fix: answer the page when a background handler throws (closes #280)

handleRpc(...).then(sendResponse) had no .catch(), and sendResponse is the only
thing that settles the dApp's window.ethereum.request() promise. Any throw
inside handleRpc therefore sent nothing back: the content script posted nothing,
and the page's promise stayed pending forever with no error and no timeout,
indistinguishable from a slow wallet. handleRpc does real work -- state loads,
provider calls, transaction population, approval plumbing -- so "it does not
throw today" was not a property anyone was maintaining.

A rejected handleRpc now answers { code: -32603, message }. -32603 is the
JSON-RPC internal error EIP-1474 defines and EIP-1193 defers to for RPC-layer
failures; no EIP-1193 4xxx code describes "the wallet broke" and none was
invented for it. The cause is not put in the message: the page gets a stable
sentence, the background console gets the method and the throw, so the failure
is visible rather than swallowed.

The two async IIFEs behind AUTISTMASK_TX_RESPONSE and AUTISTMASK_SIGN_RESPONSE
are the same shape one level down. Every statement is inside a try, but a throw
from one of the catch blocks escapes as an unhandled rejection and neither the
popup nor the page is answered. Each gets a last-resort .catch() that settles
the approval through settleApproval() -- the existing chokepoint, with no new
delete or resolve -- and answers the popup. The transaction one reports the
broadcast stage, because it cannot tell whether the transaction reached the
network and that is the wording that does not invite a second send. Every other
message handler on the path is synchronous and cannot leave a promise pending.

Each of the three is driven by a real failure rather than a hook in the handler:
a rejecting extension-storage read, which getState() awaits unguarded, and a
failure classifier that throws while classifying a genuine verification failure.
All three were demonstrated failing against the unfixed code, the RPC one with
sendResponse at zero calls, which is precisely the page-side hang.

README.md

@@ -169,6 +169,34 @@ reserve while sitting on the same side of the estimate, so swapping the two in
 what [#154](https://git.eeqj.de/sneak/AutistMask/issues/154) was, and it was
 previously correct by reading only.
 
+It also covers the **dApp approval round trips** — the one place where the
+content script, the inpage provider, the background worker and the approval
+popup all have to work together. A local test page is served by the route
+handler on a reserved-TLD origin, gets `window.ethereum` from the shipped
+`MAIN`-world content script like any other page, and drives
+`eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
+`eth_sendTransaction` through the real prompts. Every signature is recovered in
+the runner and compared against the active address, the transaction assertions
+run against the raw signed transaction captured at `eth_sendRawTransaction`
+rather than against anything the extension reported, rejecting each prompt is
+required to return a rejection to the page rather than hang or resolve, and the
+password is required to be absent from every message the approval window sends
+to the background — with the message that would carry it required to be present,
+so that check cannot pass by observing nothing. That last one is the standing
+floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
+
+Three limits of that coverage, none of them papered over. The RPC is stubbed
+throughout, so this is **not** a real dApp against a real network with real
+funds; that remains a human pass before 1.0.0. The site-connection prompt is
+raised through `chrome.action.openPopup()`, and headless Chromium's
+browser-action popup is not a page Playwright can see or click, so that one
+prompt is driven at the URL the extension itself puts on the action — the same
+page and the same approval id, but whether a real toolbar click shows it is not
+observable here. And the EIP-1193 error code does not survive the last hop: the
+rejection that crosses the boundary carries code 4001 and is asserted to, but
+`src/content/inpage.js` rebuilds it as `new Error(message)`, so the calling page
+catches an error with no `code` property.
+
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
 consumes exactly one matching record, and a declaration nothing matched fails

TODO.md

@@ -45,6 +45,64 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-14: A background message handler that throws now rejects the page
+  instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
+  and `sendResponse` is the only thing that settles the dApp's
+  `window.ethereum.request()` promise — so any throw inside `handleRpc` left
+  that promise pending forever, with no error and no timeout, indistinguishable
+  from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
+  internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
+  describes "the wallet broke" and none was invented) and logs the method and
+  the throw to the background console rather than swallowing them. The two async
+  IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
+  same shape one level down — every statement inside a `try`, but a throw out of
+  a `catch` block escaping unhandled — and each got a last-resort `.catch()`
+  settling the approval through `settleApproval()` and answering the popup; the
+  transaction one reports the broadcast stage, because it cannot tell whether
+  the transaction reached the network. Every other handler on the path is
+  synchronous. All three are driven by real failures — a rejecting storage read,
+  and a failure classifier that throws while classifying a genuine verification
+  failure — and were demonstrated failing first, the RPC one with `sendResponse`
+  at zero calls ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
+- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
+  rebuilt every failure as `new Error(error.message)`, so the code the
+  background produced and the content script relayed intact was dropped in the
+  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
+  the user deliberately declined was indistinguishable from one that broke. The
+  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
+  boundary sent one, `data`, passed through verbatim rather than matched against
+  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
+  here. An error the background sent with no code stays a plain `Error` with no
+  `code` property, and `message` is unchanged in every case. All four request
+  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
+  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
+  now requires it on the page's Error as well as on the wire, for all four
+  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
+- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
+  that bear it, not to one of them. A ticker is not unique: seven of the 512
+  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
+  share a symbol with another bundled entry at a different real contract, and
+  the table, built from the list first-wins, kept only the earlier one. The
+  other seven were judged spoofs of their own symbol at their own address and
+  hidden from the balance list, the history and the send selector, so a holder
+  could not spend them. Both contracts of each pair come from the same CoinGecko
+  fetch of 2026-02-27, so neither was stale and neither was dropped.
+  `isSpoofedSymbol()` asks set membership instead of equality, which does not
+  loosen the rule — a contract outside the set is still a spoof — and a test now
+  walks `TOKENS` asserting no bundled token is filtered at its own address,
+  which is the walk the suite lacked
+  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
+- 2026-08-12: The dApp approval round trips are driven end to end in the
+  browser. A test page served by the harness speaks EIP-1193 to the real inpage
+  provider through the real content script, background worker and approval popup
+  for `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
+  `eth_sendTransaction`. Every signature is recovered and compared against the
+  active address, the transaction is checked against the bytes handed to the
+  stubbed RPC, each rejection must reach the page as a rejection, and the
+  password must appear in no message the approval window sends — the assertion
+  that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
+  floor. This does not discharge a real dApp with real funds against mainnet
+  ([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
 - 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
   sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
   character that paints nothing removed (the format and default-ignorable

src/background/index.js

@@ -57,6 +57,16 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
+// What the page is told when a request failed in a way the wallet has no
+// specific answer for. -32603 is the JSON-RPC internal error EIP-1474 defines
+// and EIP-1193 defers to for RPC-layer failures; no EIP-1193 4xxx code
+// describes "the wallet broke", and one is not invented here. The cause is
+// logged rather than put in the message: the page gets a stable sentence, the
+// background console gets the throw.
+const INTERNAL_ERROR_CODE = -32603;
+const INTERNAL_ERROR_MESSAGE =
+    "AutistMask could not complete this request because of an internal error.";
+
 async function getState() {
     const result = await storageApi.get("autistmask");
     return (
@@ -865,8 +875,25 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // keep fallback
             }
         }
-        handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
+        handleRpc(msg.method, msg.params, trustedOrigin)
+            .then((response) => {
                 sendResponse(response);
+            })
+            .catch((err) => {
+                // Without this the page's window.ethereum.request() promise
+                // stays pending forever: no response is sent, the content
+                // script posts nothing back, and the dApp cannot tell the
+                // failure from a slow wallet. handleRpc does real work —
+                // state loads, provider calls, transaction population — so
+                // "it does not throw today" is not a property anyone is
+                // maintaining.
+                log.errorf("RPC request failed:", msg.method, err);
+                sendResponse({
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                });
             });
         return true;
     }
@@ -1051,7 +1078,31 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     stage: TX_STAGE_BROADCAST,
                 });
             }
-        })();
+        })().catch((e) => {
+            // Every statement above is inside a try, but a throw from one of
+            // the catch blocks escapes as an unhandled rejection and neither
+            // the popup nor the page is ever answered. Settle both, through
+            // the same chokepoint as every other retirement. The stage is
+            // broadcast because this cannot tell whether the transaction
+            // reached the network, and that is the wording that does not
+            // invite a second send.
+            log.errorf("transaction approval response failed:", e);
+            settleApproval(
+                msg.id,
+                {
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                },
+                { holdsClaim: true },
+            );
+            sendResponse({
+                error: INTERNAL_ERROR_MESSAGE,
+                retryable: false,
+                stage: TX_STAGE_BROADCAST,
+            });
+        });
         return true;
     }
 
@@ -1135,7 +1186,25 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 }
                 sendResponse({ error: errMsg, retryable });
             }
-        })();
+        })().catch((e) => {
+            // Same shape as the transaction path: a throw out of the catch
+            // block above would leave the popup and the page both waiting.
+            log.errorf("sign approval response failed:", e);
+            settleApproval(
+                msg.id,
+                {
+                    error: {
+                        code: INTERNAL_ERROR_CODE,
+                        message: INTERNAL_ERROR_MESSAGE,
+                    },
+                },
+                { holdsClaim: true },
+            );
+            sendResponse({
+                error: INTERNAL_ERROR_MESSAGE,
+                retryable: false,
+            });
+        });
         return true;
     }
 

src/content/inpage.js

@@ -11,6 +11,39 @@
     let nextId = 1;
     const pending = {};
 
+    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
+    // rather than properties bolted onto an Error because this object crosses
+    // no boundary after construction — it is built in the page's own realm and
+    // handed straight to the caller's catch — so the prototype survives and
+    // `error.name` is a stable thing for a dApp to see.
+    class ProviderRpcError extends Error {
+        constructor(code, message, data) {
+            super(message);
+            this.name = "ProviderRpcError";
+            this.code = code;
+            if (data !== undefined) this.data = data;
+        }
+    }
+
+    // Rebuild a boundary error as the error the page catches, carrying the
+    // code (and data) the extension reported. Without this a dApp cannot tell
+    // a user's refusal (4001) from a wallet that broke, and retries or shows
+    // an error instead of accepting the refusal.
+    //
+    // Whatever code arrived is passed through verbatim rather than being
+    // matched against a list: the extension emits 4001, 4100 and 4902 today,
+    // and a code this file has never heard of is still the truth about what
+    // happened. An error reported with no code at all stays a plain Error —
+    // a ProviderRpcError whose `code` is undefined would advertise a
+    // conformance it does not have. `message` is untouched in every case.
+    function toPageError(error) {
+        const message = (error && error.message) || "Request failed";
+        if (error && error.code !== undefined && error.code !== null) {
+            return new ProviderRpcError(error.code, message, error.data);
+        }
+        return new Error(message);
+    }
+
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -20,7 +53,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(new Error(error.message || "Request failed"));
+            p.reject(toPageError(error));
         } else {
             p.resolve(result);
         }

src/shared/symbolSpoof.js

@@ -8,12 +8,19 @@
 // either verdict alone, because the balance list is where the user forms
 // their belief about what they own (issue #235).
 //
-// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
+// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
-// bear it, or to null.  Null means the symbol belongs to the native asset,
+// that may bear it, or to null.  Null means the symbol belongs to the native
-// which has no contract at all, so no contract may bear it and every one
+// asset, which has no contract at all, so no contract may bear it and every
-// that does is a spoof.  "ETH" is the only such entry today; the rule is
+// one that does is a spoof.  "ETH" is the only such entry today; the rule is
 // written so that a second one needs no change here or at any call site.
 //
+// The value is a set because a ticker is not unique: seven symbols in the
+// bundled list belong to two real contracts each, and answering with one of
+// them hid the other one's holders' money (issue #276).  Membership, not
+// equality, is therefore the question — but it is the same question, asked of
+// a table that can now state the truth.  Every address in a set is one the
+// wallet ships as a real token; a contract outside the set is still a spoof.
+//
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
 // question is whether the symbol reaches the user's eye as a known one,
@@ -93,7 +100,7 @@ function isSpoofedSymbol(symbol, contractAddress) {
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
-    return contract !== normalizeAddress(legit);
+    return !legit.has(contract);
 }
 
 module.exports = {

src/shared/tokenList.js

@@ -3607,14 +3607,33 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
+// Build a map of symbol (uppercased) -> the set of contract addresses
-// Used for spoofed-symbol detection. "ETH" maps to null (native token).
+// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
+// "ETH" maps to null: the native asset has no contract, so no contract may
+// bear its symbol.
+//
+// The value is a set and not a single address because tickers are not unique
+// and the list above proves it: seven of these 512 tokens share a symbol with
+// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
+// different real contracts each, all of them from the same source fetch.  A
+// one-address-per-symbol table can only answer that by picking a winner, and
+// the loser is then a token in our own bundled list that the spoof filter
+// hides from the balance list, the history and the send selector at its own
+// address, so the user cannot spend it (issue #276).  Naming every address
+// that bears the symbol is the only shape that says what is true; it does not
+// loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
     const upper = t.symbol.toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
+        KNOWN_SYMBOLS.set(upper, new Set());
+    }
+    const addresses = KNOWN_SYMBOLS.get(upper);
+    // A null entry is the native asset and stays null: an ERC-20 that reports
+    // the native symbol does not thereby become entitled to it.
+    if (addresses !== null) {
+        addresses.add(t.address.toLowerCase());
     }
 }
 

tests/backgroundApproval.test.js

@@ -133,6 +133,14 @@ function loadBackground(options) {
         ensureRecurringAlarms: jest.fn(async () => {}),
         registerAlarmHandlers: jest.fn(),
     }));
+    // The real verification module, except where a test replaces one export
+    // with a throw to drive the handler's own error handling into failing.
+    if (opts.approvalVerify) {
+        jest.doMock("../src/shared/approvalVerify", () => ({
+            ...jest.requireActual("../src/shared/approvalVerify"),
+            ...opts.approvalVerify,
+        }));
+    }
 
     const persisted = {
         wallets: [
@@ -152,7 +160,10 @@ function loadBackground(options) {
     global.chrome = {
         storage: {
             local: {
-                get: jest.fn(async () => ({ autistmask: persisted })),
+                get: jest.fn(
+                    opts.storageGet ||
+                        (async () => ({ autistmask: persisted })),
+                ),
                 set: jest.fn(async () => {}),
             },
         },
@@ -280,6 +291,25 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
+// Node aborts the worker process on an unhandled rejection; an extension
+// service worker does not — the promise is simply never settled, nothing is
+// sent back, and the page's window.ethereum.request() waits forever. Recording
+// them instead of dying on them keeps that difference visible: the assertion
+// that the page WAS answered is what reports the failure, and the recording is
+// asserted empty alongside it.
+const unhandledRejections = [];
+process.on("unhandledRejection", (reason) => {
+    unhandledRejections.push(reason);
+});
+
+// Node reports an unhandled rejection on the macrotask turn after the promise
+// was left unhandled, which is past everything settle() waits for.
+async function settleIncludingRejections() {
+    await settle();
+    await new Promise((resolve) => setImmediate(resolve));
+    await new Promise((resolve) => setImmediate(resolve));
+}
+
 afterEach(() => {
     delete global.chrome;
     jest.resetModules();
@@ -1034,6 +1064,147 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 });
 
+// A handler that throws must still answer. `sendResponse` is the only thing
+// that settles the page's window.ethereum.request() promise, so a throw that
+// escapes a handler leaves that promise pending forever — no error, no
+// timeout, indistinguishable from a slow wallet. Each case below drives a real
+// throw out of a handler rather than asserting the catch block exists.
+describe("a handler that throws still settles the page", () => {
+    const INTERNAL_ERROR = {
+        code: -32603,
+        message:
+            "AutistMask could not complete this request because of an internal error.",
+    };
+
+    let errorLog;
+    beforeEach(() => {
+        errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
+        unhandledRejections.length = 0;
+    });
+    afterEach(() => {
+        errorLog.mockRestore();
+    });
+
+    // getState() awaits extension storage unguarded, and every read path in
+    // handleRpc goes through it. A storage read that rejects is the whole
+    // failure — no hook in the handler itself.
+    test("a rejected handleRpc rejects the page instead of hanging it", async () => {
+        const bg = loadBackground({
+            storageGet: async () => {
+                throw new Error("storage unavailable");
+            },
+        });
+
+        const answer = bg.send(
+            { type: "AUTISTMASK_RPC", method: "eth_accounts", params: [] },
+            { origin: ORIGIN },
+        );
+        await settleIncludingRejections();
+
+        // The channel is held open for the async answer, and the answer
+        // arrives.
+        expect(answer.kept).toBe(true);
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR,
+        });
+        expect(unhandledRejections).toEqual([]);
+        // Not swallowed: the throw is on the background console, which is how
+        // this class gets caught in future.
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "RPC request failed:",
+            "eth_accounts",
+            expect.objectContaining({ message: "storage unavailable" }),
+        );
+    });
+
+    // The transaction response handler wraps every statement in a try, so what
+    // escapes it is a throw from inside one of its catch blocks. Here the
+    // failure classifier itself throws while classifying a real verification
+    // failure — the approval is left claimed, so nothing else can settle it.
+    test("a throw while handling a failed transaction settles both the page and the popup", async () => {
+        const bg = loadBackground({
+            approvalVerify: {
+                describeTxFailure: () => {
+                    throw new Error("classifier broke");
+                },
+            },
+        });
+        const pending = bg.requestTx();
+        await settle();
+        const id = pending.id();
+
+        // A real verification failure: the artifact is signed at a nonce the
+        // approval never displayed.
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_TX_RESPONSE",
+                id,
+                approved: true,
+                rawSignedTx: await signedAtNonce(NONCE + 1),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settleIncludingRejections();
+
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR.message,
+            retryable: false,
+            // The handler cannot tell whether the transaction reached the
+            // network, so the popup must not say "start again from the site".
+            stage: "broadcast",
+        });
+        expect(unhandledRejections).toEqual([]);
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "transaction approval response failed:",
+            expect.objectContaining({ message: "classifier broke" }),
+        );
+    });
+
+    test("a throw while handling a failed signature settles both the page and the popup", async () => {
+        const bg = loadBackground({
+            approvalVerify: {
+                failureIsRetryable: () => {
+                    throw new Error("classifier broke");
+                },
+            },
+        });
+        const pending = bg.requestSign();
+        await settle();
+
+        // A real verification failure: the active address moved after the
+        // approval was raised.
+        bg.setActiveAddress(other.address);
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_SIGN_RESPONSE",
+                id: pending.id(),
+                approved: true,
+                signature: await signer.signMessage(
+                    Buffer.from(MESSAGE.slice(2), "hex"),
+                ),
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settleIncludingRejections();
+
+        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: INTERNAL_ERROR.message,
+            retryable: false,
+        });
+        expect(unhandledRejections).toEqual([]);
+        expect(errorLog).toHaveBeenCalledWith(
+            "[AutistMask]",
+            "sign approval response failed:",
+            expect.objectContaining({ message: "classifier broke" }),
+        );
+    });
+});
+
 describe("popup-only messages", () => {
     test("a page sender cannot answer an approval", async () => {
         const bg = loadBackground();

tests/e2e/network.js

@@ -23,6 +23,8 @@
 
 "use strict";
 
+const { Transaction } = require("ethers");
+
 // Fictional ERC-20 used to seed the transaction-detail test. The symbol
 // must not collide with any entry in src/shared/tokenList.js, or
 // isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
@@ -62,6 +64,87 @@ function word(value) {
     return "0x" + BigInt(value).toString(16).padStart(64, "0");
 }
 
+// -------------------------------------------------------- dApp fixture
+//
+// The origin the EIP-1193 test page is served from, and the page itself.
+//
+// It is a fixture like every other one in this file: the route handler
+// fulfils the navigation from the string below, so the page never comes
+// from a remote origin and nothing about the dApp round trips leaves the
+// container. `.test` is reserved by RFC 6761 and has no owner to reach in
+// the first place; the launch arguments map every host to NOTFOUND anyway.
+//
+// What the page deliberately does NOT do is load a provider. window.ethereum
+// is put there by the shipped manifest's MAIN-world content script, exactly
+// as it is on any http(s) page a user visits, so what these tests speak to
+// is the real inpage provider and not a copy the harness wired up.
+const DAPP_ORIGIN = "https://dapp.e2e.test";
+const DAPP_URL = DAPP_ORIGIN + "/";
+
+// Requests are parked rather than awaited. An approval prompt only exists
+// while its call is in flight, so a test that awaited the promise could
+// never drive the popup that has to settle it; start() files the promise
+// under a key and settle() collects it once the prompt has been dealt with.
+//
+// The rejection branch records the whole observable shape of the error as it
+// arrives — name, message, and whether a `code` is present at all as distinct
+// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// carrying code 4001; what the page can actually see is recorded here rather
+// than assumed, and asserted in run.js.
+//
+// The message log is the page's half of the boundary observation: every
+// AUTISTMASK_* message that crosses between this page and the content
+// script, in both directions, verbatim.
+const DAPP_HTML = [
+    "<!doctype html>",
+    '<html lang="en">',
+    "<head>",
+    '<meta charset="utf-8">',
+    "<title>AutistMask e2e dApp</title>",
+    // Inline and empty: without it Chromium asks for /favicon.ico, which
+    // the unstubbed-request guard would report as escaping traffic.
+    '<link rel="icon" href="data:,">',
+    "</head>",
+    "<body>",
+    "<h1>AutistMask e2e dApp</h1>",
+    "<script>",
+    "window.__dapp = {",
+    "    messages: [],",
+    "    calls: {},",
+    "    start: function (key, method, params) {",
+    "        window.__dapp.calls[key] = window.ethereum",
+    "            .request({ method: method, params: params })",
+    "            .then(",
+    "                function (result) {",
+    "                    return { settled: 'resolved', result: result };",
+    "                },",
+    "                function (error) {",
+    "                    return {",
+    "                        settled: 'rejected',",
+    "                        message: String((error && error.message) || error),",
+    "                        name: error ? error.name : undefined,",
+    "                        hasCode: !!error && 'code' in Object(error),",
+    "                        code: error ? error.code : undefined,",
+    "                    };",
+    "                },",
+    "            );",
+    "    },",
+    "    settle: function (key) {",
+    "        return window.__dapp.calls[key];",
+    "    },",
+    "};",
+    "window.addEventListener('message', function (event) {",
+    "    if (event.source !== window) return;",
+    "    var d = event.data;",
+    "    if (!d || typeof d.type !== 'string') return;",
+    "    if (d.type.indexOf('AUTISTMASK') !== 0) return;",
+    "    window.__dapp.messages.push(d);",
+    "});",
+    "</script>",
+    "</body>",
+    "</html>",
+].join("\n");
+
 // ------------------------------------------------------------ fee fixture
 //
 // The confirmation screen carries two different numbers for the same
@@ -101,6 +184,11 @@ const RPC_RESULTS = {
     eth_estimateGas: hex(GAS_LIMIT),
     eth_getTransactionCount: "0x0",
     eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
+    // "not mined yet", which is what a node answers for a transaction it has
+    // only just accepted. The wait screen the dApp transaction approval hands
+    // off to polls this every 10 seconds; leaving it unstubbed would report
+    // the poll as escaping traffic the moment a test outlived one tick.
+    eth_getTransactionReceipt: null,
 };
 
 // The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
@@ -264,6 +352,31 @@ function rpcReply(req, opts, report) {
     if (req.method === "eth_getBlockByNumber") {
         return Object.assign(envelope, { result: latestBlock() });
     }
+    // The end of the dApp transaction round trip: the raw signed transaction
+    // the background hands to the node. It is recorded verbatim so a test can
+    // recover the signer from the exact bytes that were broadcast, rather than
+    // from anything the extension reported about them.
+    //
+    // The reply must be the transaction's real hash. ethers compares the hash
+    // the node returns against the one it computes itself and throws on a
+    // mismatch, so a constant here would fail the broadcast for a reason that
+    // has nothing to do with what is being tested.
+    if (req.method === "eth_sendRawTransaction") {
+        const raw = Array.isArray(req.params) ? req.params[0] : null;
+        let parsed;
+        try {
+            parsed = Transaction.from(raw);
+        } catch {
+            report("eth_sendRawTransaction with an undecodable transaction");
+            return Object.assign(envelope, {
+                error: { code: -32000, message: "undecodable transaction" },
+            });
+        }
+        if (Array.isArray(opts.broadcastTransactions)) {
+            opts.broadcastTransactions.push(raw);
+        }
+        return Object.assign(envelope, { result: parsed.hash });
+    }
     if (req.method === "eth_estimateGas" && opts.failGasEstimate) {
         // A refusal the node itself would produce, not a transport error:
         // this is the shape the confirmation screen has to turn into
@@ -375,6 +488,8 @@ function traceEnabled(raw) {
  *   node-side refusal.
  * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
  *   eth_estimateGas until this is cleared again.
+ * @param {string[]} [opts.broadcastTransactions]  every raw signed
+ *   transaction handed to eth_sendRawTransaction, appended in order.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -420,6 +535,18 @@ async function installNetworkStubs(ctx, opts) {
             return handleRpc(route, req.postData(), opts, report);
         }
 
+        // The local EIP-1193 test page. Served from here so the dApp round
+        // trips run against a real http(s) origin — which is what makes the
+        // shipped content scripts inject at all — without any remote origin
+        // being involved.
+        if (url.origin === DAPP_ORIGIN && p === "/") {
+            return route.fulfill({
+                status: 200,
+                contentType: "text/html; charset=utf-8",
+                body: DAPP_HTML,
+            });
+        }
+
         // Blockscout v2
         if (p.includes("/api/v2/")) {
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
@@ -508,6 +635,8 @@ async function installNetworkStubs(ctx, opts) {
 
 module.exports = {
     installNetworkStubs,
+    DAPP_ORIGIN,
+    DAPP_URL,
     FEE_ESTIMATE_WEI,
     FEE_RESERVE_WEI,
     STUB_COUNTERPARTY,

tests/inpageErrors.test.js

@@ -0,0 +1,310 @@
+// The EIP-1193 error the page actually catches (src/content/inpage.js).
+//
+// The bug this pins down (issue #274): the provider rebuilt every failure as
+// `new Error(error.message)`, so the `code` the background produced and the
+// content script relayed intact was thrown away in the last hop. A dApp
+// checking `err.code === 4001` — the standard way to tell "the user said no"
+// from "the wallet broke" — saw undefined, and well-behaved sites showed an
+// error or retried instead of accepting the refusal.
+//
+// inpage.js is a bare IIFE injected into the page's JS context, not a module:
+// it takes no import and exports nothing, and reaches for `window` at load.
+// So it is evaluated here the way the browser evaluates it, against a stub
+// window, and the provider is collected from `window.ethereum`. The globals it
+// touches are passed in as function parameters rather than assigned to
+// globalThis: nothing leaks between tests, and the source is compiled in this
+// realm, so the errors it constructs are comparable against this file's own
+// `Error` — which a second realm's intrinsics would silently defeat.
+//
+// There is no jsdom in this repo; see tests/txStatus.test.js.
+
+const fs = require("fs");
+const path = require("path");
+const { webcrypto } = require("crypto");
+
+const SOURCE = fs.readFileSync(
+    path.join(__dirname, "..", "src", "content", "inpage.js"),
+    "utf8",
+);
+
+const loadInto = new Function(
+    "window",
+    "self",
+    "crypto",
+    "Event",
+    "CustomEvent",
+    SOURCE,
+);
+
+class StubEvent {
+    constructor(type) {
+        this.type = type;
+    }
+}
+
+class StubCustomEvent extends StubEvent {
+    constructor(type, init) {
+        super(type);
+        this.detail = init && init.detail;
+    }
+}
+
+// Every code the background emits on the RPC path today, read out of
+// src/background/index.js. The provider must not know this list — it passes
+// through whatever arrived — but the cases below are the real ones.
+const REJECTED = 4001; // user rejected the request
+const UNAUTHORIZED = 4100; // site not connected / wrong address
+const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
+
+// A stub window with the four things inpage.js touches: message listeners,
+// postMessage out to the content script, window.ethereum, and dispatchEvent
+// for the EIP-6963 announcement.
+function loadProvider() {
+    const messageListeners = [];
+    const posted = [];
+
+    const win = {
+        addEventListener(type, fn) {
+            if (type === "message") messageListeners.push(fn);
+        },
+        removeEventListener(type, fn) {
+            const i = messageListeners.indexOf(fn);
+            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
+        },
+        postMessage(data) {
+            posted.push(data);
+        },
+        dispatchEvent() {
+            return true;
+        },
+    };
+    win.window = win;
+
+    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
+
+    // Deliver the content script's answer to an outstanding request. The id is
+    // read back off the wire rather than assumed: inpage.js issues its own
+    // eth_chainId at load, so the first id a test sees is not 1.
+    function respond(response) {
+        const request = posted
+            .filter((m) => m.type === "AUTISTMASK_REQUEST")
+            .pop();
+        expect(request).toBeDefined();
+        const event = {
+            source: win,
+            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
+        };
+        for (const fn of messageListeners.slice()) fn(event);
+    }
+
+    return { provider: win.ethereum, posted, respond };
+}
+
+// Start a request, answer it with `response`, and hand back the rejection.
+// Fails the test if the call resolves instead.
+async function rejectionFrom(start, response) {
+    const { provider, respond } = loadProvider();
+    const settled = start(provider).then(
+        (result) => ({ resolved: result }),
+        (error) => ({ error }),
+    );
+    // The provider posts synchronously, so the request is already on the wire.
+    respond(response);
+    const outcome = await settled;
+    expect(outcome).not.toHaveProperty("resolved");
+    return outcome.error;
+}
+
+describe("an EIP-1193 code reaches the page", () => {
+    test("a user rejection arrives as code 4001", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect(err.code).toBe(REJECTED);
+        expect(err.message).toBe("User rejected the request.");
+    });
+
+    test("it is a ProviderRpcError, and an Error", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect(err).toBeInstanceOf(Error);
+        expect(err.name).toBe("ProviderRpcError");
+    });
+
+    test("4100 unauthorized arrives intact", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
+            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
+        );
+        expect(err.code).toBe(UNAUTHORIZED);
+        expect(err.message).toBe("Unauthorized");
+    });
+
+    test("4902 unrecognized chain arrives intact", async () => {
+        const message =
+            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "wallet_switchEthereumChain" }),
+            { error: { code: UNRECOGNIZED_CHAIN, message } },
+        );
+        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
+        expect(err.message).toBe(message);
+    });
+
+    // The provider is not allowed to know the list above: a code added to the
+    // background later must reach the page without this file being edited.
+    test("a code the provider has never heard of is passed through", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_accounts" }),
+            { error: { code: 4900, message: "Disconnected" } },
+        );
+        expect(err.code).toBe(4900);
+    });
+
+    test("data is carried when the boundary sent it", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_call" }),
+            {
+                error: {
+                    code: -32000,
+                    message: "execution reverted",
+                    data: "0x08c379a0",
+                },
+            },
+        );
+        expect(err.code).toBe(-32000);
+        expect(err.data).toBe("0x08c379a0");
+    });
+
+    test("no data property is invented when the boundary sent none", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            {
+                error: {
+                    code: REJECTED,
+                    message: "User rejected the request.",
+                },
+            },
+        );
+        expect("data" in err).toBe(false);
+    });
+});
+
+describe("the message is untouched", () => {
+    test("a coded error keeps the message byte for byte", async () => {
+        const message =
+            "This site asked to sign as an address that is not " +
+            "the active one.";
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "personal_sign" }),
+            { error: { code: UNAUTHORIZED, message } },
+        );
+        expect(err.message).toBe(message);
+    });
+
+    test("an error the background sent with no code keeps its message", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { message: "No accounts available" } },
+        );
+        expect(err.message).toBe("No accounts available");
+    });
+
+    // A ProviderRpcError whose code is undefined would claim a conformance it
+    // does not have, and `'code' in err` is exactly what a careful dApp asks.
+    test("an error with no code gets no code property at all", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { message: "No accounts available" } },
+        );
+        expect(err).toBeInstanceOf(Error);
+        expect("code" in err).toBe(false);
+    });
+
+    test("an error with no message keeps the generic fallback", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_sendTransaction" }),
+            { error: { code: REJECTED } },
+        );
+        expect(err.message).toBe("Request failed");
+        expect(err.code).toBe(REJECTED);
+    });
+});
+
+// Every entry point the provider exposes, not just eth_requestAccounts. They
+// all funnel through the same response listener, and this is what says so.
+describe("every request path carries the code", () => {
+    const rejection = {
+        error: { code: REJECTED, message: "User rejected the request." },
+    };
+
+    test("request()", async () => {
+        const err = await rejectionFrom(
+            (p) => p.request({ method: "eth_requestAccounts" }),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("enable()", async () => {
+        const err = await rejectionFrom((p) => p.enable(), rejection);
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("send(method, params)", async () => {
+        const err = await rejectionFrom(
+            (p) => p.send("eth_requestAccounts", []),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("send({ method, params })", async () => {
+        const err = await rejectionFrom(
+            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
+            rejection,
+        );
+        expect(err.code).toBe(REJECTED);
+    });
+
+    test("sendAsync() hands the code to its callback", async () => {
+        const { provider, respond } = loadProvider();
+        const called = new Promise((resolve) => {
+            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
+                resolve(e),
+            );
+        });
+        respond(rejection);
+        const err = await called;
+        expect(err.name).toBe("ProviderRpcError");
+        expect(err.code).toBe(REJECTED);
+        expect(err.message).toBe("User rejected the request.");
+    });
+});
+
+describe("the success path is unchanged", () => {
+    test("a result still resolves", async () => {
+        const { provider, respond } = loadProvider();
+        const settled = provider.request({ method: "eth_requestAccounts" });
+        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
+        await expect(settled).resolves.toEqual([
+            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
+        ]);
+        expect(provider.selectedAddress).toBe(
+            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
+        );
+    });
+});

tests/symbolSpoof.test.js

@@ -56,7 +56,7 @@ global.chrome = {
 };
 
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
-const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { filterTransactions } = require("../src/shared/transactions");
 const {
     fetchTokenBalances,
@@ -284,12 +284,138 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     // asserts the claim it stands for — `[ -~]` would admit an interior
     // space and let a whitespace-bearing entry through the guard.
     test("no bundled symbol is touched by the normalization", () => {
-        for (const [symbol, address] of KNOWN_SYMBOLS) {
+        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
             expect(symbol).toBe(symbol.trim());
             expect(symbol).toMatch(/^[!-~]+$/);
-            if (address === null) continue;
+            if (addresses === null) continue;
+            for (const address of addresses) {
                 expect(isSpoofedSymbol(symbol, address)).toBe(false);
             }
+        }
+    });
+});
+
+// Issue #276: the guard that was missing.  The suite walked KNOWN_SYMBOLS,
+// which is built from TOKENS, so it could only ever assert that the table
+// agrees with itself.  Seven symbols appear twice in the bundled list at two
+// different real contracts, and the table kept whichever came first, so the
+// other seven contracts — tokens in our own shipped list, at their own
+// addresses — were judged spoofs and hidden from the balance list, the
+// history and the send selector.  That is the over-filtering direction: it
+// hides a holding the user cannot then spend.
+//
+// This walk is over TOKENS, the data the wallet actually ships, so it fails
+// whenever a bundled token would be filtered at its own address no matter
+// which side of the table the mistake is on.
+describe("the shipped token list", () => {
+    test("no bundled token is filtered at its own address", () => {
+        const filtered = TOKENS.filter((t) =>
+            isSpoofedSymbol(t.symbol, t.address),
+        ).map((t) => t.symbol + " @ " + t.address);
+        expect(filtered).toEqual([]);
+    });
+
+    // The third failure mode the issue asks about: a symbol whose table entry
+    // names an address that is in neither the table nor the list would be a
+    // contract we vouch for and do not ship.  There is none, and the table is
+    // built from the list, so this asserts the derivation has not acquired a
+    // hand-written entry.
+    test("every address the table vouches for is a bundled token", () => {
+        const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
+        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
+            if (addresses === null) continue;
+            expect(addresses.size).toBeGreaterThan(0);
+            for (const address of addresses) {
+                expect(address).toBe(address.toLowerCase());
+                expect(bundled.has(address)).toBe(true);
+                // And it is the token that actually reports that symbol.
+                const token = TOKENS.find(
+                    (t) => t.address.toLowerCase() === address,
+                );
+                expect(token.symbol.toUpperCase()).toBe(symbol);
+            }
+        }
+    });
+
+    // Both contracts behind a shared ticker must pass, from either side: a
+    // rule that admits only the one the table happens to visit first is the
+    // bug, not the fix.
+    test("both contracts behind a shared ticker are admitted", () => {
+        const bySymbol = new Map();
+        for (const t of TOKENS) {
+            const upper = t.symbol.toUpperCase();
+            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
+            bySymbol.get(upper).push(t);
+        }
+        const shared = [...bySymbol].filter(([, list]) => list.length > 1);
+        // The shared tickers are a fact about the shipped data; if a future
+        // list has none, this test would silently assert nothing.
+        expect(shared.length).toBeGreaterThan(0);
+        for (const [, list] of shared) {
+            for (const t of list) {
+                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
+            }
+        }
+    });
+
+    // The seven from issue #276, named so that the reconciliation is a fact
+    // in the suite: each is two real contracts from the same source fetch,
+    // and the table now holds both rather than the one that came first.
+    test("the seven shared tickers each name both bundled contracts", () => {
+        const expected = {
+            TON: [
+                "0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
+                "0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
+            ],
+            FRAX: [
+                "0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
+                "0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
+            ],
+            REUSD: [
+                "0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
+                "0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
+            ],
+            EURE: [
+                "0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
+                "0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
+            ],
+            MSUSD: [
+                "0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
+                "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
+            ],
+            MUSD: [
+                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
+                "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
+            ],
+            JPYC: [
+                "0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
+                "0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
+            ],
+        };
+        for (const [symbol, addresses] of Object.entries(expected)) {
+            expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
+                [...addresses].sort(),
+            );
+            for (const address of addresses) {
+                expect(isSpoofedSymbol(symbol, address)).toBe(false);
+            }
+        }
+    });
+
+    // The other direction, on the same symbols: widening the table to hold
+    // every bundled address for a ticker must not turn it into a pass for
+    // any other contract.
+    test("a shared ticker from a third contract is still a spoof", () => {
+        const bySymbol = new Map();
+        for (const t of TOKENS) {
+            const upper = t.symbol.toUpperCase();
+            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
+            bySymbol.get(upper).push(t);
+        }
+        for (const [symbol, list] of bySymbol) {
+            if (list.length < 2) continue;
+            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
+        }
     });
 });
 

tests/transactions.test.js

@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
     });
 
     test("USDC and WETH map to their genuine lowercased contracts", () => {
-        expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
+        expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
-        expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
+        expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
     });
 
     test("the spam fixture symbol is not in the known token list", () => {