harden: verify all approval fields and make failed signing retryable (closes #174 )

verifySignedTx compared only from, to, value and data, so a signed transaction could differ from the approval in chain id, nonce, gas limit or any fee field and still be broadcast. It now compares every consequential field and refuses outright on any mismatch: the chain id against the selected network (and against the approval when the page fixed one), plus nonce, gas limit, gasPrice, maxFeePerGas and maxPriorityFeePerGas wherever the approval carries a value, together with the fee mechanism the approval implies. Fields the approval does not carry are populated locally by the popup and have no approved value to compare against, so they are held to absolute ceilings instead. A failed signing attempt also left a button that could not succeed: the background deleted the approval before it broadcast, so a retry found nothing to sign. The approval is now retired only once the request has an outcome, and the background tells the popup whether the failure is retryable, so the button comes back for a failure the user can correct and stays down with an explanation when the approval is spent.
2026-08-11 12:26:54 +00:00
15 changed files with 232 additions and 1675 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,3 @@
 # .git is deliberately NOT excluded: build.js shells out to `git rev-parse` for
 # build-info stamping and the Dockerfile runs `make build`, so excluding it
 # would make every built extension report commitHash "unknown".
 node_modules
 .DS_Store
 dist
--- a/2
+++ b/2
@@ -11,7 +11,7 @@ setup:
 	@script/setup
 install:
-	@yarn install --frozen-lockfile
+	@yarn install
 test:
 	@script/test
--- a/README.md
+++ b/README.md
@@ -31,13 +31,10 @@ list exists to detect symbol spoofing attacks and improve UX.
 ```bash
 git clone https://git.eeqj.de/sneak/autistmask.git
 cd autistmask
-make setup
+make install
 make build
 ```
 `make setup` is the entrypoint for a fresh clone: it installs dependencies from
 the lockfile and installs the git pre-commit hook.
 Load the extension:
 - **Chrome**: Navigate to `chrome://extensions/`, enable "Developer mode", click
@@ -100,19 +97,6 @@ provide:
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 The Makefile shims to those. It also carries a few targets that have no
 `script/` counterpart and are Makefile-only conveniences:
 - `make install` — `yarn install --frozen-lockfile` on its own, without the rest
  of `script/bootstrap`. Frozen so a stale `yarn.lock` fails instead of being
  silently rewritten. Use `make setup` for a fresh clone.
 - `make hooks` — shims to `script/install-precommit`
 - `make build` — build the extension into `dist/chrome/` and `dist/firefox/`
 - `make build-debug` — the same build with `AUTISTMASK_DEBUG=1` (see
  [Debug Builds](#debug-builds))
 - `make clean` — remove `dist/`
 - `make dev` — build in watch mode
 ## End-to-End Tests
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
@@ -287,10 +271,10 @@ on a different table knows exactly tf I am talking about.
 Every interactive element must visually indicate that it is clickable. Buttons
 use a visible border, padding, and a hover state (invert to white-on-black).
-Text that triggers an action (e.g. "Add additional wallet...") uses an
+Text that triggers an action (e.g. "Import private key") uses an underline. No
-underline. No invisible hit targets, no bare text that happens to have a click
+invisible hit targets, no bare text that happens to have a click handler. If it
-handler. If it does something when you click it, it must look like it does
+does something when you click it, it must look like it does something when you
-something when you click it.
+click it.
 #### Display Consistency
@@ -350,181 +334,115 @@ attack.
 The core hierarchy is **Wallets → Addresses**:
- A **wallet** is one of three types:
+- A **wallet** is either:
-    - An **HD wallet** (`type: "hd"`, recovery phrase): generates multiple
+    - An **HD wallet** (recovery phrase): generates multiple addresses from a
-      addresses from a single 12/24 word recovery phrase using BIP-39/BIP-44
+      single 12/24 word recovery phrase using BIP-39/BIP-44 derivation. The user
-      derivation. The user can add more addresses with a "+" button.
+      can add more addresses with a "+" button.
-    - A **key wallet** (`type: "key"`, private key): a single address imported
+    - A **key wallet** (private key): a single address imported directly from a
-      directly from a private key. No "+" button since there is only one
+      private key. No "+" button since there is only one address.
-      address.
+- An **address** holds ETH and any user-added ERC-20 tokens.
    - An **xprv wallet** (`type: "xprv"`, extended private key): the same
      multi-address behavior as an HD wallet, including the "+" button and the
      address scan on import, but imported from an extended private key rather
      than a recovery phrase. It therefore has no recovery phrase to display or
      back up.
 - An **address** holds ETH and ERC-20 tokens.
 - The user can have multiple wallets, each with multiple addresses (HD) or a
  single address (key).
 Which tokens an address shows is decided by `fetchTokenBalances()` in
 `src/shared/balances.js`, from the Blockscout `token-balances` response, so
 tokens do appear without the user adding them. An ERC-20 is shown when its
 balance is nonzero and it is in the bundled top-250 token list, is tracked by
 the user, or has 1,000 or more holders; a token claiming a symbol from the
 bundled list from any other contract address is always dropped. That filter is
 unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
 the transaction history and the send-screen token selector, not this list.
 Tracked tokens with a zero balance are listed as well while "Show tracked tokens
 with zero balance" is on.
 #### Navigation
 The main view shows all addresses grouped by wallet, with ETH balances inline.
 The user taps an address to see its detail view (full address, balance, tokens,
-send/receive). Navigation is a stack: each forward action pushes the current
+send/receive). Navigation is flat — every view has a "Back" or "Cancel" button
-screen, and every view has a "Back" or "Cancel" button that pops back to it (see
+that returns to the previous context. No deep nesting, no tabs, no hamburger
-the Screen Map below). There is no hamburger menu and no persistent tab bar; the
+menus.
 Settings gear in the title bar is the only global control. Two screens carry an
 in-screen control beyond that: AddWallet uses three tabs to select the import
 mode, and AddressDetail keeps its one rarely-used action ("Export Private Key")
 behind a "···" menu.
 ### Screen Map
-Navigation uses a stack model (like iOS): each forward action pushes the current
+Navigation uses a stack model (like iOS): each action pushes a screen onto the
-screen onto `state.viewStack`, and "Back" pops it (`pushCurrentView()` and
+stack, and "Back" pops it. The root screen is either Welcome (no wallets) or
-`goBack()` in `src/popup/views/helpers.js`). The root screen is either Welcome
+Home (has wallets). Screens are listed below with their elements and
-(no wallets) or Home (has wallets). Each screen below gives its view id in
+transitions.
 parentheses; the registry of view ids is the `VIEWS` array in
 `src/popup/views/helpers.js`, and the markup for a screen is the element with id
 `view-` plus that view id in `src/popup/index.html`.
-Three elements sit outside the screens and are present on all of them: the title
+#### Welcome
 bar ("AutistMask by @sneak" plus the Settings gear), the flash message line
 under it, and the red banner at the very top that appears on a debug build, when
 runtime debug mode is on, or when the active network is a testnet. They are not
 repeated in the element lists below.
-Closing and reopening the popup returns to the screen the user was last on only
+- **When**: No wallets exist yet.
-for the views listed in `RESTORABLE_VIEWS` (`src/popup/index.js`). Every other
+- **Elements**: "AutistMask" heading, brief intro text, "Add wallet" button.
 screen, including ExportPrivKey, falls back to Home.
 #### Welcome (`welcome`)
 - **When**: No wallets exist yet (`state.hasWallet` is false). This is the root
  screen in that case.
 - **Elements**:
    - "Welcome! To get started, add a wallet." text
    - "Add wallet" button
 - **Transitions**:
    - "Add wallet" → **AddWallet**
-#### Home (`main`)
+#### Home
 - **When**: At least one wallet exists. This is the root screen.
 - **Elements**:
-    - Active address ETH balance (large) + USD value in parentheses
+    - Header: "AutistMask", Settings gear button
-    - "Total:" USD value across ETH and every token shown for the active address
+    - Active address ETH balance (large) + USD value (inline parentheses)
    - Total USD value across all tokens (small text)
    - Active address (color dot, full address, etherscan link, tap to copy)
-    - Send / Receive quick-action buttons, both acting on the active address
+    - Send / Receive quick-action buttons
    - ETH/USD price display
-    - Wallet list: each wallet shows its name (tap to rename inline) and a "+"
+    - Wallet list: each wallet shows name (tap to rename), "+" button (HD only),
-      button for HD and xprv wallets, then one block per address with "Address
+      and its addresses with color dots, balances, and `[info]` buttons
-      N" (bold when active), the ENS name if resolved, the full address, an
+    - Recent transactions across all addresses (merged, deduplicated, filtered)
      `[info]` button, the address USD total, and a balance line for ETH and for
      each token shown for that address
    - "Recent Transactions": up to 25 transactions merged across every address
      of every wallet, deduplicated by hash and filtered
    - "Add additional wallet..." link at bottom
 - **Transitions**:
-    - Tap address row → sets the active address and broadcasts
+    - Tap address row → sets active address (no screen change)
      `AUTISTMASK_ACTIVE_CHANGED` (no screen change)
    - Tap wallet name → inline rename field (no screen change)
    - "+" on wallet → derives the next address inline (no screen change)
    - `[info]` on address → **AddressDetail**
-    - "Send" → **Send** (refuses with a flash message on a zero balance)
+    - "Send" → **Send** (selects active address)
    - "Receive" → **Receive** (shows active address QR)
-    - Tap home tx row → **TransactionDetail**
+    - "+" on wallet → derives next address inline
    - "Add additional wallet..." → **AddWallet**
    - Settings gear → **Settings** (toggles; tap again to return)
    - Tap home tx row → **AddressDetail** (for the address involved)
-#### AddWallet (`add-wallet`)
+#### AddWallet
- **When**: User wants to add a new wallet (from Welcome, Home, or Settings).
+- **When**: User wants to add a new wallet (from Home, Welcome, or Settings).
  This one screen covers all three import modes; there is no separate import
  screen.
 - **Elements**:
-    - "Back" button, "Add Wallet" heading
+    - "Add Wallet" heading, "Back" button
-    - Three tabs — "From Phrase" (`tab-mnemonic`), "From Key" (`tab-privkey`),
+    - Instruction text
-      "From xprv" (`tab-xprv`) — each showing its own form section:
+    - Die button `[die]` (generates random recovery phrase)
-        - **From Phrase**: instruction text, a die button that generates a
+    - Recovery phrase textarea
-          random recovery phrase, a recovery phrase textarea, and a backup
+    - Backup warning box (shown after die is clicked)
-          warning box that becomes visible once the die button has been used
+    - Password + confirm password inputs
-        - **From Key**: instruction text and a masked private key input
+    - "Add" button
-        - **From xprv**: instruction text and a masked extended private key
+    - "Have a private key instead?" link
-          input
+- **Transitions**:
-    - Password + confirm password inputs, with a hint line whose wording depends
+    - "Add" (valid phrase + password) → **Home**
-      on the selected tab
+    - "Back" → previous screen (Home or Welcome)
    - "Have a private key instead?" → **ImportKey**
 #### ImportKey
 - **When**: User wants to import a single private key.
 - **Elements**:
    - "Import Private Key" heading, "Back" button
    - Instruction text
    - Private key input (password-masked)
    - Password + confirm password inputs
    - "Import" button
 - **Transitions**:
-    - "Import" with a valid entry and a matching password of at least 12
+    - "Import" (valid key + password) → **Home**
-      characters → creates the wallet, clears the navigation stack, and →
+    - "Back" → **AddWallet**
      **Home**. The phrase and xprv modes then scan for further used addresses
      and report the count as a flash message.
    - "Import" with an invalid entry, a duplicate wallet or address, or a short
      or mismatched password → flash message, no screen change
    - "Back" → previous screen (Welcome, Home, or Settings)
-#### AddressDetail (`address`)
+#### AddressDetail
 - **When**: User tapped `[info]` on an address from Home.
 - **Elements**:
    - "Back" button
    - Blockie identicon (48px, centered)
    - Title: "Wallet Name — Address N"
-    - ENS name (if resolved, bold above the address)
+    - ENS name (if resolved, bold with color dot)
    - Full address (color dot, etherscan link, tap to copy)
    - USD total for address
-    - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
+    - Balance list: ETH + tracked ERC-20 tokens (4 decimal places, USD inline).
-      places, USD inline). Each balance row is clickable → **AddressToken**
+      Each balance row is clickable → **AddressToken**
-    - Send / Receive / + Token buttons and a "···" menu button
+    - Send / Receive / + Token buttons
    - "···" dropdown containing a single "Export Private Key" entry
    - Transaction list (with ENS resolution for counterparties)
 - **Transitions**:
    - Tap balance row → **AddressToken** (for that token)
-    - "Send" → **Send** (refuses with a flash message on a zero balance)
+    - "Send" → **Send**
    - "Receive" → **Receive**
    - "+ Token" → **AddToken**
    - "···" → "Export Private Key" → **ExportPrivKey**
    - Tap transaction row → **TransactionDetail**
-    - "Back" → previous screen (Home)
+    - "Back" → **Home**
-#### ExportPrivKey (`export-privkey`)
+#### AddressToken
 - **When**: User chose "Export Private Key" from the "···" menu on
  AddressDetail. This screen discloses secret material.
 - **Elements**:
    - "Back" button
    - Blockie identicon (48px, centered)
    - "Export Private Key" heading
    - "Wallet Name — Address N" and the full address (etherscan link, tap to
      copy)
    - Warning that anyone holding the private key can transfer all funds from
      the address
    - Error line
    - Password input and "Reveal" button, shown until the key is revealed
    - The private key on a highlighted background, tap to copy, shown only after
      the password has been accepted
 - **Transitions**:
    - "Reveal" (correct password) → decrypts the wallet secret, derives this
      address's key, hides the password input and shows the key (no screen
      change)
    - "Reveal" (wrong password) → "Wrong password." on the error line, nothing
      revealed
    - "Back" → clears the key and password from the DOM, then → previous screen
      (AddressDetail)
 #### AddressToken (`address-token`)
 - **When**: User clicked a specific token balance on AddressDetail.
 - **Elements**:
@@ -535,64 +453,49 @@ screen, including ExportPrivKey, falls back to Home.
    - USD total for this token
    - Single token balance line (4 decimal places)
    - Send / Receive buttons
    - Token contract well (ERC-20 only): full contract address (tap to copy,
      etherscan link) plus name, symbol, decimals, holder count and project
      website where known
    - Token-filtered transaction list (only this token's transfers)
 - **Transitions**:
-    - "Send" → **Send** (token locked: the dropdown is replaced by a static
+    - "Send" → **Send** (token pre-selected and locked in dropdown)
      symbol and contract address)
    - "Receive" → **Receive** (ERC-20 warning shown for non-ETH tokens)
    - Tap transaction row → **TransactionDetail**
-    - "Back" → previous screen (AddressDetail)
+    - "Back" → **AddressDetail**
-#### Send (`send`)
+#### Send
- **When**: User wants to send ETH or a token, from Home, AddressDetail, or
+- **When**: User wants to send ETH or a token from this address.
  AddressToken.
 - **Elements**:
-    - "Back" button, "Send" heading
+    - "Send" heading, "Back" button
    - From: address with color dot + etherscan link
    - What to send: token dropdown (or static display with contract address when
      locked from AddressToken)
-    - To: address or ENS name input, with an inline validation message
+    - To: address or ENS name input
    - Amount input with current balance display
-    - "Review" button, disabled until the recipient validates
+    - "Review" button
 - **Transitions**:
    - "Review" (valid inputs, ENS resolved) → **ConfirmTx**
-    - "Review" with an unresolvable ENS name or an invalid amount → flash
+    - "Back" → **AddressToken** (if came from token view) or **AddressDetail**
      message, no screen change
    - "Back" → previous screen (Home, AddressDetail, or AddressToken)
-#### ConfirmTx (`confirm-tx`)
+#### ConfirmTx
 - **When**: User reviewed send details and is ready to authorize.
 - **Elements**:
-    - "Back" button, "Confirm Transaction" heading
+    - "Confirm Transaction" heading, "Back" button
    - Type: "Native ETH transfer" or "ERC-20 token transfer (SYMBOL)"
    - Token contract: full address + etherscan link (ERC-20 only)
    - From: blockie + color dot + full address + etherscan link + wallet title
    - To: blockie + color dot + full address + etherscan link + ENS name
    - Amount: value + symbol (USD in parentheses)
    - Your balance: value + symbol (USD in parentheses)
-    - Estimated network fee: "Estimating..." then the ETH amount (USD in
+    - Estimated network fee: ETH amount (USD in parentheses), fetched async
-      parentheses) or "Unable to estimate", fetched async
+    - Warnings (scam address, self-send)
    - Warnings: inline warnings from the local checks (scam address, self-send)
      plus four reserved warning boxes made visible by the async checks —
      recipient with no transaction history, recipient is a contract, burn
      address, and an Etherscan phishing/scam label
    - Errors (insufficient balance)
-    - Password: an inline field on this screen, not a modal, with its own error
+    - "Send" button (disabled if errors)
      line
    - "Sign & Send" button (disabled if errors)
 - **Transitions**:
-    - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
+    - "Send" → password modal → broadcast tx → **WaitTx**
-    - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
+    - "Send" → password modal → broadcast fails → **ErrorTx**
    - "Sign & Send" (wrong password) → "Wrong password." on the password error
      line, no screen change
    - "Back" → **Send**
-#### WaitTx (`wait-tx`)
+#### WaitTx
 - **When**: Transaction has been broadcast, waiting for on-chain confirmation.
 - **Elements**:
@@ -606,24 +509,20 @@ screen, including ExportPrivKey, falls back to Home.
    - Receipt found → **SuccessTx**
    - 60 seconds without confirmation → **ErrorTx** (timeout message)
-#### SuccessTx (`success-tx`)
+#### SuccessTx
 - **When**: Transaction confirmed on-chain.
 - **Elements**:
    - "Transaction Confirmed" heading
    - Decoded action well (shown when the transaction carried recognized
      calldata; the top-level Amount and To are hidden in that case)
    - Amount + symbol
    - To: color dot + full address + etherscan link
    - Block number
    - Transaction hash: full hash (tap to copy) + etherscan link
    - "Done" button
 - **Transitions**:
-    - "Done" in the approval popup → closes the popup window
+    - "Done" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
    - "Done" otherwise → resets the navigation stack, then → **AddressToken**
      (if `selectedToken` set) or **AddressDetail**
-#### ErrorTx (`error-tx`)
+#### ErrorTx
 - **When**: Transaction broadcast failed, or timed out waiting for confirmation.
 - **Elements**:
@@ -635,28 +534,24 @@ screen, including ExportPrivKey, falls back to Home.
      full hash (tap to copy) + etherscan link
    - "Done" button
 - **Transitions**:
-    - "Done" in the approval popup → closes the popup window
+    - "Done" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
    - "Done" otherwise → resets the navigation stack, then → **AddressToken**
      (if `selectedToken` set) or **AddressDetail**
-#### Receive (`receive`)
+#### Receive
- **When**: User wants to receive funds at this address, from Home,
+- **When**: User wants to receive funds at this address.
  AddressDetail, or AddressToken.
 - **Elements**:
-    - "Back" button, "Receive" heading
+    - "Receive" heading, "Back" button
    - Instruction text
    - QR code encoding the address
    - Full address (color dot, selectable, etherscan link)
    - "Copy address" button
    - ERC-20 warning (shown when navigating from AddressToken for non-ETH token)
 - **Transitions**:
-    - "Back" → previous screen (Home, AddressDetail, or AddressToken)
+    - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
-#### TransactionDetail (`transaction`)
+#### TransactionDetail
- **When**: User tapped a transaction row on Home, AddressDetail, or
+- **When**: User tapped a transaction row from AddressDetail or AddressToken.
  AddressToken.
 - **Elements** (grouped into logical blocks using light well containers; field
  labels are self-explanatory so groups have no headings):
    - "Transaction" heading, "Back" button
@@ -681,182 +576,91 @@ screen, including ExportPrivKey, falls back to Home.
    - Raw data (shown when calldata is present): full calldata in monospace
      dashed border
 - **Transitions**:
-    - "Back" → previous screen (Home, AddressDetail, or AddressToken)
+    - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
-#### AddToken (`add-token`)
+#### AddToken
- **When**: User wants to track an ERC-20 token, reached from "+ Token" on
+- **When**: User wants to track an ERC-20 token on this address.
  AddressDetail.
 - **Elements**:
-    - "Back" button, "Add Token" heading
+    - "Add Token" heading, "Back" button
    - Instruction text (find contract address on Etherscan)
    - Contract address input
-    - Status line ("Looking up token...", cleared or replaced on failure)
+    - Token info preview (name, symbol — fetched from contract)
-    - Common token quick-pick buttons (top 25 by market cap), which fill the
+    - Common token quick-pick buttons
      contract address input
    - "Add" button
 - **Transitions**:
-    - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
+    - "Add" (valid contract) → **AddressDetail**
-      **AddressDetail**
+    - "Back" → **AddressDetail**
    - "Add" with a token already tracked, a scam-listed address, or a failed
      contract lookup → flash message, no screen change
    - "Back" → previous screen (AddressDetail)
-#### Settings (`settings`)
+#### Settings
- **When**: User tapped the Settings gear.
+- **When**: User tapped Settings gear from Home.
 - **Elements**:
-    - "Back" button, "Settings" heading
+    - "Settings" heading, "Back" button
-    - Wallets: one row per wallet with its name (tap to rename inline) and an
+    - Wallets: "+ Add wallet" button
-      `[x]` delete button, plus a "+ Add wallet" button
+    - Display: "Show tracked tokens with zero balance" checkbox
-    - Tracked Tokens: one row per tracked token with an `[x]` remove button,
+    - Ethereum RPC: endpoint URL input + "Save" button
-      plus a "+ Add token" button
+    - Blockscout API: endpoint URL input + "Save" button
    - Display: "Show tracked tokens with zero balance" checkbox and a Theme
      selector (System / Light / Dark)
    - Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
      resets the RPC and Blockscout endpoints to that network's defaults
    - Ethereum RPC: endpoint URL input + "Save" button (validated against
      `eth_chainId` before being saved)
    - Blockscout API: endpoint URL input + "Save" button (validated against
      `/stats` before being saved)
    - Token Spam Protection:
        - "Hide tokens with fewer than 1,000 holders" checkbox
        - "Hide transactions from detected fraud contracts" checkbox
        - "Hide dust transactions below N gwei" checkbox + threshold input
        - "UTC Timestamps" checkbox
    - Allowed Sites: list with remove buttons
    - Denied Sites: list with remove buttons
    - About: project link, license, author, version, release date, and the
      commit, which links to the commit in the repository
    - Debug: hidden until revealed, then an "Enable debug mode" checkbox that
      turns on the red banner and verbose logging
 - **Transitions**:
    - "+ Add wallet" → **AddWallet**
-    - "+ Add token" → **SettingsAddToken**
+    - "Back" (or Settings gear again) → **Home**
    - `[x]` on a wallet → **DeleteWallet**
    - Tap wallet name → inline rename field (no screen change)
    - `[x]` on a tracked token or a site → removes it in place (no screen
      change)
    - Ten clicks on the version → reveals the Debug well (no screen change)
    - "Back" (or Settings gear again) → previous screen (Home)
-#### DeleteWallet (`delete-wallet-confirm`)
+#### SiteApproval
- **When**: User tapped the `[x]` next to a wallet in Settings.
+- **When**: A website requests wallet access via `eth_requestAccounts`. Opened
- **Elements**:
+  in a separate popup by the background script.
    - "Back" button, "Delete Wallet" heading
    - Warning naming the wallet and stating that deletion is permanent and any
      funds are unrecoverable without the recovery phrase
    - Error line
    - Password input
    - "Confirm Delete" button
 - **Transitions**:
    - "Confirm Delete" (correct password, other wallets remain) → deletes the
      wallet and its site permissions, then → **Settings** with a "Wallet
      deleted." flash message
    - "Confirm Delete" (correct password, last wallet) → deletes the wallet,
      clears the selection and the navigation stack, then → **Welcome**
    - Either way, the active address moves only if it belonged to the deleted
      wallet, and `AUTISTMASK_ACTIVE_CHANGED` is broadcast when it does
      (`src/shared/walletDelete.js`)
    - "Confirm Delete" (wrong password) → "Wrong password." on the error line,
      nothing deleted
    - "Back" → previous screen (Settings)
 #### SettingsAddToken (`settings-addtoken`)
 - **When**: User tapped "+ Add token" in Settings. Tokens added here are tracked
  across every address, unlike AddToken which is reached from one address.
 - **Elements**:
    - "Back" button, "Add Token" heading
    - Instruction text
    - "Top tokens:" quick-pick buttons (top 10 by market cap; already-tracked
      tokens are disabled)
    - "Or pick from top 100:" dropdown (already-tracked tokens are disabled) +
      "Add selected" button
    - "Or enter contract address:" input, a status line, and an "Add" button
 - **Transitions**:
    - Any of the three add paths, on success → adds the token and shows an
      "Added SYMBOL" flash message (no screen change)
    - A duplicate, a scam-listed address, or a failed contract lookup → flash
      message, no screen change
    - "Back" → previous screen (Settings)
 #### SiteApproval (`approve-site`)
 - **When**: A website requests wallet access via `eth_requestAccounts` or
  `wallet_requestPermissions` and is on neither the allowed nor the denied list.
  The background script prefers the toolbar popup (`action.openPopup()`) and
  falls back to a separate popup window (`src/background/index.js`,
  `requestApproval()`).
 - **Elements**:
    - "Connection Request" heading
-    - Phishing warning banner (shown when the hostname is on the phishing
+    - Site hostname (bold)
      blocklist)
    - Site hostname (bold) + "wants to connect to your wallet"
    - Address that will be shared (color dot + full address + etherscan link)
    - "Remember my choice for this site" checkbox
    - "Allow" / "Deny" buttons
 - **Transitions**:
-    - "Allow" / "Deny" → closes popup (returns result to background script; the
+    - "Allow" / "Deny" → closes popup (returns result to background script)
      choice is persisted to the allowed or denied list when "Remember" is
      checked)
    - Popup closed without answering → treated as a denial
-#### TxApproval (`approve-tx`)
+#### TxApproval
 - **When**: A connected website requests a transaction via
-  `eth_sendTransaction`. Always opened in a separate popup window by the
+  `eth_sendTransaction`. Opened via the toolbar popup by the background script.
  background script (`windows.create()`), because the request is triggered
  programmatically rather than by a user gesture.
 - **Elements**:
    - "Transaction Request" heading
    - Phishing warning banner (shown when the hostname is on the phishing
      blocklist)
    - Site hostname (bold) + "wants to send a transaction"
    - Decoded action (if calldata is recognized): action name, token details,
      amounts, steps, deadline (see Transaction Decoding)
    - From: color dot + full address + etherscan link
-    - Contract: color dot + full address + etherscan link (or "contract
+    - To/Contract: color dot + full address + etherscan link (or "contract
      creation"), token symbol label if known
-    - Value: amount in ETH (4 decimal places, USD in parentheses)
+    - Value: amount in ETH (4 decimal places)
    - Raw data: full calldata displayed inline (shown if present)
-    - Password input and an error line
+    - Password input
    - "Confirm" / "Reject" buttons
 - **Transitions**:
-    - "Confirm" (correct password) → decrypts and signs in the popup, hands the
+    - "Confirm" (with password) → closes popup (returns result to background)
      signed transaction to the background to broadcast, then → **WaitTx** in
      the same popup window
    - "Confirm" (wrong password) → error line, no screen change
    - "Reject" → closes popup (returns rejection to background)
    - Popup window closed without answering → the request is rejected with
      EIP-1193 code 4001
-#### SignApproval (`approve-sign`)
+#### SignApproval
 - **When**: A connected website requests a message signature via
-  `personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened the same way as
+  `personal_sign`, `eth_sign`, or `eth_signTypedData_v4`. Opened via the toolbar
-  TxApproval, in a separate popup window.
+  popup by the background script.
 - **Elements**:
    - "Signature Request" heading
    - Phishing warning banner (shown when the hostname is on the phishing
      blocklist)
    - Site hostname (bold) + "wants you to sign a message"
    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
    - Type: "Personal message" or "Typed data (EIP-712)"
    - From: color dot + full address + etherscan link
    - Message: decoded UTF-8 text (personal_sign) or formatted domain/type/
      message fields (EIP-712 typed data)
-    - Password input and an error line
+    - Password input
    - "Sign" / "Reject" buttons
 - **Transitions**:
-    - "Sign" (correct password) → signs locally → closes popup (returns
+    - "Sign" (with password) → signs locally → closes popup (returns signature)
      signature)
    - "Sign" (wrong password, or a signing failure) → error line, no screen
      change
    - "Reject" → closes popup (returns rejection to background)
    - Popup window closed without answering → the request is rejected with
      EIP-1193 code 4001
 ### External Services
@@ -892,7 +696,7 @@ communicates with three external services to function as a wallet:
 What the extension does NOT do:
 - No analytics or telemetry services
- No token list APIs (the top-250 token list is bundled at build time)
+- No token list APIs (user adds tokens manually by contract address)
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
@@ -1011,12 +815,10 @@ hardcoded test phrase.
 - Create new HD wallet (generates 12-word recovery phrase)
 - Import HD wallet from existing 12 or 24 word recovery phrase
 - Import single-address wallet from private key
 - Import multi-address wallet from an extended private key (`xprv`)
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
- View ERC-20 token balances (bundled top-250 tokens, tokens with 1,000 or more
+- View ERC-20 token balances (user adds token by contract address)
  holders, and tokens the user adds by contract address)
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)
@@ -1162,8 +964,7 @@ Currently supported:
 - Built in token swaps (use a DEX in the browser)
 - Analytics, telemetry, or tracking of any kind
 - Advertisements or promotions
- Obscure token list auto-discovery — nothing outside the bundled list, the
+- Obscure token list auto-discovery (user adds tokens manually)
  1,000-holder floor, and the tokens the user added by contract address
    - We detect common/popular ERC20s in the basic case
 - Fiat on/off ramps
 - Extensive transaction decoding/parsing
@@ -1185,7 +986,7 @@ Currently supported:
 ### Transactions
- [x] Gas estimation and fee display before confirming
+- [ ] Gas estimation and fee display before confirming
 ### Testing
@@ -1221,17 +1022,13 @@ covered by the GPL-3.0 license above. These files, their copyright holders, and
 their licenses are:
 | File                                                       | Source                                                                                                                    | Copyright                         | License                                                        |
-| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
-| `src/shared/phishingBlocklist.json`                        | `eth-phishing-detect` community-maintained phishing domain blocklist, vendored from its `src/config.json` | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
+| `src/shared/phishingBlocklist.json`                        | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
 | `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`                               | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
 | `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                                         | Copyright (c) 2018 Luit Hollander | MIT                                                            |
 The full license texts for these third-party files are included in the
-[LICENSE](LICENSE) file. The `eth-phishing-detect` row carries no repository
+[LICENSE](LICENSE) file.
 link because the upstream is hosted under a competitor's organization name,
 which project policy keeps out of code and documentation; the vendored copy and
 the runtime refresh both come from that upstream, whose URL is the
 `BLOCKLIST_URL` constant in `src/shared/phishingDomains.js`.
 ## Author
--- a/TODO.md
+++ b/TODO.md
@@ -44,42 +44,18 @@ undefined identifiers, which is how
 # Completed Steps
- 2026-08-11: Approval verification became an allowlist — transaction type
+- 2026-08-11: Approval verification extended to every consequential field —
-  restricted to 0/1/2 so an EIP-7702 delegation can no longer ride along on an
+  chain id against the selected network, nonce, gas limit, both EIP-1559 fees
-  approved transfer, every consequential field compared, and the artifact
+  and the legacy gas price — with a failed signing attempt made retryable
-  re-serialized from the checked fields alone; broadcast failure is now terminal
+  instead of leaving a dead button
  ([#174](https://git.eeqj.de/sneak/AutistMask/issues/174)).
 - 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
  Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
  the Makefile-only targets documented in the README
  ([#166](https://git.eeqj.de/sneak/AutistMask/issues/166)).
 - 2026-08-11: `script/verify-build` diagnostics corrected: the both-markers
  message now states what is and is not proven, an unreadable bundle is
  diagnosed as an I/O fault rather than as changed output, the `*.js` assumption
  lives only in `build.js`, and the unlisted-bundle scan hard-fails when it
  cannot enumerate `dist/`
  ([#180](https://git.eeqj.de/sneak/AutistMask/issues/180)).
 - 2026-08-11: Three `README.md` claims corrected against the code — blocklist
  attribution, token-display rule, navigation model
  ([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
 - 2026-08-11: README Screen Map rebuilt from the code — every screen, element
  and transition re-verified against `src/popup/`
  ([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).
 - 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
  all five network destinations documented, password/Settings/Add Wallet
  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
 - 2026-08-11: `loadState()` now derives `hasWallet` from the wallet list instead
  of trusting the persisted flag, so a profile already saved inconsistent no
  longer stays broken on every load
  ([#195](https://git.eeqj.de/sneak/AutistMask/issues/195)).
 - 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
  remaining wallets, the selection only moves when it was deleted, and the
  active-address change is broadcast to connected sites
  ([#156](https://git.eeqj.de/sneak/AutistMask/issues/156)).
 - 2026-08-11: One row per on-chain value movement in transaction history: the
  merge moved into the pure `mergeTransactions` and the zero-ETH native side of
  a plain ERC-20 transfer absorbed into its token row
  ([#177](https://git.eeqj.de/sneak/AutistMask/issues/177)).
 - 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
  on `next`, with Status and Next Step refreshed
  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
--- a/build.js
+++ b/build.js
@@ -29,12 +29,6 @@ function repoRelative(p) {
 // reports every input that contributed to an output in the metafile, which is
 // the authoritative answer to "is constants.js in this bundle" — unlike
 // searching the minified text, it does not depend on what survived minification.
 //
 // The ".js" filter below is the only place that assumption lives:
 // script/verify-build searches every file and symlink under dist/ for a
 // marker, without filtering by extension, and hard-fails if it cannot walk the
 // whole tree, so a bundle emitted under some other extension fails there as
 // unlisted rather than escaping both checks at once.
 function outputsContainingAuditedModule(metafile) {
    return Object.entries(metafile.outputs)
        .filter(([outFile, info]) => {
@@ -121,17 +115,8 @@ async function build() {
    // build that never gets around to writing one cannot be verified against
    // a stale list.
    fs.rmSync(BUNDLE_MANIFEST, { force: true });
    // The locally installed binary, not `npx` — npx silently fetches from the
    // registry when the binary is absent, which is an unpinned network fetch
    // in the middle of a build.
    const tailwindBin = path.join(
        __dirname,
        "node_modules",
        ".bin",
        "tailwindcss",
    );
    execSync(
-        `"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
+        `npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
        { stdio: "inherit" },
    );
--- a/package.json
+++ b/package.json
@@ -7,7 +7,6 @@
    "private": true,
    "scripts": {
        "test": "jest --forceExit",
        "test:verbose": "jest --forceExit --verbose",
        "build": "node build.js",
        "lint": "prettier --check .",
        "fmt": "prettier --write .",
--- a/script/test
+++ b/script/test
@@ -7,13 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
    cd "$ROOT"
    echo "Running tests..."
-    timeout 30 yarn run test 2>&1 || {
+    timeout 30 yarn run test 2>&1
        echo "--- Rerunning with --verbose for details ---"
        timeout 30 yarn run test:verbose 2>&1 || true
        # Always fail: the first run already proved the tests are broken, so a
        # flaky pass on the rerun must not turn the build green.
        exit 1
    }
 }
 main "$@"
--- a/script/verify-build
+++ b/script/verify-build
@@ -34,51 +34,16 @@ fail() {
    exit 1
 }
 # Is the literal $1 present in the file $2? Match (grep exit 0) and no-match
 # (exit 1) are answers about the emitted output. Anything else (exit 2: the
 # file could not be read) is not an answer at all, and must not be reported as
 # "no marker" — that would blame the bundle for a permissions or I/O fault.
 has_marker() {
-    _hm_status=0
+    grep -q -F "$1" "$2" 2>/dev/null
    grep -q -F -e "$1" -- "$2" || _hm_status=$?
    case "$_hm_status" in
    0) return 0 ;;
    1) return 1 ;;
    *)
        fail "grep exited $_hm_status reading $2, so the file could not be
    searched and its DEBUG state was not checked at all. That is a permissions
    or I/O fault on the artifact, not a change in the emitted output. Refusing
    to report success."
        ;;
    esac
 }
 # Does the manifest list the path $1, as a whole line? Same discipline as
 # has_marker: exit 0 and 1 are answers about the manifest, exit 2 means the
 # manifest could not be read and is not an answer at all. Without this, an
 # unreadable manifest reads as "this file is not listed" and every emitted
 # bundle gets reported as an unlisted one.
 is_listed() {
    _il_status=0
    grep -q -x -F -e "$1" -- "$MANIFEST" || _il_status=$?
    case "$_il_status" in
    0) return 0 ;;
    1) return 1 ;;
    *)
        fail "grep exited $_il_status reading $MANIFEST, so it could not be
    searched and nothing was established about which bundles it lists. That is
    a permissions or I/O fault on the manifest, not a stale manifest. Refusing
    to report success."
        ;;
    esac
 }
 # Read one bundle's DEBUG state into MARKER. Exactly one marker must be
 # present. Both means the ternary in constants.js was never folded, which is
 # what happens when the __BUILD_DEBUG__ define goes missing from build.js:
-# DEBUG stops being known at build time. Neither means we are reading output
+# DEBUG stops being known at build time and the debug branch is live again.
-# we do not understand. Both are hard failures; neither is ever treated as
+# Neither means we are reading output we do not understand. Both are hard
-# absence of a problem.
+# failures; neither is ever treated as absence of a problem.
 read_marker() {
    _file="$1"
    _on=no
@@ -87,14 +52,9 @@ read_marker() {
    if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
    if [ "$_on" = yes ] && [ "$_off" = yes ]; then
-        fail "$_file carries both debug markers, so DEBUG was not resolved at
+        fail "$_file carries both debug markers, so the build-time DEBUG value
-    build time: the ternary in src/shared/constants.js survived into the
+    was never resolved and the debug branch is still live. Check that build.js
-    emitted output. This does not mean the debug branch is live in this
+    still defines __BUILD_DEBUG__."
    artifact: an unresolved __BUILD_DEBUG__ is undeclared in extension
    context, so DEBUG evaluates to false at runtime. It does mean the
    release/debug distinction is no longer enforced at build time, and which
    way that fallback happens to evaluate is then an accident a refactor can
    flip. Check that build.js still defines __BUILD_DEBUG__."
    fi
    if [ "$_on" = no ] && [ "$_off" = no ]; then
        fail "$_file carries no debug marker, so its DEBUG state cannot be
@@ -110,43 +70,13 @@ read_marker() {
 }
 # The manifest says which bundles must carry a marker. This says no other
-# emitted file may carry one, which catches a manifest that has gone stale
+# emitted bundle may carry one, which catches a manifest that has gone stale
 # or short rather than trusting whatever it happens to list.
 #
 # Deliberately unfiltered by extension. build.js selects manifest entries with
 # an endsWith(".js") test; repeating that literal here would mean a bundle
 # emitted under some other extension escaped the manifest AND this check at
 # once, which is the correlated blind spot the two-source design exists to
 # avoid. Every file under dist/ is searched, so build.js's filter is the only
 # place the assumption lives and this check is what catches it being wrong.
 #
 # That claim only holds if the walk is exhaustive, so two things are enforced
 # here rather than assumed:
 #
 #   - find's exit status is checked. A subtree it cannot descend is reported on
 #     stderr and then simply missing from the listing, so an unchecked status
 #     turns "could not look" into "nothing was there" — the same conflation
 #     has_marker exists to prevent. The status cannot be read off a pipeline
 #     ending in sort, so the sort is a separate step.
 #   - symlinks are walked too (-type l), not skipped. A marker-carrying bundle
 #     reachable under an unlisted path in dist/ is a stale manifest whether the
 #     path is a link or a file, and grep reads through the link. A link that
 #     cannot be read through — dangling, or pointing at a directory — fails
 #     hard via has_marker's exit-2 path, which is the fail-closed answer: the
 #     build emits neither, so their DEBUG state is unproven, not fine.
 check_unlisted_bundles() {
-    _find_status=0
+    _listing="$(find dist -type f -name '*.js' | sort)"
    _listing="$(find dist \( -type f -o -type l \) -print)" || _find_status=$?
    [ "$_find_status" -eq 0 ] ||
        fail "find exited $_find_status enumerating dist/, so part of the tree
    was never walked and nothing was established about the files in it. Any
    unlisted bundle there went unchecked. That is a permissions or I/O fault on
    the artifact, not a stale manifest. Refusing to report success."
    _listing="$(printf '%s\n' "$_listing" | sort)"
    while read -r _file; do
        [ -n "$_file" ] || continue
-        if is_listed "$_file"; then
+        if grep -q -x -F "$_file" "$MANIFEST"; then
            continue
        fi
        if has_marker "$MARKER_ON" "$_file" ||
@@ -183,18 +113,12 @@ main() {
        fail "$MANIFEST is empty, so no emitted bundle was found to contain
    src/shared/constants.js. That is never correct, so it is a failure and not
    a pass."
    [ -r "$MANIFEST" ] ||
        fail "$MANIFEST is not readable, so nothing was inspected. That is a
    permissions or I/O fault, not a pass."
    count=0
    while read -r file; do
        [ -n "$file" ] || continue
        [ -f "$file" ] ||
            fail "$MANIFEST lists $file, which does not exist."
        [ -s "$file" ] ||
            fail "$MANIFEST lists $file, which is empty. An empty bundle
    carries no marker and proves nothing, so this is a failure and not a pass."
        read_marker "$file"
        [ "$MARKER" = "$expected" ] ||
            fail "$file is $MARKER but this build expects $expected."
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -17,10 +17,6 @@ const {
    verifySignedTx,
    verifySignature,
    failureIsRetryable,
    describeTxFailure,
    TX_STAGE_SIGN,
    TX_STAGE_VERIFY,
    TX_STAGE_BROADCAST,
 } = require("../shared/approvalVerify");
 const {
    isPhishingDomain,
@@ -743,12 +739,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
        // approval so the user can correct the problem and try again with the
        // transaction they already saw.
        if (msg.error) {
-            const outcome = describeTxFailure(TX_STAGE_SIGN, msg.error);
+            sendResponse({ error: msg.error, retryable: true });
            sendResponse({
                error: outcome.error,
                retryable: outcome.retryable,
                stage: TX_STAGE_SIGN,
            });
            return false;
        }
@@ -771,16 +762,13 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                // retried against that approval; it is refused outright.
                // Anything else that failed before the check ran is the
                // user's to retry.
-                const outcome = describeTxFailure(TX_STAGE_VERIFY, e);
+                const errMsg = e.shortMessage || e.message;
-                if (outcome.spendApproval) {
+                const retryable = failureIsRetryable(e);
                if (!retryable) {
                    finishApproval(msg.id);
-                    approval.resolve({ error: { message: outcome.error } });
+                    approval.resolve({ error: { message: errMsg } });
                }
-                sendResponse({
+                sendResponse({ error: errMsg, retryable });
                    error: outcome.error,
                    retryable: outcome.retryable,
                    stage: TX_STAGE_VERIFY,
                });
                return;
            }
@@ -791,18 +779,11 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                approval.resolve({ txHash: tx.hash });
                sendResponse({ txHash: tx.hash });
            } catch (e) {
-                // Terminal, never retried: the node may have accepted the
+                // The node would not take it. The approval stays pending, so
-                // transaction and still failed to answer, and the popup's
+                // a retry re-signs the same approved transaction.
                // retry re-signs at a freshly fetched nonce rather than
                // re-broadcasting these bytes. Retrying would send the
                // approved transfer a second time.
                const outcome = describeTxFailure(TX_STAGE_BROADCAST, e);
                finishApproval(msg.id);
                approval.resolve({ error: { message: outcome.error } });
                sendResponse({
-                    error: outcome.error,
+                    error: e.shortMessage || e.message,
-                    retryable: outcome.retryable,
+                    retryable: true,
                    stage: TX_STAGE_BROADCAST,
                });
            }
        })();
--- a/src/shared/approvalVerify.js
+++ b/src/shared/approvalVerify.js
@@ -7,21 +7,6 @@
 // the signer from the artifact and checks it against the approval it is
 // holding before acting on it. All recovery is delegated to ethers.
 //
 // The check is an allowlist, in both directions, because a denylist cannot be
 // correct against a transaction format that keeps gaining fields:
 //
 //  - only transaction types 0, 1 and 2 are accepted. Every later EIP-2718 type
 //    adds a field with consequences of its own — EIP-7702's authorizationList
 //    rewrites the code at the signer's own account, EIP-4844's blob
 //    commitments carry a separate fee — and a check that enumerates the fields
 //    it refuses admits every one of them by default.
 //  - after the per-field comparisons, the artifact is rebuilt from those
 //    checked fields and nothing else, and the two are compared byte for byte.
 //    Anything the artifact carries that this module does not name is absent
 //    from the rebuild and changes the bytes, so the final assertion is that
 //    the artifact *is* the approved transaction, not merely that it is not one
 //    of the tampered shapes that were thought of.
 //
 // Every consequential field is compared, and a mismatch is a refusal to act,
 // never a warning: what the user approved is what gets broadcast, or nothing
 // does.
@@ -40,74 +25,12 @@
 const {
    Transaction,
    accessListify,
    getAddress,
    getBytes,
    verifyMessage,
    verifyTypedData,
 } = require("ethers");
 // The only transaction types this wallet signs: legacy, EIP-2930 and
 // EIP-1559. populateTransaction() produces nothing else, so nothing else can
 // be an artifact of an approval this wallet raised.
 const ALLOWED_TX_TYPES = [0, 1, 2];
 // The serialized fields of each allowed type, which is also the complete set
 // of fields the checks below compare or bound. The artifact is rebuilt from
 // exactly these at the end of verification and compared byte for byte, so a
 // field outside this table cannot ride along unexamined.
 const SERIALIZED_FIELDS = {
    0: ["chainId", "nonce", "gasPrice", "gasLimit", "to", "value", "data"],
    1: [
        "chainId",
        "nonce",
        "gasPrice",
        "gasLimit",
        "to",
        "value",
        "data",
        "accessList",
    ],
    2: [
        "chainId",
        "nonce",
        "maxPriorityFeePerGas",
        "maxFeePerGas",
        "gasLimit",
        "to",
        "value",
        "data",
        "accessList",
    ],
 };
 // Fields no allowed type may carry. The type allowlist already excludes every
 // type that defines them, and the structural check at the end of verification
 // would catch them anyway; they are named here so that an artifact carrying
 // one is refused with a message that says what it was.
 const FORBIDDEN_FIELDS = [
    {
        key: "authorizationList",
        message:
            "The signed transaction would hand the signing account over to another contract, which was not approved.",
    },
    {
        key: "blobVersionedHashes",
        message:
            "The signed transaction carries blob commitments, which were not approved.",
    },
    {
        key: "blobs",
        message:
            "The signed transaction carries blobs, which were not approved.",
    },
    {
        key: "maxFeePerBlobGas",
        message:
            "The signed transaction carries a blob gas fee, which was not approved.",
    },
 ];
 // Above the block gas limit of every supported network (see networks.js), so
 // no transaction that could ever be included is refused by it.
 const MAX_GAS_LIMIT = 100000000n;
@@ -158,12 +81,11 @@ function present(v) {
    return v !== null && v !== undefined && v !== "";
 }
-// Whether a field carries anything at all. An empty array is nothing: ethers
+// Normalize a transaction value (hex string, decimal string, number or
-// reports an absent access list on a type 2 transaction as `[]`.
+// bigint) to a bigint. An absent value is zero, matching ethers.
-function carriesValue(v) {
+function normalizeValue(v) {
-    if (!present(v)) return false;
+    if (!present(v)) return 0n;
-    if (Array.isArray(v)) return v.length > 0;
+    return BigInt(v);
    return true;
 }
 // Normalize a quantity that must be present, refusing anything that is not a
@@ -182,37 +104,6 @@ function normalizeQuantity(v, label) {
    }
 }
 // Normalize a transaction value (hex string, decimal string, number or
 // bigint) to a bigint. An absent value is zero, matching ethers. The value is
 // page-controlled, so it goes through the same refusal as every other
 // quantity rather than throwing a raw BigInt conversion error.
 function normalizeValue(v) {
    if (!present(v)) return 0n;
    return normalizeQuantity(v, "value");
 }
 // Normalize an access list to a comparable string. An absent or empty list is
 // the empty string, so absent and `[]` are the same thing.
 function normalizeAccessList(v) {
    if (!carriesValue(v)) return "";
    let list;
    try {
        list = accessListify(v);
    } catch {
        throw refuse(
            "The approved access list is not a valid access list, so it cannot be compared with the signed transaction.",
        );
    }
    return list
        .map(
            (entry) =>
                String(entry.address).toLowerCase() +
                ":" +
                entry.storageKeys.map((k) => String(k).toLowerCase()).join(","),
        )
        .join(";");
 }
 // Normalize call data to a lowercase hex string. Absent data is "0x".
 function normalizeData(v) {
    if (v === null || v === undefined || v === "" || v === "0x") return "0x";
@@ -254,43 +145,6 @@ const APPROVED_QUANTITIES = [
    },
 ];
 // Refuse a field only a transaction type this wallet does not sign can carry.
 // The type allowlist keeps these unreachable in production, which is exactly
 // what they are for; it also means nothing else exercises them, so this is
 // exported and tested on its own rather than left to be believed.
 function assertNoForbiddenFields(parsed) {
    for (const field of FORBIDDEN_FIELDS) {
        if (carriesValue(parsed[field.key])) throw refuse(field.message);
    }
 }
 // Closing structural check. Rebuild the transaction from the fields the
 // comparisons cover, and nothing else, then compare the unsigned bytes. Every
 // field carried by the artifact but absent from the rebuild changes the
 // serialization, so this refuses anything this module does not account for —
 // including a field a future ethers learns to parse onto an allowed type —
 // instead of waving it through by not naming it. Also exported for its own
 // test: nothing reachable today can make the bytes differ.
 function assertNothingUnchecked(parsed) {
    let rebuilt;
    try {
        const fields = { type: parsed.type };
        for (const key of SERIALIZED_FIELDS[parsed.type]) {
            fields[key] = parsed[key];
        }
        rebuilt = Transaction.from(fields);
    } catch {
        throw refuse(
            "The signed transaction could not be rebuilt from the fields that were checked, so it cannot be shown to be the approved transaction.",
        );
    }
    if (rebuilt.unsignedSerialized !== parsed.unsignedSerialized) {
        throw refuse(
            "The signed transaction carries data beyond the fields that were checked against the approval.",
        );
    }
 }
 // Assert that a raw signed transaction is the transaction the user approved,
 // signed by the address the approval was raised for, on the network that is
 // selected. Returns the parsed ethers Transaction on success, throws
@@ -316,16 +170,6 @@ function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
        );
    }
    // Before any field is looked at: the type decides which fields exist at
    // all, so an unrecognised type is refused outright rather than compared
    // field by field against an approval that cannot describe it.
    if (!ALLOWED_TX_TYPES.includes(parsed.type)) {
        throw refuse(
            "The signed transaction is of a type this wallet does not sign, so what it would do beyond the approved transfer cannot be checked.",
        );
    }
    assertNoForbiddenFields(parsed);
    // The selected network, not the artifact, is the authority on which chain
    // this may be broadcast to; without it nothing can be verified.
    if (!present(selectedChainId)) {
@@ -362,14 +206,6 @@ function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
            "The signed transaction does not carry the approved call data.",
        );
    }
    if (
        normalizeAccessList(parsed.accessList) !==
        normalizeAccessList(txParams.accessList)
    ) {
        throw refuse(
            "The signed transaction does not carry the approved access list.",
        );
    }
    // An approval that fixed EIP-1559 fees must not be signed as a legacy
    // transaction, and vice versa: the fee the user agreed to is only
@@ -378,7 +214,7 @@ function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
        present(txParams.maxFeePerGas) ||
        present(txParams.maxPriorityFeePerGas);
    const approvedLegacy = present(txParams.gasPrice);
-    const signedEip1559 = parsed.type === 2;
+    const signedEip1559 = parsed.type === 2 || parsed.type === 3;
    if (
        (approvedEip1559 && !signedEip1559) ||
        (approvedLegacy && signedEip1559)
@@ -410,8 +246,6 @@ function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
        }
    }
    assertNothingUnchecked(parsed);
    return parsed;
 }
@@ -450,63 +284,18 @@ function verifySignature(signParams, signature, expectedFrom) {
    return recovered;
 }
 // The stage a transaction approval failed at. Which stage it is decides
 // whether the approval survives the failure.
 const TX_STAGE_SIGN = "sign";
 const TX_STAGE_VERIFY = "verify";
 const TX_STAGE_BROADCAST = "broadcast";
 function errorText(err) {
    if (typeof err === "string" && err !== "") return err;
    if (err && (err.shortMessage || err.message)) {
        return err.shortMessage || err.message;
    }
    return "The transaction could not be sent.";
 }
 // What the background does with a pending transaction approval after a failed
 // attempt: what it tells the popup, and whether the approval is spent
 // (resolved to the requesting page as an error and deleted) or left standing
 // so the user can try the transaction they already saw again.
 //
 //  - sign: the popup could not produce an artifact, almost always a wrong
 //    password. Nothing left the extension, so the approval stands.
 //  - verify: a mismatch is a refusal and spends the approval — an artifact
 //    that is not the approved transaction must never be retried against that
 //    approval. Anything else failed before the check ran and is retryable.
 //  - broadcast: always terminal. A broadcast that throws after the node
 //    accepted the transaction is routine (a timeout, a dropped response, a
 //    node answering "already known"), and the popup's retry does not
 //    re-broadcast these bytes — it re-runs populateTransaction() and signs
 //    again at a freshly fetched pending-tag nonce. Retrying would therefore
 //    put a second transaction on the chain for one approval.
 function describeTxFailure(stage, err) {
    const error = errorText(err);
    const retryable =
        stage === TX_STAGE_SIGN ||
        (stage === TX_STAGE_VERIFY && failureIsRetryable(err));
    return { error, retryable, spendApproval: !retryable };
 }
 // What the popup shows and does after the background reports a failed signing
 // attempt. A retryable failure leaves the approval pending in the background,
 // so the button goes back to being usable; a refusal spent the approval, and
 // the popup says so rather than offering a button that cannot succeed.
 //
 // A failed broadcast gets its own wording: the transaction may already be on
 // the network, so telling the user to start again from the site is exactly the
 // wrong instruction.
 function describeSigningFailure(response, fallbackMessage) {
    let message = (response && response.error) || fallbackMessage;
    if (!/[.!?]$/.test(message)) message += ".";
    const retryable = !!(response && response.retryable);
    if (!retryable) {
        message +=
-            response && response.stage === TX_STAGE_BROADCAST
+            " This request can no longer be signed. Please start it again" +
-                ? " The transaction may still have reached the network." +
+            " from the site.";
                  " Check the account before sending it again."
                : " This request can no longer be signed. Please start it" +
                  " again from the site.";
    }
    return { message, retryable };
 }
@@ -514,19 +303,10 @@ function describeSigningFailure(response, fallbackMessage) {
 module.exports = {
    verifySignedTx,
    verifySignature,
    assertNoForbiddenFields,
    assertNothingUnchecked,
    sameAddress,
    failureIsRetryable,
    describeTxFailure,
    describeSigningFailure,
    ApprovalMismatchError,
    ALLOWED_TX_TYPES,
    SERIALIZED_FIELDS,
    FORBIDDEN_FIELDS,
    TX_STAGE_SIGN,
    TX_STAGE_VERIFY,
    TX_STAGE_BROADCAST,
    MAX_GAS_LIMIT,
    MAX_FEE_PER_GAS,
 };
--- a/src/shared/state.js
+++ b/src/shared/state.js
@@ -84,11 +84,8 @@ async function loadState() {
    const result = await storageApi.get("autistmask");
    if (result.autistmask) {
        const saved = result.autistmask;
        state.hasWallet = saved.hasWallet;
        state.wallets = saved.wallets || [];
        // Derived, never read from storage: a profile persisted with the flag
        // out of step with the wallet list would otherwise stay broken on
        // every load. Nothing depends on the two disagreeing.
        state.hasWallet = state.wallets.length > 0;
        state.trackedTokens = saved.trackedTokens || [];
        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
        state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
--- a/src/shared/transactions.js
+++ b/src/shared/transactions.js
@@ -113,85 +113,6 @@ function parseTokenTransfer(tt, addrLower) {
    };
 }
 // True when a parsed native entry moved no ETH.  Contract-call entries have
 // their amount fields blanked by parseTx, so they are never judged here.
 function movedNoEther(tx) {
    if (tx.direction === "contract") return false;
    return BigInt(tx.rawAmount || "0") === BigInt(0);
 }
 // Merge parsed normal transactions with parsed ERC-20 token transfers into
 // one row per distinct value movement.  Pure: it reads only its arguments
 // and returns a new list sorted newest block first.
 //
 // The merge key is the transaction hash for the native entry and
 // hash + token contract for each token transfer, so:
 //
 //   - A display-level contract call (a swap and friends, direction
 //     "contract") absorbs every token leg of its hash into the single
 //     native entry, because the legs are hops of one operation rather
 //     than separate movements the user made.
 //   - Otherwise each distinct token contract in the transaction keeps its
 //     own row, so a hash carrying several genuine transfers stays several
 //     rows.
 //   - The native entry of such a transaction is dropped when it moved no
 //     ETH and at least one token transfer shares its hash: that entry is
 //     the ERC-20 call itself, already represented by the token row.  A
 //     native entry that moved ETH survives alongside the token rows, since
 //     the ETH and the tokens are two real movements, and a zero-value
 //     native transaction with no token transfer on its hash survives too.
 function mergeTransactions(txs, tokenTransfers) {
    const byKey = new Map();
    // Entries are copied so consolidation never writes through to the
    // caller's objects.
    for (const tx of txs) {
        byKey.set(tx.hash, { ...tx });
    }
    const absorbedHashes = new Set();
    for (const parsed of tokenTransfers) {
        const existing = byKey.get(parsed.hash);
        if (existing && existing.direction === "contract") {
            // For contract calls (swaps), consolidate into the original
            // tx entry.  Prefer the "received" transfer (swap output)
            // for the display amount.  If no received transfer exists,
            // fall back to the first "sent" transfer (swap input).
            const isReceived = parsed.direction === "received";
            const needsAmount = !existing.exactValue;
            if (isReceived || needsAmount) {
                existing.value = parsed.value;
                existing.exactValue = parsed.exactValue;
                existing.rawAmount = parsed.rawAmount;
                existing.rawUnit = parsed.rawUnit;
                existing.symbol = parsed.symbol;
                existing.contractAddress = parsed.contractAddress;
                existing.holders = parsed.holders;
            }
            // Keep the original tx's from/to (the user's address and the
            // contract they called), not the token transfer's from/to
            // which may be a router or Permit2 contract.
            continue;
        }
        if (existing && movedNoEther(existing)) {
            absorbedHashes.add(parsed.hash);
        }
        // Every other token transfer gets its own entry.
        byKey.set(parsed.hash + ":" + (parsed.contractAddress || ""), {
            ...parsed,
        });
    }
    for (const hash of absorbedHashes) {
        byKey.delete(hash);
    }
    const merged = [...byKey.values()];
    merged.sort((a, b) => b.blockNumber - a.blockNumber);
    return merged;
 }
 async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
    log.debugf("fetchRecentTransactions", address);
    const addrLower = address.toLowerCase();
@@ -224,11 +145,53 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
    const txJson = txResp.ok ? await txResp.json() : {};
    const ttJson = ttResp.ok ? await ttResp.json() : {};
-    const txs = mergeTransactions(
+    const txsByHash = new Map();
        (txJson.items || []).map((tx) => parseTx(tx, addrLower)),
        (ttJson.items || []).map((tt) => parseTokenTransfer(tt, addrLower)),
    );
    for (const tx of txJson.items || []) {
        txsByHash.set(tx.hash, parseTx(tx, addrLower));
    }
    // When a token transfer shares a hash with a normal tx, the normal tx
    // is the contract call (0 ETH) and the token transfer has the real
    // amount and symbol.  For contract calls (swaps), a single transaction
    // can produce multiple token transfers (input, intermediates, output).
    // We consolidate these into the original tx entry using the token
    // transfer where the user *receives* tokens (the swap output), so
    // the transaction list shows the final result rather than confusing
    // intermediate hops.  We preserve the original tx's from/to so the
    // user sees their own address, not a router or Permit2 contract.
    for (const tt of ttJson.items || []) {
        const parsed = parseTokenTransfer(tt, addrLower);
        const existing = txsByHash.get(parsed.hash);
        if (existing && existing.direction === "contract") {
            // For contract calls (swaps), consolidate into the original
            // tx entry.  Prefer the "received" transfer (swap output)
            // for the display amount.  If no received transfer exists,
            // fall back to the first "sent" transfer (swap input).
            const isReceived = parsed.direction === "received";
            const needsAmount = !existing.exactValue;
            if (isReceived || needsAmount) {
                existing.value = parsed.value;
                existing.exactValue = parsed.exactValue;
                existing.rawAmount = parsed.rawAmount;
                existing.rawUnit = parsed.rawUnit;
                existing.symbol = parsed.symbol;
                existing.contractAddress = parsed.contractAddress;
                existing.holders = parsed.holders;
            }
            // Keep the original tx's from/to (the user's address and the
            // contract they called), not the token transfer's from/to
            // which may be a router or Permit2 contract.
            continue;
        }
        // Non-contract token transfers get their own entries.
        const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
        txsByHash.set(ttKey, parsed);
    }
    const txs = [...txsByHash.values()];
    txs.sort((a, b) => b.blockNumber - a.blockNumber);
    const result = txs.slice(0, count);
    log.debugf("fetchRecentTransactions done, count:", result.length);
    return result;
@@ -302,8 +265,4 @@ function filterTransactions(txs, filters = {}) {
    return { transactions: filtered, newFraudContracts: newFraud };
 }
-module.exports = {
+module.exports = { fetchRecentTransactions, filterTransactions };
    fetchRecentTransactions,
    filterTransactions,
    mergeTransactions,
 };
--- a/tests/approvalVerify.test.js
+++ b/tests/approvalVerify.test.js
@@ -2,18 +2,9 @@ const { Network, Transaction, Wallet } = require("ethers");
 const {
    verifySignedTx,
    verifySignature,
    assertNoForbiddenFields,
    assertNothingUnchecked,
    sameAddress,
    failureIsRetryable,
    describeTxFailure,
    describeSigningFailure,
    ALLOWED_TX_TYPES,
    SERIALIZED_FIELDS,
    FORBIDDEN_FIELDS,
    TX_STAGE_SIGN,
    TX_STAGE_VERIFY,
    TX_STAGE_BROADCAST,
    MAX_GAS_LIMIT,
    MAX_FEE_PER_GAS,
 } = require("../src/shared/approvalVerify");
@@ -322,287 +313,6 @@ describe("verifySignedTx field comparison", () => {
    });
 });
 // The transaction type decides which fields exist, so an artifact of a type
 // this wallet does not sign carries consequences the approval cannot describe
 // and none of the field comparisons can see. The approval used here is the
 // ordinary dApp shape with no fee fields — the common case, since
 // populateTransaction() fills them — which is exactly the case the
 // fee-mechanism check cannot catch by accident.
 describe("verifySignedTx transaction type", () => {
    const BARE_APPROVAL = {
        from: signer.address,
        to: RECIPIENT,
        value: "0x2386f26fc10000",
        data: "0x",
    };
    // An EIP-7702 artifact that pays the approved amount to the approved
    // recipient and, in the same transaction, installs the attacker's code at
    // the signer's own account for good. Every field the approval screen shows
    // matches; only the type and the authorization list do not.
    test("refuses a type 4 artifact that delegates the signer's own account", async () => {
        const authorization = await signer.authorize({
            address: OTHER_RECIPIENT,
            chainId: 1,
            nonce: 8,
        });
        const raw = await signedFor(BARE_APPROVAL, signer, {
            type: 4,
            authorizationList: [authorization],
        });
        const parsed = Transaction.from(raw);
        expect(parsed.type).toBe(4);
        expect(parsed.authorizationList[0].address).toBe(OTHER_RECIPIENT);
        expect(() =>
            verifySignedTx(raw, BARE_APPROVAL, signer.address, SELECTED),
        ).toThrow(/type this wallet does not sign/);
    });
    test("refuses a type 3 blob artifact", async () => {
        const raw = await signedFor(BARE_APPROVAL, signer, {
            type: 3,
            maxFeePerBlobGas: 1000000000n,
            blobVersionedHashes: ["0x01" + "ab".repeat(31)],
        });
        expect(Transaction.from(raw).type).toBe(3);
        expect(() =>
            verifySignedTx(raw, BARE_APPROVAL, signer.address, SELECTED),
        ).toThrow(/type this wallet does not sign/);
    });
    test("refuses every type outside the allowlist, not just the known ones", async () => {
        for (const type of [3, 4]) {
            expect(ALLOWED_TX_TYPES).not.toContain(type);
        }
        expect(ALLOWED_TX_TYPES).toEqual([0, 1, 2]);
    });
    test("a type refusal is a refusal, not a warning", async () => {
        const authorization = await signer.authorize({
            address: OTHER_RECIPIENT,
            chainId: 1,
            nonce: 8,
        });
        const raw = await signedFor(BARE_APPROVAL, signer, {
            type: 4,
            authorizationList: [authorization],
        });
        try {
            verifySignedTx(raw, BARE_APPROVAL, signer.address, SELECTED);
            throw new Error("expected a rejection");
        } catch (e) {
            expect(e.approvalMismatch).toBe(true);
            expect(e.message).toMatch(/^[A-Z].*\.$/);
        }
    });
    test("accepts a legacy type 0 transaction", async () => {
        const approved = { ...BARE_APPROVAL, gasPrice: "0x77359400" };
        const raw = await signedFor(approved, signer, {
            type: 0,
            gasPrice: 2000000000n,
            maxFeePerGas: null,
            maxPriorityFeePerGas: null,
        });
        expect(() =>
            verifySignedTx(raw, approved, signer.address, SELECTED),
        ).not.toThrow();
    });
    test("accepts a type 1 transaction whose access list is the approved one", async () => {
        const accessList = [{ address: OTHER_RECIPIENT, storageKeys: [] }];
        const approved = {
            ...BARE_APPROVAL,
            gasPrice: "0x77359400",
            accessList,
        };
        const raw = await signedFor(approved, signer, {
            type: 1,
            gasPrice: 2000000000n,
            maxFeePerGas: null,
            maxPriorityFeePerGas: null,
            accessList,
        });
        expect(Transaction.from(raw).type).toBe(1);
        expect(() =>
            verifySignedTx(raw, approved, signer.address, SELECTED),
        ).not.toThrow();
    });
    test("refuses an access list the approval never carried", async () => {
        const raw = await signedFor(BARE_APPROVAL, signer, {
            accessList: [{ address: OTHER_RECIPIENT, storageKeys: [] }],
        });
        expect(() =>
            verifySignedTx(raw, BARE_APPROVAL, signer.address, SELECTED),
        ).toThrow(/approved access list/);
    });
    test("treats an absent access list and an empty one as the same thing", async () => {
        const approved = { ...BARE_APPROVAL, accessList: [] };
        const raw = await signedFor(BARE_APPROVAL, signer, {});
        expect(() =>
            verifySignedTx(raw, approved, signer.address, SELECTED),
        ).not.toThrow();
    });
 });
 // The allowlist is only exhaustive while it accounts for every field an
 // artifact can carry. These tests are what makes that claim checkable rather
 // than asserted.
 describe("verifySignedTx exhaustiveness", () => {
    // Every accessor ethers exposes on a parsed transaction, and where this
    // module deals with it. If an ethers upgrade adds a transaction field,
    // this fails and forces a decision about it instead of letting it default
    // to unchecked.
    test("every field ethers can parse is accounted for", () => {
        const derived = [
            // Recovered from the signature or computed from the payload, not
            // independent content: covered by the signer check and by the
            // fields below.
            "from",
            "fromPublicKey",
            "hash",
            "serialized",
            "signature",
            "type",
            "typeName",
            "unsignedHash",
            "unsignedSerialized",
            // Blob sidecar machinery, meaningful only alongside `blobs`,
            // which is refused outright.
            "kzg",
            "blobWrapperVersion",
        ];
        const accounted = new Set([
            ...derived,
            ...FORBIDDEN_FIELDS.map((f) => f.key),
            ...Object.values(SERIALIZED_FIELDS).flat(),
        ]);
        const exposed = Object.getOwnPropertyNames(Transaction.prototype)
            .filter((name) => {
                const d = Object.getOwnPropertyDescriptor(
                    Transaction.prototype,
                    name,
                );
                return d && typeof d.get === "function";
            })
            .sort();
        expect(exposed.filter((name) => !accounted.has(name))).toEqual([]);
    });
    // The two layers behind the type allowlist. Nothing reachable through
    // verifySignedTx can trip either of them while the allowlist holds — that
    // is what they are for — so they are exercised directly rather than taken
    // on trust.
    test("a forbidden field is refused even on an allowed type", async () => {
        const authorization = await signer.authorize({
            address: OTHER_RECIPIENT,
            chainId: 1,
            nonce: 8,
        });
        const carriers = {
            authorizationList: [authorization],
            blobVersionedHashes: ["0x01" + "ab".repeat(31)],
            blobs: ["0x00"],
            maxFeePerBlobGas: 1n,
        };
        for (const key of Object.keys(carriers)) {
            expect(FORBIDDEN_FIELDS.map((f) => f.key)).toContain(key);
            let thrown;
            try {
                assertNoForbiddenFields({ type: 2, [key]: carriers[key] });
                throw new Error("expected a rejection");
            } catch (e) {
                thrown = e;
            }
            expect(thrown.approvalMismatch).toBe(true);
            expect(thrown.message).toMatch(/^[A-Z].*\.$/);
        }
        expect(() => assertNoForbiddenFields({ type: 2 })).not.toThrow();
    });
    // Stands in for a future ethers that parses a field this module does not
    // know about onto an allowed type: every field the module checks is
    // identical, and the bytes are not.
    test("an artifact carrying more than the checked fields is refused", async () => {
        const parsed = Transaction.from(await signedWith({}));
        const smuggled = { type: parsed.type };
        for (const key of SERIALIZED_FIELDS[parsed.type]) {
            smuggled[key] = parsed[key];
        }
        smuggled.unsignedSerialized = parsed.unsignedSerialized + "ff";
        expect(() => assertNothingUnchecked(smuggled)).toThrow(
            /beyond the fields that were checked/,
        );
        expect(() => assertNothingUnchecked(parsed)).not.toThrow();
    });
    // The closing check rebuilds the artifact from the fields the module
    // compared and compares the bytes, so an artifact carrying anything else
    // is refused without the module having to name it. Assert the rebuild is
    // faithful for every accepted shape, since a rebuild that dropped a
    // legitimate field would refuse honest transactions.
    test("an accepted artifact of each allowed type rebuilds byte for byte", async () => {
        const shapes = [
            {
                approved: { ...TX_PARAMS, gasPrice: "0x77359400" },
                overrides: {
                    type: 0,
                    gasPrice: 2000000000n,
                    maxFeePerGas: null,
                    maxPriorityFeePerGas: null,
                },
            },
            {
                approved: {
                    ...TX_PARAMS,
                    gasPrice: "0x77359400",
                    accessList: [
                        {
                            address: RECIPIENT,
                            storageKeys: ["0x" + "11".repeat(32)],
                        },
                    ],
                },
                overrides: {
                    type: 1,
                    gasPrice: 2000000000n,
                    maxFeePerGas: null,
                    maxPriorityFeePerGas: null,
                    accessList: [
                        {
                            address: RECIPIENT,
                            storageKeys: ["0x" + "11".repeat(32)],
                        },
                    ],
                },
            },
            { approved: TX_PARAMS, overrides: {} },
        ];
        for (const shape of shapes) {
            const raw = await signedFor(
                shape.approved,
                signer,
                shape.overrides,
            );
            const parsed = verifySignedTx(
                raw,
                shape.approved,
                signer.address,
                SELECTED,
            );
            const fields = { type: parsed.type };
            for (const key of SERIALIZED_FIELDS[parsed.type]) {
                fields[key] = parsed[key];
            }
            expect(Transaction.from(fields).unsignedSerialized).toBe(
                parsed.unsignedSerialized,
            );
        }
    });
 });
 // The approval and the artifact spell the same values differently. None of
 // these differences is tampering, so none may refuse the signature.
 describe("verifySignedTx normalization", () => {
@@ -701,43 +411,6 @@ describe("verifySignedTx normalization", () => {
            ),
        ).toThrow(/is not a number/);
    });
    // The value is page-controlled. A refusal is correct; a raw BigInt
    // conversion error is not, because it is not a mismatch, so it would be
    // reported retryable and leave the approval unspent behind a live button
    // that can never succeed.
    test("refuses an approved value that is not a number, as a mismatch", async () => {
        const raw = await signedWith({});
        for (const value of ["cheap", 1.5, "1e18", {}]) {
            let thrown;
            try {
                verifySignedTx(
                    raw,
                    { ...TX_PARAMS, value },
                    signer.address,
                    SELECTED,
                );
                throw new Error("expected a rejection");
            } catch (e) {
                thrown = e;
            }
            expect(thrown.approvalMismatch).toBe(true);
            expect(thrown.message).toMatch(/approved value is not a number/);
            expect(failureIsRetryable(thrown)).toBe(false);
        }
    });
    test("refuses an approved access list that is not an access list", async () => {
        const raw = await signedWith({});
        expect(() =>
            verifySignedTx(
                raw,
                { ...TX_PARAMS, accessList: ["nope"] },
                signer.address,
                SELECTED,
            ),
        ).toThrow(/not a valid access list/);
    });
 });
 const TYPED_DATA = JSON.stringify({
@@ -917,73 +590,6 @@ describe("signing failure and retry", () => {
        );
        expect(outcome.message).toMatch(/^[A-Z].*\.$/);
    });
    test("a popup that could not sign leaves the approval standing", () => {
        const outcome = describeTxFailure(
            TX_STAGE_SIGN,
            "That password is incorrect. Please try again.",
        );
        expect(outcome.retryable).toBe(true);
        expect(outcome.spendApproval).toBe(false);
        expect(outcome.error).toMatch(/password is incorrect/);
    });
    test("a mismatch found at verification spends the approval", async () => {
        const raw = await signedFor({ ...TX_PARAMS, to: OTHER_RECIPIENT });
        let outcome;
        try {
            verifySignedTx(raw, TX_PARAMS, signer.address, SELECTED);
        } catch (e) {
            outcome = describeTxFailure(TX_STAGE_VERIFY, e);
        }
        expect(outcome.retryable).toBe(false);
        expect(outcome.spendApproval).toBe(true);
    });
    test("a failure before the check ran is still retryable", () => {
        const outcome = describeTxFailure(
            TX_STAGE_VERIFY,
            new Error("The wallet state could not be read."),
        );
        expect(outcome.retryable).toBe(true);
        expect(outcome.spendApproval).toBe(false);
    });
    // A broadcast that throws after the node took the transaction is routine:
    // a timeout, a dropped response, a node answering "already known". The
    // popup's retry does not re-broadcast the same bytes — it re-populates and
    // re-signs at a freshly fetched nonce — so a retryable broadcast failure
    // would put the approved transfer on the chain twice.
    test("a failed broadcast is terminal, whatever the node said", () => {
        for (const message of [
            "already known",
            "timeout of 30000ms exceeded",
            "could not coalesce error",
            "replacement transaction underpriced",
        ]) {
            const outcome = describeTxFailure(
                TX_STAGE_BROADCAST,
                new Error(message),
            );
            expect(outcome.retryable).toBe(false);
            expect(outcome.spendApproval).toBe(true);
            expect(outcome.error).toBe(message);
        }
    });
    test("a failed broadcast does not tell the user to send it again", () => {
        const outcome = describeSigningFailure(
            {
                error: "The node did not answer.",
                retryable: false,
                stage: TX_STAGE_BROADCAST,
            },
            "The transaction could not be sent.",
        );
        expect(outcome.retryable).toBe(false);
        expect(outcome.message).toMatch(/may still have reached the network/);
        expect(outcome.message).not.toMatch(/start it again from the site/);
    });
 });
 // End-to-end over the messaging boundary, without a browser: run the exact
--- a/tests/state.test.js
+++ b/tests/state.test.js
@@ -1,104 +0,0 @@
 const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
 function oneWallet() {
    return [{ name: "Wallet 1", type: "hd", addresses: [ADDRESS] }];
 }
 // state.js resolves the storage API at require time, so the stub has to exist
 // before the module is loaded, and the module registry has to be reset between
 // cases because `state` is a module-level singleton.
 function loadModuleWith(persisted) {
    jest.resetModules();
    const set = jest.fn(async () => {});
    global.chrome = {
        storage: {
            local: {
                get: jest.fn(async () =>
                    persisted ? { autistmask: persisted } : {},
                ),
                set,
            },
        },
    };
    return { mod: require("../src/shared/state"), set };
 }
 afterEach(() => {
    delete global.chrome;
 });
 describe("loadState hasWallet reconciliation", () => {
    // A profile that deleted its last wallet on a build predating the write
    // path fix keeps hasWallet: true forever. It must load as no wallet, which
    // is what sends the popup to the welcome view.
    test("stored hasWallet true with zero wallets loads as no wallet", async () => {
        const { mod } = loadModuleWith({ hasWallet: true, wallets: [] });
        await mod.loadState();
        expect(mod.state.hasWallet).toBe(false);
    });
    test("stored hasWallet true with a missing wallets key loads as no wallet", async () => {
        const { mod } = loadModuleWith({ hasWallet: true });
        await mod.loadState();
        expect(mod.state.wallets).toEqual([]);
        expect(mod.state.hasWallet).toBe(false);
    });
    test("stored hasWallet false with one wallet loads as having a wallet", async () => {
        const { mod } = loadModuleWith({
            hasWallet: false,
            wallets: oneWallet(),
        });
        await mod.loadState();
        expect(mod.state.hasWallet).toBe(true);
    });
    test("absent hasWallet with wallets present loads as having a wallet", async () => {
        const { mod } = loadModuleWith({ wallets: oneWallet() });
        await mod.loadState();
        expect(mod.state.hasWallet).toBe(true);
    });
    test("consistent stored states are preserved", async () => {
        const withWallet = loadModuleWith({
            hasWallet: true,
            wallets: oneWallet(),
        });
        await withWallet.mod.loadState();
        expect(withWallet.mod.state.hasWallet).toBe(true);
        const without = loadModuleWith({ hasWallet: false, wallets: [] });
        await without.mod.loadState();
        expect(without.mod.state.hasWallet).toBe(false);
    });
    test("empty storage leaves the default no-wallet state", async () => {
        const { mod } = loadModuleWith(null);
        await mod.loadState();
        expect(mod.state.hasWallet).toBe(false);
        expect(mod.state.wallets).toEqual([]);
    });
    // The correction is derived on every load rather than written back, so a
    // load never has a storage side effect.
    test("loadState does not write to storage", async () => {
        const { mod, set } = loadModuleWith({ hasWallet: true, wallets: [] });
        await mod.loadState();
        expect(set).not.toHaveBeenCalled();
    });
    // Deriving must not disturb the rest of the load.
    test("other persisted fields still load", async () => {
        const { mod } = loadModuleWith({
            hasWallet: false,
            wallets: oneWallet(),
            networkId: "sepolia",
            theme: "dark",
            activeAddress: ADDRESS,
        });
        await mod.loadState();
        expect(mod.state.networkId).toBe("sepolia");
        expect(mod.state.theme).toBe("dark");
        expect(mod.state.activeAddress).toBe(ADDRESS);
    });
 });
--- a/tests/transactions.test.js
+++ b/tests/transactions.test.js
@@ -36,7 +36,6 @@ global.chrome = { storage: { local: {} } };
 const {
    fetchRecentTransactions,
    filterTransactions,
    mergeTransactions,
 } = require("../src/shared/transactions");
 const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { debugFetch } = require("../src/shared/log");
@@ -686,339 +685,6 @@ describe("legitimate transactions are never filtered", () => {
    });
 });
 // ---------------------------------------------------------------------------
 // mergeTransactions is the pure core of the merge: it takes parsed native
 // entries and parsed token transfers and decides how many rows one on-chain
 // transaction becomes.  One transaction is one row per distinct value
 // movement, so the native side of a plain ERC-20 transfer must not survive
 // next to its token row (the duplicate-row bug), while a hash that really
 // did move several things must keep a row for each.
 // ---------------------------------------------------------------------------
 // A native entry as parseTx produces it for a decoded contract call: the
 // amount fields are blanked and direction is "contract".
 function contractCallTx(overrides = {}) {
    return nativeTx({
        from: VICTIM,
        to: USDC_CONTRACT,
        value: "",
        exactValue: "",
        rawAmount: "",
        rawUnit: "",
        valueGwei: 0,
        direction: "contract",
        directionLabel: "Approve",
        isContractCall: true,
        method: "approve",
        ...overrides,
    });
 }
 // The native entry parseTx produces for a plain ERC-20 transfer: sent to the
 // token contract, no ETH, and method "transfer", which is exactly why it is
 // not marked as a display-level contract call.
 function erc20CallTx(overrides = {}) {
    return nativeTx({
        from: VICTIM,
        to: USDC_CONTRACT,
        value: "0.0000",
        exactValue: "0.0",
        rawAmount: "0",
        valueGwei: 0,
        direction: "sent",
        directionLabel: "Sent",
        isContractCall: true,
        method: "transfer",
        ...overrides,
    });
 }
 describe("mergeTransactions: one row per value movement", () => {
    const HASH = "0x" + "d".repeat(64);
    const OTHER_HASH = "0x" + "e".repeat(64);
    const ROUTER = "0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad";
    test("a plain ERC-20 transfer yields one row, the token row", () => {
        const native = erc20CallTx({ hash: HASH });
        const token = tokenTx({
            hash: HASH,
            from: VICTIM,
            to: ORDINARY_PEER,
            direction: "sent",
            directionLabel: "Sent",
        });
        const merged = mergeTransactions([native], [token]);
        expect(merged).toHaveLength(1);
        expect(merged[0].symbol).toBe("USDC");
        expect(merged[0].exactValue).toBe("1500.5");
        expect(merged[0].contractAddress).toBe(USDC_CONTRACT);
    });
    test("an ETH-only transfer keeps its row unchanged", () => {
        const merged = mergeTransactions([legitimateEthSend()], []);
        expect(merged).toHaveLength(1);
        expect(merged[0]).toEqual(legitimateEthSend());
    });
    test("a genuine zero-value native transaction is still displayed", () => {
        const zero = nativeTx({
            hash: HASH,
            from: VICTIM,
            to: ORDINARY_PEER,
            value: "0.0000",
            exactValue: "0.0",
            rawAmount: "0",
            valueGwei: 0,
            direction: "sent",
            directionLabel: "Sent",
        });
        const merged = mergeTransactions([zero], []);
        expect(merged).toEqual([zero]);
    });
    test("a zero-value native row is only absorbed by a transfer sharing its hash", () => {
        const zero = erc20CallTx({ hash: HASH });
        const unrelated = tokenTx({ hash: OTHER_HASH });
        const merged = mergeTransactions([zero], [unrelated]);
        expect(merged).toHaveLength(2);
        expect(merged.map((t) => t.hash).sort()).toEqual(
            [HASH, OTHER_HASH].sort(),
        );
    });
    test("a native transaction that moved ETH keeps its row beside the token row", () => {
        // An undecoded call (no method name) carrying ETH that also emitted
        // a token transfer: two real movements, so two rows.
        const native = nativeTx({
            hash: HASH,
            from: VICTIM,
            to: ROUTER,
            value: "0.2500",
            exactValue: "0.25",
            rawAmount: "250000000000000000",
            valueGwei: 250000000,
            direction: "sent",
            directionLabel: "Sent",
            isContractCall: true,
        });
        const token = tokenTx({ hash: HASH, from: ROUTER, to: VICTIM });
        const merged = mergeTransactions([native], [token]);
        expect(merged).toHaveLength(2);
        expect(merged.map((t) => t.symbol).sort()).toEqual(["ETH", "USDC"]);
    });
    test("a sub-gwei ETH movement keeps its row beside the token row", () => {
        // 500000000 wei is 0.5 gwei, so parseTx's valueGwei floors to 0 while
        // rawAmount stays nonzero.  Deciding "moved no ETH" on valueGwei would
        // delete this row and lose a real ETH movement, so the decision is made
        // on rawAmount as a BigInt.
        const native = nativeTx({
            hash: HASH,
            from: VICTIM,
            to: ROUTER,
            value: "0.0000",
            exactValue: "0.0000000005",
            rawAmount: "500000000",
            valueGwei: 0,
            direction: "sent",
            directionLabel: "Sent",
            isContractCall: true,
        });
        const token = tokenTx({ hash: HASH, from: ROUTER, to: VICTIM });
        const merged = mergeTransactions([native], [token]);
        expect(merged).toHaveLength(2);
        expect(merged.map((t) => t.symbol).sort()).toEqual(["ETH", "USDC"]);
        expect(merged.find((t) => t.symbol === "ETH").rawAmount).toBe(
            "500000000",
        );
    });
    test("a swap consolidates every token leg into one row, preferring the received leg", () => {
        const native = contractCallTx({
            hash: HASH,
            to: ROUTER,
            directionLabel: "Swap",
            method: "execute",
        });
        const sentLeg = tokenTx({
            hash: HASH,
            from: VICTIM,
            to: ROUTER,
            direction: "sent",
            directionLabel: "Sent",
        });
        const receivedLeg = tokenTx({
            hash: HASH,
            from: ROUTER,
            to: VICTIM,
            value: "0.2500",
            exactValue: "0.25",
            rawAmount: "250000000000000000",
            rawUnit: "WETH base units (10^-18)",
            symbol: "WETH",
            contractAddress: WETH_CONTRACT,
            holders: 850000,
        });
        const merged = mergeTransactions([native], [sentLeg, receivedLeg]);
        expect(merged).toHaveLength(1);
        expect(merged[0].symbol).toBe("WETH");
        expect(merged[0].exactValue).toBe("0.25");
        // The user's own address and the contract called are preserved.
        expect(merged[0].from).toBe(VICTIM);
        expect(merged[0].to).toBe(ROUTER);
        expect(merged[0].directionLabel).toBe("Swap");
    });
    test("a swap whose legs are all sent takes its amount from the first sent leg", () => {
        const native = contractCallTx({
            hash: HASH,
            to: ROUTER,
            directionLabel: "Swap",
            method: "execute",
        });
        const firstSent = tokenTx({
            hash: HASH,
            from: VICTIM,
            to: ROUTER,
            direction: "sent",
            directionLabel: "Sent",
        });
        const secondSent = tokenTx({
            hash: HASH,
            from: VICTIM,
            to: ROUTER,
            value: "0.2500",
            exactValue: "0.25",
            rawAmount: "250000000000000000",
            rawUnit: "WETH base units (10^-18)",
            symbol: "WETH",
            contractAddress: WETH_CONTRACT,
            holders: 850000,
            direction: "sent",
            directionLabel: "Sent",
        });
        const merged = mergeTransactions([native], [firstSent, secondSent]);
        expect(merged).toHaveLength(1);
        // With no received leg the display amount comes from the first sent
        // leg, and a later sent leg does not overwrite it.
        expect(merged[0].symbol).toBe("USDC");
        expect(merged[0].exactValue).toBe("1500.5");
        expect(merged[0].contractAddress).toBe(USDC_CONTRACT);
        expect(merged[0].holders).toBe(3500000);
    });
    test("a contract call carrying ETH plus a token transfer stays one row", () => {
        const native = contractCallTx({
            hash: HASH,
            to: ROUTER,
            directionLabel: "Swap",
            method: "swapExactETHForTokens",
            valueGwei: 250000000,
        });
        const received = tokenTx({ hash: HASH, from: ROUTER, to: VICTIM });
        const merged = mergeTransactions([native], [received]);
        expect(merged).toHaveLength(1);
        expect(merged[0].symbol).toBe("USDC");
        expect(merged[0].exactValue).toBe("1500.5");
        // The ETH leg is still visible as the row's native quantity.
        expect(merged[0].valueGwei).toBe(250000000);
    });
    test("an approve keeps its row and survives the filters", () => {
        const approve = contractCallTx({ hash: HASH });
        const merged = mergeTransactions([approve], []);
        expect(merged).toEqual([approve]);
        expect(filterTransactions(merged, filters()).transactions).toEqual([
            approve,
        ]);
    });
    test("a contract creation keeps its row", () => {
        const creation = nativeTx({
            hash: HASH,
            from: VICTIM,
            to: "",
            value: "0.0000",
            exactValue: "0.0",
            rawAmount: "0",
            valueGwei: 0,
            direction: "sent",
            directionLabel: "Sent",
        });
        expect(mergeTransactions([creation], [])).toEqual([creation]);
    });
    test("a native self-send keeps its single row", () => {
        const selfSend = nativeTx({
            hash: HASH,
            from: VICTIM,
            to: VICTIM,
            direction: "sent",
            directionLabel: "Sent",
        });
        expect(mergeTransactions([selfSend], [])).toEqual([selfSend]);
    });
    test("a token self-send yields one row", () => {
        const native = erc20CallTx({ hash: HASH });
        const token = tokenTx({
            hash: HASH,
            from: VICTIM,
            to: VICTIM,
            direction: "sent",
            directionLabel: "Sent",
        });
        const merged = mergeTransactions([native], [token]);
        expect(merged).toHaveLength(1);
        expect(merged[0].symbol).toBe("USDC");
        expect(merged[0].from).toBe(VICTIM);
        expect(merged[0].to).toBe(VICTIM);
    });
    test("several distinct tokens moved by one ERC-20 call keep a row each", () => {
        const native = erc20CallTx({ hash: HASH });
        const usdc = tokenTx({ hash: HASH });
        const weth = tokenTx({
            hash: HASH,
            symbol: "WETH",
            contractAddress: WETH_CONTRACT,
            holders: 850000,
        });
        const merged = mergeTransactions([native], [usdc, weth]);
        expect(merged.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
    });
    test("rows are sorted by block number, newest first", () => {
        const older = nativeTx({ hash: HASH, blockNumber: 21000000 });
        const newer = nativeTx({ hash: OTHER_HASH, blockNumber: 21000010 });
        const merged = mergeTransactions([older, newer], []);
        expect(merged.map((t) => t.blockNumber)).toEqual([21000010, 21000000]);
    });
    test("the entries handed in are never mutated", () => {
        const native = contractCallTx({ hash: HASH, method: "execute" });
        const token = tokenTx({ hash: HASH });
        const before = JSON.stringify([native, token]);
        mergeTransactions([native], [token]);
        expect(JSON.stringify([native, token])).toBe(before);
    });
 });
 // ---------------------------------------------------------------------------
 // fetchRecentTransactions owns the per-address merge of normal transactions
 // with ERC-20 transfers.  (The cross-address merge Home performs lives in
@@ -1220,12 +886,13 @@ describe("fetchRecentTransactions merge and dedup", () => {
        expect(txs.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
    });
-    // Regression guard for the duplicate-row bug: for a plain ERC-20
+    // Documents current behaviour: for a plain ERC-20 transfer the method is
-    // transfer the method is "transfer", so parseTx does not mark the entry
+    // "transfer", so parseTx does not mark the entry as a contract call in
-    // as a contract call in the display sense.  The native side of that
+    // the display sense and the merge loop does not consolidate the token
-    // transaction moved no ETH and is represented by the token row, so it
+    // transfer into it.  The result is two entries for one transaction: a
-    // must not survive the merge as a second, zero-value row.
+    // zero-value native row and the real token row.  The zero-value row also
-    test("a plain ERC-20 transfer produces exactly one entry", async () => {
+    // escapes dust filtering because isContractCall is true.
    test("current behaviour: a plain ERC-20 transfer produces two entries", async () => {
        const hash = "0x" + "5".repeat(64);
        respondWith(
            [
@@ -1258,15 +925,14 @@ describe("fetchRecentTransactions merge and dedup", () => {
        );
        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT);
-        expect(txs).toHaveLength(1);
+        expect(txs).toHaveLength(2);
-        expect(txs[0].symbol).toBe("USDC");
+        expect(txs.map((t) => t.symbol).sort()).toEqual(["ETH", "USDC"]);
-        expect(txs[0].exactValue).toBe("1.0");
+        const nativeRow = txs.find((t) => t.symbol === "ETH");
-        expect(txs[0].direction).toBe("sent");
+        expect(nativeRow.exactValue).toBe("0.0");
-        expect(txs[0].contractAddress).toBe(USDC_CONTRACT);
+        expect(nativeRow.isContractCall).toBe(true);
-        // The surviving row is the token row, and the filters keep it.
+        // And the zero-value row is not removed by the dust filter.
        const kept = filterTransactions(txs, filters()).transactions;
-        expect(kept).toHaveLength(1);
+        expect(kept).toHaveLength(2);
        expect(kept[0].symbol).toBe("USDC");
    });
    test("entries are sorted by block number descending and capped at count", async () => {