fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Eighteen existing tests and three shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

README.md

@@ -1474,24 +1474,23 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. A token claiming a symbol from the bundled list from any other
-contract address is always dropped, tracked or not, and so is any token claiming
-a symbol that belongs to the native asset and therefore has no legitimate
-contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
-`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
-tokens with fewer than 1,000 holders" setting governs the transaction history
-and the send-screen token selector, not this list. A token's holder count is
-unknown when the explorer reports none, or reports anything other than a whole
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
-or more, so such a token is shown only when it is on the bundled list or
-tracked. Every nonzero holding of a token shown is stored exactly, however
-small, but a holding below 0.000001 is left out of the balance lists, the
-send-screen token selector, the address total and the remove-address warning
-(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
-confirmation screens show it when its token is the one being sent. Tracked
-tokens with a zero balance are listed as well while "Show tracked tokens with
-zero balance" is on.
+more holders. On Ethereum Mainnet, a token claiming a symbol from the bundled
+list from any other contract address is always dropped, tracked or not. On every
+network, a token claiming a label of the native asset is always dropped. Those
+labels are `"ETH"` and each network's `nativeCurrency`, such as `"SepoliaETH"`.
+That filter is unconditional — the "Hide tokens with fewer than 1,000 holders"
+setting governs the transaction history and the send-screen token selector, not
+this list. A token's holder count is unknown when the explorer reports none, or
+reports anything other than a whole number written in digits alone, such as
+`1,000` or `1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list
+does not take an unknown count as 1,000 or more, so such a token is shown only
+when it is on the bundled list or tracked. Every nonzero holding of a token
+shown is stored exactly, however small, but a holding below 0.000001 is left out
+of the balance lists, the send-screen token selector, the address total and the
+remove-address warning (`isBelowOneMillionth()` in
+`src/shared/amountDisplay.js`). The Send and confirmation screens show it when
+its token is the one being sent. Tracked tokens with a zero balance are listed
+as well while "Show tracked tokens with zero balance" is on.
 
 #### Stored state and its version
 
@@ -3199,26 +3198,27 @@ indexes it as a real token transfer.
   Ethereum mainnet ERC-20s taken from the CoinGecko API, with decimals verified
   on-chain and addresses EIP-55 checksummed; `TOKENS` in
   `src/shared/tokenList.js` is the authoritative set. It is bundled at build
-  time and only changes when that file is regenerated. Any token transfer
-  claiming a symbol from this list (e.g. "ETH", "USDT", "USDC") but originating
-  from an unrecognized contract address is identified as a spoof and filtered
-  from display. The fake "Ethereum" token in the attack above used symbol "ETH"
-  from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not
-  match the known WETH contract — so it would be caught by this check. Detecting
-  a spoof is also what adds a contract to the fraud contract blocklist below;
-  that is the only thing that populates it. In the transaction history the check
-  is the "Hide fake tokens impersonating a known symbol" setting, on by default;
-  with it off, spoofed transfers are shown and no new blocklist entries are
-  learned from them. The send-screen token selector and the balance list apply
-  the same check unconditionally, because they decide which tokens the user can
-  act on and what the user believes they own rather than what the history
-  displays. All three surfaces read the rule from `src/shared/symbolSpoof.js`,
-  so they cannot answer the question differently. A symbol the list maps to no
-  contract at all — the native asset's labels: `"ETH"` and every network's
-  `nativeCurrency`, such as `"SepoliaETH"`, on every network — may be borne by
-  no contract, so every ERC-20 claiming it is a spoof on all three. The user's
-  real ETH balance is not an ERC-20 and is read over RPC, so the rule never sees
-  it.
+  time and only changes when that file is regenerated. On Ethereum Mainnet, any
+  token transfer claiming a symbol from this list (e.g. "ETH", "USDT", "USDC")
+  but originating from an unrecognized contract address is identified as a spoof
+  and filtered from display. On another network, the list's symbols are not
+  checked, because the list holds mainnet contracts. The fake "Ethereum" token
+  in the attack above used symbol "ETH" from contract
+  `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not match the known
+  WETH contract — so it would be caught by this check. Detecting a spoof is also
+  what adds a contract to the fraud contract blocklist below; that is the only
+  thing that populates it. In the transaction history the check is the "Hide
+  fake tokens impersonating a known symbol" setting, on by default; with it off,
+  spoofed transfers are shown and no new blocklist entries are learned from
+  them. The send-screen token selector and the balance list apply the same check
+  unconditionally, because they decide which tokens the user can act on and what
+  the user believes they own rather than what the history displays. All three
+  surfaces read the rule from `src/shared/symbolSpoof.js`, so they cannot answer
+  the question differently. A symbol the list maps to no contract at all — the
+  native asset's labels: `"ETH"` and every network's `nativeCurrency`, such as
+  `"SepoliaETH"`, on every network — may be borne by no contract, so every
+  ERC-20 claiming it is a spoof on all three. The user's real ETH balance is not
+  an ERC-20 and is read over RPC, so the rule never sees it.
 
 - **Low-holder token filtering**: Token transfers from ERC-20 contracts with
   fewer than 1,000 holders are hidden from transaction history by default.

docs/README.md

@@ -377,13 +377,15 @@ point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
 at build time and updated only when a new release ships a newer snapshot. If a
 transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
 but comes from an unrecognized contract, it is identified as a spoof and hidden.
-In your transaction history this is the "Hide fake tokens impersonating a known
-symbol" setting, which you can switch off; doing so also stops new entries being
-added to the fraud contract blocklist below, since detecting a spoof is what
-fills it. The send token list always applies the check. Your balances apply it
-too, with one exception: a token claiming the symbol "ETH" is not filtered
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
+On Sepolia, only "ETH" and "SepoliaETH" count as known symbols, because the
+bundled list holds Ethereum Mainnet tokens. In your transaction history the
+check is the "Hide fake tokens impersonating a known symbol" setting, which you
+can switch off; doing so also stops new entries being added to the fraud
+contract blocklist below, since detecting a spoof is what fills it. The send
+token list always applies the check. Your balances apply it too, with one
+exception: a token claiming the symbol "ETH" is not filtered there, so a fake
+"ETH" token can still show up in your balance list even though it is hidden from
+your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your

src/popup/index.js

@@ -65,7 +65,14 @@ function renderWalletList() {
 const pageClosed = new AbortController();
 window.addEventListener("pagehide", () => pageClosed.abort());
 
+// While a refresh runs, a request through ctx is not dropped. The request sets
+// refreshAgain, and one more refresh runs once the running one ends. Several
+// requests in that time lead to one more refresh, not several. An import asks
+// for a refresh after its address scan. A refresh already running does not
+// have the addresses the scan found
+// (https://git.eeqj.de/sneak/AutistMask/issues/581).
 let refreshInFlight = false;
+let refreshAgain = false;
 
 // The ten-second refresh startRefresh() starts, stopped when the popup moves to
 // the recovery screen: there is no profile left to refresh.
@@ -89,7 +96,10 @@ let refreshTimer = null;
 // user turned "Use Blockscout" off. So the save drops every token the user has
 // not tracked if the stored setting is off by then.
 async function doRefreshAndRender() {
-    if (refreshInFlight) return;
+    if (refreshInFlight) {
+        refreshAgain = true;
+        return;
+    }
     refreshInFlight = true;
     try {
         await followStoredSettings();
@@ -132,28 +142,35 @@ async function doRefreshAndRender() {
         });
         renderWalletList();
     } catch (e) {
-        // Every call site fires this and walks away — the boot below, the ten
-        // second interval, and eight views through ctx — so it must never
-        // reject: an unhandled rejection is not a report of anything. The save
-        // inside it reports its own failure through onSaveFailure() (see
-        // src/shared/state.js); what is left here is a failed network round
-        // trip, which the next tick retries.
+        // No caller waits for this function, so it must never reject. An
+        // unhandled rejection reports nothing. The save inside it reports its
+        // own failure through onSaveFailure() (see src/shared/state.js); what
+        // is left here is a failed network round trip, which the next tick
+        // retries.
         log.errorf("popup: background refresh failed:", e);
     } finally {
         refreshInFlight = false;
     }
+    if (refreshAgain) {
+        refreshAgain = false;
+        doRefreshAndRender();
+    }
 }
 
 // Refreshes now and every ten seconds from then on. Called once a wallet
 // exists: by init() when the popup opens with one, and by AddWallet when it
 // adds one, which in a popup that opened on Welcome is the first
-// (https://git.eeqj.de/sneak/AutistMask/issues/530). With the refresh already
-// running it starts no second one, and on the recovery screen it does nothing.
+// (https://git.eeqj.de/sneak/AutistMask/issues/530). With the ten-second
+// refresh already started, it starts no second one. On the recovery screen it
+// does nothing.
 function startRefresh() {
     if (!$("view-state-recovery").classList.contains("hidden")) return;
     doRefreshAndRender();
     if (refreshTimer === null) {
-        refreshTimer = setInterval(doRefreshAndRender, 10000);
+        // A tick that finds a refresh running is dropped.
+        refreshTimer = setInterval(() => {
+            if (!refreshInFlight) return doRefreshAndRender();
+        }, 10000);
     }
 }
 

src/popup/views/send.js

@@ -154,7 +154,9 @@ function renderSendTokenSelect(addr) {
         // out. Its token's own screen can still send it: there
         // state.selectedToken picks the token, not this list.
         if (isBelowOneMillionth(t.balance)) continue;
-        if (isSpoofedSymbol(t.symbol, t.address)) continue;
+        if (isSpoofedSymbol(t.symbol, t.address, currentNetwork().chainId)) {
+            continue;
+        }
         if (fraudSet.has(t.address.toLowerCase())) continue;
         // An unknown holder count does not withhold a token the user holds:
         // only a count the explorer actually reported as below the threshold

src/shared/approvalAmount.js

@@ -105,15 +105,16 @@ function explorerSymbol(lower, wallets) {
 // trust. `sources` is as for resolveTokenDecimals().
 //
 // A tracked or explorer-reported symbol is attacker-influenced text, so it is
-// held to the spoof rule (symbolSpoof.js): a candidate that wears a bundled or
-// native ticker from a contract not entitled to it is refused and the next
-// source tried, so resolving a symbol never becomes a new way to claim a known
-// ticker. The bundled list is the wallet's own data and is trusted as it is.
+// held to the spoof rule (symbolSpoof.js): a candidate that the rule calls a
+// spoof is refused and the next source tried, so resolving a symbol never
+// becomes a new way to claim a known ticker. The bundled list is the wallet's
+// own data and is trusted as it is.
 function resolveTokenSymbol(tokenAddress, sources) {
     const lower = (tokenAddress || "").toLowerCase();
     if (!lower) return null;
 
-    const bundled = bundledToken(lower, sources && sources.chainId);
+    const chainId = sources && sources.chainId;
+    const bundled = bundledToken(lower, chainId);
     if (bundled && bundled.symbol) return bundled.symbol;
 
     const tracked = ((sources && sources.trackedTokens) || []).find(
@@ -125,7 +126,7 @@ function resolveTokenSymbol(tokenAddress, sources) {
     if (reported) candidates.push(reported);
 
     for (const symbol of candidates) {
-        if (!isSpoofedSymbol(symbol, tokenAddress)) return symbol;
+        if (!isSpoofedSymbol(symbol, tokenAddress, chainId)) return symbol;
     }
     return null;
 }

src/shared/balances.js

@@ -209,7 +209,9 @@ async function fetchTokenBalances(
             // Every row here is an ERC-20 the explorer reported, so it has a
             // contract address; the native ETH balance is fetched over RPC in
             // refreshBalances and never passes through this loop.
-            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
+            if (isSpoofedSymbol(item.token.symbol, tokenAddr, chainId)) {
+                continue;
+            }
 
             balances.push({
                 address: item.token.address_hash,
@@ -267,7 +269,7 @@ async function fetchTrackedTokenBalances(
     signal,
 ) {
     const listed = trackedTokens.filter(
-        (token) => !isSpoofedSymbol(token.symbol, token.address),
+        (token) => !isSpoofedSymbol(token.symbol, token.address, chainId),
     );
     // Each token's balanceOf answer, or null where it failed.
     const balances = await Promise.all(

src/shared/symbolSpoof.js

@@ -19,7 +19,8 @@
 // them hid the other one's holders' money (issue #276).  Membership, not
 // equality, is therefore the question — but it is the same question, asked of
 // a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token; a contract outside the set is still a spoof.
+// wallet ships as a real token on Ethereum Mainnet.  On mainnet, a contract
+// outside the set is still a spoof.
 //
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
@@ -27,6 +28,7 @@
 // since that is what the user acts on.
 
 const { KNOWN_SYMBOLS } = require("./tokenList");
+const { NETWORKS } = require("./networks");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.
@@ -93,18 +95,24 @@ function normalizeSymbol(symbol) {
 }
 
 // True when a token bearing `symbol` from contract `contractAddress` is
-// impersonating a known symbol.
+// impersonating a known symbol. `chainId` is the chain id of the token's
+// network.
+//
+// The native asset's labels are known symbols on every network. The bundled
+// list's symbols are known symbols only on Ethereum Mainnet, because the list
+// holds mainnet contracts.
 //
 // An empty contract address is the native asset, which is never a spoof:
 // this is what keeps the user's real ETH out of the rule, and it holds for
 // any symbol that becomes null-mapped later, not just for ETH.
-function isSpoofedSymbol(symbol, contractAddress) {
+function isSpoofedSymbol(symbol, contractAddress, chainId) {
     const contract = normalizeAddress(contractAddress);
     if (!contract) return false;
     const sym = normalizeSymbol(symbol);
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
+    if (chainId !== NETWORKS.mainnet.chainId) return false;
     return !legit.has(contract);
 }
 

src/shared/transactions.js

@@ -317,7 +317,10 @@ function filterTransactions(txs, filters = {}) {
         const contract = normalizeAddress(tx.contractAddress);
 
         // Filter spoofed known symbols and record the fraud contract
-        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
+        if (
+            hideSpoofed &&
+            isSpoofedSymbol(tx.symbol, tx.contractAddress, tx.chainId)
+        ) {
             if (contract && !fraudSet.has(contract)) {
                 fraudSet.add(contract);
                 newFraud.push(contract);

tests/approvalBundledListSepolia.test.js

@@ -5,7 +5,8 @@
 // same address on Sepolia is another token, but the screen named it USDC and
 // scaled its amount at USDC's decimals
 // (https://git.eeqj.de/sneak/AutistMask/issues/632). The bundled list now names
-// a token only on Ethereum Mainnet.
+// a token only on Ethereum Mainnet. The same screen for a mainnet transfer of
+// USDC, while Sepolia is active, still names USDC.
 //
 // Driven through the real approval screen, against the minimal DOM stub
 // tests/approvalTokenNetwork.test.js uses.
@@ -93,9 +94,10 @@ function decodedLine(label) {
         );
 }
 
-// Open the approval screen, with Sepolia active, for the site's Sepolia
-// transaction sending TRANSFER_DATA to the contract at USDC's address.
-async function showSepoliaTransfer() {
+// Open the approval screen, with Sepolia active, for the site's transaction
+// sending TRANSFER_DATA to the contract at USDC's address on the network with
+// chain id `chainId`.
+async function showTransfer(chainId) {
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" }, close: () => {} };
     globalThis.chrome.runtime = {
@@ -110,7 +112,7 @@ async function showSepoliaTransfer() {
                 approvedTx: {
                     type: 2,
                     from: FROM,
-                    chainId: NETWORKS.sepolia.chainId,
+                    chainId,
                     nonce: "0x7",
                     gasLimit: "0x30d40",
                     maxPriorityFeePerGas: "0x3b9aca00",
@@ -145,7 +147,7 @@ async function showSepoliaTransfer() {
 }
 
 test("names no token, and states the amount in base units", async () => {
-    await showSepoliaTransfer();
+    await showTransfer(NETWORKS.sepolia.chainId);
     expect(state.currentView).toBe("approve-tx");
     expect(node("approve-tx-to").innerHTML).not.toContain("USDC");
     expect(decodedLine("Token")).toContain(
@@ -155,3 +157,13 @@ test("names no token, and states the amount in base units", async () => {
         '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
     );
 });
+
+// A transaction is named for its own network, not the active one.
+test("a mainnet transfer of USDC is still named and scaled as USDC", async () => {
+    await showTransfer(NETWORKS.mainnet.chainId);
+    expect(state.currentView).toBe("approve-tx");
+    expect(decodedLine("Token")).toContain('<div class="font-bold">USDC</div>');
+    expect(decodedLine("Amount")).toContain(
+        '<div class="font-bold">1234.5000 USDC</div>',
+    );
+});

tests/bundledListScreens.test.js

@@ -0,0 +1,81 @@
+// The token screen, the Send screen and the confirmation screen for the
+// contract at USDC's mainnet address. No address holds it and the user does
+// not track it, so only the bundled token list can name it.
+//
+// The bundled token list holds Ethereum Mainnet contracts, so these screens
+// name the token from it on Ethereum Mainnet only
+// (https://git.eeqj.de/sneak/AutistMask/issues/632). Driven through the real
+// popup over a stored profile.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+} = require("./support/popupBoot");
+
+const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// The popup reopened onto AddressToken for USDC's address, on `networkId`.
+function bootOnToken(networkId) {
+    return bootPopup(
+        unversionedValidProfile({
+            networkId,
+            currentView: "address-token",
+            viewStack: ["main", "address"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            selectedToken: USDC,
+        }),
+    );
+}
+
+// AddressToken's Send, then Review for 1 token to RECIPIENT.
+async function reviewSend(boot) {
+    await boot.click("btn-address-token-send");
+    expect(boot.visibleViews()).toEqual(["send"]);
+    boot.node("send-to").value = RECIPIENT;
+    boot.node("send-amount").value = "1";
+    await boot.click("btn-send-review");
+    expect(boot.visibleViews()).toEqual(["confirm-tx"]);
+}
+
+describe("on Ethereum Mainnet, the bundled list names the token", () => {
+    test("on the token screen", async () => {
+        const boot = await bootOnToken("mainnet");
+        expect(boot.visibleViews()).toEqual(["address-token"]);
+        expect(boot.text("address-token-title")).toContain("USDC");
+        const info = boot.node("address-token-contract-info").innerHTML;
+        expect(info).toContain(
+            '<span class="text-muted">Decimals:</span> 6</div>',
+        );
+    });
+
+    test("on the Send screen and the confirmation screen", async () => {
+        const boot = await bootOnToken("mainnet");
+        await reviewSend(boot);
+        expect(boot.text("send-balance")).toContain("USDC");
+        expect(boot.text("confirm-amount")).toContain("USDC");
+    });
+});
+
+describe("with Sepolia active, the bundled list does not name the token", () => {
+    test("on the token screen", async () => {
+        const boot = await bootOnToken("sepolia");
+        expect(boot.visibleViews()).toEqual(["address-token"]);
+        expect(boot.text("address-token-title")).not.toContain("USDC");
+        const info = boot.node("address-token-contract-info").innerHTML;
+        expect(info).not.toContain("Decimals:");
+    });
+
+    test("on the Send screen and the confirmation screen", async () => {
+        const boot = await bootOnToken("sepolia");
+        await reviewSend(boot);
+        expect(boot.text("send-balance")).not.toContain("USDC");
+        expect(boot.text("confirm-amount")).not.toContain("USDC");
+    });
+});

tests/refreshDuringRefresh.test.js

@@ -0,0 +1,157 @@
+// While a refresh runs, a request through ctx is not dropped. One more refresh
+// runs once the running one ends, however many were asked for in that time
+// (https://git.eeqj.de/sneak/AutistMask/issues/581). A tick of the ten-second
+// timer that finds a refresh running is dropped. Each test boots the real popup
+// over a stored profile and holds the ten-second refresh open. `readChain()`
+// sets each address's balance from `CHAIN`, as the real `refreshBalances()`
+// sets it from the node.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    ADDRESS,
+} = require("./support/popupBoot");
+const {
+    hdWalletFromMnemonic,
+    deriveAddressFromXpub,
+} = require("../src/shared/wallet");
+
+const PHRASE =
+    "abandon abandon abandon abandon abandon abandon " +
+    "abandon abandon abandon abandon abandon about";
+const PASSWORD = "correct horse battery staple";
+
+// The first two addresses of PHRASE, both used on the chain.
+const { xpub, firstAddress } = hdWalletFromMnemonic(PHRASE);
+const SECOND_ADDRESS = deriveAddressFromXpub(xpub, 1);
+
+// The ETH balance the chain holds for each address, in ether.
+const CHAIN = {
+    [ADDRESS]: "1.5",
+    [firstAddress]: "2.0",
+    [SECOND_ADDRESS]: "3.0",
+};
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// The balance stand-in for a refresh that returns.
+async function readChain(wallets) {
+    for (const wallet of wallets) {
+        for (const addr of wallet.addresses) {
+            addr.balance = CHAIN[addr.address];
+        }
+    }
+}
+
+// Boots the popup over a profile with one wallet. From then on,
+// `refreshBalances()` never returns unless the test answers it. So an unwanted
+// refresh is counted once and then waits, instead of starting more.
+async function boot() {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { refreshBalances } = require("../src/shared/balances");
+    refreshBalances.mockImplementation(() => new Promise(() => {}));
+    return { page, refreshBalances };
+}
+
+// Starts the ten-second refresh and holds it open until finish() is called.
+// The held refresh then writes the chain's balances. finish() resolves once
+// the held refresh has saved them and drawn Home. The one refresh after the
+// held one also returns.
+async function holdRefresh(page) {
+    const { refreshBalances } = require("../src/shared/balances");
+    let answer;
+    refreshBalances
+        .mockImplementationOnce(async (wallets) => {
+            await new Promise((resolve) => {
+                answer = resolve;
+            });
+            await readChain(wallets);
+        })
+        .mockImplementationOnce(readChain);
+    const ticking = page.tick();
+    await page.settle();
+    return {
+        finish: async () => {
+            answer();
+            await ticking;
+        },
+    };
+}
+
+// Imports PHRASE on AddWallet. Its address scan finds the phrase's first two
+// addresses.
+async function importPhrase(page) {
+    const { scanForAddresses } = require("../src/shared/balances");
+    scanForAddresses.mockImplementationOnce(async () => ({
+        addresses: [
+            { address: firstAddress, index: 0 },
+            { address: SECOND_ADDRESS, index: 1 },
+        ],
+        nextIndex: 2,
+    }));
+    await page.click("btn-add-wallet-bottom");
+    await page.click("tab-mnemonic");
+    page.node("wallet-mnemonic").value = PHRASE;
+    page.node("add-wallet-password").value = PASSWORD;
+    page.node("add-wallet-password-confirm").value = PASSWORD;
+    await page.click("btn-add-wallet-confirm");
+}
+
+// Imports the private key `key` on AddWallet.
+async function importKey(page, key) {
+    await page.click("btn-add-wallet-bottom");
+    await page.click("tab-privkey");
+    page.node("import-private-key").value = key;
+    page.node("add-wallet-password").value = PASSWORD;
+    page.node("add-wallet-password-confirm").value = PASSWORD;
+    await page.click("btn-add-wallet-confirm");
+}
+
+test("addresses that an import finds during a refresh show their balances once one more refresh returns", async () => {
+    const { page } = await boot();
+    const refresh = await holdRefresh(page);
+
+    await importPhrase(page);
+    expect(page.visibleViews()).toEqual(["main"]);
+    expect(page.text("flash-msg")).toBe("Found 2 addresses.");
+
+    await refresh.finish();
+    await page.settle();
+
+    const list = page.node("wallet-list").innerHTML;
+    expect(list).toContain("<span>2.0000</span>");
+    expect(list).toContain("<span>3.0000</span>");
+});
+
+test("several requests during a refresh lead to exactly one more refresh", async () => {
+    const { page, refreshBalances } = await boot();
+    const refresh = await holdRefresh(page);
+    const calls = refreshBalances.mock.calls.length;
+
+    await importKey(page, "0x" + "11".repeat(32));
+    await importKey(page, "0x" + "22".repeat(32));
+    await importPhrase(page);
+    expect(refreshBalances).toHaveBeenCalledTimes(calls);
+
+    await refresh.finish();
+    await page.settle();
+
+    expect(refreshBalances).toHaveBeenCalledTimes(calls + 1);
+});
+
+test("a tick of the ten-second timer during a refresh starts no other refresh", async () => {
+    const { page, refreshBalances } = await boot();
+    const refresh = await holdRefresh(page);
+    const calls = refreshBalances.mock.calls.length;
+
+    await page.tick();
+
+    await refresh.finish();
+    await page.settle();
+
+    expect(refreshBalances).toHaveBeenCalledTimes(calls);
+});

tests/resolveTokenSymbol.test.js

@@ -106,7 +106,19 @@ describe("resolveTokenSymbol", () => {
     test("rejects a tracked entry claiming a bundled ticker it is not", () => {
         // NOVEL_TOKEN is not the real USDC contract, so it may not wear USDC.
         state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
-        expect(resolveTokenSymbol(NOVEL_TOKEN, state)).toBeNull();
+        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
+        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBeNull();
+    });
+
+    // The bundled list holds mainnet contracts, so on Sepolia any contract may
+    // carry one of its symbols.
+    test("on Sepolia, reads a tracked entry carrying a bundled ticker", () => {
+        state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
+        const sources = {
+            chainId: "0xaa36a7",
+            trackedTokens: state.trackedTokens,
+        };
+        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBe("USDC");
     });
 
     test("rejects an explorer entry claiming the native ETH ticker", () => {

tests/symbolSpoof.test.js

@@ -72,6 +72,11 @@ const {
 const { renderSendTokenSelect } = require("../src/popup/views/send");
 const { state } = require("../src/shared/state");
 const { debugFetch } = require("../src/shared/log");
+const { NETWORKS } = require("../src/shared/networks");
+
+// The bundled list's symbols are known symbols only on Ethereum Mainnet.
+const MAINNET = NETWORKS.mainnet.chainId;
+const SEPOLIA = NETWORKS.sepolia.chainId;
 
 // The fake "Ethereum" token with symbol "ETH" from the attack documented in
 // README.md, given a holder count high enough to clear every other filter so
@@ -116,14 +121,29 @@ describe("the shared rule", () => {
     });
 
     test("a known symbol from its own contract is not a spoof", () => {
-        expect(isSpoofedSymbol("USDC", USDC_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase())).toBe(
-            false,
-        );
+        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, MAINNET)).toBe(false);
+        expect(
+            isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase(), MAINNET),
+        ).toBe(false);
     });
 
     test("a known symbol from another contract is a spoof", () => {
-        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT)).toBe(true);
+        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, MAINNET)).toBe(true);
+    });
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+    // mainnet contracts, so on Sepolia any contract may carry one of its
+    // symbols.
+    test("on Sepolia, a bundled symbol from any contract is not a spoof", () => {
+        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(false);
+        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, SEPOLIA)).toBe(false);
+    });
+
+    test("on Sepolia, the native asset's labels are still reserved", () => {
+        expect(isSpoofedSymbol("ETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(true);
+        expect(isSpoofedSymbol("SepoliaETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(
+            true,
+        );
     });
 
     test("a symbol that is not in the table is not judged here", () => {
@@ -164,7 +184,9 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     test("ASCII padding does not buy a pass", () => {
         expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
         expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT)).toBe(true);
+        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT, MAINNET)).toBe(
+            true,
+        );
     });
 
     test("non-breaking and other Unicode spaces do not either", () => {
@@ -243,7 +265,9 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 
     test("compatibility forms fold onto the symbol they imitate", () => {
         expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
+        expect(
+            isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT, MAINNET),
+        ).toBe(true);
     });
 
     // The two knowingly open classes, asserted here so that the boundary is
@@ -271,8 +295,10 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     });
 
     test("a genuine contract still bears its own padded symbol", () => {
-        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT, MAINNET)).toBe(false);
+        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT, MAINNET)).toBe(
+            false,
+        );
     });
 
     // Normalization must not invent a match.  Interior ASCII whitespace is
@@ -296,7 +322,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
             expect(symbol).toMatch(/^[!-~]+$/);
             if (addresses === null) continue;
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
             }
         }
     });
@@ -317,7 +343,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 describe("the shipped token list", () => {
     test("no bundled token is filtered at its own address", () => {
         const filtered = TOKENS.filter((t) =>
-            isSpoofedSymbol(t.symbol, t.address),
+            isSpoofedSymbol(t.symbol, t.address, MAINNET),
         ).map((t) => t.symbol + " @ " + t.address);
         expect(filtered).toEqual([]);
     });
@@ -360,7 +386,9 @@ describe("the shipped token list", () => {
         expect(shared.length).toBeGreaterThan(0);
         for (const [, list] of shared) {
             for (const t of list) {
-                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
+                expect(isSpoofedSymbol(t.symbol, t.address, MAINNET)).toBe(
+                    false,
+                );
             }
         }
     });
@@ -404,7 +432,7 @@ describe("the shipped token list", () => {
                 [...addresses].sort(),
             );
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
             }
         }
     });
@@ -421,7 +449,9 @@ describe("the shipped token list", () => {
         }
         for (const [symbol, list] of bySymbol) {
             if (list.length < 2) continue;
-            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
+            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT, MAINNET)).toBe(
+                true,
+            );
         }
     });
 });
@@ -506,10 +536,40 @@ describe("surface 2: the Send token selector", () => {
     }
 
     beforeEach(() => {
+        state.networkId = "mainnet";
         state.fraudContracts = [];
         state.hideLowHolderTokens = true;
     });
 
+    afterAll(() => {
+        state.networkId = "mainnet";
+    });
+
+    // A token reporting USDC's symbol from another contract.
+    function otherUsdc() {
+        return {
+            address: FAKE_ETH_CONTRACT,
+            symbol: "USDC",
+            decimals: 6,
+            balance: "12.5",
+            holders: 900000,
+        };
+    }
+
+    test("a bundled symbol from another contract is not selectable", () => {
+        render([otherUsdc()]);
+        expect(select.children).toEqual([]);
+    });
+
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+    // mainnet contracts, so on Sepolia any contract may carry its symbols.
+    test("with Sepolia active, a bundled symbol from another contract is selectable", () => {
+        state.networkId = "sepolia";
+        render([otherUsdc()]);
+        expect(select.children).toHaveLength(1);
+        expect(select.children[0].value).toBe(FAKE_ETH_CONTRACT);
+    });
+
     test("a fake ETH token is not selectable", () => {
         render([
             {
@@ -627,7 +687,12 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(
+            HOLDER,
+            BLOCKSCOUT,
+            [],
+            MAINNET,
+        );
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -641,11 +706,40 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(
+            HOLDER,
+            BLOCKSCOUT,
+            [],
+            MAINNET,
+        );
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+    // mainnet contracts, so on Sepolia any contract may carry its symbols.
+    test("a bundled symbol from another contract is listed on Sepolia only", async () => {
+        respondWith([fakeEthItem({ symbol: "USDC", decimals: "6" })]);
+        expect(
+            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], MAINNET),
+        ).toEqual([]);
+        const sepolia = await fetchTokenBalances(
+            HOLDER,
+            BLOCKSCOUT,
+            [],
+            SEPOLIA,
+        );
+        expect(sepolia).toHaveLength(1);
+        expect(sepolia[0].symbol).toBe("USDC");
+    });
+
+    test("a fake ETH token is filtered on Sepolia too", async () => {
+        respondWith([fakeEthItem()]);
+        expect(
+            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], SEPOLIA),
+        ).toEqual([]);
+    });
+
     // The trap in this change: the user's real ETH balance is not an ERC-20
     // and is fetched over RPC in refreshBalances, so it never passes through
     // this loop at all.  An explorer row that is not an ERC-20 is dropped

tests/trackedTokenBalances.test.js

@@ -133,13 +133,13 @@ function trackedRow(balance, decimals = null, holders = null) {
     };
 }
 
-async function refresh(addresses, trackedTokens) {
+async function refresh(addresses, trackedTokens, networkId = "mainnet") {
     await refreshBalances(
         [{ addresses }],
         RPC_URL,
         EXPLORER_URL,
         trackedTokens,
-        "mainnet",
+        networkId,
         new AbortController().signal,
     );
     return addresses;
@@ -307,3 +307,76 @@ test("a tracked token wearing a known symbol from another contract is not listed
     );
     expect(first.tokenBalances).toEqual([]);
 });
+
+// https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+// Ethereum Mainnet contracts. A token outside the tracked tokens with an
+// unknown holder count is listed only when the bundled list names it.
+test("an untracked bundled token with an unknown holder count is listed on Ethereum Mainnet only", async () => {
+    explorerRows = [explorerRow(USDC, "USDC", 5000000, null)];
+    const [mainnet] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [],
+    );
+    expect(mainnet.tokenBalances).toEqual([
+        {
+            address: USDC,
+            name: "USDC",
+            symbol: "USDC",
+            decimals: 6,
+            balance: "5.0",
+            holders: null,
+        },
+    ]);
+    const [sepolia] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [],
+        "sepolia",
+    );
+    expect(sepolia.tokenBalances).toEqual([]);
+});
+
+test("a tracked token at a bundled token's address takes the bundled scale on Ethereum Mainnet only", async () => {
+    holdings[USDC] = { [FIRST]: 5000000n };
+    // The tracked entry records no decimals, and Blockscout fails.
+    const tracked = [
+        { address: USDC, symbol: "USDC", name: "USD Coin", decimals: null },
+    ];
+    const row = (balance) => ({
+        address: USDC,
+        name: "USD Coin",
+        symbol: "USDC",
+        decimals: null,
+        balance: balance,
+        holders: null,
+    });
+    const [mainnet] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        tracked,
+    );
+    expect(mainnet.tokenBalances).toEqual([row("5.0")]);
+    const [sepolia] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        tracked,
+        "sepolia",
+    );
+    expect(sepolia.tokenBalances).toEqual([row(null)]);
+});
+
+test("with Sepolia active, a tracked token wearing a bundled symbol from another contract is listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ address: OTHER, symbol: "USDC", name: "Other", decimals: 6 }],
+        "sepolia",
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: OTHER,
+            name: "Other",
+            symbol: "USDC",
+            decimals: null,
+            balance: "5.0",
+            holders: null,
+        },
+    ]);
+});

tests/transactions.test.js

@@ -144,6 +144,7 @@ function tokenTx(overrides = {}) {
         isError: false,
         contractAddress: USDC_CONTRACT,
         holders: 3500000,
+        chainId: "0x1",
         ...overrides,
     };
 }
@@ -259,6 +260,32 @@ describe("known-symbol spoof verification", () => {
         expect(result.newFraudContracts).toEqual([NOVEL_SPAM_CONTRACT]);
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+    // mainnet contracts, so its symbols are not known symbols on Sepolia.
+    test("on Sepolia, a bundled symbol from another contract is kept", () => {
+        const sepoliaToken = tokenTx({
+            symbol: "USDC",
+            contractAddress: NOVEL_SPAM_CONTRACT,
+            holders: 5000000,
+            chainId: "0xaa36a7",
+        });
+        const result = filterTransactions([sepoliaToken], filters());
+        expect(result.transactions).toEqual([sepoliaToken]);
+        expect(result.newFraudContracts).toEqual([]);
+    });
+
+    test('on Sepolia, "ETH" as an ERC-20 is still spoofed', () => {
+        const fakeEth = tokenTx({
+            symbol: "ETH",
+            contractAddress: NOVEL_SPAM_CONTRACT,
+            holders: 5000000,
+            chainId: "0xaa36a7",
+        });
+        expect(filterTransactions([fakeEth], filters()).transactions).toEqual(
+            [],
+        );
+    });
+
     test("the genuine contract for that symbol is not spoofed", () => {
         const genuine = tokenTx();
         const result = filterTransactions([genuine], filters());