fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

A tracked token that the spoof rule refuses still got a zero row in the balance list while "Show tracked tokens with zero balance" was on. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds that row. AddToken and SettingsAddToken refuse such a token after the contract lookup, with the flash "Not added: this token fakes a known symbol." The bundled-list buttons on SettingsAddToken need no check: the rule never refuses a bundled token. README.md and docs/README.md now say the balance list drops such a token whatever the settings.

Model: opus-5-5

Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 
 COPY script/ script/
 COPY package.json yarn.lock ./
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 RUN script/bootstrap
 
 COPY . .

README.md

@@ -1473,21 +1473,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. A token claiming a symbol from the bundled list from any other
-contract address is always dropped, tracked or not, and so is any token claiming
-a symbol that belongs to the native asset and therefore has no legitimate
-contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
-`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
-tokens with fewer than 1,000 holders" setting governs the transaction history
-and the send-screen token selector, not this list. A token's holder count is
-unknown when the explorer reports none, or reports anything other than a whole
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
-or more, so such a token is shown only when it is on the bundled list or
-tracked. Every nonzero holding of a token shown is stored exactly, however
-small, but a holding below 0.000001 is left out of the balance lists, the
-send-screen token selector, the address total and the remove-address warning
-(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
+more holders. The balance list always drops a token that claims a bundled-list
+symbol from another contract address, whatever the settings. The list also drops
+every token that claims the native asset's symbol: `"ETH"`, or any network's
+`nativeCurrency`, such as `"SepoliaETH"`. That filter is unconditional — the
+"Hide tokens with fewer than 1,000 holders" setting governs the transaction
+history and the send-screen token selector, not this list. A token's holder
+count is unknown when the explorer reports none, or reports anything other than
+a whole number written in digits alone, such as `1,000` or `1e3`
+(`parseHoldersCount()` in `src/shared/holders.js`). This list does not take an
+unknown count as 1,000 or more, so such a token is shown only when it is on the
+bundled list or tracked. Every nonzero holding of a token shown is stored
+exactly, however small, but a holding below 0.000001 is left out of the balance
+lists, the send-screen token selector, the address total and the remove-address
+warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
 zero balance" is on.
@@ -2053,15 +2052,21 @@ view would leave a wallet one click from deletion.
       fee estimate and the contract and never-sent recipient checks ask that
       network's RPC endpoint, and the Etherscan label check asks that network's
       explorer
-    - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
-      total fee the RPC endpoint fills in at signing is over its bound in
-      `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
-      signed; "The gas limit or fee the RPC endpoint quoted for this transaction
-      is more than this wallet will sign for, so it was not sent. Please go back
-      and try again." in its own box, the same sentence for all three, no screen
-      change
-    - "Sign & Send" (wrong password) → "Wrong password." on the password error
-      line, no screen change
+    - "Sign & Send" (correct password) when the gas limit or a fee is over its
+      bound → nothing is signed; "The gas limit or fee the RPC endpoint quoted
+      for this transaction is more than this wallet will sign for, so it was not
+      sent. Please go back and try again." in its own box, no screen change. For
+      an ETH amount that Send's "Max" filled in, the gas limit and fees are
+      those of this screen's own fee estimate (see Amount above). For any other
+      send, the RPC endpoint fills in the gas limit and fees at signing. Just
+      before signing, `assertWithinCeilings()` (`src/shared/approvalVerify.js`)
+      refuses the send when any of these is over its bound:
+        - the gas limit
+        - each fee per gas the transaction sets
+        - the total fee: the gas limit times `maxFeePerGas`, or times `gasPrice`
+          when the transaction has no `maxFeePerGas`
+    - "Sign & Send" (wrong password) → "That password is incorrect. Please try
+      again." on the password error line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
       selected: the two are saved separately, so the popup can reopen onto this
       screen with another address selected. When the selected wallet does not
@@ -2233,6 +2238,8 @@ view would leave a wallet one click from deletion.
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
+    - "Add" with a token that the spoof rule refuses → nothing is tracked; "Not
+      added: this token fakes a known symbol." flash message, no screen change
     - "Add", then the contract lookup answers while another screen shows, or
       after AddToken was opened again → tracks the token, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2541,6 +2548,9 @@ view would leave a wallet one click from deletion.
       "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
+    - "Add" by contract address with a token that the spoof rule refuses →
+      nothing is tracked; "Not added: this token fakes a known symbol." flash
+      message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
       lookup answers → nothing is tracked; "The active network changed before
       the lookup finished, so the token was not added." flash message, no screen

docs/README.md

@@ -380,10 +380,8 @@ but comes from an unrecognized contract, it is identified as a spoof and hidden.
 In your transaction history this is the "Hide fake tokens impersonating a known
 symbol" setting, which you can switch off; doing so also stops new entries being
 added to the fraud contract blocklist below, since detecting a spoof is what
-fills it. The send token list always applies the check. Your balances apply it
-too, with one exception: a token claiming the symbol "ETH" is not filtered
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
+fills it. The send token list always applies the check. Your balance list always
+applies the check too.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your

eslint.config.js

@@ -153,8 +153,7 @@ module.exports = [
         },
     },
 
-    // The helpers the script/ entrypoints call: plain node programs too, run
-    // from a shell script rather than from yarn, and never bundled.
+    // The files in script/lib/ run on plain node too, and are never bundled.
     {
         files: ["script/lib/**/*.js"],
         languageOptions: {

package.json

@@ -6,8 +6,8 @@
     "license": "GPL-3.0",
     "private": true,
     "scripts": {
-        "test": "jest --forceExit --maxWorkers=3",
-        "test:verbose": "jest --forceExit --maxWorkers=3 --verbose",
+        "test": "node script/lib/jest.js --maxWorkers=3",
+        "test:verbose": "node script/lib/jest.js --maxWorkers=3 --verbose",
         "build": "node build.js",
         "lint": "eslint . && prettier --check .",
         "fmt": "prettier --write .",

script/bootstrap

@@ -118,6 +118,7 @@ ensure_yarn() {
     fi
 }
 
+# yarn warns about the workspaces field in eslint and babel-plugin-istanbul; no newer release drops it.
 install_js_deps() {
     if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
         nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \

script/lib/jest.js

@@ -0,0 +1,40 @@
+// Runs jest with the arguments it is given, and fails the run when jest had to
+// force-stop the worker process that ran a test file. Jest itself only prints a
+// warning when that happens, and its run still passes. The warning means a test
+// left a timer or another open handle running. The test scripts in package.json
+// run jest through this file.
+//
+// Jest runs inside this process and writes to the terminal directly, so its
+// output looks the same as a plain jest run. This file only checks each write
+// to stderr for the warning below.
+
+"use strict";
+
+// The start of the warning that jest prints on stderr after it force-stops a
+// worker process.
+const WORKER_WARNING = "A worker process has failed to exit gracefully";
+
+let forceStopped = false;
+
+const writeStderr = process.stderr.write.bind(process.stderr);
+process.stderr.write = (chunk, ...rest) => {
+    if (String(chunk).includes(WORKER_WARNING)) {
+        forceStopped = true;
+    }
+    return writeStderr(chunk, ...rest);
+};
+
+// Runs after jest has finished, as the process exits.
+process.on("exit", () => {
+    if (forceStopped) {
+        console.error(
+            "script/lib/jest.js: failing the run, because jest force-stopped " +
+                "a worker process. A test left a timer or another open " +
+                "handle running.",
+        );
+        process.exitCode = 1;
+    }
+});
+
+// Jest's own command-line program. It reads its arguments from process.argv.
+require("jest/bin/jest");

src/popup/views/addToken.js

@@ -3,6 +3,7 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
 // Counts the times AddToken has opened. A contract lookup started before
@@ -77,6 +78,15 @@ function init(ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked.
+            if (isSpoofedSymbol(info.symbol, contractAddr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                if (addTokenScreenOpenings !== opening) return;
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, contractAddr);
             state.trackedTokens.push({
                 address: contractAddr,
@@ -117,6 +127,7 @@ function init(ctx) {
                     ? detail
                     : "Could not add the token.",
             );
+            if (addTokenScreenOpenings !== opening) return;
             infoEl.textContent = "";
             infoEl.style.visibility = "hidden";
         }

src/popup/views/helpers.js

@@ -33,6 +33,7 @@ const { networkByChainId } = require("../../shared/networks");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { displaySymbol } = require("../../shared/symbolDisplay");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { walletHasRecoveryPhrase } = require("../../shared/wallet");
 const { markViewRendered } = require("../viewRouter");
 
@@ -447,6 +448,9 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     if (showZero && trackedTokens) {
         for (const t of trackedTokens) {
             if (seen.has(t.address.toLowerCase())) continue;
+            // A token that the spoof rule refuses has no stored balance, and
+            // gets no zero row either.
+            if (isSpoofedSymbol(t.symbol, t.address)) continue;
             html += balanceLine(
                 t.symbol,
                 0,

src/popup/views/settingsAddToken.js

@@ -3,6 +3,7 @@ const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
+const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
 const { log } = require("../../shared/log");
 
 let ctx;
@@ -155,6 +156,16 @@ function init(_ctx) {
                 );
                 return;
             }
+            // The balance list never shows a token that the spoof rule
+            // refuses, so such a token is not tracked. The rule never refuses
+            // a bundled token, so the "Top tokens:" buttons and the top 100
+            // dropdown need no such check.
+            if (isSpoofedSymbol(info.symbol, addr)) {
+                showFlash("Not added: this token fakes a known symbol.");
+                infoEl.textContent = "";
+                infoEl.style.visibility = "hidden";
+                return;
+            }
             log.infof("Adding token", info.symbol, addr);
             state.trackedTokens.push({
                 address: addr,

tests/addTokenLateAnswer.test.js

@@ -75,7 +75,7 @@ test("an answer after the user opened Settings adds the token and Settings stays
     expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
 });
 
-test("Back onto AddToken after that answer shows no lookup status", async () => {
+test("Back from Settings onto AddToken after the lookup answered shows no lookup status", async () => {
     const boot = await openAddToken();
     const answerLookup = addWithPendingLookup(boot);
     expect(boot.text("add-token-info")).toBe("Looking up token...");
@@ -104,6 +104,28 @@ test("an answer after AddToken was opened again adds the token and leaves AddTok
     expect(boot.storage.read("autistmask").trackedTokens).toEqual([TOKEN]);
 });
 
+test("a lookup that fails after AddToken was opened again leaves the status line as it is", async () => {
+    const boot = await openAddToken();
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    let failFirstLookup;
+    lookupTokenInfo.mockImplementationOnce(
+        () =>
+            new Promise((_, reject) => {
+                failFirstLookup = reject;
+            }),
+    );
+    const firstAdd = boot.click("btn-add-token-confirm");
+    await boot.click("btn-add-token-back");
+    await boot.click("btn-add-token");
+    boot.node("add-token-address").value = OTHER_TOKEN_ADDRESS;
+    // The second lookup is never answered.
+    addWithPendingLookup(boot);
+
+    failFirstLookup(new Error("lookup failed"));
+    await firstAdd;
+    expect(boot.text("add-token-info")).toBe("Looking up token...");
+});
+
 test("an answer while AddToken still shows goes to AddressDetail with the token listed", async () => {
     const boot = await openAddToken();
     const answerLookup = addWithPendingLookup(boot);

tests/addressKey.test.js

@@ -161,7 +161,7 @@ function click(element) {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 // ------------------------------------------------------------ harness
@@ -188,7 +188,11 @@ let sent;
 // handler to the buttons it drew, as the browser's fresh list would have.
 let plusButton;
 
+// showFlash() starts a timer that clears the message one or two seconds later.
+// Each test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     approvalDetails = null;
     sent = [];
     mockNode.broadcast = [];
@@ -239,6 +243,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+    jest.useRealTimers();
     jest.restoreAllMocks();
 });
 

tests/backgroundApproval.test.js

@@ -537,7 +537,18 @@ async function settleIncludingRejections() {
     await new Promise((resolve) => setImmediate(resolve));
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });
@@ -1883,18 +1894,6 @@ describe("a closed approval window leaves the request pending", () => {
         return bg.actionPopups[bg.actionPopups.length - 1];
     }
 
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
     test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();

tests/backgroundStateIsolation.test.js

@@ -103,7 +103,18 @@ function deferred() {
     return { promise, resolve };
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/chainSwitchGate.test.js

@@ -56,7 +56,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerChainSwitch.test.js

@@ -64,7 +64,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/coldWorkerSendTransaction.test.js

@@ -76,7 +76,18 @@ async function settle() {
     for (let i = 0; i < 60; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
 });
 

tests/connectedSitesWorkerRestart.test.js

@@ -57,7 +57,18 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// While an approval is pending, the background starts a 20-second timer to
+// keep itself running. The timer is stubbed and never starts, so no test in
+// this file leaves it running.
+let keepRunningTimer;
+beforeEach(() => {
+    keepRunningTimer = jest
+        .spyOn(global, "setInterval")
+        .mockImplementation(() => 1);
+});
+
 afterEach(() => {
+    keepRunningTimer.mockRestore();
     delete global.chrome;
     jest.resetModules();
 });

tests/deleteWalletLostPassword.test.js

@@ -102,6 +102,17 @@ function makeDocument() {
 
 // ------------------------------------------------------------ harness
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
+beforeEach(() => {
+    jest.useFakeTimers();
+});
+
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 function wallet(name, secret, addresses) {
     return {
         type: "hd",

tests/sendAmountRule.test.js

@@ -131,10 +131,14 @@ async function review(amount, token) {
 async function confirm(amount, token) {
     const txInfo = await review("0.5", token);
     confirmTx.show({ ...txInfo, amount });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     state.wallets = [
         {
@@ -167,6 +171,10 @@ beforeEach(() => {
     state.currentView = null;
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe.each([
     ["1e-3", "ETH"],
     ["1e-3", "TOK"],

tests/sendMax.test.js

@@ -277,14 +277,18 @@ async function review() {
 
 // show() starts the fee estimate without awaiting it; this lets it settle.
 async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+    for (let i = 0; i < 10; i++) await jest.advanceTimersByTimeAsync(0);
 }
 
 function canSend() {
     return !el("btn-confirm-send").disabled;
 }
 
+// showFlash() starts a timer that clears the message two seconds later. Each
+// test here runs on fake timers and drops them in afterEach, so that timer
+// never outlives the test.
 beforeEach(() => {
+    jest.useFakeTimers();
     elements.clear();
     log.errorf.mockClear();
     pageClosed = new AbortController();
@@ -297,6 +301,10 @@ beforeEach(() => {
     mockNode.broadcast = [];
 });
 
+afterEach(() => {
+    jest.useRealTimers();
+});
+
 describe("Max on an ETH send", () => {
     test("fills in the exact balance minus the fee reserve", async () => {
         await refreshWith(BALANCE_WEI);

tests/spoofedTrackedToken.test.js

@@ -0,0 +1,91 @@
+// A token that the spoof rule refuses never shows in the balance list, even
+// tracked at zero balance with "Show tracked tokens with zero balance" on, and
+// the two add-token screens refuse to track one
+// (https://git.eeqj.de/sneak/AutistMask/issues/705). Driven through the real
+// popup over a stored profile.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+
+// Claims the symbol of the bundled USDT from another contract.
+const FAKE_USDT = {
+    address: TOKEN_ADDRESS,
+    symbol: "USDT",
+    decimals: 6,
+    name: "Tether USD",
+};
+// A symbol the bundled list does not have, so the spoof rule passes it.
+const TEST_TOKEN = {
+    address: "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+const REFUSED_FLASH = "Not added: this token fakes a known symbol.";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+test("a fake token tracked at zero balance is not listed while zero balances are shown", async () => {
+    const boot = await bootPopup(
+        unversionedValidProfile({
+            currentView: "address",
+            selectedWallet: 0,
+            selectedAddress: 0,
+            trackedTokens: [FAKE_USDT, TEST_TOKEN],
+            showZeroBalanceTokens: true,
+        }),
+    );
+    const rows = boot.node("address-balances").innerHTML;
+    expect(rows).toContain(`data-token="${TEST_TOKEN.address.toLowerCase()}"`);
+    expect(rows).not.toContain(
+        `data-token="${FAKE_USDT.address.toLowerCase()}"`,
+    );
+});
+
+// Each screen is opened from AddressDetail by the buttons named, in order.
+describe.each([
+    [
+        "AddToken",
+        ["btn-add-token"],
+        "add-token",
+        "add-token-address",
+        "btn-add-token-confirm",
+    ],
+    [
+        "SettingsAddToken",
+        ["btn-settings", "btn-settings-add-token"],
+        "settings-addtoken",
+        "settings-addtoken-address",
+        "btn-settings-addtoken-manual",
+    ],
+])("%s", (_, opening, view, field, button) => {
+    test("refuses a fake token by contract address", async () => {
+        const boot = await bootPopup(
+            unversionedValidProfile({
+                currentView: "address",
+                selectedWallet: 0,
+                selectedAddress: 0,
+            }),
+        );
+        for (const id of opening) await boot.click(id);
+        expect(boot.visibleViews()).toEqual([view]);
+        const { lookupTokenInfo } = require("../src/shared/balances");
+        lookupTokenInfo.mockResolvedValueOnce({
+            symbol: FAKE_USDT.symbol,
+            decimals: FAKE_USDT.decimals,
+            name: FAKE_USDT.name,
+        });
+        boot.node(field).value = FAKE_USDT.address;
+
+        await boot.click(button);
+        expect(boot.text("flash-msg")).toBe(REFUSED_FLASH);
+        expect(boot.visibleViews()).toEqual([view]);
+        expect(boot.storage.read("autistmask").trackedTokens).toEqual([]);
+    });
+});

tests/walletDefects.test.js

@@ -357,6 +357,11 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     beforeEach(() => {
+        // showFlash() starts a timer that clears the message two seconds
+        // later. Each test here runs on fake timers and drops them in
+        // afterEach, so that timer never outlives the test.
+        jest.useFakeTimers();
+
         const broken = brokenXprvWallet();
         // A balance, so that no Send button's zero-balance refusal can stand
         // in for the defect check.
@@ -398,6 +403,7 @@ describe("every way to a signature or the private key refuses a defective wallet
     });
 
     afterEach(() => {
+        jest.useRealTimers();
         state.wallets = [];
         state.activeAddress = null;
         state.selectedWallet = null;