fix: run libsodium on WebAssembly under the extension CSP (closes #182)

libsodium ships a WASM build and a wasm2js translation in one file, tries
WASM first, and silently falls back if instantiation throws. Under a plain
script-src 'self' the fallback was taken on every popup load, announced by
nothing but an uncaught CompileError.

Measured on the vault's own Argon2id parameters (OPSLIMIT_INTERACTIVE,
MEMLIMIT_INTERACTIVE), node 22: WASM 141-198ms per derivation, wasm2js
3204-3660ms. The work factor is identical either way — it is set by the
ops and memory parameters, not by wall time — so the fallback bought no
security and cost about 3.5s on every operation that asks for the
password, which is every signature.

Both manifests now declare script-src 'self' 'wasm-unsafe-eval';
object-src 'self' for extension pages: an object under
content_security_policy.extension_pages for Chrome MV3, a bare string for
Firefox MV2. The keyword permits compiling WebAssembly and nothing else —
not eval() of strings, not inline script, not remote script — and reaching
it requires already executing script in an extension page. 'unsafe-eval'
is not granted.

The silence is what made this dangerous, so the fallback is now loud at
three levels: tests/manifest.test.js pins both policies to exactly that
token set, failing make check if the grant is dropped or if anything is
added beside it; tests/vaultBackend.test.js asserts the unit tests
exercise the WASM backend, with a self-validating check that libsodium
never swapped its fallback in; and the e2e suite compiles a WebAssembly
module inside the real popup under the real manifest, with the harness
allowlist entry that used to excuse the CompileError now deleted.

The runtime fallback itself is kept — a wallet that refuses to decrypt is
worse than a slow one — but vault.js now reports the backend and logs an
error when it is not WASM.

README.md

@@ -123,16 +123,17 @@ unavailable). The suite lives in `tests/e2e/` and is driven by
 `playwright-core`, whose version must stay matched to the container's Playwright
 version — the browsers ship inside the image.
 
-It covers popup load, wallet creation through the UI, the Add Token screen, the
-transaction detail screen for an ERC-20 transfer, and the recovery phrase screen
-— which wallet types are offered it, that it holds nothing before the password
-is accepted, that a wrong password reveals nothing, that leaving it by either
-route wipes it — including a leave taken while the decrypt is still running —
-and that reopening the popup does not land on it. All outbound network is
-intercepted at the browser level and served from fixtures in
-`tests/e2e/network.js`, so the run is deterministic and fully offline;
-unrecognised outbound requests are reported as failures rather than silently
-allowed.
+It covers popup load, WebAssembly compilation under the shipped CSP (see
+[Content Security Policy](#content-security-policy)), wallet creation through
+the UI, the Add Token screen, the transaction detail screen for an ERC-20
+transfer, and the recovery phrase screen — which wallet types are offered it,
+that it holds nothing before the password is accepted, that a wrong password
+reveals nothing, that leaving it by either route wipes it — including a leave
+taken while the decrypt is still running — and that reopening the popup does not
+land on it. All outbound network is intercepted at the browser level and served
+from fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
+offline; unrecognised outbound requests are reported as failures rather than
+silently allowed.
 
 That reporting has one bound worth knowing. Observation ends when the browser
 context is torn down, and nothing can watch traffic after that, so the run keeps
@@ -149,10 +150,11 @@ page, which it does not by default — `script/test-e2e` sets
 `PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
 experimental, the harness does not take it on trust. At launch it waits for the
 background worker's **own** startup request — the phishing blocklist fetch that
-`src/background/index.js` issues unconditionally — to arrive in the route
-handler, and aborts the entire suite if none does within 30 seconds
-(`tests/e2e/harness.js`). The check is passive on purpose: a synthetic probe
-fetched from inside the worker via `worker.evaluate()` was tried first and
+`src/background/index.js` issues on startup, which on the suite's throwaway
+profile always happens because no previous fetch timestamp is persisted — to
+arrive in the route handler, and aborts the entire suite if none does within 30
+seconds (`tests/e2e/harness.js`). The check is passive on purpose: a synthetic
+probe fetched from inside the worker via `worker.evaluate()` was tried first and
 rejected, because evaluating in an extension service worker that early kills the
 worker outright, destroying the thing being measured. Observing traffic the
 extension already generates perturbs nothing. Losing the race fails closed — the
@@ -212,9 +214,10 @@ src/
     styles/main.css   — Tailwind source
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
+    alarms.js         — recurring background jobs (extension alarms API)
     balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
-    ens.js            — ENS forward/reverse resolution
+    ens.js            — ENS forward/reverse resolution (popup only)
     prices.js         — ETH/USD and token/USD via CoinDesk API
     scamlist.js       — known fraud contract addresses
     state.js          — persisted state (extension storage)
@@ -228,6 +231,74 @@ manifest/
   firefox.json        — Manifest V2 for Firefox
 ```
 
+### Background scheduling
+
+Chrome runs `src/background/index.js` as a Manifest V3 service worker, which the
+browser terminates after roughly 30 seconds idle and re-evaluates from scratch
+on the next event. Two consequences shape every recurring job in the background:
+
+- `setInterval` and `setTimeout` are useless. They are destroyed with the
+  worker, so a job scheduled that way runs until the first idle period and never
+  again. Both recurring jobs — the 60-second balance refresh and the 24-hour
+  phishing blocklist refresh — are scheduled through the extension alarms API
+  (`src/shared/alarms.js`) instead. The browser holds the schedule and wakes the
+  worker to deliver it. Alarm periods are clamped to a one-minute minimum, so
+  the balance refresh is expressed as exactly one minute and nothing is silently
+  slowed down.
+- Module-level variables do not survive either. Anything that must be remembered
+  across a restart goes in extension storage, including the timestamp of the
+  last phishing list fetch: without it a revived worker would either re-fetch on
+  every wake or, with a naive in-memory guard, never notice that an update is
+  due. `localStorage` does not exist in a service worker at all — the one
+  remaining user of it, `src/shared/ens.js`, runs only in the popup and is
+  marked as such.
+
+Both jobs also carry a freshness guard, and a guard must never be timed to the
+alarm period it gates. Each guard is measured from the moment the last run
+finished, which is one run-duration after the alarm that started it, so a guard
+of exactly one period vetoes the very next tick and the real cadence becomes two
+periods. The two jobs solve this differently, because their guards exist for
+different reasons:
+
+- The phishing refresh has a 24-hour cache TTL whose job is to keep the worker
+  off the network on the wakes between scheduled refreshes — Chrome revives the
+  worker every ~30 seconds while the browser is busy, and every revival runs the
+  startup path. The scheduled alarm tick is not one of those wakes, so it
+  bypasses the TTL and fetches unconditionally. Shortening the TTL instead would
+  not work: the startup path re-checks it on every wake, so a shorter TTL simply
+  becomes the real refresh rate.
+- The balance refresh guard exists to skip work an open popup has already done —
+  the popup refreshes every 10 seconds and stamps the same field. That has to
+  keep applying on the scheduled tick, so the guard is shortened to half the
+  alarm period instead of bypassed: comfortably above the popup's 10 seconds, so
+  an open popup still suppresses the background job, and comfortably below the
+  60-second period, so the schedule always wins.
+
+Two timestamps are persisted for the phishing list, not one. `lastFetchTime`
+records a fetch that produced a usable delta and drives the TTL.
+`lastAttemptTime` records that the network was contacted at all, and is written
+even when the result is unusable — a failed request, or a delta over the 256 KiB
+cap. Without it those cases leave no freshness mark and the worker re-downloads
+the full blocklist on every wake, indefinitely; with it, unscheduled retries are
+floored at one hour. Both are discarded on load if they are in the future, since
+a stamp from a skewed clock or a restored backup would otherwise suppress
+updates until that time arrives, permanently and with no way out.
+
+The startup path (`ensureRecurringAlarms()` plus the phishing list init) runs on
+`onInstalled`, on `onStartup`, and at the top level of the worker, so every way
+the background context can start re-establishes the schedule. On a fresh install
+more than one of those fires, so they share a single in-flight run rather than
+racing. It is idempotent: an alarm that already exists with the period the code
+asks for is left alone, because re-creating one restarts its schedule and a busy
+extension would push the next fire out indefinitely. An alarm carrying a
+different period — one created by an earlier version — is re-created once, or a
+period changed in a new release would never reach an existing install.
+
+Firefox uses Manifest V2 with a persistent background page, where timers would
+survive. Both browsers are built from one bundle and both take the alarm path,
+so there is a single code path to reason about; `"alarms"` is declared in both
+`manifest/chrome.json` and `manifest/firefox.json`.
+
 ### UI Design Philosophy
 
 The UI is inspired by _Universal Paperclips_. It's deliberately minimal,
@@ -582,16 +653,26 @@ of it.
     - To: blockie + color dot + full address + etherscan link + ENS name
     - Amount: value + symbol (USD in parentheses)
     - Your balance: value + symbol (USD in parentheses)
-    - Estimated network fee: "Estimating..." then the ETH amount (USD in
-      parentheses) or "Unable to estimate", fetched async
+    - Network fee: "Estimating..." then two lines, or "Unable to estimate",
+      fetched async. The first line is what the transfer is expected to cost,
+      `gasLimit * gasPrice` (USD in parentheses); the second is the
+      `gasLimit * maxFeePerGas` reserve the node requires, which is what the
+      balance check gates on. The second line is omitted on a network with no
+      type-2 pricing, where the two are the same number, but its space is
+      reserved either way
     - Warnings: inline warnings from the local checks (scam address, self-send)
       plus four reserved warning boxes made visible by the async checks —
       recipient with no transaction history, recipient is a contract, burn
       address, and an Etherscan phishing/scam label
-    - Errors (insufficient balance)
+    - Errors (insufficient balance), plus three reserved error boxes — the
+      amount plus the fee exceeds the balance (ETH transfers), not enough ETH to
+      pay the fee for the transfer (ERC-20 transfers), and the fee could not be
+      estimated. The first two are mutually exclusive per transfer type, so only
+      the applicable one holds space
     - Password: an inline field on this screen, not a modal, with its own error
       line
-    - "Sign & Send" button (disabled if errors)
+    - "Sign & Send" button (disabled if errors, and while the network fee
+      estimate is pending or unavailable)
 - **Transitions**:
     - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
     - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
@@ -719,8 +800,8 @@ of it.
       plus a "+ Add wallet" button
     - Tracked Tokens: one row per tracked token with an `[x]` remove button,
       plus a "+ Add token" button
-    - Display: "Show tracked tokens with zero balance" checkbox and a Theme
-      selector (System / Light / Dark)
+    - Display: "Show tracked tokens with zero balance" checkbox, "UTC
+      Timestamps" checkbox, and a Theme selector (System / Light / Dark)
     - Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
       resets the RPC and Blockscout endpoints to that network's defaults
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
@@ -728,10 +809,10 @@ of it.
     - Blockscout API: endpoint URL input + "Save" button (validated against
       `/stats` before being saved)
     - Token Spam Protection:
+        - "Hide fake tokens impersonating a known symbol" checkbox
         - "Hide tokens with fewer than 1,000 holders" checkbox
         - "Hide transactions from detected fraud contracts" checkbox
         - "Hide dust transactions below N gwei" checkbox + threshold input
-        - "UTC Timestamps" checkbox
     - Allowed Sites: list with remove buttons
     - Denied Sites: list with remove buttons
     - About: project link, license, author, version, release date, and the
@@ -938,9 +1019,14 @@ CoinDesk price API, and Blockscout API), AutistMask also contacts:
 - **Phishing domain blocklist**: A community-maintained phishing domain
   blocklist is vendored into the extension at build time. At runtime, the
   extension fetches the live list once every 24 hours to detect newly added
-  domains. Only the delta (domains not already in the vendored list) is kept in
-  memory, keeping runtime memory usage small. The delta is persisted to
-  localStorage if it is under 256 KiB.
+  domains, plus once on a start where the list is more than 24 hours old. Only
+  the delta (domains not already in the vendored list) is kept in memory,
+  keeping runtime memory usage small. The delta and the timestamp of the fetch
+  that produced it are persisted to extension storage if the record is under 256
+  KiB; an oversized delta is dropped along with its timestamp, so a later start
+  fetches again rather than claiming freshness for data it no longer holds. A
+  fetch that fails, or one whose delta was too large to store, is not retried
+  more than once an hour outside the 24-hour schedule.
 - **Etherscan address labels**: When confirming a transaction, the extension
   performs a best-effort lookup of the recipient address on Etherscan to check
   for phishing/scam labels. This is a direct page fetch with no API key; the
@@ -983,6 +1069,36 @@ battle-tested.
 Exceptions require explicit authorization in a code comment referencing this
 policy, but as of now there are none.
 
+### Content Security Policy
+
+Both manifests declare the same policy for extension pages —
+`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
+`content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
+a bare string in `manifest/firefox.json` (MV2).
+
+`'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
+build and a `wasm2js` translation of it in one file, tries WASM first, and
+silently falls back to the translation if instantiation throws. Under a plain
+`script-src 'self'` the fallback was taken on every popup load, announced by
+nothing but an uncaught `CompileError`. Measured on the same Argon2id parameters
+the vault uses (`OPSLIMIT_INTERACTIVE`, `MEMLIMIT_INTERACTIVE`), WASM derives a
+key in 141-198ms and `wasm2js` in 3204-3660ms. The work factor is identical — it
+is set by the ops and memory parameters, not by wall time — so the fallback
+bought nothing and cost about three and a half seconds on every operation that
+asks for the password, which is every signature.
+
+The keyword permits compiling WebAssembly and nothing else: not `eval()` of
+strings, not inline script, not remote script. Using it requires already
+executing script in an extension page, which is complete compromise on its own.
+`'unsafe-eval'` is a different proposition and is not granted.
+
+The grant is pinned in both directions. `tests/manifest.test.js` asserts the
+exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
+20x regression on the key derivation) and adding anything beyond it both fail
+`make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
+backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
+under the real manifest.
+
 ### DEBUG Mode Policy
 
 The `DEBUG` constant in the popup JS enables a red "DEBUG / INSECURE" banner and
@@ -1117,7 +1233,19 @@ indexes it as a real token transfer.
   a spoof and filtered from display. The fake "Ethereum" token in the attack
   above used symbol "ETH" from contract
   `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not match the known
-  WETH contract — so it would be caught by this check.
+  WETH contract — so it would be caught by this check. Detecting a spoof is also
+  what adds a contract to the fraud contract blocklist below; that is the only
+  thing that populates it. In the transaction history the check is the "Hide
+  fake tokens impersonating a known symbol" setting, on by default; with it off,
+  spoofed transfers are shown and no new blocklist entries are learned from
+  them. The send-screen token selector applies the same check unconditionally,
+  because it decides which tokens the user can act on rather than what the
+  history displays. The balance list applies it unconditionally too, but not
+  identically: it exempts symbols that `KNOWN_SYMBOLS` maps to `null`, and
+  `"ETH"` is the only one. So the fake "Ethereum" token above is filtered from
+  the transaction history and from the send selector, but a fake-`ETH` ERC-20
+  that clears the balance list's own 1,000-holder floor — or that the user
+  tracked manually — is still shown in the balance list.
 
 - **Low-holder token filtering**: Token transfers from ERC-20 contracts with
   fewer than 1,000 holders are hidden from transaction history by default.
@@ -1147,11 +1275,19 @@ indexes it as a real token transfer.
   about. The threshold is user-configurable in Settings; a threshold of `0`
   hides nothing, exactly as clearing the checkbox does.
 
-- **User-configurable**: All of the above filters (known symbol verification,
-  low-holder threshold, fraud contract blocklist, dust threshold) are settings
-  that default to on but can be individually disabled by the user. AutistMask is
-  designed as a sharp tool — users who understand the risks can configure the
-  wallet to show everything unfiltered, unix-style.
+- **User-configurable**: All four filters (known symbol verification, low-holder
+  threshold, fraud contract blocklist, dust threshold) are settings that default
+  to on but can be individually disabled by the user. AutistMask is designed as
+  a sharp tool — users who understand the risks can configure the wallet to show
+  everything unfiltered, unix-style. All four settings govern the transaction
+  history; what else each one reaches varies. The known-symbol check also runs
+  unconditionally on the send-screen token selector, and on the balance list
+  except for symbols mapped to `null` (`"ETH"` alone), which the balance list
+  does not filter. The fraud contract blocklist is applied unconditionally on
+  that selector and is not consulted by the balance list at all. The low-holder
+  setting also gates the send selector, while the balance list's own
+  1,000-holder floor is unconditional (see Data Model). The dust threshold
+  applies to the transaction history alone.
 
 #### Phishing Domain Protection
 
@@ -1163,6 +1299,12 @@ live list once every 24 hours and keeps only the delta (newly added domains not
 in the vendored list) in memory. This architecture keeps runtime memory usage
 small while ensuring fresh coverage of new phishing domains.
 
+The 24-hour cadence is an alarm, not a timer; the alarm tick fetches
+unconditionally rather than re-checking the 24-hour cache TTL that gates the
+startup path; and the fetch timestamps live in extension storage rather than in
+module variables — see [Background scheduling](#background-scheduling) for why
+all three are required.
+
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all

TODO.md

@@ -44,10 +44,27 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
+  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
+  fallback at 20x the Argon2id cost, pinned in both directions by
+  `tests/manifest.test.js` and observed in the real popup by the e2e suite
+  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
+- 2026-08-11: Known-symbol spoof verification became a Settings toggle
+  (`hideSpoofedSymbols`), on by default, governing the transaction-history
+  filter and the fraud-contract learning it feeds
+  ([#176](https://git.eeqj.de/sneak/AutistMask/issues/176)).
 - 2026-08-11: `script/verify-build` now walks `dist/` NUL-delimited and asserts
   `dist/` is a real directory, so a path with a trailing space or a newline can
   no longer carry a debug marker past the unlisted-bundle check
   ([#223](https://git.eeqj.de/sneak/AutistMask/issues/223)).
+- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
+  into Display, next to the theme selector
+  ([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
+- 2026-08-11: Network fee counted in the confirmation-screen balance check for
+  both ETH and ERC-20 sends, reserving what the node actually charges a type-2
+  transaction, with the arithmetic in a pure, unit-tested
+  `src/shared/txValidation.js`
+  ([#154](https://git.eeqj.de/sneak/AutistMask/issues/154)).
 - 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of
   falling back to the 100,000 gwei default, and every address comparison in
   `src/shared/transactions.js` goes through one case-normalising helper so a
@@ -57,6 +74,17 @@ undefined identifiers, which is how
   from the wallet row in Settings, wiped on leaving the screen and excluded from
   the views the popup can reopen onto
   ([#161](https://git.eeqj.de/sneak/AutistMask/issues/161)).
+- 2026-08-11: Extended-key import hardened — the base58 checksum is now enforced
+  on every xprv and xpub, and a non-master key is refused with an explanation
+  instead of being derived beneath
+  ([#210](https://git.eeqj.de/sneak/AutistMask/issues/210)).
+- 2026-08-11: the balance refresh and the 24-hour phishing list refresh moved
+  from `setInterval` to the extension alarms API, with the phishing delta and
+  its fetch timestamps persisted to extension storage, so neither job dies with
+  the MV3 service worker. Each job's freshness guard was decoupled from its
+  alarm period at the same time — timed to the period, a guard vetoes its own
+  scheduled tick and halves the real refresh rate
+  ([#158](https://git.eeqj.de/sneak/AutistMask/issues/158)).
 - 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
   Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
   the Makefile-only targets documented in the README

docs/README.md

@@ -130,10 +130,14 @@ live list to pick up newly added domains, keeping only the entries not already
 in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
 user-configurable.
 
-When it is contacted: once when the background script starts, and every 24 hours
-after that. It is a plain download of a public file — nothing about you is sent,
-but the host sees your IP address. If the fetch fails, the bundled copy is still
-used.
+When it is contacted: when the background script starts, if the last fetch was
+more than 24 hours ago, and every 24 hours after that. The time of the last
+fetch is remembered across browser and background restarts, so restarting does
+not cause a re-download. If a fetch fails, or the list is too large to keep, the
+extension waits an hour before trying again outside that 24-hour schedule rather
+than retrying on every restart. It is a plain download of a public file —
+nothing about you is sent, but the host sees your IP address. If the fetch
+fails, the bundled copy is still used.
 
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
@@ -265,7 +269,10 @@ The confirmation screen shows:
 - **From and To addresses** with identicons and Etherscan links
 - **Amount** with USD estimate
 - **Your current balance** with USD estimate
-- **Estimated network fee** in ETH with USD estimate
+- **Network fee** — what the transfer is expected to cost, in ETH with a USD
+  estimate, and below it the larger amount reserved until it confirms. The
+  reserve is what the network requires up front and what the balance check gates
+  on; the refund of the difference is why the two differ
 - **Warnings** if the recipient is a contract, a burn address, one of your own
   addresses, on the bundled scam-address list, or labelled as a phisher on
   Etherscan
@@ -323,7 +330,14 @@ by default:
 **Known token symbol verification.** AutistMask ships a list of roughly 500
 legitimate ERC-20 tokens with their contract addresses. If a transaction or
 balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
-an unrecognized contract, it is identified as a spoof and hidden.
+an unrecognized contract, it is identified as a spoof and hidden. In your
+transaction history this is the "Hide fake tokens impersonating a known symbol"
+setting, which you can switch off; doing so also stops new entries being added
+to the fraud contract blocklist below, since detecting a spoof is what fills it.
+The send token list always applies the check. Your balances apply it too, with
+one exception: a token claiming the symbol "ETH" is not filtered there, so a
+fake "ETH" token can still show up in your balance list even though it is hidden
+from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your
@@ -359,16 +373,16 @@ Click the gear icon on the home screen to access settings:
 - **Wallets**: Your wallets, and "+ Add wallet".
 - **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
   token".
-- **Display**: Toggle whether tracked tokens with zero balance are shown, and
-  choose the theme (System, Light, or Dark).
+- **Display**: Toggle whether tracked tokens with zero balance are shown, switch
+  timestamps to UTC, and choose the theme (System, Light, or Dark).
 - **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
   resets the RPC and Blockscout endpoints to that network's defaults.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
 - **Blockscout API**: Change the Blockscout instance used for token balances and
   transaction history. You can use a self-hosted instance.
-- **Token Spam Protection**: Toggle individual scam filters, set the dust
-  transaction threshold, and switch timestamps to UTC.
+- **Token Spam Protection**: Toggle individual scam filters and set the dust
+  transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
 - **About**: License, author, version, release date, and a link to the commit
   this build came from.

manifest/chrome.json

@@ -3,8 +3,11 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Chrome",
-    "permissions": ["storage", "activeTab"],
+    "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
+    "content_security_policy": {
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
+    },
     "action": {
         "default_popup": "src/popup/index.html"
     },

manifest/firefox.json

@@ -3,7 +3,8 @@
     "name": "AutistMask",
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
-    "permissions": ["storage", "activeTab", "<all_urls>"],
+    "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

src/background/index.js

@@ -12,13 +12,20 @@ const {
     currentNetwork,
 } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
-const { debugFetch } = require("../shared/log");
+const { debugFetch, log } = require("../shared/log");
 const { verifySignedTx, verifySignature } = require("../shared/approvalVerify");
 const {
     isPhishingDomain,
-    updatePhishingList,
-    startPeriodicRefresh,
+    refreshPhishingListOnSchedule,
+    initPhishingList,
 } = require("../shared/phishingDomains");
+const {
+    BALANCE_REFRESH_ALARM,
+    PHISHING_REFRESH_ALARM,
+    BALANCE_REFRESH_PERIOD_MINUTES,
+    ensureRecurringAlarms,
+    registerAlarmHandlers,
+} = require("../shared/alarms");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -591,12 +598,22 @@ async function broadcastAccountsChanged() {
 // Background balance refresh: every 60 seconds when the popup isn't open.
 // When the popup IS open, its 10-second interval keeps lastBalanceRefresh
 // fresh, so this naturally skips.
-const BACKGROUND_REFRESH_INTERVAL = 60000;
+//
+// The alarm period alone sets the cadence; this guard only suppresses a
+// refresh something else has just done, so it must stay strictly shorter than
+// the period. Timed to the period it would veto every tick it gates —
+// lastBalanceRefresh is stamped after the refresh runs, so a tick one period
+// after the last one always lands inside a guard of equal length and the real
+// cadence becomes two periods. Half the period keeps it comfortably above the
+// popup's 10-second refresh, so an open popup still suppresses the background
+// job, and comfortably below the alarm period, so the schedule always wins.
+const BALANCE_REFRESH_PERIOD_MS = BALANCE_REFRESH_PERIOD_MINUTES * 60 * 1000;
+const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 
 async function backgroundRefresh() {
     await loadState();
     const now = Date.now();
-    if (now - (state.lastBalanceRefresh || 0) < BACKGROUND_REFRESH_INTERVAL)
+    if (now - (state.lastBalanceRefresh || 0) < RECENT_BALANCE_REFRESH_MS)
         return;
     if (state.wallets.length === 0) return;
     await refreshBalances(
@@ -609,12 +626,58 @@ async function backgroundRefresh() {
     await saveState();
 }
 
-setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL);
+// Both recurring jobs run off alarms, not timers. On Chrome MV3 this file is
+// a service worker that the browser terminates after about 30 seconds idle,
+// so a setInterval would only ever survive until the first idle period and
+// module-level state does not outlive it. Alarms are held by the browser and
+// wake the worker to deliver them.
+registerAlarmHandlers({
+    [BALANCE_REFRESH_ALARM]: backgroundRefresh,
+    // The scheduled refresh, which restores persisted state on a freshly
+    // revived worker and then fetches unconditionally. The freshness guards
+    // belong to the startup path; applying them here would make the tick skip
+    // itself.
+    [PHISHING_REFRESH_ALARM]: refreshPhishingListOnSchedule,
+});
 
-// Fetch the phishing domain blocklist delta on startup and refresh every 24h.
-// The vendored blocklist is bundled at build time; this fetches only new entries.
-updatePhishingList();
-startPeriodicRefresh();
+// Everything the background context needs re-established on start. This runs
+// on a fresh install, on browser startup, and on every revival of a
+// terminated worker, so it must be idempotent: ensureRecurringAlarms() only
+// creates alarms that are missing or carrying a stale period, and
+// initPhishingList() fetches only when the persisted timestamps say the list
+// is stale.
+//
+// On a fresh install the top-level call and the onInstalled listener both run,
+// close enough together that both could see an alarm missing and create it.
+// Sharing one in-flight run makes the "create only when missing" check
+// race-free; the memo is dropped once it settles so a later onStartup runs
+// again.
+let backgroundJobsRun = null;
+
+function startBackgroundJobs() {
+    if (backgroundJobsRun) return backgroundJobsRun;
+    backgroundJobsRun = Promise.all([
+        ensureRecurringAlarms(),
+        initPhishingList(),
+    ])
+        .catch((err) => {
+            // An alarm that failed to schedule means a recurring job silently
+            // never runs again; it must not be an unhandled rejection.
+            log.errorf("background job startup failed:", err);
+        })
+        .finally(() => {
+            backgroundJobsRun = null;
+        });
+    return backgroundJobsRun;
+}
+
+if (runtime.onInstalled) {
+    runtime.onInstalled.addListener(startBackgroundJobs);
+}
+if (runtime.onStartup) {
+    runtime.onStartup.addListener(startBackgroundJobs);
+}
+startBackgroundJobs();
 
 // When approval window is closed without a response, treat as rejection
 if (windowsApi && windowsApi.onRemoved) {

src/popup/index.html

@@ -136,7 +136,9 @@
                 <div id="add-wallet-section-xprv" class="hidden">
                     <p class="mb-2">
                         Paste your extended private key (xprv) below. This will
-                        import the HD wallet and scan for used addresses.
+                        import the HD wallet and scan for used addresses. It
+                        must be the master key for the wallet; an account-level
+                        or child key is not supported.
                     </p>
                     <div class="mb-2">
                         <input
@@ -582,10 +584,18 @@
                     <div id="confirm-balance" class="text-xs"></div>
                 </div>
                 <div id="confirm-fee" class="mb-3" style="visibility: hidden">
-                    <div class="text-xs text-muted mb-1">
-                        Estimated network fee
-                    </div>
+                    <div class="text-xs text-muted mb-1">Network fee</div>
                     <div id="confirm-fee-amount" class="text-xs"></div>
+                    <!-- Holds its one line of space from the first paint, so
+                    the reserve appearing when the estimate lands moves
+                    nothing. The placeholder is never seen. -->
+                    <div
+                        id="confirm-fee-reserve"
+                        class="text-xs text-muted"
+                        style="visibility: hidden"
+                    >
+                        reserve pending
+                    </div>
                 </div>
                 <div
                     id="confirm-warnings"
@@ -647,6 +657,31 @@
                     class="mb-2 border border-border border-dashed p-2"
                     style="visibility: hidden; min-height: 1.25rem"
                 ></div>
+                <div
+                    id="confirm-amount-fee-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    Your balance does not cover this amount plus the network
+                    fee. Please go back and send a smaller amount.
+                </div>
+                <div
+                    id="confirm-gas-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    You do not have enough ETH to pay the network fee for this
+                    transfer. Please add ETH to this address and try again.
+                </div>
+                <div
+                    id="confirm-fee-unknown-error"
+                    class="mb-2 border border-border border-dashed p-2 text-xs"
+                    style="visibility: hidden"
+                >
+                    The network fee could not be estimated, so this transaction
+                    cannot be checked against your balance. Please go back and
+                    try again.
+                </div>
                 <div class="mb-2">
                     <label class="block mb-1 text-xs">Password</label>
                     <input
@@ -869,6 +904,12 @@
                         />
                         Show tracked tokens with zero balance
                     </label>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
+                    >
+                        <input type="checkbox" id="settings-utc-timestamps" />
+                        UTC Timestamps
+                    </label>
                     <div class="text-xs flex items-center gap-1">
                         <label for="settings-theme">Theme:</label>
                         <select
@@ -948,6 +989,15 @@
                         transfers and prevent interaction with suspicious
                         tokens.
                     </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-2"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-hide-spoofed-symbols"
+                        />
+                        Hide fake tokens impersonating a known symbol
+                    </label>
                     <label
                         class="text-xs flex items-center gap-1 cursor-pointer mb-2"
                     >
@@ -979,12 +1029,6 @@
                         />
                         <span class="text-xs text-muted">gwei</span>
                     </div>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
-                    >
-                        <input type="checkbox" id="settings-utc-timestamps" />
-                        UTC Timestamps
-                    </label>
                 </div>
 
                 <div class="bg-well p-3 mx-1 mb-3">

src/popup/views/addWallet.js

@@ -6,6 +6,7 @@ const {
     addressFromPrivateKey,
     hdWalletFromXprv,
     isValidXprv,
+    isMasterExtendedKey,
 } = require("../../shared/wallet");
 const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
@@ -213,14 +214,25 @@ async function importXprvKey(ctx) {
         return;
     }
     if (!isValidXprv(xprv)) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
+        return;
+    }
+    if (!isMasterExtendedKey(xprv)) {
+        showFlash(
+            "That is an account-level or child key, which cannot be imported. " +
+                "Please paste the master extended private key for the wallet.",
+        );
         return;
     }
     let result;
     try {
         result = hdWalletFromXprv(xprv);
     } catch (e) {
-        showFlash("Invalid extended private key.");
+        showFlash(
+            "That extended private key is not valid. Please check it and try again.",
+        );
         return;
     }
     const { xpub, firstAddress } = result;

src/popup/views/addressDetail.js

@@ -148,6 +148,7 @@ async function loadTransactions(address) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
+            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,

src/popup/views/addressToken.js

@@ -222,6 +222,7 @@ async function loadTransactions(address, tokenId) {
             state.blockscoutUrl,
         );
         const result = filterTransactions(rawTxs, {
+            hideSpoofedSymbols: state.hideSpoofedSymbols,
             hideLowHolderTokens: state.hideLowHolderTokens,
             hideFraudContracts: state.hideFraudContracts,
             hideDustTransactions: state.hideDustTransactions,

src/popup/views/confirmTx.js

@@ -32,11 +32,24 @@ const {
     getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
+const {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    feeReserveWei,
+    feeEstimateWei,
+    validateTransfer,
+} = require("../../shared/txValidation");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 
 let pendingTx = null;
+// Network fee for the transaction currently on screen. Reset by show() and
+// filled in by estimateGas() when the estimate resolves or fails.
+let feeStatus = FEE_PENDING;
+let feeWei = null;
 
 function restore() {
     const d = state.viewData;
@@ -67,6 +80,8 @@ function valueWithUsd(text, usdAmount) {
 
 function show(txInfo) {
     pendingTx = txInfo;
+    feeStatus = FEE_PENDING;
+    feeWei = null;
 
     const isErc20 = txInfo.token !== "ETH";
     const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
@@ -153,50 +168,14 @@ function show(txInfo) {
         warningsEl.style.visibility = "hidden";
     }
 
-    // Check for errors
-    const errors = [];
-    if (isErc20) {
-        const tokenBal = parseFloat(txInfo.tokenBalance || "0");
-        if (parseFloat(txInfo.amount) > tokenBal) {
-            errors.push(
-                "Insufficient " +
-                    symbol +
-                    " balance. You have " +
-                    txInfo.tokenBalance +
-                    " " +
-                    symbol +
-                    " but are trying to send " +
-                    txInfo.amount +
-                    " " +
-                    symbol +
-                    ".",
-            );
-        }
-    } else if (parseFloat(txInfo.amount) > parseFloat(txInfo.balance)) {
-        errors.push(
-            "Insufficient balance. You have " +
-                txInfo.balance +
-                " ETH but are trying to send " +
-                txInfo.amount +
-                " ETH.",
-        );
-    }
+    // The two fee messages are mutually exclusive per transaction type, and
+    // the type is known here, before the first paint. Drop the one that can
+    // never apply and reserve the space of the one that can, so the async
+    // estimate landing later never moves anything.
+    $("confirm-amount-fee-error").classList.toggle("hidden", isErc20);
+    $("confirm-gas-error").classList.toggle("hidden", !isErc20);
 
-    const errorsEl = $("confirm-errors");
-    const sendBtn = $("btn-confirm-send");
-    if (errors.length > 0) {
-        errorsEl.innerHTML = errors
-            .map((e) => `<div class="text-xs">${e}</div>`)
-            .join("");
-        errorsEl.style.visibility = "visible";
-        sendBtn.disabled = true;
-        sendBtn.classList.add("text-muted");
-    } else {
-        errorsEl.innerHTML = "";
-        errorsEl.style.visibility = "hidden";
-        sendBtn.disabled = false;
-        sendBtn.classList.remove("text-muted");
-    }
+    renderValidation(txInfo);
 
     // Reset password field and error
     $("confirm-tx-password").value = "";
@@ -205,6 +184,7 @@ function show(txInfo) {
     // Gas estimate — show placeholder then fetch async
     $("confirm-fee").style.visibility = "visible";
     $("confirm-fee-amount").textContent = "Estimating...";
+    setVisible("confirm-fee-reserve", false);
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
     attachCopyHandlers("view-confirm-tx");
@@ -224,11 +204,101 @@ function show(txInfo) {
     checkRecipientHistory(txInfo);
 }
 
+// Render the balance check for the transaction on screen. Called once during
+// show() and again when the fee estimate resolves or fails. Every element it
+// touches already occupies its space, so re-running it never moves anything.
+function renderValidation(txInfo) {
+    const isErc20 = txInfo.token !== "ETH";
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
+
+    const { canSend, codes } = validateTransfer({
+        isErc20,
+        amount: txInfo.amount,
+        ethBalance: txInfo.balance,
+        tokenBalance: txInfo.tokenBalance,
+        feeStatus,
+        feeWei,
+    });
+
+    // Messages carrying the user's own numbers are built here; the fixed
+    // sentences live in the reserved elements in index.html.
+    const messages = [];
+    if (codes.includes(CODES.AMOUNT_INVALID)) {
+        messages.push("Please enter a valid amount to send.");
+    }
+    if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
+        messages.push(
+            "Insufficient " +
+                symbol +
+                " balance. You have " +
+                txInfo.tokenBalance +
+                " " +
+                symbol +
+                " but are trying to send " +
+                txInfo.amount +
+                " " +
+                symbol +
+                ".",
+        );
+    }
+    if (codes.includes(CODES.INSUFFICIENT_ETH)) {
+        messages.push(
+            "Insufficient balance. You have " +
+                txInfo.balance +
+                " ETH but are trying to send " +
+                txInfo.amount +
+                " ETH.",
+        );
+    }
+
+    const errorsEl = $("confirm-errors");
+    if (messages.length > 0) {
+        errorsEl.innerHTML = messages
+            .map((m) => `<div class="text-xs">${escapeHtml(m)}</div>`)
+            .join("");
+        errorsEl.style.visibility = "visible";
+    } else {
+        errorsEl.innerHTML = "";
+        errorsEl.style.visibility = "hidden";
+    }
+
+    setVisible(
+        "confirm-amount-fee-error",
+        codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
+    );
+    setVisible(
+        "confirm-gas-error",
+        codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
+    );
+    setVisible(
+        "confirm-fee-unknown-error",
+        codes.includes(CODES.FEE_UNAVAILABLE),
+    );
+
+    // While the estimate is in flight there is no error to show — the fee
+    // line already reads "Estimating..." — but sending stays blocked so a
+    // transaction the fee would break cannot be signed in the meantime.
+    const sendBtn = $("btn-confirm-send");
+    sendBtn.disabled = !canSend;
+    sendBtn.classList.toggle("text-muted", !canSend);
+}
+
+function setVisible(id, visible) {
+    $(id).style.visibility = visible ? "visible" : "hidden";
+}
+
+// A fee in wei as an ETH string, truncated to 6 decimal places.
+function formatFeeEth(wei) {
+    const parts = formatEther(wei).split(".");
+    const dec =
+        parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
+    return parts[0] + "." + dec + " ETH";
+}
+
 async function estimateGas(txInfo) {
     try {
         const provider = getProvider(state.rpcUrl);
         const feeData = await provider.getFeeData();
-        const gasPrice = feeData.gasPrice;
         let gasLimit;
 
         if (txInfo.token === "ETH") {
@@ -246,21 +316,55 @@ async function estimateGas(txInfo) {
             });
         }
 
-        const gasCostWei = gasLimit * gasPrice;
-        const gasCostEth = formatEther(gasCostWei);
-        // Format to 6 significant decimal places
-        const parts = gasCostEth.split(".");
-        const dec =
-            parts.length > 1
-                ? parts[1].slice(0, 6).replace(/0+$/, "") || "0"
-                : "0";
-        const feeStr = parts[0] + "." + dec + " ETH";
+        // What the node will require to be reserved, which is what the gate
+        // must be: the send pins no fee fields, so it is broadcast as a
+        // type-2 transaction priced at maxFeePerGas.
+        const gasCostWei = feeReserveWei(gasLimit, feeData);
+        if (gasCostWei === null) {
+            throw new Error("no usable gas price from the provider");
+        }
+        // What the transaction is expected to cost, which is a different and
+        // usually much smaller number. Both are shown: quoting only the
+        // reserve overstates the typical cost by roughly double on mainnet,
+        // and quoting only the estimate contradicts the balance check.
+        const estimateWei = feeEstimateWei(gasLimit, feeData);
+        // The user may have left this transaction while the estimate was in
+        // flight; a stale fee must not reach the screen or the balance check.
+        if (pendingTx !== txInfo) return;
+
         const ethPrice = getPrice("ETH");
-        const feeUsd = ethPrice ? parseFloat(gasCostEth) * ethPrice : null;
-        $("confirm-fee-amount").textContent = valueWithUsd(feeStr, feeUsd);
+        const usd = (wei) =>
+            ethPrice ? parseFloat(formatEther(wei)) * ethPrice : null;
+
+        if (estimateWei !== null && estimateWei < gasCostWei) {
+            $("confirm-fee-amount").textContent = valueWithUsd(
+                "~" + formatFeeEth(estimateWei),
+                usd(estimateWei),
+            );
+            $("confirm-fee-reserve").textContent =
+                "up to " + formatFeeEth(gasCostWei) + " reserved";
+            setVisible("confirm-fee-reserve", true);
+        } else {
+            // No spread to report: either there is no estimate, or the node
+            // quotes a gas price at or above maxFeePerGas, so the expected
+            // cost is not below the reserve. Show the reserve alone.
+            $("confirm-fee-amount").textContent = valueWithUsd(
+                formatFeeEth(gasCostWei),
+                usd(gasCostWei),
+            );
+            setVisible("confirm-fee-reserve", false);
+        }
+        feeStatus = FEE_KNOWN;
+        feeWei = gasCostWei;
+        renderValidation(txInfo);
     } catch (e) {
         log.errorf("gas estimation failed:", e.message);
+        if (pendingTx !== txInfo) return;
         $("confirm-fee-amount").textContent = "Unable to estimate";
+        setVisible("confirm-fee-reserve", false);
+        feeStatus = FEE_UNAVAILABLE;
+        feeWei = null;
+        renderValidation(txInfo);
     }
 }
 

src/popup/views/home.js

@@ -163,6 +163,7 @@ async function loadHomeTxs(ctx) {
     if (allAddresses.length === 0) return;
 
     const filters = {
+        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,

src/popup/views/settings.js

@@ -303,6 +303,12 @@ function init(ctx) {
         applyTheme(state.theme);
     });
 
+    $("settings-hide-spoofed-symbols").checked = state.hideSpoofedSymbols;
+    $("settings-hide-spoofed-symbols").addEventListener("change", async () => {
+        state.hideSpoofedSymbols = $("settings-hide-spoofed-symbols").checked;
+        await saveState();
+    });
+
     $("settings-hide-low-holders").checked = state.hideLowHolderTokens;
     $("settings-hide-low-holders").addEventListener("change", async () => {
         state.hideLowHolderTokens = $("settings-hide-low-holders").checked;

src/shared/alarms.js

@@ -0,0 +1,114 @@
+// Periodic scheduling for the background context.
+//
+// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
+// which takes every setInterval/setTimeout with it. The extension alarms API
+// is the mechanism that survives: the browser holds the schedule and wakes
+// the worker to deliver onAlarm. Firefox MV2 runs a persistent background
+// page where timers would survive, but alarms behave identically there, so
+// both targets share this path and both manifests declare the "alarms"
+// permission.
+//
+// Periods are whole minutes at or above the browser-enforced one-minute
+// minimum, so nothing here is silently clamped to a slower cadence.
+//
+// Trap for anyone changing a period: each job also carries a freshness guard
+// that can veto its own scheduled tick. A guard timed to the alarm period
+// halves the real cadence, because the guard is measured from when the last
+// run finished and the alarm fires one run-duration earlier than that. Every
+// guard must therefore either be strictly shorter than the period it gates or
+// be bypassed on the scheduled tick — see backgroundRefresh() in
+// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
+
+const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
+const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
+
+const MIN_ALARM_PERIOD_MINUTES = 1;
+const BALANCE_REFRESH_PERIOD_MINUTES = 1;
+const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
+
+// Resolved on use rather than captured at module load: the worker is torn
+// down and re-evaluated repeatedly, and tests install a stub after requiring
+// the module.
+function alarmsApi() {
+    if (typeof browser !== "undefined" && browser.alarms) return browser.alarms;
+    if (typeof chrome !== "undefined" && chrome.alarms) return chrome.alarms;
+    return null;
+}
+
+/**
+ * Create an alarm unless one with the requested period already exists.
+ *
+ * The existence check is load-bearing: creating an alarm resets its schedule,
+ * and this runs on every worker wake. Creating unconditionally would push the
+ * next fire time out on every incoming message, so a busy extension would
+ * never see the alarm fire at all.
+ *
+ * The period comparison is equally load-bearing in the other direction: an
+ * alarm created by an older version keeps its old period forever unless a
+ * changed constant re-creates it, so a period edit would never reach an
+ * existing install. Re-creating on a period change happens once and then
+ * settles into the existence check above.
+ *
+ * @param {string} name
+ * @param {number} periodInMinutes
+ * @returns {Promise<boolean>} true if the alarm was created by this call.
+ */
+async function ensureAlarm(name, periodInMinutes) {
+    const api = alarmsApi();
+    if (!api) return false;
+    const period = Math.max(periodInMinutes, MIN_ALARM_PERIOD_MINUTES);
+    const existing = await api.get(name);
+    if (existing && existing.periodInMinutes === period) return false;
+    api.create(name, {
+        periodInMinutes: period,
+        delayInMinutes: period,
+    });
+    return true;
+}
+
+/**
+ * Ensure both recurring background jobs are scheduled. Safe to call on every
+ * worker start, on onInstalled and on onStartup.
+ *
+ * @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
+ * call had to create.
+ */
+async function ensureRecurringAlarms() {
+    const balance = await ensureAlarm(
+        BALANCE_REFRESH_ALARM,
+        BALANCE_REFRESH_PERIOD_MINUTES,
+    );
+    const phishing = await ensureAlarm(
+        PHISHING_REFRESH_ALARM,
+        PHISHING_REFRESH_PERIOD_MINUTES,
+    );
+    return { balance, phishing };
+}
+
+/**
+ * Register per-alarm handlers. One listener dispatches by alarm name so the
+ * worker only ever installs a single onAlarm listener.
+ *
+ * @param {Object<string, function>} handlers
+ * @returns {boolean} true if the listener was installed.
+ */
+function registerAlarmHandlers(handlers) {
+    const api = alarmsApi();
+    if (!api || !api.onAlarm) return false;
+    api.onAlarm.addListener((alarm) => {
+        const handler = handlers[alarm && alarm.name];
+        if (handler) handler();
+    });
+    return true;
+}
+
+module.exports = {
+    BALANCE_REFRESH_ALARM,
+    PHISHING_REFRESH_ALARM,
+    MIN_ALARM_PERIOD_MINUTES,
+    BALANCE_REFRESH_PERIOD_MINUTES,
+    PHISHING_REFRESH_PERIOD_MINUTES,
+    ensureAlarm,
+    ensureRecurringAlarms,
+    registerAlarmHandlers,
+};

src/shared/ens.js

@@ -1,6 +1,11 @@
 // Cached ENS reverse resolution.
 // Resolves addresses to ENS names via ethers provider.lookupAddress(),
 // caching results in localStorage with a 12-hour TTL.
+//
+// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
+// so this module must not be pulled into src/background/. Anything the
+// background context needs to cache goes in extension storage instead (see
+// shared/phishingDomains.js).
 
 const { getProvider } = require("./balances");
 const { log } = require("./log");

src/shared/phishingDomains.js

@@ -8,8 +8,14 @@
 // The domain-checker checks the in-memory delta first (fresh/recent scam
 // sites), then falls back to the vendored list.
 //
-// If the delta is under 256 KiB it is persisted to localStorage so it
-// survives extension/service-worker restarts.
+// If the delta and its fetch timestamp fit in 256 KiB they are persisted to
+// extension storage, so they survive termination of the MV3 service worker.
+// Extension storage, not localStorage: localStorage does not exist in a
+// service worker, so the previous persistence never ran on Chrome at all.
+// The stored timestamps are what keep a restarted worker from re-fetching on
+// every wake while still noticing an overdue update. Those guards apply to the
+// startup path only; the 24-hour alarm tick bypasses them, or it would veto
+// its own refresh — see updatePhishingList().
 
 const vendoredConfig = require("./phishingBlocklist.json");
 
@@ -17,7 +23,14 @@ const BLOCKLIST_URL =
     "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+// Floor on how often an unscheduled path may hit the network. The worker is
+// revived every ~30 seconds while the browser is busy, and every revival runs
+// the startup path; without a persisted record of the last attempt, any state
+// that leaves lastFetchTime unset — a fetch that failed, or a delta too large
+// to store — would download the full list on every single wake.
+const MIN_FETCH_ATTEMPT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+
 const DELTA_STORAGE_KEY = "phishing-delta";
 const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 
@@ -29,45 +42,104 @@ const vendoredBlacklist = new Set(
 // Delta set — only entries from live list that are NOT in vendored.
 let deltaBlacklist = new Set();
 let lastFetchTime = 0;
+let lastAttemptTime = 0;
 let fetchPromise = null;
-let refreshTimer = null;
+let loadPromise = null;
+
+// Resolved on use rather than captured at module load, so a test can install
+// a stub after requiring the module and so the popup — which has no reason to
+// touch the delta — does not fail to load where the API is absent.
+function storageApi() {
+    if (typeof browser !== "undefined" && browser.storage) {
+        return browser.storage.local;
+    }
+    if (typeof chrome !== "undefined" && chrome.storage) {
+        return chrome.storage.local;
+    }
+    return null;
+}
 
 /**
- * Load delta entries from localStorage on startup.
- * Called once during module initialization in the background script.
+ * Sanitise a timestamp read back from storage.
+ *
+ * A value in the future is permanent poison: every guard here measures elapsed
+ * time as `Date.now() - stamp` and tests only the lower bound, so a stamp a
+ * year ahead suppresses updates for a year with no path that ever clears it.
+ * Clock skew and a restored profile backup both produce one. Since these
+ * timestamps only ever gate work, discarding an impossible one is safe: it
+ * costs at most a single extra fetch and restores a sane value immediately.
+ *
+ * @param {unknown} value
+ * @returns {number} the timestamp, or 0 if it is unusable.
  */
-function loadDeltaFromStorage() {
+function sanitizeTimestamp(value) {
+    if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+    if (value <= 0 || value > Date.now()) return 0;
+    return value;
+}
+
+/**
+ * Load the persisted delta and its timestamps from extension storage.
+ * Runs once per worker lifetime; every entry point funnels through
+ * ensureDeltaLoaded() so a wake from termination restores state exactly once.
+ *
+ * @returns {Promise<void>}
+ */
+async function loadDeltaFromStorage() {
+    const storage = storageApi();
+    if (!storage) return;
     try {
-        const raw = localStorage.getItem(DELTA_STORAGE_KEY);
-        if (!raw) return;
-        const data = JSON.parse(raw);
-        if (data.blacklist && Array.isArray(data.blacklist)) {
+        const result = await storage.get(DELTA_STORAGE_KEY);
+        const data = result && result[DELTA_STORAGE_KEY];
+        if (!data) return;
+        if (Array.isArray(data.blacklist)) {
             deltaBlacklist = new Set(
                 data.blacklist.map((d) => d.toLowerCase()),
             );
         }
+        lastFetchTime = sanitizeTimestamp(data.lastFetchTime);
+        lastAttemptTime = sanitizeTimestamp(data.lastAttemptTime);
     } catch {
-        // localStorage unavailable or corrupt — start empty
+        // Storage unavailable or corrupt — start empty and re-fetch.
     }
 }
 
+function ensureDeltaLoaded() {
+    if (!loadPromise) loadPromise = loadDeltaFromStorage();
+    return loadPromise;
+}
+
 /**
- * Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
+ * Persist the delta and its timestamps if they fit within MAX_DELTA_BYTES.
+ *
+ * The 256 KiB cap covers the delta and its freshness claim: when the delta is
+ * too large to keep, lastFetchTime goes with it, so the next start re-fetches
+ * rather than trusting a freshness claim for a delta it no longer holds.
+ * lastAttemptTime is written either way — it records that the network was
+ * contacted, which stays true whatever became of the response, and it is what
+ * stops a permanently oversized list from downloading on every worker wake.
+ *
+ * @returns {Promise<void>}
  */
-function saveDeltaToStorage() {
+async function saveDeltaToStorage() {
+    const storage = storageApi();
+    if (!storage) return;
     try {
         const data = {
             blacklist: Array.from(deltaBlacklist),
+            lastFetchTime,
+            lastAttemptTime,
         };
         const json = JSON.stringify(data);
         if (json.length < MAX_DELTA_BYTES) {
-            localStorage.setItem(DELTA_STORAGE_KEY, json);
+            await storage.set({ [DELTA_STORAGE_KEY]: data });
+        } else if (lastAttemptTime > 0) {
+            await storage.set({ [DELTA_STORAGE_KEY]: { lastAttemptTime } });
         } else {
-            // Too large — remove stale key if present
-            localStorage.removeItem(DELTA_STORAGE_KEY);
+            await storage.remove(DELTA_STORAGE_KEY);
         }
     } catch {
-        // localStorage unavailable — skip silently
+        // Storage unavailable — skip silently
     }
 }
 
@@ -76,6 +148,7 @@ function saveDeltaToStorage() {
  * Used for both live fetches and testing.
  *
  * @param {{ blacklist?: string[] }} config
+ * @returns {Promise<void>} resolves once the delta has been persisted.
  */
 function loadConfig(config) {
     const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
@@ -86,7 +159,7 @@ function loadConfig(config) {
     );
 
     lastFetchTime = Date.now();
-    saveDeltaToStorage();
+    return saveDeltaToStorage();
 }
 
 /**
@@ -111,6 +184,11 @@ function hostnameVariants(hostname) {
  * Check if a hostname is on the phishing blocklist.
  * Checks delta first (fresh/recent scam sites), then vendored list.
  *
+ * Synchronous by design — callers answer an approval prompt with it. On a
+ * worker that has just woken, the persisted delta may still be loading; the
+ * vendored list, which is bundled and always present, carries the check until
+ * it lands.
+ *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
  */
@@ -127,28 +205,59 @@ function isPhishingDomain(hostname) {
 
 /**
  * Fetch the latest blocklist and compute delta against vendored data.
- * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
+ * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS,
+ * counted from the persisted timestamp so the cache outlives the worker.
  *
+ * `force` is what makes the 24-hour alarm actually refresh every 24 hours.
+ * The alarm fires one period after the previous alarm, but lastFetchTime is
+ * stamped when that fetch *completed*, so an unforced tick lands one fetch
+ * latency inside its own TTL, skips, and turns the real cadence into 48 hours.
+ * Shortening the TTL instead would not fix it: the worker wakes every ~30
+ * seconds and the startup path re-checks the TTL each time, so a shortened TTL
+ * simply becomes the real cadence. The TTL is there to stop redundant fetches
+ * on wake, and the scheduled tick is not redundant, so it bypasses it.
+ *
+ * @param {{force?: boolean}} [opts] force: fetch unless one is already in
+ * flight, ignoring both the freshness and the retry guard. For the scheduled
+ * alarm tick only.
  * @returns {Promise<void>}
  */
-async function updatePhishingList() {
-    // Skip if recently fetched
-    if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
+async function updatePhishingList({ force = false } = {}) {
+    // A worker that has just been revived knows nothing until the persisted
+    // record is back in memory; without this the freshness check below would
+    // always see 0 and re-fetch on every wake.
+    await ensureDeltaLoaded();
+
+    if (!force) {
+        const now = Date.now();
+        // Skip if recently fetched.
+        if (lastFetchTime > 0 && now - lastFetchTime < CACHE_TTL_MS) return;
+        // Skip if the network was contacted recently and the result was not
+        // usable — a failed fetch or an oversized delta leaves lastFetchTime
+        // unset, and without this every wake would retry.
+        if (
+            lastAttemptTime > 0 &&
+            now - lastAttemptTime < MIN_FETCH_ATTEMPT_INTERVAL_MS
+        ) {
             return;
         }
+    }
 
     // De-duplicate concurrent calls
     if (fetchPromise) return fetchPromise;
 
     fetchPromise = (async () => {
+        lastAttemptTime = Date.now();
         try {
             const resp = await fetch(BLOCKLIST_URL);
             if (!resp.ok) throw new Error("HTTP " + resp.status);
             const config = await resp.json();
-            loadConfig(config);
+            await loadConfig(config);
         } catch {
-            // Silently fail — vendored list still provides coverage.
-            // We'll retry next time.
+            // Silently fail — vendored list still provides coverage. Persist
+            // the attempt so a persistently failing fetch is retried on the
+            // schedule rather than on every wake.
+            await saveDeltaToStorage();
         } finally {
             fetchPromise = null;
         }
@@ -158,12 +267,29 @@ async function updatePhishingList() {
 }
 
 /**
- * Start periodic refresh of the phishing list.
- * Should be called once from the background script on startup.
+ * Restore persisted state and fetch if the list is overdue.
+ *
+ * Called from the background script every time it starts — a fresh install,
+ * a browser start, and every revival of a terminated service worker all land
+ * here. The recurring 24-hour schedule itself is an alarm (see
+ * shared/alarms.js), not a timer, because timers die with the worker.
+ *
+ * @returns {Promise<void>}
  */
-function startPeriodicRefresh() {
-    if (refreshTimer) return;
-    refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
+async function initPhishingList() {
+    await ensureDeltaLoaded();
+    return updatePhishingList();
+}
+
+/**
+ * The 24-hour alarm tick. Separate from initPhishingList() because this is the
+ * scheduled refresh and must not be vetoed by the guards that exist to keep
+ * the unscheduled startup path off the network.
+ *
+ * @returns {Promise<void>}
+ */
+async function refreshPhishingListOnSchedule() {
+    return updatePhishingList({ force: true });
 }
 
 /**
@@ -190,21 +316,22 @@ function getDeltaSize() {
 function _reset() {
     deltaBlacklist = new Set();
     lastFetchTime = 0;
+    lastAttemptTime = 0;
     fetchPromise = null;
-    if (refreshTimer) {
-        clearInterval(refreshTimer);
-        refreshTimer = null;
-    }
+    loadPromise = null;
 }
 
-// Load persisted delta on module initialization
-loadDeltaFromStorage();
-
 module.exports = {
     isPhishingDomain,
     updatePhishingList,
-    startPeriodicRefresh,
+    refreshPhishingListOnSchedule,
+    initPhishingList,
+    loadDeltaFromStorage,
     loadConfig,
+    CACHE_TTL_MS,
+    MIN_FETCH_ATTEMPT_INTERVAL_MS,
+    DELTA_STORAGE_KEY,
+    MAX_DELTA_BYTES,
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,

src/shared/state.js

@@ -21,6 +21,7 @@ const DEFAULT_STATE = {
     deniedSites: {},
     rememberSiteChoice: true,
     showZeroBalanceTokens: true,
+    hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
     hideFraudContracts: true,
     hideDustTransactions: true,
@@ -61,6 +62,7 @@ async function saveState() {
         deniedSites: state.deniedSites,
         rememberSiteChoice: state.rememberSiteChoice,
         showZeroBalanceTokens: state.showZeroBalanceTokens,
+        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,
@@ -112,6 +114,12 @@ async function loadState() {
             saved.showZeroBalanceTokens !== undefined
                 ? saved.showZeroBalanceTokens
                 : true;
+        // A profile written before this setting existed has no key for it.
+        // It is a safety filter, so absent must load as on, not as undefined.
+        state.hideSpoofedSymbols =
+            saved.hideSpoofedSymbols !== undefined
+                ? saved.hideSpoofedSymbols
+                : true;
         state.hideLowHolderTokens =
             saved.hideLowHolderTokens !== undefined
                 ? saved.hideLowHolderTokens

src/shared/transactions.js

@@ -267,12 +267,19 @@ function filterTransactions(txs, filters = {}) {
     const dustThresholdGwei = filters.dustThresholdGwei ?? 100000;
     const newFraud = [];
     const filtered = [];
+    // Fail-safe, unlike the three flags below: this one is off only when the
+    // caller says so explicitly, so a caller that omits the key keeps the
+    // check rather than silently losing it.  The setting also governs the
+    // blocklist learning below, which exists only to serve this check —
+    // leaving learning on while the check is off would re-hide the very rows
+    // the user asked to see, through the fraud-contract rule.
+    const hideSpoofed = filters.hideSpoofedSymbols !== false;
 
     for (const tx of txs) {
         const contract = normalizeAddress(tx.contractAddress);
 
-        // Always filter spoofed known symbols and record the fraud contract
-        if (isSpoofedSymbol(tx)) {
+        // Filter spoofed known symbols and record the fraud contract
+        if (hideSpoofed && isSpoofedSymbol(tx)) {
             if (contract && !fraudSet.has(contract)) {
                 fraudSet.add(contract);
                 newFraud.push(contract);

src/shared/txValidation.js

@@ -0,0 +1,171 @@
+// Balance arithmetic for the transaction confirmation screen.
+//
+// Pure: no DOM, no network, no state. Everything is exact integer math on
+// 18-decimal fixed point (wei for ETH), so it can be unit tested directly
+// instead of through the confirmation view. The caller maps the returned
+// codes to the reserved message elements on the screen.
+//
+// Human decimal strings ("1.25") are scaled to 18 decimals for comparison.
+// That scale is independent of a token's own decimals: both the amount and
+// the token balance arrive as human decimal strings, so comparing them at a
+// common scale is exact.
+
+const { parseUnits } = require("ethers");
+
+const SCALE_DECIMALS = 18;
+
+// Whether the asynchronous fee estimate has arrived yet.
+const FEE_PENDING = "pending";
+const FEE_KNOWN = "known";
+const FEE_UNAVAILABLE = "unavailable";
+
+const CODES = {
+    // The amount is not a non-negative number we can do exact arithmetic on.
+    AMOUNT_INVALID: "amount-invalid",
+    // ERC-20: the token amount exceeds the token balance.
+    INSUFFICIENT_TOKEN: "insufficient-token",
+    // ETH: the amount alone already exceeds the ETH balance.
+    INSUFFICIENT_ETH: "insufficient-eth",
+    // ETH: the amount fits, the amount plus the network fee does not.
+    INSUFFICIENT_ETH_WITH_FEE: "insufficient-eth-with-fee",
+    // ERC-20: the token balance covers the transfer, the ETH balance does
+    // not cover the network fee it costs.
+    INSUFFICIENT_ETH_FOR_FEE: "insufficient-eth-for-fee",
+    // The fee estimate has not arrived yet.
+    FEE_PENDING: "fee-pending",
+    // The fee estimate failed. Unknown is never treated as zero.
+    FEE_UNAVAILABLE: "fee-unavailable",
+};
+
+// The fee that must be reserved for a transaction, in wei: the amount the
+// node will require, not the amount the transaction is expected to cost.
+//
+// A send that pins no fee fields is populated by ethers as a type-2
+// (EIP-1559) transaction, and a node validates that against
+// `value + gasLimit * maxFeePerGas`. ethers derives maxFeePerGas as
+// `baseFeePerGas * 2 + maxPriorityFeePerGas`, so reserving `gasPrice`
+// (roughly `baseFee + tip`) under-reserves by about `gasLimit * baseFee` and
+// lets through a transaction the node then rejects with "insufficient funds
+// for gas * price + value". gasPrice is the fallback only for a network that
+// offers no type-2 pricing at all.
+//
+// Returns null when no usable price is available, which the caller must treat
+// as a failed estimate rather than as a free transaction.
+function feeReserveWei(gasLimit, feeData) {
+    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
+    const price = feeData?.maxFeePerGas ?? feeData?.gasPrice;
+    if (typeof price !== "bigint" || price < 0n) return null;
+    return gasLimit * price;
+}
+
+// What the transaction is expected to actually cost, in wei — not what must
+// be reserved for it. A type-2 transaction is charged `baseFee + tip` per gas
+// and refunded the rest of the cap, and `eth_gasPrice` reports roughly that,
+// so gasPrice is the estimate and maxFeePerGas is the reserve. On a network
+// with no type-2 pricing the two are the same number.
+//
+// Display only: nothing gates on this. Returns null on the same unusable
+// inputs as feeReserveWei().
+function feeEstimateWei(gasLimit, feeData) {
+    if (typeof gasLimit !== "bigint" || gasLimit < 0n) return null;
+    const price = feeData?.gasPrice ?? feeData?.maxFeePerGas;
+    if (typeof price !== "bigint" || price < 0n) return null;
+    return gasLimit * price;
+}
+
+// Scale a human decimal string to 18-decimal fixed point. Returns null when
+// the value is not a decimal number or carries more precision than the scale
+// can hold, which the caller must treat as unusable rather than as zero.
+function toFixedPoint(value) {
+    if (typeof value !== "string" && typeof value !== "number") return null;
+    const text = String(value).trim();
+    if (text === "") return null;
+    try {
+        return parseUnits(text, SCALE_DECIMALS);
+    } catch (e) {
+        return null;
+    }
+}
+
+// Validate a pending transfer against the balances that must cover it.
+//
+//   isErc20      — token transfer rather than a native ETH transfer
+//   amount       — human decimal string being sent, non-negative. Anything
+//                  else, a negative value included, is an unusable amount
+//                  rather than an amount that passes every comparison.
+//   ethBalance   — human decimal string, the sender's ETH balance
+//   tokenBalance — human decimal string, the sender's token balance
+//   feeStatus    — FEE_PENDING, FEE_KNOWN or FEE_UNAVAILABLE. Anything else
+//                  is treated as FEE_UNAVAILABLE.
+//   feeWei       — the fee reserve in wei from feeReserveWei(), as a
+//                  non-negative bigint, when FEE_KNOWN. Any other value makes
+//                  the fee unavailable rather than zero.
+//
+// Returns { canSend, codes }. Every code blocks sending: canSend is true
+// only when nothing was found.
+function validateTransfer({
+    isErc20 = false,
+    amount,
+    ethBalance,
+    tokenBalance,
+    feeStatus = FEE_PENDING,
+    feeWei = null,
+} = {}) {
+    const codes = [];
+
+    const amountFp = toFixedPoint(amount);
+    const ethFp = toFixedPoint(ethBalance) ?? 0n;
+
+    // A negative amount parses to a valid bigint, so every comparison below
+    // is trivially false and the send clears the screen — then dies at encode
+    // time in parseEther(). Unusable, on the same footing as a malformed fee.
+    if (amountFp === null || amountFp < 0n) {
+        codes.push(CODES.AMOUNT_INVALID);
+        return { canSend: false, codes };
+    }
+
+    // Fail closed. Anything that is not a usable fee under a recognised
+    // status — a malformed feeWei, or a status this module does not know —
+    // is an unavailable estimate, never a fee of zero. Every such input errs
+    // in the direction that lets money out, so none of them is trusted.
+    const known =
+        feeStatus === FEE_KNOWN && typeof feeWei === "bigint" && feeWei >= 0n;
+    let status = feeStatus;
+    if (feeStatus === FEE_KNOWN && !known) status = FEE_UNAVAILABLE;
+    if (status !== FEE_KNOWN && status !== FEE_PENDING) {
+        status = FEE_UNAVAILABLE;
+    }
+
+    const feeFp = known ? feeWei : null;
+
+    if (isErc20) {
+        const tokenFp = toFixedPoint(tokenBalance) ?? 0n;
+        if (amountFp > tokenFp) codes.push(CODES.INSUFFICIENT_TOKEN);
+        if (feeFp !== null && feeFp > ethFp) {
+            codes.push(CODES.INSUFFICIENT_ETH_FOR_FEE);
+        }
+    } else if (amountFp > ethFp) {
+        codes.push(CODES.INSUFFICIENT_ETH);
+    } else if (feeFp !== null && amountFp + feeFp > ethFp) {
+        codes.push(CODES.INSUFFICIENT_ETH_WITH_FEE);
+    }
+
+    // An unknown fee is never assumed to be zero: sending stays blocked
+    // until the estimate arrives, and stays blocked if it never does.
+    if (status === FEE_PENDING) codes.push(CODES.FEE_PENDING);
+    if (status === FEE_UNAVAILABLE) codes.push(CODES.FEE_UNAVAILABLE);
+
+    return { canSend: codes.length === 0, codes };
+}
+
+module.exports = {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    SCALE_DECIMALS,
+    feeReserveWei,
+    feeEstimateWei,
+    toFixedPoint,
+    validateTransfer,
+};

src/shared/vault.js

@@ -1,14 +1,80 @@
 // Vault: password-based encryption of secrets using libsodium.
 // Uses Argon2id for key derivation and XSalsa20-Poly1305 for encryption.
 // All crypto operations are delegated to libsodium — no raw primitives.
+//
+// Backend: WebAssembly, deliberately (#182).
+//
+// libsodium ships one file containing both a WebAssembly build and a
+// wasm2js ("asm.js") translation of it. It tries WASM first and, if
+// instantiation throws, silently swaps in the translation. An extension
+// CSP of plain script-src 'self' refuses WASM, so every popup load used
+// to take that fallback — announced by nothing but an uncaught
+// CompileError in the console.
+//
+// Measured here, same Argon2id parameters (OPSLIMIT_INTERACTIVE,
+// MEMLIMIT_INTERACTIVE = 2 passes over 64MiB), node 22 on this machine:
+// WASM 141-198ms per derivation, wasm2js 3204-3660ms. The work factor is
+// identical either way — it is set by the ops/mem parameters, not by wall
+// time — so the fallback bought no security, it only made every password
+// operation take three and a half seconds, and the wallet asks for the
+// password on every signature.
+//
+// So both manifests declare 'wasm-unsafe-eval' for extension pages. That
+// keyword permits compiling WebAssembly and nothing else: not eval() of
+// strings, not inline script, not remote script. Reaching it requires
+// already executing script in the extension page, which is total
+// compromise on its own. 'unsafe-eval' would be a different matter and is
+// not granted. tests/manifest.test.js pins both policies to exactly
+// "'self' 'wasm-unsafe-eval'" so neither the grant nor the surrounding
+// strictness can drift unnoticed.
+//
+// The fallback still exists, and a wallet that refuses to decrypt is
+// worse than a slow one, so it is not disabled — it is made loud:
+// cryptoBackend() reports which backend this realm can run, ensureReady()
+// logs an error if it is not WASM, tests/vaultBackend.test.js asserts the
+// unit tests exercise the WASM backend, and the end-to-end suite asserts
+// it in the real popup under the real manifest.
 
 const sodium = require("libsodium-wrappers-sumo");
+const { log } = require("./log");
+
+// An empty WebAssembly module: the 8-byte magic number and version header,
+// no sections. Compiling it asks the cheapest possible form of the only
+// question that matters here — may this realm compile WebAssembly at all —
+// which is exactly what a CSP without 'wasm-unsafe-eval' refuses, and
+// exactly what decides which backend libsodium ends up on.
+const EMPTY_WASM_MODULE = new Uint8Array([
+    0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+]);
+
+// "wasm" or "asmjs": whether this realm may compile WebAssembly, which is
+// what decides libsodium's backend when the CSP is the reason it cannot —
+// the case this codebase guards. It probes the realm, not libsodium, so a
+// fallback taken for some other reason (allocation failure, corrupt module)
+// would not be caught here; tests/vaultBackend.test.js checks libsodium's
+// own marker directly.
+async function cryptoBackend() {
+    try {
+        await WebAssembly.compile(EMPTY_WASM_MODULE);
+        return "wasm";
+    } catch (_) {
+        return "asmjs";
+    }
+}
 
 let ready = false;
 
 async function ensureReady() {
     if (!ready) {
         await sodium.ready;
+        if ((await cryptoBackend()) !== "wasm") {
+            log.errorf(
+                "libsodium is running on the wasm2js fallback: this realm " +
+                    "refuses to compile WebAssembly, so every password " +
+                    "derivation costs roughly 20x what it should. See the " +
+                    "backend note in src/shared/vault.js.",
+            );
+        }
         ready = true;
     }
 }
@@ -59,4 +125,4 @@ async function decryptWithPassword(encrypted, password) {
     return sodium.to_string(plaintext);
 }
 
-module.exports = { encryptWithPassword, decryptWithPassword };
+module.exports = { cryptoBackend, decryptWithPassword, encryptWithPassword };

src/shared/wallet.js

@@ -16,8 +16,60 @@ function generateMnemonic() {
     return m.phrase;
 }
 
+// Every extended key (xprv or xpub) entering the app goes through this.
+//
+// ethers' HDNodeWallet.fromExtendedKey does NOT verify the base58 checksum
+// when the decoded payload is the usual 82 bytes, which is exactly the case
+// the checksum exists to catch: a key with a one-character typo parses into a
+// *different* wallet instead of being rejected. Re-encoding the parsed node
+// reproduces a well-formed key byte for byte, checksum included, so comparing
+// the round trip against the input rejects any altered character. Measured by
+// the sweep in tests/wallet.test.js over every single-character substitution
+// of the BIP-32 vector 1 master key: 199 parse without the round-trip
+// comparison, 0 with it.
+//
+// Returns the parsed node, or null if the key is not a well-formed extended
+// key. Callers turn null into a user-facing error; none of them may fall back
+// to fromExtendedKey directly.
+function parseExtendedKey(key) {
+    if (typeof key !== "string") return null;
+    try {
+        const node = HDNodeWallet.fromExtendedKey(key);
+        return node.extendedKey === key ? node : null;
+    } catch {
+        return null;
+    }
+}
+
+// A master key is at depth 0. Only from there is BIP44_ETH_PATH the absolute
+// path it names; deriving it under an account-level or child key yields
+// addresses that correspond to nothing the user holds.
+const MASTER_DEPTH = 0;
+
+// Parse an extended private key that the BIP-44 Ethereum account path can be
+// derived from, or throw. Both callers derive BIP44_ETH_PATH from the result.
+function masterXprvOrThrow(key) {
+    const node = parseExtendedKey(key);
+    if (!node) {
+        throw new Error("Not a valid extended private key (xprv).");
+    }
+    if (!node.privateKey) {
+        throw new Error("Not an extended private key (xprv).");
+    }
+    if (node.depth !== MASTER_DEPTH) {
+        throw new Error(
+            "Not a master extended private key (xprv): an account-level or " +
+                "child key cannot be imported.",
+        );
+    }
+    return node;
+}
+
 function deriveAddressFromXpub(xpub, index) {
-    const node = HDNodeWallet.fromExtendedKey(xpub);
+    const node = parseExtendedKey(xpub);
+    if (!node) {
+        throw new Error("Not a valid extended key.");
+    }
     return node.deriveChild(index).address;
 }
 
@@ -29,23 +81,28 @@ function hdWalletFromMnemonic(mnemonic) {
 }
 
 function hdWalletFromXprv(xprv) {
-    const root = HDNodeWallet.fromExtendedKey(xprv);
-    if (!root.privateKey) {
-        throw new Error("Not an extended private key (xprv).");
-    }
-    const node = root.derivePath("44'/60'/0'/0");
+    // BIP44_ETH_PATH is absolute ("m/..."), which ethers will only derive from
+    // a depth-0 node. The relative form this used to derive would have been
+    // applied *beneath* an account-level key instead of being refused.
+    const node = masterXprvOrThrow(xprv).derivePath(BIP44_ETH_PATH);
     const xpub = node.neuter().extendedKey;
     const firstAddress = node.deriveChild(0).address;
     return { xpub, firstAddress };
 }
 
+// Well-formed extended private key. Says nothing about depth: the import view
+// reports a non-master key separately, since "check it for a typo" is the
+// wrong advice for a key the user copied correctly.
 function isValidXprv(key) {
-    try {
-        const node = HDNodeWallet.fromExtendedKey(key);
-        return !!node.privateKey;
-    } catch {
-        return false;
-    }
+    const node = parseExtendedKey(key);
+    return !!(node && node.privateKey);
+}
+
+// Whether an extended key is a master key, i.e. the one BIP44_ETH_PATH can be
+// derived from. False for anything parseExtendedKey rejects.
+function isMasterExtendedKey(key) {
+    const node = parseExtendedKey(key);
+    return !!node && node.depth === MASTER_DEPTH;
 }
 
 function addressFromPrivateKey(key) {
@@ -63,8 +120,8 @@ function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
         return node.deriveChild(addrIndex);
     }
     if (walletData.type === "xprv") {
-        const root = HDNodeWallet.fromExtendedKey(decryptedSecret);
-        const node = root.derivePath("44'/60'/0'/0");
+        const node =
+            masterXprvOrThrow(decryptedSecret).derivePath(BIP44_ETH_PATH);
         return node.deriveChild(addrIndex);
     }
     return new Wallet(decryptedSecret);
@@ -89,6 +146,7 @@ module.exports = {
     hdWalletFromMnemonic,
     hdWalletFromXprv,
     isValidXprv,
+    isMasterExtendedKey,
     addressFromPrivateKey,
     getSignerForAddress,
     isValidMnemonic,

tests/alarms.test.js

@@ -0,0 +1,468 @@
+// Scheduling for the background context.
+//
+// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
+// so anything scheduled with setInterval/setTimeout dies with it. These tests
+// pin the recurring jobs to the alarms API and to the re-registration path a
+// revived worker runs.
+
+// A controllable clock plus a stubbed balance refresh, so a cadence test can
+// measure the interval between refreshes that actually happened rather than
+// asserting the interval someone intended.
+let mockNow = 0;
+const mockBalanceRefreshAt = [];
+
+// jest.resetModules() clears the call record of every jest.fn, and loading the
+// worker is exactly that call — so anything that must be counted across a load
+// is counted here rather than read off a mock.
+let mockSetIntervalCalls = 0;
+
+// Extension storage reads do not take a constant amount of time, and that is
+// what makes a guard timed to the alarm period bite: backgroundRefresh()
+// stamps its freshness marker after awaiting loadState(), so any read that is
+// quicker than the previous one puts the next tick inside a guard of exactly
+// one period and the tick is skipped. A simulation with a constant latency
+// would sit exactly on the boundary and hide the bug.
+const MOCK_STORAGE_LATENCIES_MS = [7, 3, 11, 2, 9, 4, 13, 1, 6, 5];
+const MOCK_MAX_STORAGE_LATENCY_MS = Math.max(...MOCK_STORAGE_LATENCIES_MS);
+let mockStorageJitter = false;
+let mockStorageOpCount = 0;
+
+function mockStorageTick() {
+    if (!mockStorageJitter) return;
+    mockNow +=
+        MOCK_STORAGE_LATENCIES_MS[
+            mockStorageOpCount++ % MOCK_STORAGE_LATENCIES_MS.length
+        ];
+}
+
+jest.mock("../src/shared/balances", () => ({
+    refreshBalances: jest.fn(async () => {
+        mockBalanceRefreshAt.push(Date.now());
+    }),
+    getProvider: jest.fn(() => ({})),
+}));
+
+function makeAlarmsStub() {
+    const alarms = new Map();
+    const listeners = [];
+    const stub = {
+        created: [],
+        alarms,
+        create: jest.fn((name, info) => {
+            stub.created.push({ name, info });
+            alarms.set(name, { name, ...info });
+        }),
+        get: jest.fn(async (name) => alarms.get(name)),
+        clear: jest.fn(async (name) => alarms.delete(name)),
+        onAlarm: {
+            addListener: jest.fn((fn) => listeners.push(fn)),
+        },
+        fire: (name) => {
+            for (const fn of listeners) fn({ name });
+        },
+        listenerCount: () => listeners.length,
+    };
+    return stub;
+}
+
+describe("alarms module", () => {
+    let alarmsStub;
+    let alarmsMod;
+
+    beforeEach(() => {
+        jest.resetModules();
+        alarmsStub = makeAlarmsStub();
+        global.chrome = { alarms: alarmsStub };
+        alarmsMod = require("../src/shared/alarms");
+    });
+
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("ensureRecurringAlarms schedules both recurring jobs", async () => {
+        const created = await alarmsMod.ensureRecurringAlarms();
+        expect(created).toEqual({ balance: true, phishing: true });
+
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        expect(names).toEqual(
+            [
+                alarmsMod.BALANCE_REFRESH_ALARM,
+                alarmsMod.PHISHING_REFRESH_ALARM,
+            ].sort(),
+        );
+    });
+
+    test("the balance refresh keeps its 60-second cadence", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        const balance = alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM);
+        expect(balance.periodInMinutes).toBe(1);
+    });
+
+    test("the phishing refresh keeps its 24-hour cadence", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        const phishing = alarmsStub.alarms.get(
+            alarmsMod.PHISHING_REFRESH_ALARM,
+        );
+        expect(phishing.periodInMinutes).toBe(24 * 60);
+    });
+
+    test("no period is below the browser-enforced minimum", async () => {
+        // A period under one minute is silently clamped by the browser, so a
+        // request for one would mean the documented cadence is not the real
+        // one. Every period must be a whole minute at or above the minimum.
+        await alarmsMod.ensureRecurringAlarms();
+        for (const { info } of alarmsStub.created) {
+            expect(info.periodInMinutes).toBeGreaterThanOrEqual(
+                alarmsMod.MIN_ALARM_PERIOD_MINUTES,
+            );
+            expect(Number.isInteger(info.periodInMinutes)).toBe(true);
+        }
+    });
+
+    test("a revived worker does not reset an existing alarm's schedule", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
+
+        // Every wake re-runs the startup path. Re-creating an alarm restarts
+        // its period, so a busy extension would push the next fire out
+        // forever and the job would never run.
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: false, phishing: false });
+        expect(alarmsStub.create).toHaveBeenCalledTimes(2);
+    });
+
+    test("a missing alarm is re-created on the next start", async () => {
+        await alarmsMod.ensureRecurringAlarms();
+        await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
+
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: true, phishing: false });
+        expect(
+            alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
+        ).toBeDefined();
+    });
+
+    test("an alarm left over with a stale period is re-created", async () => {
+        // An install carries its alarms across an extension update, so a
+        // period changed in a new release only ever reaches users if the
+        // stale one is reconciled.
+        alarmsStub.create(alarmsMod.PHISHING_REFRESH_ALARM, {
+            periodInMinutes: 7 * 24 * 60,
+        });
+        alarmsStub.create.mockClear();
+
+        const created = await alarmsMod.ensureRecurringAlarms();
+        expect(created.phishing).toBe(true);
+        expect(
+            alarmsStub.alarms.get(alarmsMod.PHISHING_REFRESH_ALARM)
+                .periodInMinutes,
+        ).toBe(alarmsMod.PHISHING_REFRESH_PERIOD_MINUTES);
+    });
+
+    test("reconciling a period settles instead of re-creating forever", async () => {
+        alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
+            periodInMinutes: 30,
+        });
+        await alarmsMod.ensureRecurringAlarms();
+        alarmsStub.create.mockClear();
+
+        const again = await alarmsMod.ensureRecurringAlarms();
+        expect(again).toEqual({ balance: false, phishing: false });
+        expect(alarmsStub.create).not.toHaveBeenCalled();
+    });
+
+    test("handlers are dispatched by alarm name from one listener", () => {
+        const balance = jest.fn();
+        const phishing = jest.fn();
+        expect(
+            alarmsMod.registerAlarmHandlers({
+                [alarmsMod.BALANCE_REFRESH_ALARM]: balance,
+                [alarmsMod.PHISHING_REFRESH_ALARM]: phishing,
+            }),
+        ).toBe(true);
+        expect(alarmsStub.listenerCount()).toBe(1);
+
+        alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
+        expect(balance).toHaveBeenCalledTimes(1);
+        expect(phishing).not.toHaveBeenCalled();
+
+        alarmsStub.fire(alarmsMod.PHISHING_REFRESH_ALARM);
+        expect(phishing).toHaveBeenCalledTimes(1);
+
+        alarmsStub.fire("some-other-extension-alarm");
+        expect(balance).toHaveBeenCalledTimes(1);
+        expect(phishing).toHaveBeenCalledTimes(1);
+    });
+
+    test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
+        // Both targets are built from one bundle. MV2 has a persistent
+        // background page, but it takes the alarm path too, so the schedule
+        // is the same code on both browsers.
+        jest.resetModules();
+        const firefoxAlarms = makeAlarmsStub();
+        global.browser = { alarms: firefoxAlarms };
+        try {
+            const mod = require("../src/shared/alarms");
+            const created = await mod.ensureRecurringAlarms();
+            expect(created).toEqual({ balance: true, phishing: true });
+            expect(firefoxAlarms.created).toHaveLength(2);
+            // The Chrome stub must not have been touched.
+            expect(alarmsStub.create).not.toHaveBeenCalled();
+        } finally {
+            delete global.browser;
+        }
+    });
+
+    test("a context without the alarms API degrades instead of throwing", async () => {
+        jest.resetModules();
+        delete global.chrome;
+        const mod = require("../src/shared/alarms");
+        await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
+            balance: false,
+            phishing: false,
+        });
+        expect(mod.registerAlarmHandlers({})).toBe(false);
+    });
+});
+
+// Loads the background worker against stubbed browser APIs. The returned
+// store is the extension storage the worker sees, so a test can seed wallet
+// state and read back what the worker persisted.
+function loadBackground(initialStore = {}) {
+    const storageStore = initialStore;
+    const alarmsStub = makeAlarmsStub();
+    const listeners = { onInstalled: [], onStartup: [] };
+    global.chrome = {
+        alarms: alarmsStub,
+        storage: {
+            local: {
+                get: async (key) => {
+                    mockStorageTick();
+                    return Object.prototype.hasOwnProperty.call(
+                        storageStore,
+                        key,
+                    )
+                        ? { [key]: storageStore[key] }
+                        : {};
+                },
+                set: async (items) => {
+                    mockStorageTick();
+                    Object.assign(storageStore, items);
+                },
+                remove: async (key) => {
+                    delete storageStore[key];
+                },
+            },
+        },
+        runtime: {
+            onMessage: { addListener: jest.fn() },
+            onConnect: { addListener: jest.fn() },
+            onInstalled: {
+                addListener: jest.fn((fn) => listeners.onInstalled.push(fn)),
+            },
+            onStartup: {
+                addListener: jest.fn((fn) => listeners.onStartup.push(fn)),
+            },
+            getURL: (p) => "chrome-extension://test/" + p,
+            lastError: null,
+        },
+        windows: {
+            onRemoved: { addListener: jest.fn() },
+            create: jest.fn(),
+        },
+        tabs: { query: jest.fn(), sendMessage: jest.fn() },
+        action: { setPopup: jest.fn() },
+    };
+    global.fetch = jest.fn(async () => ({
+        ok: true,
+        json: async () => ({ blacklist: [] }),
+    }));
+    jest.resetModules();
+    require("../src/background/index");
+    return { alarmsStub, listeners, store: storageStore };
+}
+
+// Flush the promise chains the startup path and the alarm handlers run on.
+async function settle() {
+    for (let i = 0; i < 3; i++) {
+        await new Promise((resolve) => setImmediate(resolve));
+    }
+}
+
+describe("background worker scheduling", () => {
+    let alarmsStub;
+    let timers;
+
+    beforeEach(() => {
+        mockSetIntervalCalls = 0;
+        timers = {
+            setInterval: jest
+                .spyOn(global, "setInterval")
+                .mockImplementation(() => {
+                    mockSetIntervalCalls++;
+                    return 0;
+                }),
+        };
+    });
+
+    afterEach(() => {
+        timers.setInterval.mockRestore();
+        delete global.chrome;
+        delete global.fetch;
+        jest.resetModules();
+    });
+
+    test("startup schedules the recurring jobs as alarms, not timers", async () => {
+        alarmsStub = loadBackground().alarmsStub;
+        // Let the startup path's promises settle.
+        await settle();
+
+        const names = alarmsStub.created.map((c) => c.name).sort();
+        const {
+            BALANCE_REFRESH_ALARM,
+            PHISHING_REFRESH_ALARM,
+        } = require("../src/shared/alarms");
+        expect(names).toEqual(
+            [BALANCE_REFRESH_ALARM, PHISHING_REFRESH_ALARM].sort(),
+        );
+        expect(mockSetIntervalCalls).toBe(0);
+    });
+
+    test("an onAlarm listener is installed on startup", async () => {
+        alarmsStub = loadBackground().alarmsStub;
+        await settle();
+        expect(alarmsStub.listenerCount()).toBe(1);
+    });
+
+    test("onInstalled and onStartup both re-establish the schedule", async () => {
+        const loaded = loadBackground();
+        alarmsStub = loaded.alarmsStub;
+        await settle();
+
+        expect(loaded.listeners.onInstalled).toHaveLength(1);
+        expect(loaded.listeners.onStartup).toHaveLength(1);
+
+        // A browser start after the alarms were dropped must put them back.
+        alarmsStub.alarms.clear();
+        alarmsStub.created.length = 0;
+        loaded.listeners.onStartup[0]();
+        await settle();
+        expect(alarmsStub.created).toHaveLength(2);
+    });
+
+    test("the install-time listener and the top-level call share one run", async () => {
+        // On a fresh install both fire, close enough that both could observe
+        // an alarm missing and create it — and a second create restarts the
+        // period the first one just set.
+        const loaded = loadBackground();
+        alarmsStub = loaded.alarmsStub;
+        loaded.listeners.onInstalled[0]();
+        await settle();
+
+        expect(alarmsStub.created).toHaveLength(2);
+        expect(alarmsStub.created.map((c) => c.name).sort()).toEqual(
+            [
+                "autistmask-balance-refresh",
+                "autistmask-phishing-refresh",
+            ].sort(),
+        );
+    });
+});
+
+// The alarm period alone must set the cadence. A freshness guard timed to the
+// period vetoes the very tick it gates, because the guard is measured from
+// when the last run finished and the alarm fires one run-duration before that.
+// These tests measure the interval between refreshes that actually ran.
+describe("balance refresh steady-state cadence", () => {
+    const {
+        BALANCE_REFRESH_PERIOD_MINUTES,
+        BALANCE_REFRESH_ALARM,
+    } = require("../src/shared/alarms");
+    const PERIOD_MS = BALANCE_REFRESH_PERIOD_MINUTES * 60 * 1000;
+
+    let clockSpy;
+    let timerSpy;
+
+    function seededStore() {
+        return {
+            autistmask: {
+                hasWallet: true,
+                wallets: [
+                    { address: "0x0000000000000000000000000000000000000001" },
+                ],
+                lastBalanceRefresh: 0,
+            },
+        };
+    }
+
+    beforeEach(() => {
+        mockNow = Date.UTC(2026, 0, 1, 0, 0, 0);
+        mockBalanceRefreshAt.length = 0;
+        mockSetIntervalCalls = 0;
+        mockStorageOpCount = 0;
+        mockStorageJitter = false;
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => mockNow);
+        timerSpy = jest.spyOn(global, "setInterval").mockImplementation(() => {
+            mockSetIntervalCalls++;
+            return 0;
+        });
+    });
+
+    afterEach(() => {
+        mockStorageJitter = false;
+        clockSpy.mockRestore();
+        timerSpy.mockRestore();
+        delete global.chrome;
+        delete global.fetch;
+        jest.resetModules();
+    });
+
+    test("ten alarm ticks produce ten refreshes, one per period", async () => {
+        const { alarmsStub } = loadBackground(seededStore());
+        await settle();
+        mockStorageJitter = true;
+
+        const TICKS = 10;
+        let tickAt = mockNow + PERIOD_MS;
+        for (let i = 0; i < TICKS; i++) {
+            mockNow = tickAt;
+            tickAt += PERIOD_MS;
+            alarmsStub.fire(BALANCE_REFRESH_ALARM);
+            await settle();
+        }
+
+        // No tick was a no-op. This is the assertion that fails when the guard
+        // is timed to the alarm period.
+        expect(mockBalanceRefreshAt).toHaveLength(TICKS);
+
+        // And the observed cadence is one period, not two.
+        const intervals = mockBalanceRefreshAt
+            .slice(1)
+            .map((t, i) => t - mockBalanceRefreshAt[i]);
+        for (const interval of intervals) {
+            expect(interval).toBeGreaterThanOrEqual(
+                PERIOD_MS - MOCK_MAX_STORAGE_LATENCY_MS,
+            );
+            expect(interval).toBeLessThanOrEqual(
+                PERIOD_MS + MOCK_MAX_STORAGE_LATENCY_MS,
+            );
+        }
+    });
+
+    test("a refresh an open popup just did still suppresses the tick", async () => {
+        // The guard's actual job, and the reason it is shortened rather than
+        // removed: while the popup is open it refreshes every 10 seconds and
+        // stamps the same field, and the background job has nothing to add.
+        const store = seededStore();
+        const { alarmsStub } = loadBackground(store);
+        await settle();
+
+        mockNow += PERIOD_MS;
+        store.autistmask.lastBalanceRefresh = mockNow - 10 * 1000;
+        alarmsStub.fire(BALANCE_REFRESH_ALARM);
+        await settle();
+
+        expect(mockBalanceRefreshAt).toHaveLength(0);
+    });
+});

tests/e2e/harness.js

@@ -22,18 +22,12 @@ const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
 // entry must name the issue that will remove it. This list is the one
 // concession in an otherwise zero-tolerance policy: an uncaught error is
 // how this harness caught issue #150 in the first place.
-const ALLOWED_ERRORS = [
-    {
-        // libsodium ships a WASM build and an asm.js fallback. The
-        // extension CSP (script-src 'self', with no wasm-unsafe-eval)
-        // refuses the WASM module on every popup load; libsodium catches
-        // it and falls back to asm.js, so the wallet works. Deciding
-        // which backend actually ships is issue #182, and this entry gets
-        // deleted when that lands.
-        issue: "#182",
-        pattern: /Refused to compile or instantiate WebAssembly module/,
-    },
-];
+//
+// Empty, and worth keeping that way. Its only entry was the WASM
+// CompileError libsodium provoked on every popup load, deleted with #182
+// when both manifests started allowing WASM; the run that used to need it
+// is now the run that proves the fix.
+const ALLOWED_ERRORS = [];
 
 function isAllowed(text) {
     return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
@@ -247,6 +241,26 @@ async function visible(page, selector, timeout = 15000) {
     await page.waitForSelector(selector, { state: "visible", timeout });
 }
 
+// An empty WebAssembly module: magic number and version header, no
+// sections. Compiling it in the popup asks the one question that decides
+// libsodium's backend — may this realm compile WebAssembly — of the real
+// page under the real shipped manifest, which is the only place the
+// answer can be observed. Kept independent of src/shared/vault.js on
+// purpose: a bundle asked to grade itself proves less than an outside
+// observation of the same realm.
+const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
+
+async function pageCompilesWasm(page) {
+    return page.evaluate(async (bytes) => {
+        try {
+            await WebAssembly.compile(new Uint8Array(bytes));
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }, EMPTY_WASM_MODULE);
+}
+
 async function openPopup(ctx, popupUrl) {
     const page = await ctx.newPage();
     await page.goto(popupUrl);
@@ -293,5 +307,6 @@ module.exports = {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 };

tests/e2e/run.js

@@ -15,6 +15,7 @@ const {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 } = require("./harness");
 const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
@@ -60,6 +61,27 @@ test("popup loads and reaches the welcome view", async (env) => {
     assert(title === "AutistMask", "unexpected popup title: " + title);
 });
 
+// The empirical half of #182. The manifest change is only a claim about
+// what the CSP permits; this is the observation. Two things have to hold
+// together, and the run covers both: the popup realm compiles WASM (here),
+// and no WASM refusal or abort is recorded anywhere in the run — the
+// harness allowlist that used to excuse exactly that error is now empty,
+// so a recurrence fails whichever test it lands in rather than being
+// tolerated. Since libsodium's WASM module is embedded in the bundle and
+// needs no fetch, a realm that compiles WASM is a realm where libsodium
+// takes the WASM path, and the next test drives a real vault encryption
+// through it.
+test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
+    const ok = await pageCompilesWasm(env.page);
+    assert(
+        ok,
+        "the popup refused to compile WebAssembly. The shipped manifest CSP " +
+            "has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
+            "fallback and every password derivation costs roughly 20x what it " +
+            "should — see the backend note in src/shared/vault.js",
+    );
+});
+
 test("wallet creation through the UI reaches the main view", async (env) => {
     env.phrase = await createWallet(env.page);
     assert(

tests/manifest.test.js

@@ -0,0 +1,108 @@
+// The shipped Content Security Policy, pinned in both directions.
+//
+// This is the anti-regression check for #182. libsodium decides its
+// backend by trying to compile WebAssembly and catching the failure, so a
+// CSP that refuses WASM demotes the vault to the wasm2js translation —
+// roughly 20x slower per Argon2id derivation — and says so only in a
+// console message nobody reads. Dropping 'wasm-unsafe-eval' from either
+// manifest therefore has to fail a check, not a log line.
+//
+// It is equally a check against loosening. 'wasm-unsafe-eval' is granted
+// deliberately and narrowly (see the backend note in src/shared/vault.js);
+// 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
+// an exact match on the token set is what keeps the next edit from
+// smuggling one in alongside.
+//
+// build.js copies these files to dist/<target>/manifest.json verbatim, so
+// what is asserted here is what ships.
+
+const fs = require("fs");
+const path = require("path");
+
+const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
+
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
+
+const FORBIDDEN_SOURCES = [
+    "'unsafe-eval'",
+    "'unsafe-inline'",
+    "http:",
+    "https:",
+    "data:",
+    "blob:",
+    "*",
+];
+
+function readManifest(name) {
+    return JSON.parse(
+        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
+    );
+}
+
+// "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
+function parseCsp(policy) {
+    const directives = {};
+    for (const part of policy.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length === 0) continue;
+        directives[tokens[0]] = tokens.slice(1);
+    }
+    return directives;
+}
+
+function assertPolicy(policy) {
+    const directives = parseCsp(policy);
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
+    );
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
+    }
+}
+
+describe("shipped Content Security Policy", () => {
+    // MV3 takes an object and applies extension_pages to the popup and the
+    // background service worker, which is where libsodium runs.
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("chrome").content_security_policy;
+        expect(typeof csp).toBe("object");
+        expect(Object.keys(csp)).toEqual(["extension_pages"]);
+        assertPolicy(csp.extension_pages);
+    });
+
+    // MV2 takes the policy as a bare string. Firefox does not require
+    // 'wasm-unsafe-eval' for MV2 today — enforcement is report-only and
+    // Bugzilla 1770909 is still open — so this is future-proofing, not a
+    // mandate. It does not weaken anything under either baseline: Gecko's
+    // real MV2 default (extensions.webextensions.default-content-security-
+    // policy) is `script-src 'self' 'wasm-unsafe-eval';` with no object-src
+    // at all, so this string leaves script-src unchanged and ADDS
+    // object-src 'self', constraining <object>/<embed> sources that were
+    // previously unrestricted. Against MDN's documented MV2 default
+    // (`script-src 'self'; object-src 'self';`) it is a one-token loosening,
+    // identical to Chrome. Same policy, different manifest shape.
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("firefox").content_security_policy;
+        expect(typeof csp).toBe("string");
+        assertPolicy(csp);
+    });
+
+    // The two targets share one codebase and one crypto path; a policy
+    // that drifts apart between them means one of the two builds is
+    // running a backend nothing tests.
+    test("both targets ship the same policy", () => {
+        const chrome =
+            readManifest("chrome").content_security_policy.extension_pages;
+        const firefox = readManifest("firefox").content_security_policy;
+        expect(firefox).toBe(chrome);
+    });
+});

tests/phishingDomains.test.js

@@ -1,17 +1,24 @@
-// Provide a localStorage mock for Node.js test environment.
-// Must be set before requiring the module since it calls loadDeltaFromStorage()
-// at module load time.
-const localStorageStore = {};
-global.localStorage = {
-    getItem: (key) =>
-        Object.prototype.hasOwnProperty.call(localStorageStore, key)
-            ? localStorageStore[key]
-            : null,
-    setItem: (key, value) => {
-        localStorageStore[key] = String(value);
+// Extension storage stub for the Node test environment. The module resolves
+// the storage API on use, so this only has to exist before the first call.
+// Values round-trip through JSON the way structured cloning would, so a test
+// cannot pass by holding a live reference to the module's own array.
+const storageStore = {};
+global.chrome = {
+    storage: {
+        local: {
+            get: async (key) =>
+                Object.prototype.hasOwnProperty.call(storageStore, key)
+                    ? { [key]: JSON.parse(JSON.stringify(storageStore[key])) }
+                    : {},
+            set: async (items) => {
+                for (const [key, value] of Object.entries(items)) {
+                    storageStore[key] = JSON.parse(JSON.stringify(value));
+                }
+            },
+            remove: async (key) => {
+                delete storageStore[key];
+            },
         },
-    removeItem: (key) => {
-        delete localStorageStore[key];
     },
 };
 
@@ -21,19 +28,32 @@ const {
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,
+    DELTA_STORAGE_KEY,
     _reset,
     _getVendoredBlacklistSize,
     _getDeltaBlacklist,
 } = require("../src/shared/phishingDomains");
 
+function clearStorage() {
+    for (const key of Object.keys(storageStore)) {
+        delete storageStore[key];
+    }
+}
+
+// The MV3 service worker is torn down when idle and re-evaluated on the next
+// event, which wipes every module-level variable. Re-requiring the module with
+// the registry reset is exactly that: fresh in-memory state, same extension
+// storage underneath.
+function restartWorker() {
+    jest.resetModules();
+    return require("../src/shared/phishingDomains");
+}
+
 // Reset delta state before each test to avoid cross-test contamination.
 // Note: vendored sets are immutable and always present.
 beforeEach(() => {
     _reset();
-    // Clear localStorage mock between tests
-    for (const key of Object.keys(localStorageStore)) {
-        delete localStorageStore[key];
-    }
+    clearStorage();
 });
 
 describe("phishingDomains", () => {
@@ -169,15 +189,34 @@ describe("phishingDomains", () => {
         });
     });
 
-    describe("localStorage persistence", () => {
-        test("saveDeltaToStorage persists delta under 256KiB", () => {
-            loadConfig({
+    describe("extension storage persistence", () => {
+        test("delta is persisted to extension storage, not localStorage", async () => {
+            await loadConfig({
                 blacklist: ["persisted-scam-xyz.com"],
             });
-            const stored = localStorage.getItem("phishing-delta");
-            expect(stored).not.toBeNull();
-            const data = JSON.parse(stored);
-            expect(data.blacklist).toContain("persisted-scam-xyz.com");
+            const stored = storageStore[DELTA_STORAGE_KEY];
+            expect(stored).toBeDefined();
+            expect(stored.blacklist).toContain("persisted-scam-xyz.com");
+        });
+
+        test("the fetch timestamp is persisted alongside the delta", async () => {
+            const before = Date.now();
+            await loadConfig({ blacklist: ["timestamped-scam-xyz.com"] });
+            const stored = storageStore[DELTA_STORAGE_KEY];
+            expect(typeof stored.lastFetchTime).toBe("number");
+            expect(stored.lastFetchTime).toBeGreaterThanOrEqual(before);
+        });
+
+        test("an oversized delta is dropped entirely, timestamp included", async () => {
+            // A record above the 256 KiB cap is not worth keeping; the
+            // timestamp goes with it so the next start re-fetches rather than
+            // claiming freshness for a delta that was never stored.
+            const huge = [];
+            for (let i = 0; i < 20000; i++) {
+                huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+            }
+            await loadConfig({ blacklist: huge });
+            expect(storageStore[DELTA_STORAGE_KEY]).toBeUndefined();
         });
 
         test("delta is cleared on _reset", () => {
@@ -203,3 +242,332 @@ describe("phishingDomains", () => {
         });
     });
 });
+
+describe("phishing list across a service worker restart", () => {
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+    });
+
+    afterEach(() => {
+        delete global.fetch;
+    });
+
+    test("a revived worker restores the persisted delta without re-fetching", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["restart-scam-xyz.com"] });
+
+        const revived = restartWorker();
+        // Nothing in memory yet — this is a brand new module instance.
+        expect(revived.getDeltaSize()).toBe(0);
+
+        global.fetch = jest.fn();
+        await revived.initPhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.getDeltaSize()).toBe(1);
+        expect(revived.isPhishingDomain("restart-scam-xyz.com")).toBe(true);
+    });
+
+    test("repeated wakes inside the cache window never re-fetch", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["no-storm-scam-xyz.com"] });
+
+        global.fetch = jest.fn();
+        for (let i = 0; i < 5; i++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+        }
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    test("a persisted timestamp older than the TTL causes a fetch on startup", async () => {
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["stale-scam-xyz.com"] });
+
+        // Age the persisted record past the 24-hour TTL.
+        storageStore[first.DELTA_STORAGE_KEY].lastFetchTime =
+            Date.now() - first.CACHE_TTL_MS - 1000;
+
+        const revived = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["refreshed-scam-xyz.com"] }),
+        }));
+        await revived.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(revived.isPhishingDomain("refreshed-scam-xyz.com")).toBe(true);
+        expect(revived.isPhishingDomain("stale-scam-xyz.com")).toBe(false);
+    });
+
+    test("a first start with nothing persisted fetches immediately", async () => {
+        const fresh = restartWorker();
+        global.fetch = jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["first-run-scam-xyz.com"] }),
+        }));
+        await fresh.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(fresh.isPhishingDomain("first-run-scam-xyz.com")).toBe(true);
+    });
+
+    test("updatePhishingList honours the persisted timestamp on its own", async () => {
+        // The startup path calls updatePhishingList() directly, so it must
+        // load persisted state itself rather than relying on anything else
+        // having finished first.
+        const first = require("../src/shared/phishingDomains");
+        await first.loadConfig({ blacklist: ["alarm-tick-scam-xyz.com"] });
+
+        const revived = restartWorker();
+        global.fetch = jest.fn();
+        await revived.updatePhishingList();
+
+        expect(global.fetch).not.toHaveBeenCalled();
+        expect(revived.isPhishingDomain("alarm-tick-scam-xyz.com")).toBe(true);
+    });
+});
+
+// The alarm period alone must set the cadence. lastFetchTime is stamped when
+// the fetch completes, so it lands one fetch latency after the alarm that
+// caused it; a freshness guard timed to the alarm period therefore vetoes
+// every scheduled tick and halves the real refresh rate. These tests measure
+// the interval between fetches that actually happened.
+describe("phishing refresh steady-state cadence", () => {
+    const { PHISHING_REFRESH_PERIOD_MINUTES } = require("../src/shared/alarms");
+    const PERIOD_MS = PHISHING_REFRESH_PERIOD_MINUTES * 60 * 1000;
+
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function fetchStub(latencyMs, seen) {
+        return jest.fn(async () => {
+            seen.push(now);
+            // A network fetch takes time, and lastFetchTime is stamped after
+            // it, not when the alarm fired.
+            now += latencyMs;
+            return { ok: true, json: async () => ({ blacklist: [] }) };
+        });
+    }
+
+    test("ten alarm ticks produce ten fetches, one per period", async () => {
+        const fetchedAt = [];
+        global.fetch = fetchStub(5000, fetchedAt);
+
+        const startup = require("../src/shared/phishingDomains");
+        const T0 = now;
+        await startup.initPhishingList();
+        expect(fetchedAt).toEqual([T0]);
+
+        const TICKS = 10;
+        let tickAt = T0 + PERIOD_MS;
+        for (let i = 0; i < TICKS; i++) {
+            now = tickAt;
+            tickAt += PERIOD_MS;
+            // The browser wakes a terminated worker to deliver the alarm, so
+            // every tick starts from cold memory and the persisted record.
+            const revived = restartWorker();
+            await revived.refreshPhishingListOnSchedule();
+        }
+
+        expect(fetchedAt).toHaveLength(TICKS + 1);
+        const intervals = fetchedAt.slice(1).map((t, i) => t - fetchedAt[i]);
+        expect(intervals).toEqual(new Array(TICKS).fill(PERIOD_MS));
+    });
+
+    test("the scheduled tick fetches whatever the last fetch's latency was", async () => {
+        // The alarm fires one period after the previous alarm, which is
+        // `latency` short of one period since the fetch it caused completed.
+        for (const latency of [200, 1000, 5000]) {
+            clearStorage();
+            jest.resetModules();
+            storageStore[DELTA_STORAGE_KEY] = {
+                blacklist: [],
+                lastFetchTime: now - PERIOD_MS + latency,
+                lastAttemptTime: now - PERIOD_MS,
+            };
+            const mod = require("../src/shared/phishingDomains");
+            const fetchedAt = [];
+            global.fetch = fetchStub(latency, fetchedAt);
+
+            await mod.refreshPhishingListOnSchedule();
+            expect(fetchedAt).toHaveLength(1);
+        }
+    });
+
+    test("a worker wake inside the cache window still does not fetch", async () => {
+        // The TTL is not removed, only taken off the scheduled path. Chrome
+        // revives the worker every ~30 seconds and every revival runs the
+        // startup path, so the TTL still has to keep that off the network.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: [],
+            lastFetchTime: now - PERIOD_MS + 5000,
+            lastAttemptTime: now - PERIOD_MS,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = jest.fn();
+
+        await mod.initPhishingList();
+        expect(global.fetch).not.toHaveBeenCalled();
+    });
+});
+
+describe("phishing list timestamps that cannot be trusted", () => {
+    let clockSpy;
+    let now;
+
+    beforeEach(() => {
+        clearStorage();
+        jest.resetModules();
+        now = Date.UTC(2026, 0, 1, 0, 0, 0);
+        clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        clockSpy.mockRestore();
+        delete global.fetch;
+    });
+
+    function okFetch() {
+        return jest.fn(async () => ({
+            ok: true,
+            json: async () => ({ blacklist: ["recovered-scam-xyz.com"] }),
+        }));
+    }
+
+    // jest.resetModules() clears the call record of a jest.fn, and simulating
+    // a worker restart is exactly that call. Anything counted across restarts
+    // has to be counted outside the mock.
+    function countingFetch(counter, response) {
+        return async () => {
+            counter.calls++;
+            return response();
+        };
+    }
+
+    test("a lastFetchTime in the future is discarded rather than trusted", async () => {
+        // Clock skew or a restored profile backup writes one. Every guard
+        // measures `Date.now() - stamp` and only tests the lower bound, so a
+        // stamp a year ahead would suppress updates for a year, and now that
+        // the value is persisted it would outlive every worker.
+        storageStore[DELTA_STORAGE_KEY] = {
+            blacklist: ["poisoned-scam-xyz.com"],
+            lastFetchTime: now + 365 * 24 * 60 * 60 * 1000,
+            lastAttemptTime: 0,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+        expect(mod.isPhishingDomain("recovered-scam-xyz.com")).toBe(true);
+        // And the record it leaves behind is sane, so recovery is permanent.
+        expect(
+            storageStore[DELTA_STORAGE_KEY].lastFetchTime,
+        ).toBeLessThanOrEqual(now);
+    });
+
+    test("a lastAttemptTime in the future does not suppress the retry", async () => {
+        storageStore[DELTA_STORAGE_KEY] = {
+            lastAttemptTime: now + 365 * 24 * 60 * 60 * 1000,
+        };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.initPhishingList();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+    });
+
+    test("an oversized delta does not re-download on every worker wake", async () => {
+        // The delta and its freshness claim are both dropped, which is right,
+        // but nothing then says a fetch just happened. Chrome cycles the
+        // worker roughly every 30 seconds idle, so without the attempt stamp
+        // this is a full blocklist download per wake, forever.
+        const huge = [];
+        for (let i = 0; i < 20000; i++) {
+            huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
+        }
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: true,
+            json: async () => ({ blacklist: huge }),
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000; // idle timeout, worker torn down and revived
+        }
+
+        expect(counter.calls).toBe(1);
+        expect(storageStore[DELTA_STORAGE_KEY].blacklist).toBeUndefined();
+        expect(typeof storageStore[DELTA_STORAGE_KEY].lastAttemptTime).toBe(
+            "number",
+        );
+    });
+
+    test("a failing fetch is not retried on every worker wake either", async () => {
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        for (let wake = 0; wake < 4; wake++) {
+            const revived = restartWorker();
+            await revived.initPhishingList();
+            now += 30 * 1000;
+        }
+
+        expect(counter.calls).toBe(1);
+    });
+
+    test("the retry floor expires, so a failure is not permanent", async () => {
+        const {
+            MIN_FETCH_ATTEMPT_INTERVAL_MS,
+        } = require("../src/shared/phishingDomains");
+        const counter = { calls: 0 };
+        global.fetch = countingFetch(counter, () => ({
+            ok: false,
+            status: 503,
+        }));
+
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Still inside the floor: no retry.
+        now += MIN_FETCH_ATTEMPT_INTERVAL_MS - 1000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(1);
+
+        // Past it: the extension goes back to the network.
+        now += 2000;
+        await restartWorker().initPhishingList();
+        expect(counter.calls).toBe(2);
+    });
+
+    test("the scheduled tick ignores the retry floor", async () => {
+        // The alarm period is far above the floor, but the floor exists to
+        // throttle wakes, not the schedule.
+        storageStore[DELTA_STORAGE_KEY] = { lastAttemptTime: now - 1000 };
+        const mod = require("../src/shared/phishingDomains");
+        global.fetch = okFetch();
+
+        await mod.refreshPhishingListOnSchedule();
+        expect(global.fetch).toHaveBeenCalledTimes(1);
+    });
+});

tests/settingsUtcTimestamps.test.js

@@ -0,0 +1,111 @@
+// Tests for the UTC Timestamps setting.
+//
+// The checkbox was moved out of the Token Spam Protection well and into the
+// Display well next to the theme selector.  It is wired by id through the $()
+// helper, so the move cannot break the handler — but nothing in the suite said
+// so.  These tests pin both halves down: the markup lives in Display and
+// nowhere else, and the value still round-trips through storage.
+
+const fs = require("fs");
+const path = require("path");
+
+const POPUP_HTML = fs.readFileSync(
+    path.join(__dirname, "..", "src", "popup", "index.html"),
+    "utf8",
+);
+
+// The body of one `<div class="bg-well ...">` well, selected by its heading.
+function wellWithHeading(html, heading) {
+    const headingIndex = html.indexOf(
+        '<h3 class="font-bold mb-1">' + heading + "</h3>",
+    );
+    expect(headingIndex).toBeGreaterThan(-1);
+    const start = html.lastIndexOf('<div class="bg-well', headingIndex);
+    const end = html.indexOf('<div class="bg-well', headingIndex);
+    return html.slice(start, end === -1 ? html.length : end);
+}
+
+describe("the UTC Timestamps checkbox placement", () => {
+    test("the checkbox appears exactly once in the popup markup", () => {
+        const matches = POPUP_HTML.match(/id="settings-utc-timestamps"/g);
+        expect(matches).toHaveLength(1);
+    });
+
+    test("it renders in the Display well, alongside the theme selector", () => {
+        const display = wellWithHeading(POPUP_HTML, "Display");
+
+        expect(display).toContain('id="settings-utc-timestamps"');
+        expect(display).toContain('id="settings-theme"');
+    });
+
+    test("it does not render in the Token Spam Protection well", () => {
+        const spam = wellWithHeading(POPUP_HTML, "Token Spam Protection");
+
+        expect(spam).not.toContain('id="settings-utc-timestamps"');
+        // The filters that do belong there are untouched.
+        expect(spam).toContain('id="settings-hide-low-holders"');
+        expect(spam).toContain('id="settings-hide-fraud-contracts"');
+        expect(spam).toContain('id="settings-hide-dust"');
+        expect(spam).toContain('id="settings-dust-threshold"');
+    });
+});
+
+describe("the UTC Timestamps setting round-trips through storage", () => {
+    let store;
+
+    function loadStateModule() {
+        store = {};
+        global.chrome = {
+            storage: {
+                local: {
+                    get: async (key) =>
+                        key in store ? { [key]: store[key] } : {},
+                    set: async (obj) => Object.assign(store, obj),
+                },
+            },
+        };
+        jest.resetModules();
+        return require("../src/shared/state");
+    }
+
+    afterEach(() => {
+        delete global.chrome;
+    });
+
+    test("defaults to off with nothing persisted", async () => {
+        const { state, loadState } = loadStateModule();
+
+        await loadState();
+
+        expect(state.utcTimestamps).toBe(false);
+    });
+
+    test("an enabled checkbox is persisted and read back", async () => {
+        const first = loadStateModule();
+
+        // What the change handler in views/settings.js does.
+        first.state.utcTimestamps = true;
+        await first.saveState();
+        expect(store.autistmask.utcTimestamps).toBe(true);
+
+        // A fresh popup load sees it.
+        jest.resetModules();
+        const second = require("../src/shared/state");
+        expect(second.state.utcTimestamps).toBe(false);
+        await second.loadState();
+        expect(second.state.utcTimestamps).toBe(true);
+    });
+
+    test("turning it back off is persisted too", async () => {
+        const { state, saveState, loadState } = loadStateModule();
+
+        state.utcTimestamps = true;
+        await saveState();
+        state.utcTimestamps = false;
+        await saveState();
+
+        state.utcTimestamps = true;
+        await loadState();
+        expect(state.utcTimestamps).toBe(false);
+    });
+});

tests/state.test.js

@@ -102,3 +102,60 @@ describe("loadState hasWallet reconciliation", () => {
         expect(mod.state.activeAddress).toBe(ADDRESS);
     });
 });
+
+// The known-symbol spoof filter is a safety filter, so an existing profile
+// stored before the setting existed must load with it on rather than with
+// undefined, which would read as off.
+describe("hideSpoofedSymbols persistence", () => {
+    test("defaults to on with empty storage", async () => {
+        const { mod } = loadModuleWith(null);
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(true);
+    });
+
+    test("a profile stored without the key loads with it on", async () => {
+        const { mod } = loadModuleWith({ wallets: oneWallet() });
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(true);
+    });
+
+    test("an explicit false survives the load", async () => {
+        const { mod } = loadModuleWith({
+            wallets: oneWallet(),
+            hideSpoofedSymbols: false,
+        });
+        await mod.loadState();
+        expect(mod.state.hideSpoofedSymbols).toBe(false);
+    });
+
+    test("saveState persists the flag", async () => {
+        const { mod, set } = loadModuleWith(null);
+        mod.state.hideSpoofedSymbols = false;
+        await mod.saveState();
+        expect(set).toHaveBeenCalledWith({
+            autistmask: expect.objectContaining({ hideSpoofedSymbols: false }),
+        });
+    });
+
+    test("the flag round-trips off through save and load", async () => {
+        const first = loadModuleWith(null);
+        first.mod.state.hideSpoofedSymbols = false;
+        await first.mod.saveState();
+        const persisted = first.set.mock.calls[0][0].autistmask;
+
+        const second = loadModuleWith(persisted);
+        await second.mod.loadState();
+        expect(second.mod.state.hideSpoofedSymbols).toBe(false);
+    });
+
+    test("the flag round-trips back on through save and load", async () => {
+        const first = loadModuleWith(null);
+        first.mod.state.hideSpoofedSymbols = true;
+        await first.mod.saveState();
+        const persisted = first.set.mock.calls[0][0].autistmask;
+
+        const second = loadModuleWith(persisted);
+        await second.mod.loadState();
+        expect(second.mod.state.hideSpoofedSymbols).toBe(true);
+    });
+});

tests/transactions.test.js

@@ -78,6 +78,7 @@ const ORDINARY_PEER = "0x5aa0f9f1e0a1d0e0e5c1e7ce3b7dbbe9c19f0a11";
 
 // The documented default settings (README.md:810-814, state.js:24-27).
 const DEFAULT_FILTERS = {
+    hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
     hideFraudContracts: true,
     hideDustTransactions: true,
@@ -367,30 +368,112 @@ describe("known-symbol spoof verification", () => {
         expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
     });
 
-    // Documents current behaviour: README.md:810-814 says all four filters
-    // "default to on but can be individually disabled".  There is no setting
-    // for known-symbol verification, and filterTransactions applies it
-    // unconditionally, so it cannot be turned off.
-    test("current behaviour: spoof filtering cannot be disabled by any setting", () => {
-        const allFiltersOff = {
+    // Turning the other three filters off must not turn this one off: each
+    // filter is independent, and this is the one the README calls out as the
+    // defense against the fake "ETH" attack.
+    test("the check still runs when the other three filters are off", () => {
+        const result = filterTransactions(
+            [fakeEthTokenTransfer()],
+            filters({
                 hideLowHolderTokens: false,
                 hideFraudContracts: false,
                 hideDustTransactions: false,
                 dustThresholdGwei: 1,
-            fraudContracts: [],
-        };
-        const result = filterTransactions(
-            [fakeEthTokenTransfer()],
-            allFiltersOff,
+            }),
         );
         expect(result.transactions).toEqual([]);
         expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
     });
 
-    test("current behaviour: spoof filtering also applies with no filters argument", () => {
+    test("spoof filtering also applies with no filters argument", () => {
         const result = filterTransactions([fakeEthTokenTransfer()]);
         expect(result.transactions).toEqual([]);
     });
+
+    // Fail-safe: unlike the other three flags, an absent hideSpoofedSymbols
+    // leaves the check ON.  A caller that forgets the key keeps the wallet's
+    // headline protection; only a user who deliberately switched the setting
+    // off sends an explicit false.
+    test("an absent hideSpoofedSymbols leaves the check on", () => {
+        const result = filterTransactions([fakeEthTokenTransfer()], {
+            fraudContracts: [],
+        });
+        expect(result.transactions).toEqual([]);
+    });
+
+    test("a truthy-but-not-true hideSpoofedSymbols leaves the check on", () => {
+        const result = filterTransactions(
+            [fakeEthTokenTransfer()],
+            filters({ hideSpoofedSymbols: undefined }),
+        );
+        expect(result.transactions).toEqual([]);
+    });
+});
+
+describe("disabling known-symbol spoof verification", () => {
+    test("the spoofed transfer is shown when hideSpoofedSymbols is false", () => {
+        const attack = fakeEthTokenTransfer();
+        const result = filterTransactions(
+            [attack],
+            filters({
+                hideSpoofedSymbols: false,
+                // The blocklist rule would otherwise hide the same row via a
+                // contract this pass had already learned.
+                hideFraudContracts: false,
+                hideLowHolderTokens: false,
+            }),
+        );
+        expect(result.transactions).toEqual([attack]);
+    });
+
+    // The blocklist is populated only by this check, so switching the check
+    // off stops the learning too.  Leaving learning on would make the setting
+    // a no-op: the contract it recorded would immediately hide the same row
+    // through the fraud-contract rule, which is on by default.
+    test("no fraud contract is learned when hideSpoofedSymbols is false", () => {
+        const result = filterTransactions(
+            [fakeEthTokenTransfer()],
+            filters({ hideSpoofedSymbols: false }),
+        );
+        expect(result.newFraudContracts).toEqual([]);
+    });
+
+    test("the setting off does not stop the other three rules", () => {
+        const dust = nativeDustTransfer();
+        const lowHolder = tokenTx({
+            symbol: NOVEL_SPAM_SYMBOL,
+            contractAddress: NOVEL_SPAM_CONTRACT,
+            holders: 0,
+        });
+        const result = filterTransactions(
+            [dust, lowHolder],
+            filters({ hideSpoofedSymbols: false }),
+        );
+        expect(result.transactions).toEqual([]);
+    });
+
+    // An already-persisted fraud contract keeps being filtered: the blocklist
+    // rule is a separate setting and is unaffected by this one.
+    test("an already-blocklisted contract is still hidden with the check off", () => {
+        const result = filterTransactions(
+            [fakeEthTokenTransfer()],
+            filters({
+                hideSpoofedSymbols: false,
+                fraudContracts: [FAKE_ETH_CONTRACT],
+            }),
+        );
+        expect(result.transactions).toEqual([]);
+        expect(result.newFraudContracts).toEqual([]);
+    });
+
+    test("a genuine transfer is unaffected by the setting either way", () => {
+        const tx = tokenTx();
+        expect(
+            filterTransactions([tx], filters({ hideSpoofedSymbols: false }))
+                .transactions,
+        ).toEqual([tx]);
+        expect(filterTransactions([tx], filters()).transactions).toEqual([tx]);
+    });
 });
 
 describe("low-holder token filtering (the 1,000-holder rule)", () => {
@@ -662,7 +745,8 @@ describe("dust threshold filtering", () => {
 });
 
 describe("filter defaults promised by the README and Settings", () => {
-    test("all three toggles default to on and the threshold to 100,000 gwei", () => {
+    test("all four toggles default to on and the threshold to 100,000 gwei", () => {
+        expect(state.hideSpoofedSymbols).toBe(true);
         expect(state.hideLowHolderTokens).toBe(true);
         expect(state.hideFraudContracts).toBe(true);
         expect(state.hideDustTransactions).toBe(true);
@@ -673,10 +757,10 @@ describe("filter defaults promised by the README and Settings", () => {
         expect(state.fraudContracts).toEqual([]);
     });
 
-    // Documents current behaviour: filterTransactions itself defaults every
-    // optional filter to off.  The "default to on" promise is satisfied by
-    // the state defaults above, which every caller passes in; the pure
-    // function makes no assumption of its own.
+    // Documents current behaviour: filterTransactions defaults the other three
+    // optional filters to off.  Their "default to on" promise is satisfied by
+    // the state defaults above, which every caller passes in.  Spoof
+    // verification is the exception and stays on unless explicitly disabled.
     test("current behaviour: with no filters argument only spoof filtering runs", () => {
         const dust = nativeDustTransfer();
         const lowHolder = tokenTx({

tests/txValidation.test.js

@@ -0,0 +1,357 @@
+const { parseEther } = require("ethers");
+const {
+    CODES,
+    FEE_PENDING,
+    FEE_KNOWN,
+    FEE_UNAVAILABLE,
+    feeReserveWei,
+    feeEstimateWei,
+    toFixedPoint,
+    validateTransfer,
+} = require("../src/shared/txValidation");
+
+// A plausible mainnet fee: 21000 gas at 20 gwei.
+const FEE = 21000n * 20000000000n; // 0.00042 ETH
+
+const GWEI = 1000000000n;
+const GAS_LIMIT = 21000n;
+
+describe("toFixedPoint", () => {
+    test("scales human decimals to 18 places", () => {
+        expect(toFixedPoint("1.5")).toBe(parseEther("1.5"));
+        expect(toFixedPoint("0")).toBe(0n);
+    });
+
+    test("rejects values it cannot represent exactly", () => {
+        expect(toFixedPoint("not a number")).toBe(null);
+        expect(toFixedPoint("")).toBe(null);
+        expect(toFixedPoint(null)).toBe(null);
+        // More precision than 18 decimals can hold.
+        expect(toFixedPoint("0.0000000000000000001")).toBe(null);
+    });
+});
+
+describe("validateTransfer, native ETH", () => {
+    const eth = (over) => ({
+        isErc20: false,
+        amount: "0.5",
+        ethBalance: "1.0",
+        feeStatus: FEE_KNOWN,
+        feeWei: FEE,
+        ...over,
+    });
+
+    test("allows a send comfortably within balance", () => {
+        const r = validateTransfer(eth());
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("blocks a send whose amount plus fee exceeds the balance", () => {
+        // The whole balance: passes an amount-only check, fails once the fee
+        // is counted. This is the bug this module exists to prevent.
+        const r = validateTransfer(eth({ amount: "1.0", ethBalance: "1.0" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("blocks a send left short by less than one fee", () => {
+        const balance = "1.0";
+        // One wei less headroom than the fee needs.
+        const amount = "0.99958000000000001"; // 1.0 - 0.00042 + 1e-17
+        const r = validateTransfer(eth({ amount, ethBalance: balance }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("allows a send that leaves exactly the fee behind", () => {
+        const r = validateTransfer(
+            eth({ amount: "0.99958", ethBalance: "1.0" }),
+        );
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("reports plain insufficient balance when the amount alone is too big", () => {
+        const r = validateTransfer(eth({ amount: "2.0", ethBalance: "1.0" }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH]);
+    });
+
+    test("blocks while the fee estimate is still pending", () => {
+        const r = validateTransfer(
+            eth({ feeStatus: FEE_PENDING, feeWei: null }),
+        );
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.FEE_PENDING]);
+    });
+
+    test("blocks when the fee estimate failed, without assuming zero", () => {
+        const r = validateTransfer(
+            eth({
+                amount: "1.0",
+                ethBalance: "1.0",
+                feeStatus: FEE_UNAVAILABLE,
+                feeWei: null,
+            }),
+        );
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.FEE_UNAVAILABLE]);
+        // A zero fee would have let this exact transfer through.
+        expect(
+            validateTransfer(
+                eth({ amount: "1.0", ethBalance: "1.0", feeWei: 0n }),
+            ).canSend,
+        ).toBe(true);
+    });
+
+    test("still reports an over-balance amount before the estimate lands", () => {
+        const r = validateTransfer(
+            eth({
+                amount: "2.0",
+                ethBalance: "1.0",
+                feeStatus: FEE_PENDING,
+                feeWei: null,
+            }),
+        );
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH, CODES.FEE_PENDING]);
+    });
+
+    test("rejects an amount it cannot do exact arithmetic on", () => {
+        const r = validateTransfer(eth({ amount: "abc" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.AMOUNT_INVALID]);
+    });
+
+    test("rejects a negative amount", () => {
+        // A negative amount parses to a perfectly good bigint, so neither
+        // balance comparison can fire: both are trivially false against it.
+        // Left unblocked it clears the screen and then dies at encode time.
+        const r = validateTransfer(
+            eth({ amount: "-1", ethBalance: "1.0", feeWei: 861000000000000n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+        expect(
+            validateTransfer(eth({ amount: "-0.000000000000000001" })),
+        ).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+    });
+
+    test("treats a missing balance as zero, not as unlimited", () => {
+        const r = validateTransfer(eth({ ethBalance: undefined }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH]);
+    });
+});
+
+describe("validateTransfer, ERC-20", () => {
+    const erc20 = (over) => ({
+        isErc20: true,
+        amount: "100.0",
+        tokenBalance: "250.0",
+        ethBalance: "1.0",
+        feeStatus: FEE_KNOWN,
+        feeWei: FEE,
+        ...over,
+    });
+
+    test("allows a transfer with tokens to spend and ETH for the fee", () => {
+        expect(validateTransfer(erc20())).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("checks the token amount against the token balance", () => {
+        const r = validateTransfer(erc20({ amount: "250.000001" }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_TOKEN]);
+    });
+
+    test("does not charge the fee against the token balance", () => {
+        // The full token balance is sendable: the fee is paid in ETH.
+        expect(validateTransfer(erc20({ amount: "250.0" })).canSend).toBe(true);
+    });
+
+    test("blocks when the ETH balance does not cover the fee", () => {
+        const r = validateTransfer(erc20({ ethBalance: "0.0001" }));
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_FOR_FEE]);
+    });
+
+    test("allows a fee exactly equal to the ETH balance", () => {
+        const r = validateTransfer(erc20({ ethBalance: "0.00042" }));
+        expect(r).toEqual({ canSend: true, codes: [] });
+    });
+
+    test("reports both shortfalls when tokens and ETH are both short", () => {
+        const r = validateTransfer(
+            erc20({ amount: "300.0", ethBalance: "0.0" }),
+        );
+        expect(r.codes).toEqual([
+            CODES.INSUFFICIENT_TOKEN,
+            CODES.INSUFFICIENT_ETH_FOR_FEE,
+        ]);
+    });
+
+    test("blocks while the fee estimate is pending or failed", () => {
+        expect(
+            validateTransfer(erc20({ feeStatus: FEE_PENDING, feeWei: null }))
+                .codes,
+        ).toEqual([CODES.FEE_PENDING]);
+        expect(
+            validateTransfer(
+                erc20({ feeStatus: FEE_UNAVAILABLE, feeWei: null }),
+            ).codes,
+        ).toEqual([CODES.FEE_UNAVAILABLE]);
+    });
+
+    test("rejects a negative token amount", () => {
+        const r = validateTransfer(
+            erc20({ amount: "-0.5", feeWei: 861000000000000n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.AMOUNT_INVALID] });
+    });
+
+    test("treats a missing token balance as zero", () => {
+        const r = validateTransfer(erc20({ tokenBalance: undefined }));
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_TOKEN]);
+    });
+});
+
+// The reserve a node requires, not the fee the transaction is expected to
+// actually cost. An unpinned send goes out as type-2, and the node checks it
+// against maxFeePerGas; reserving gasPrice lets a transaction the node will
+// reject pass the gate.
+describe("feeReserveWei", () => {
+    // baseFee 20 gwei, tip 1 gwei: eth_gasPrice reports ~21 gwei, while
+    // ethers populates maxFeePerGas as baseFee * 2 + tip = 41 gwei.
+    const type2 = {
+        gasPrice: 21n * GWEI,
+        maxFeePerGas: 41n * GWEI,
+        maxPriorityFeePerGas: 1n * GWEI,
+    };
+
+    test("reserves gasLimit * maxFeePerGas, not gasLimit * gasPrice", () => {
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(GAS_LIMIT * 41n * GWEI);
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(861000000000000n);
+        // The number the node would not have accepted.
+        expect(feeReserveWei(GAS_LIMIT, type2)).not.toBe(441000000000000n);
+    });
+
+    test("gates out a send the type-2 reserve cannot fund", () => {
+        // Exactly fundable against a gasPrice reserve (0.999559 + 0.000441 is
+        // the whole balance to the wei), and short against the reserve the
+        // node will actually require.
+        const send = {
+            isErc20: false,
+            amount: "0.999559",
+            ethBalance: "1.0",
+            feeStatus: FEE_KNOWN,
+        };
+        expect(
+            validateTransfer({
+                ...send,
+                feeWei: GAS_LIMIT * type2.gasPrice,
+            }).canSend,
+        ).toBe(true);
+        const r = validateTransfer({
+            ...send,
+            feeWei: feeReserveWei(GAS_LIMIT, type2),
+        });
+        expect(r.canSend).toBe(false);
+        expect(r.codes).toEqual([CODES.INSUFFICIENT_ETH_WITH_FEE]);
+    });
+
+    test("falls back to gasPrice on a network with no type-2 pricing", () => {
+        const legacy = { gasPrice: 21n * GWEI, maxFeePerGas: null };
+        expect(feeReserveWei(GAS_LIMIT, legacy)).toBe(GAS_LIMIT * 21n * GWEI);
+    });
+
+    test("returns null when no usable price or gas limit is available", () => {
+        expect(feeReserveWei(GAS_LIMIT, { gasPrice: null })).toBe(null);
+        expect(feeReserveWei(GAS_LIMIT, {})).toBe(null);
+        expect(feeReserveWei(GAS_LIMIT, null)).toBe(null);
+        expect(feeReserveWei(21000, type2)).toBe(null);
+    });
+});
+
+// The display counterpart of the reserve: what the transaction is expected to
+// cost. Shown alongside the reserve so the screen neither contradicts the gate
+// nor quotes the user roughly double what they will pay.
+describe("feeEstimateWei", () => {
+    const type2 = {
+        gasPrice: 21n * GWEI,
+        maxFeePerGas: 41n * GWEI,
+        maxPriorityFeePerGas: 1n * GWEI,
+    };
+
+    test("estimates gasLimit * gasPrice, below the reserve", () => {
+        expect(feeEstimateWei(GAS_LIMIT, type2)).toBe(441000000000000n);
+        expect(feeReserveWei(GAS_LIMIT, type2)).toBe(861000000000000n);
+        expect(feeEstimateWei(GAS_LIMIT, type2)).toBeLessThan(
+            feeReserveWei(GAS_LIMIT, type2),
+        );
+    });
+
+    test("equals the reserve when the network has no type-2 pricing", () => {
+        const legacy = { gasPrice: 21n * GWEI, maxFeePerGas: null };
+        expect(feeEstimateWei(GAS_LIMIT, legacy)).toBe(
+            feeReserveWei(GAS_LIMIT, legacy),
+        );
+    });
+
+    test("falls back to maxFeePerGas when there is no gasPrice", () => {
+        const noLegacy = { gasPrice: null, maxFeePerGas: 41n * GWEI };
+        expect(feeEstimateWei(GAS_LIMIT, noLegacy)).toBe(
+            feeReserveWei(GAS_LIMIT, noLegacy),
+        );
+    });
+
+    test("returns null on the same unusable inputs as the reserve", () => {
+        expect(feeEstimateWei(GAS_LIMIT, {})).toBe(null);
+        expect(feeEstimateWei(GAS_LIMIT, null)).toBe(null);
+        expect(feeEstimateWei(GAS_LIMIT, { gasPrice: -1n })).toBe(null);
+        expect(feeEstimateWei(21000, type2)).toBe(null);
+    });
+});
+
+// Everything that is not a usable fee blocks exactly as FEE_UNAVAILABLE does.
+// Each of these previously returned { canSend: true, codes: [] } — counting no
+// fee at all, on a full-balance send, in the direction that lets money out.
+describe("validateTransfer, unusable fee input fails closed", () => {
+    const fullBalanceSend = (over) => ({
+        isErc20: false,
+        amount: "1.0",
+        ethBalance: "1.0",
+        ...over,
+    });
+
+    test("blocks a null fee claiming to be known", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: null }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks a known fee that is a number rather than a bigint", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: 420000000000000 }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks an unrecognised fee status", () => {
+        const r = validateTransfer(fullBalanceSend({ feeStatus: "bogus" }));
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks a negative fee", () => {
+        const r = validateTransfer(
+            fullBalanceSend({ feeStatus: FEE_KNOWN, feeWei: -1n }),
+        );
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+
+    test("blocks an ERC-20 transfer on an unusable fee too", () => {
+        const r = validateTransfer({
+            isErc20: true,
+            amount: "100.0",
+            tokenBalance: "250.0",
+            ethBalance: "1.0",
+            feeStatus: FEE_KNOWN,
+            feeWei: null,
+        });
+        expect(r).toEqual({ canSend: false, codes: [CODES.FEE_UNAVAILABLE] });
+    });
+});

tests/vaultBackend.test.js

@@ -0,0 +1,52 @@
+// The unit tests must exercise the libsodium backend that actually ships
+// (#182). Before this, they could not: node compiles WebAssembly happily,
+// the extension CSP refused it, and so the browser silently ran the
+// wasm2js translation while every test ran the WASM build.
+//
+// With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
+// hold that agreement in place from the node side. tests/manifest.test.js
+// holds up the CSP end of it, and the end-to-end suite observes the real
+// popup.
+
+const { cryptoBackend } = require("../src/shared/vault");
+
+// The module libsodium-wrappers-sumo itself requires and drives. Not a new
+// dependency: it is inspected here, never used to perform crypto, because
+// it is the only thing that can say which backend is loaded.
+const SODIUM_CORE = "libsodium-sumo";
+
+describe("libsodium backend", () => {
+    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
+        await expect(cryptoBackend()).resolves.toBe("wasm");
+    });
+
+    test("libsodium did not swap in the wasm2js fallback", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        // useBackupModule is the entry point to the fallback; taking it
+        // replaces the module's exports with the translation's, and the
+        // entry point goes with them. Still present after ready means the
+        // WASM module is the one in place. The test below is what keeps
+        // that inference honest.
+        expect(typeof core.useBackupModule).toBe("function");
+    });
+
+    // Deliberately last, and deliberately destructive: it takes the
+    // fallback, which replaces the loaded module for the rest of this
+    // file. Jest gives each test file its own module registry, so nothing
+    // outside sees it.
+    //
+    // Without this, the check above would be a claim about libsodium's
+    // internals with nothing holding it to account: if a future version
+    // kept useBackupModule on the fallback module too, the marker would
+    // quietly become true in both backends and the test would pass while
+    // measuring nothing. Forcing the fallback and watching the marker
+    // disappear is what makes its presence mean something.
+    test("the fallback marker distinguishes the two backends", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        expect(typeof core.useBackupModule).toBe("function");
+        await core.useBackupModule();
+        expect(typeof core.useBackupModule).toBe("undefined");
+    });
+});

tests/wallet.test.js

@@ -160,6 +160,31 @@ function masterXprv(phrase, passphrase = "") {
     ).extendedKey;
 }
 
+// The account-level (depth-3) extended private key m/44'/60'/0' for a phrase.
+// A normal thing for a user to hold, and not something the import flow can
+// derive the BIP-44 account path from.
+function accountXprv(phrase) {
+    return HDNodeWallet.fromSeed(
+        Mnemonic.fromPhrase(phrase, "").computeSeed(),
+    ).derivePath("m/44'/60'/0'").extendedKey;
+}
+
+// Every single-character substitution of `key`, using base58 characters that
+// are not the original. Base58 has no visually ambiguous characters, so each
+// of these is a plausible typo rather than a contrived string.
+const TYPO_CHARS = ["a", "b", "2", "Z"];
+
+function singleCharacterTypos(key) {
+    const out = [];
+    for (let i = 0; i < key.length; i++) {
+        for (const c of TYPO_CHARS) {
+            if (c === key[i]) continue;
+            out.push(key.slice(0, i) + c + key.slice(i + 1));
+        }
+    }
+    return out;
+}
+
 describe("hdWalletFromMnemonic", () => {
     test("first address matches the published vector for m/44'/60'/0'/0/0", () => {
         expect(wallet.hdWalletFromMnemonic(VECTOR_PHRASE).firstAddress).toBe(
@@ -299,19 +324,7 @@ describe("isValidXprv", () => {
         expect(wallet.isValidXprv(xpub)).toBe(false);
     });
 
-    // Skipped: this asserts the correct behaviour, which the code does not
-    // currently have. isValidXprv gates the paste-your-extended-private-key
-    // import in src/popup/views/addWallet.js:215, and it accepts a key with a
-    // one-character typo: ethers' HDNodeWallet.fromExtendedKey skips base58
-    // checksum verification whenever the decoded payload is the usual 82
-    // bytes, which is the whole point of that checksum. Measured on this
-    // vector: changing any one of the last 14 characters passes validation,
-    // and for 9 of those 14 positions the import silently yields a *different*
-    // wallet (e.g. 0x3F334f0a356d6B46B1d70B590E7437D77100d28D instead of
-    // 0x022b971dFF0C43305e691DEd7a14367AF19D6407) with no error shown.
-    // Tracked as https://git.eeqj.de/sneak/AutistMask/issues/210; out of scope
-    // here, which is tests only. Unskip when it is fixed.
-    test.skip("rejects an extended key with a one-character typo", () => {
+    test("rejects an extended key with a one-character typo", () => {
         const index = BIP32_VECTOR_1_XPRV.length - 8;
         const typo =
             BIP32_VECTOR_1_XPRV.slice(0, index) +
@@ -320,6 +333,125 @@ describe("isValidXprv", () => {
 
         expect(wallet.isValidXprv(typo)).toBe(false);
     });
+
+    // The base58 checksum exists to make a mistyped key impossible to use, and
+    // ethers does not enforce it: HDNodeWallet.fromExtendedKey skips checksum
+    // verification whenever the decoded payload is the usual 82 bytes, which
+    // is precisely the case it is there to catch. A typo anywhere in the key
+    // must be refused, not silently turned into someone else's wallet.
+    test("no single-character typo anywhere in the key is accepted", () => {
+        const accepted = singleCharacterTypos(BIP32_VECTOR_1_XPRV).filter(
+            (typo) => wallet.isValidXprv(typo),
+        );
+
+        expect(accepted).toEqual([]);
+    });
+
+    test("a typo never yields a wallet, let alone a different one", () => {
+        const correct = wallet.hdWalletFromXprv(BIP32_VECTOR_1_XPRV);
+        const derived = [];
+        for (const typo of singleCharacterTypos(BIP32_VECTOR_1_XPRV)) {
+            try {
+                derived.push(wallet.hdWalletFromXprv(typo).firstAddress);
+            } catch {
+                // Rejected, which is the required behaviour.
+            }
+        }
+
+        expect(derived).toEqual([]);
+        expect(correct.firstAddress).toBe(
+            "0x022b971dFF0C43305e691DEd7a14367AF19D6407",
+        );
+    });
+});
+
+describe("extended key depth", () => {
+    // hdWalletFromXprv derives the BIP-44 Ethereum account path from the key
+    // it is given. That is only the path it names when the key is the master
+    // key. Under an account-level key the same derivation lands at
+    // m/44'/60'/0'/44'/60'/0'/0, whose addresses correspond to nothing the
+    // user holds, so a non-master key is refused rather than derived from.
+    test("a master key is a master key", () => {
+        expect(wallet.isMasterExtendedKey(masterXprv(VECTOR_PHRASE))).toBe(
+            true,
+        );
+        expect(wallet.isMasterExtendedKey(BIP32_VECTOR_1_XPRV)).toBe(true);
+    });
+
+    test("an account-level key is not a master key", () => {
+        expect(wallet.isMasterExtendedKey(accountXprv(VECTOR_PHRASE))).toBe(
+            false,
+        );
+    });
+
+    test("a derived xpub is not a master key", () => {
+        expect(
+            wallet.isMasterExtendedKey(
+                wallet.hdWalletFromMnemonic(VECTOR_PHRASE).xpub,
+            ),
+        ).toBe(false);
+    });
+
+    test("a mistyped key is not a master key either", () => {
+        expect(wallet.isMasterExtendedKey(BIP32_VECTOR_1_XPRV + "a")).toBe(
+            false,
+        );
+    });
+
+    test("hdWalletFromXprv rejects an account-level key", () => {
+        expect(() =>
+            wallet.hdWalletFromXprv(accountXprv(VECTOR_PHRASE)),
+        ).toThrow(/master/i);
+    });
+
+    test("getSignerForAddress rejects an account-level key", () => {
+        expect(() =>
+            wallet.getSignerForAddress(
+                { type: "xprv" },
+                0,
+                accountXprv(VECTOR_PHRASE),
+            ),
+        ).toThrow(/master/i);
+    });
+
+    test("the account-level key is well-formed, so only depth rejects it", () => {
+        expect(wallet.isValidXprv(accountXprv(VECTOR_PHRASE))).toBe(true);
+    });
+
+    test("a master key still imports and derives the published addresses", () => {
+        const { xpub, firstAddress } = wallet.hdWalletFromXprv(
+            masterXprv(VECTOR_PHRASE),
+        );
+
+        expect(firstAddress).toBe(VECTOR_ADDRESSES[0]);
+        expect(
+            [0, 1, 2].map((i) => wallet.deriveAddressFromXpub(xpub, i)),
+        ).toEqual(VECTOR_ADDRESSES);
+    });
+});
+
+describe("deriveAddressFromXpub checksum enforcement", () => {
+    // The xpub path shares the hole: fromExtendedKey accepts a mistyped xpub
+    // just as readily, and deriveAddressFromXpub would hand back addresses
+    // from a different tree.
+    const { xpub } = wallet.hdWalletFromMnemonic(VECTOR_PHRASE);
+
+    test("the correct xpub still derives the published addresses", () => {
+        expect(wallet.deriveAddressFromXpub(xpub, 0)).toBe(VECTOR_ADDRESSES[0]);
+    });
+
+    test("no single-character typo anywhere in an xpub is accepted", () => {
+        const derived = [];
+        for (const typo of singleCharacterTypos(xpub)) {
+            try {
+                derived.push(wallet.deriveAddressFromXpub(typo, 0));
+            } catch {
+                // Rejected, which is the required behaviour.
+            }
+        }
+
+        expect(derived).toEqual([]);
+    });
 });
 
 describe("isValidMnemonic", () => {