fix: count the network fee in the confirm-screen balance check (closes #154)

The Send button was enabled whenever the amount alone fit the balance, so
a max-value ETH send passed the confirmation screen and failed at
broadcast, after the user had committed to it.

The arithmetic moves into src/shared/txValidation.js as a pure function
over 18-decimal fixed point: native ETH now requires amount + fee <=
balance, and an ERC-20 transfer requires the ETH balance to cover the fee
on top of the token check, reported as its own error. Validation re-runs
when the async estimate resolves; Send stays disabled while the estimate
is pending and when it fails, so an unknown fee is never treated as zero.
The fee messages are static elements that already reserve their space, so
nothing moves when the estimate lands.

The fee reserved is the one the node will actually require. The send pins
no fee fields, so ethers broadcasts a type-2 transaction and the node
validates it against value + gasLimit * maxFeePerGas; gating on gasPrice
would under-reserve by roughly gasLimit * baseFee and let through exactly
the broadcast failure this change exists to prevent. feeReserveWei()
derives that reserve, falling back to gasPrice only where no type-2
pricing exists, and the fee shown on screen is the same figure so the
displayed number and the gate can never contradict each other.

validateTransfer() fails closed: a feeWei that is not a non-negative
bigint under FEE_KNOWN, and any unrecognised feeStatus, block exactly as
FEE_UNAVAILABLE does rather than counting as a fee of zero.

README.md

@@ -346,32 +346,17 @@ The core hierarchy is **Wallets → Addresses**:
       address scan on import, but imported from an extended private key rather
       than a recovery phrase. It therefore has no recovery phrase to display or
       back up.
-- An **address** holds ETH and ERC-20 tokens.
+- An **address** holds ETH and any user-added ERC-20 tokens.
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
-Which tokens an address shows is decided by `fetchTokenBalances()` in
-`src/shared/balances.js`, from the Blockscout `token-balances` response, so
-tokens do appear without the user adding them. An ERC-20 is shown when its
-balance is nonzero and it is in the bundled top-250 token list, is tracked by
-the user, or has 1,000 or more holders; a token claiming a symbol from the
-bundled list from any other contract address is always dropped. That filter is
-unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
-the transaction history and the send-screen token selector, not this list.
-Tracked tokens with a zero balance are listed as well while "Show tracked tokens
-with zero balance" is on.
-
 #### Navigation
 
 The main view shows all addresses grouped by wallet, with ETH balances inline.
 The user taps an address to see its detail view (full address, balance, tokens,
-send/receive). Navigation is a stack: each forward action pushes the current
-screen, and every view has a "Back" or "Cancel" button that pops back to it (see
-the Screen Map below). There is no hamburger menu and no persistent tab bar; the
-Settings gear in the title bar is the only global control. Two screens carry an
-in-screen control beyond that: AddWallet uses three tabs to select the import
-mode, and AddressDetail keeps its one rarely-used action ("Export Private Key")
-behind a "···" menu.
+send/receive). Navigation is flat — every view has a "Back" or "Cancel" button
+that returns to the previous context. No deep nesting, no tabs, no hamburger
+menus.
 
 ### Screen Map
 
@@ -408,7 +393,7 @@ screen, including ExportPrivKey, falls back to Home.
 - **When**: At least one wallet exists. This is the root screen.
 - **Elements**:
     - Active address ETH balance (large) + USD value in parentheses
-    - "Total:" USD value across ETH and every token shown for the active address
+    - "Total:" USD value across ETH and all tracked tokens of the active address
     - Active address (color dot, full address, etherscan link, tap to copy)
     - Send / Receive quick-action buttons, both acting on the active address
     - ETH/USD price display
@@ -416,7 +401,7 @@ screen, including ExportPrivKey, falls back to Home.
       button for HD and xprv wallets, then one block per address with "Address
       N" (bold when active), the ENS name if resolved, the full address, an
       `[info]` button, the address USD total, and a balance line for ETH and for
-      each token shown for that address
+      each tracked token
     - "Recent Transactions": up to 25 transactions merged across every address
       of every wallet, deduplicated by hash and filtered
     - "Add additional wallet..." link at bottom
@@ -469,8 +454,8 @@ screen, including ExportPrivKey, falls back to Home.
     - ENS name (if resolved, bold above the address)
     - Full address (color dot, etherscan link, tap to copy)
     - USD total for address
-    - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
-      places, USD inline). Each balance row is clickable → **AddressToken**
+    - Balance list: ETH + tracked ERC-20 tokens (4 decimal places, USD inline).
+      Each balance row is clickable → **AddressToken**
     - Send / Receive / + Token buttons and a "···" menu button
     - "···" dropdown containing a single "Export Private Key" entry
     - Transaction list (with ENS resolution for counterparties)
@@ -879,7 +864,7 @@ communicates with three external services to function as a wallet:
 What the extension does NOT do:
 
 - No analytics or telemetry services
-- No token list APIs (the top-250 token list is bundled at build time)
+- No token list APIs (user adds tokens manually by contract address)
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
@@ -1002,8 +987,7 @@ hardcoded test phrase.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
-- View ERC-20 token balances (bundled top-250 tokens, tokens with 1,000 or more
-  holders, and tokens the user adds by contract address)
+- View ERC-20 token balances (user adds token by contract address)
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)
@@ -1149,8 +1133,7 @@ Currently supported:
 - Built in token swaps (use a DEX in the browser)
 - Analytics, telemetry, or tracking of any kind
 - Advertisements or promotions
-- Obscure token list auto-discovery — nothing outside the bundled list, the
-  1,000-holder floor, and the tokens the user added by contract address
+- Obscure token list auto-discovery (user adds tokens manually)
     - We detect common/popular ERC20s in the basic case
 - Fiat on/off ramps
 - Extensive transaction decoding/parsing
@@ -1208,17 +1191,13 @@ covered by the GPL-3.0 license above. These files, their copyright holders, and
 their licenses are:
 
 | File                                                       | Source                                                                                                                    | Copyright                         | License                                                        |
-| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
-| `src/shared/phishingBlocklist.json`                        | `eth-phishing-detect` community-maintained phishing domain blocklist, vendored from its `src/config.json` | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
+| `src/shared/phishingBlocklist.json`                        | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
 | `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`                               | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
 | `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                                         | Copyright (c) 2018 Luit Hollander | MIT                                                            |
 
 The full license texts for these third-party files are included in the
-[LICENSE](LICENSE) file. The `eth-phishing-detect` row carries no repository
-link because the upstream is hosted under a competitor's organization name,
-which project policy keeps out of code and documentation; the vendored copy and
-the runtime refresh both come from that upstream, whose URL is the
-`BLOCKLIST_URL` constant in `src/shared/phishingDomains.js`.
+[LICENSE](LICENSE) file.
 
 ## Author
 

TODO.md

@@ -49,9 +49,6 @@ undefined identifiers, which is how
   transaction, with the arithmetic in a pure, unit-tested
   `src/shared/txValidation.js`
   ([#154](https://git.eeqj.de/sneak/AutistMask/issues/154)).
-- 2026-08-11: Three `README.md` claims corrected against the code — blocklist
-  attribution, token-display rule, navigation model
-  ([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
 - 2026-08-11: README Screen Map rebuilt from the code — every screen, element
   and transition re-verified against `src/popup/`
   ([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).