After reviewing, enter your password and click "Sign & Send". The transaction
+After reviewing, click "Send" and enter your password. The transaction will be
-will be broadcast to the network and you will see a waiting screen with a timer.
+broadcast to the network and you will see a waiting screen with a timer. Once
-Once confirmed (or after 60 seconds), you will see either a success or error
+confirmed (or after 60 seconds), you will see either a success or error screen
-screen with the transaction hash and an Etherscan link.
+with the transaction hash and an Etherscan link.
 
 ### Sending a Specific Token
 
@@ -287,10 +219,10 @@ cannot accidentally switch to a different one.
 1. Click "Receive" from the home screen or an address detail view.
 2. Share the QR code or copy the address using the "Copy address" button.
 
-When receiving ERC-20 tokens, make sure the sender is sending on the network you
+When receiving ERC-20 tokens, make sure the sender is sending on the Ethereum
-are using. AutistMask supports Ethereum mainnet and the Sepolia testnet. Tokens
+network. AutistMask is an Ethereum mainnet wallet. Tokens sent on other networks
-sent on other networks (Polygon, Arbitrum, BSC, etc.) to the same address will
+(Polygon, Arbitrum, BSC, etc.) to the same address will not appear and may be
-not appear and may be permanently lost.
+permanently lost.
 
 ## Connecting to Web3 Sites
 
@@ -305,12 +237,7 @@ pages. When a site requests access to your wallet:
 
 When a connected site requests a transaction, a separate approval popup appears
 showing the transaction details (from, to, value, data). You must enter your
-password and click "Confirm" to authorize it. Message and typed-data signature
+password and click "Confirm" to authorize it.
-requests work the same way, with a "Sign" button, and also require your
-password.
-
-If the requesting site's domain is on the phishing blocklist, all three approval
-screens show a red phishing warning before you decide.
 
 You can manage site permissions in Settings. Allowed and denied sites can be
 individually removed to reset their permissions.
@@ -320,16 +247,15 @@ individually removed to reset their permissions.
 AutistMask includes several defenses against common Ethereum scams, all enabled
 by default:
 
-**Known token symbol verification.** AutistMask ships a list of roughly 500
+**Known token symbol verification.** AutistMask ships a list of ~250 legitimate
-legitimate ERC-20 tokens with their contract addresses. If a transaction or
+ERC-20 tokens with their contract addresses. If a transaction claims to involve
-balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
+a known symbol (like "ETH" or "USDT") but comes from an unrecognized contract,
-an unrecognized contract, it is identified as a spoof and hidden.
+it is identified as a spoof and hidden.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
-from transaction history and the send token list, and are left out of your
+from transaction history and the send token list. Legitimate tokens have
-balances unless they are on the bundled known-token list or you added them
+substantial holder counts; scam tokens deployed for address poisoning typically
-yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
+have zero.
-for address poisoning typically have zero.
 
 **Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
 adds the contract address to a local blocklist. Future transactions from that
@@ -340,47 +266,31 @@ ETH by default) are hidden. Scammers send dust from look-alike addresses to
 plant them in your transaction history. The threshold is configurable in
 Settings.
 
-**Scam address list.** A list of known fraud, drainer, and phishing addresses is
+All of these filters can be individually disabled in Settings if you prefer to
-shipped with the extension. Sending to one of them raises a warning on the
-confirmation screen. It contains only addresses involved in fraud -- it is not a
-sanctions list.
-
-**Phishing domain warnings.** Sites asking to connect or to have something
-approved are checked against the phishing domain blocklist described under
-External Services, and flagged with a red banner if they match.
-
-The first four filters can be individually disabled in Settings if you prefer to
 see everything unfiltered.
 
 ## Settings
 
 Click the gear icon on the home screen to access settings:
 
-- **Wallets**: Your wallets, and "+ Add wallet".
+- **Wallets**: Add a new wallet.
-- **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
+- **Display**: Toggle whether tracked tokens with zero balance are shown.
-  token".
-- **Display**: Toggle whether tracked tokens with zero balance are shown, and
-  choose the theme (System, Light, or Dark).
-- **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
-  resets the RPC and Blockscout endpoints to that network's defaults.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and
   transaction history. You can use a self-hosted instance.
-- **Token Spam Protection**: Toggle individual scam filters, set the dust
+- **Token Spam Protection**: Toggle individual scam filters and set the dust
-  transaction threshold, and switch timestamps to UTC.
+  transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
-- **About**: License, author, version, release date, and a link to the commit
-  this build came from.
 
 ## Frequently Asked Questions
 
-**Can I use AutistMask alongside another wallet?**
+**Is AutistMask compatible with MetaMask?**
 
-Yes. AutistMask uses the standard `m/44'/60'/0'/0` derivation path, so importing
+Yes. AutistMask uses the same derivation path (`m/44'/60'/0'/0`) as MetaMask. If
-the same recovery phrase gives you the same addresses as any other wallet using
+you import the same recovery phrase, you will get the same addresses. You can
-that path. Two wallet extensions can be installed side by side, though only one
+use both wallets side by side, though only one can be the active
-can be the active `window.ethereum` provider at a time.
+`window.ethereum` provider at a time.
 
 **Can I use AutistMask with a hardware wallet?**
 
@@ -388,9 +298,8 @@ Not yet. Hardware wallet support may be added in the future.
 
 **Does AutistMask support networks other than Ethereum mainnet?**
 
-Ethereum mainnet and the Sepolia testnet, selectable in Settings. No other
+Not currently. AutistMask is Ethereum mainnet only. Multi-chain support may be
-networks are supported today. On Sepolia, USD values are not shown, because
+added in the future.
-testnet tokens have no market value.
 
 **Where is my data stored?**
 
@@ -403,7 +312,7 @@ to any server operated by AutistMask.
 
 Your data is deleted. Make sure you have your recovery phrase backed up before
 uninstalling. With your recovery phrase, you can restore your wallet in
-AutistMask or any other wallet that uses the standard derivation path.
+AutistMask or any other compatible wallet (MetaMask, etc.) at any time.
 
 **What happens if a transaction times out?**