fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout and each
recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on
Etherscan", now gate those requests. Both are off in a new install and offered
unticked on Welcome and in Settings. While one is off, the screens that relied
on it say so in a plain line. Each gated request reads its setting from storage
before it asks and when the answer lands, and drops a late answer. An open popup
takes another page's change and draws its screens again. While "Use Blockscout"
is off, no address keeps an untracked token, and no screen names a token from
Blockscout's report. ENS lookups ask only the RPC endpoint.

Model: opus-5-5 (implementation); fable-5-1 (prose)

README.md

@@ -12,16 +12,29 @@ intercepts tx status links to their own site instead of going to Etherscan, etc.
 None of the common alternatives work on Firefox.
 
 Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
-Everything you need, nothing you don't. We import as few libraries as possible,
-don't implement any crypto, and don't send user-specific data anywhere but a
-(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
-extension contacts three user-configurable services: the configured RPC node for
-blockchain interactions, a public CoinDesk API (no API key) for realtime price
-information, and a Blockscout block-explorer API for transaction history and the
-balances of tokens the user has not tracked. It also performs best-effort
-Etherscan address label lookups during transaction confirmation. A
-community-maintained phishing domain blocklist is built into the extension at
-build time and checked locally; nothing is fetched for it at runtime.
+Everything you need, nothing you don't. We import as few libraries as possible
+and don't implement any crypto. By default the wallet sends user-specific data
+only to the Ethereum RPC endpoint. The user can change that endpoint in
+Settings. The endpoint defaults to a public node.
+
+Out of the box the extension contacts two services:
+
+- the configured RPC node, for blockchain interactions
+- a public CoinDesk API (no API key), for realtime prices. The API receives
+  token symbols and nothing else.
+
+Two more services are sent none of the user's data until the user ticks a
+checkbox for each. Welcome and Settings both offer the two checkboxes:
+
+- "Use Blockscout": a Blockscout block-explorer API, used for:
+    - transaction history
+    - the tokens the user has not tracked
+    - transaction details
+- "Check recipients on Etherscan": a best-effort Etherscan label lookup of the
+  recipient during transaction confirmation
+
+A community-maintained phishing domain blocklist is built into the extension at
+build time and checked locally. Nothing is fetched for it at runtime.
 
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -422,6 +435,35 @@ It also covers the red banner on the Settings screen: switching the network
 there to Sepolia must put up the `[TESTNET]` banner, and switching back to
 mainnet must take it down, both while Settings is still on screen.
 
+It also covers what a new install sends to Blockscout and Etherscan
+([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The harness installs
+a route handler before the first popup page opens. From then on, the handler
+records every request the extension makes, from its pages and from its
+background worker. The background worker starts earlier, but it makes no request
+while it starts up. The tests take these steps in order:
+
+- Welcome must offer "Use Blockscout" and "Check recipients on Etherscan"
+  unticked.
+- With neither ticked, Home, AddressDetail, AddressToken and ConfirmTx must each
+  show the line saying what is off.
+- The popup is then closed until the background has run a balance refresh of its
+  own. No recorded request may have gone to Blockscout or Etherscan.
+- "Use Blockscout" is ticked from AddressDetail's gear. On "Back", AddressDetail
+  must ask Blockscout for its history and no longer say the setting is off.
+  Blockscout must then be asked for the token balances.
+- The stub Blockscout then reports a token the user has not tracked. Home lists
+  it. "Use Blockscout" is unticked from AddressDetail's gear. On "Back", the
+  token must be gone from AddressDetail, from Send's token dropdown and from
+  Home. Those three screens must each show the line saying the setting is off.
+  The setting is then ticked again.
+- "Check recipients on Etherscan" is ticked from ConfirmTx's gear. On "Back",
+  ConfirmTx must ask Etherscan about the recipient and show the label the stub
+  page gives the recipient.
+
+Both settings stay on for the rest of the run. TransactionDetail with "Use
+Blockscout" off is not driven here: while the setting is off, there is no
+history row to open it from. The unit tests cover that case.
+
 It also covers the confirmation screen, for both a native ETH send and an ERC-20
 send: Send disabled while the fee estimate is in flight, enabled once it lands,
 the fee block quoting the expected cost and the reserve separately, the distinct
@@ -845,13 +887,16 @@ src/
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
     alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH and tracked token balances via RPC, others via Blockscout
+    balances.js       — ETH and tracked token balances via RPC, others via
+                        Blockscout while "Use Blockscout" is on
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
     prices.js         — ETH/USD and token/USD via CoinDesk API
     scamlist.js       — known fraud contract addresses
     state.js          — persisted state (extension storage)
+    storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
+                        read from storage for the requests those settings gate
     symbolSpoof.js    — the known-symbol spoof rule, shared by all surfaces
     tokenList.js      — top ERC-20 tokens by market cap (hardcoded)
     transactions.js   — tx history fetching + anti-poisoning filters
@@ -1122,25 +1167,39 @@ with the same floor (`.5` reads `.5000`).
 
 **Specific Exception — unknown token scale:** Calldata carries base units and no
 scale, so every amount on the dApp approval screen needs the token's `decimals`.
-It is resolved from the bundled token list, then from the tokens the user tracks
-on the network the transaction is for, then, when that is the active network,
-from what the block explorer reported for the contract in the wallet's balances,
-which are the active network's only (`resolveTokenDecimals()` in
-`src/shared/approvalAmount.js`). Where none of them answers, the amount is not
-formatted: the line reads `5000000000 base units (decimals unknown)`. A guessed
-scale is not an approximation but a different number — 1,000 units of a
-6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
-whose only job is to state what is being authorized. Both amount paths of that
-screen take this rule: the ERC-20 `transfer`/`approve` line
-(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
-`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
-a move into the router (`src/shared/uniswap.js`). The token permission warning
-on the signature screen takes the same rule for its amounts. An unbounded
-allowance or permit needs no scale to describe and is still shown as
-`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
-`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
-decimal places, so a token that reports 81 to 255 is shown as one whose scale
-nothing knows.
+The wallet takes the `decimals` from these sources, in this order
+(`resolveTokenDecimals()` in `src/shared/approvalAmount.js`):
+
+- the bundled token list
+- the tokens the user tracks on the network the transaction is for
+- what the block explorer reported for the contract in the wallet's balances.
+  Those balances cover the active network only. This source is used only while
+  "Use Blockscout" is on (`tokenSourcesByChainId()` in
+  `src/popup/views/helpers.js`).
+
+The token's name comes from the same sources. While "Use Blockscout" is off, a
+token gets a line under it when the bundled list and the tracked tokens lack its
+name or decimals. The line says "Blockscout's report of your balances is not
+used to name this token, because "Use Blockscout" is off in Settings." These
+screens show the line:
+
+- TxApproval and SignApproval
+- WaitTx, SuccessTx and ErrorTx, which follow TxApproval
+
+Where none of the sources answers, the amount is not formatted: the line reads
+`5000000000 base units (decimals unknown)`. A guessed scale is not an
+approximation but a different number — 1,000 units of a 6-decimal token
+formatted at 18 decimals reads `0.000000001` — on the screen whose only job is
+to state what is being authorized. Both amount paths of that screen take this
+rule: the ERC-20 `transfer`/`approve` line (`src/popup/views/approval.js`) and
+the swap's `Amount`, `Min. received`, `Moved from the sender` and
+`Permit2 allowance` lines and the `Paid to` line of a move into the router
+(`src/shared/uniswap.js`). The token permission warning on the signature screen
+takes the same rule for its amounts. An unbounded allowance or permit needs no
+scale to describe and is still shown as `Unlimited`. A source's answer counts
+only if it is a whole number from 0 to 80: `decimals()` returns a `uint8`, but
+`formatUnits()` cannot format more than 80 decimal places, so a token that
+reports 81 to 255 is shown as one whose scale nothing knows.
 
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1155,21 +1214,21 @@ printing `0.0000` for money that is really there. `0` is a real scale and is
 never treated as absent.
 
 `tokenBalances[].decimals` is therefore the explorer's own answer and nothing
-else, and `null` in the entry of a tracked token, whose balance is read through
-the RPC endpoint and not asked of the explorer. It is not the same question as
-the scale a screen should render at. Anything that needs the second one calls
-`resolveTokenDecimals()` — the balance list, the approval and swap lines, and
-the Send screen, which carries the resolved scale onto the pending transaction
-for `transferAmount.js` to encode and compare against. Reading the stored field
-directly instead answers `null` for a bundled or tracked token the explorer
-merely omitted, which is not a refusal the wallet has any reason to make.
+else, which is not the same question as the scale a screen should render at.
+Anything that needs the second one calls `resolveTokenDecimals()` — the balance
+list, the approval and swap lines, and the Send screen, which carries the
+resolved scale onto the pending transaction for `transferAmount.js` to encode
+and compare against. Reading the stored field directly instead answers `null`
+for a bundled or tracked token the explorer merely omitted, which is not a
+refusal the wallet has any reason to make.
 
-The Send screen also consults every address's explorer reports, so a contract
-two addresses report different `decimals` for has no scale there, and the stored
-balance, formatted at one of those scales, is withdrawn with it. The Send
-screen's `Current balance` and the confirmation screen's balance line then both
-read `unknown (SYMBOL)`. The balance list formats each explorer row as it is
-fetched, without that cross-address check, and shows the row's figure.
+While "Use Blockscout" is on, the Send screen also consults every address's
+explorer reports. The reports for two addresses may give different `decimals`
+for one contract. That token then has no scale on Send. Its stored balance is
+not shown either. The Send screen's `Current balance` and the confirmation
+screen's balance line then both read `unknown (SYMBOL)`. The balance list
+formats each explorer row as it is fetched, without that cross-address check,
+and shows the row's figure.
 
 **Decoded amount lines on the transaction approval screen:** the `Amount` line
 of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
@@ -1382,28 +1441,45 @@ The core hierarchy is **Wallets → Addresses**:
 
 Which tokens an address shows is decided on every refresh by `refreshBalances()`
 in `src/shared/balances.js`. The balance of each token tracked on the active
-network is read with `balanceOf` through the RPC endpoint, for every address; a
-read that fails leaves that token's previous figure, as a failed ETH balance
-does. Every other token comes from the Blockscout `token-balances` response
-(`fetchTokenBalances()`), so tokens do appear without the user adding them, and
-they keep their previous figures while Blockscout fails. A tracked token is
-shown when its balance is nonzero, and any other ERC-20 when its balance is
-nonzero and it is in the bundled known-token list or has 1,000 or more holders.
-A token claiming a symbol from the bundled list from any other contract address
-is always dropped, tracked or not, and so is any token claiming a symbol that
-belongs to the native asset and therefore has no legitimate contract at all
-(`"ETH"`, and every network's `nativeCurrency`, such as `"SepoliaETH"`, on every
-network). That filter is unconditional — the "Hide tokens with fewer than 1,000
-holders" setting governs the transaction history and the send-screen token
-selector, not this list. A token's holder count is unknown when the explorer
-reports none, or reports anything other than a whole number written in digits
-alone, such as `1,000` or `1e3` (`parseHoldersCount()` in
-`src/shared/holders.js`); a tracked token's entry has none, because the explorer
-is not asked about it. This list does not take an unknown count as 1,000 or
-more, so such a token is shown only when it is on the bundled list or tracked.
-Every nonzero holding of a token shown is stored exactly, however small, but a
-holding below 0.000001 is left out of the balance lists, the send-screen token
-selector, the address total and the remove-address warning
+network is read with `balanceOf` through the RPC endpoint, for every address.
+Its holder count and `decimals` are those of Blockscout's entry for it in the
+same refresh, kept from before while Blockscout fails. A read that fails keeps
+that token's previous entry, as a failed ETH balance keeps its figure, or takes
+Blockscout's entry from the same refresh when there is none. Every other token
+comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
+tokens do appear without the user adding them, and they keep their previous
+figures while Blockscout fails.
+
+The refresh asks Blockscout only while the user has "Use Blockscout" on. The
+setting is off until the user turns it on. While it is off:
+
+- Only tracked tokens are listed. Turning the setting off drops every other
+  token from every address at once.
+- A tracked token's entry has no holder count and no `decimals` from Blockscout.
+- A tracked token's balance uses the decimals from the bundled list, or else the
+  decimals saved when the token was tracked.
+
+Blockscout may answer just before the user turns the setting off. So the popup's
+refresh and the background's both check the stored setting again when they save.
+If the setting is off by then, the save drops every token the user has not
+tracked.
+
+A tracked token is shown when its balance is nonzero, and any other ERC-20 when
+its balance is nonzero and it is in the bundled known-token list or has 1,000 or
+more holders. A token claiming a symbol from the bundled list from any other
+contract address is always dropped, tracked or not, and so is any token claiming
+a symbol that belongs to the native asset and therefore has no legitimate
+contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens with fewer than 1,000 holders" setting governs the transaction history
+and the send-screen token selector, not this list. A token's holder count is
+unknown when the explorer reports none, or reports anything other than a whole
+number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+or more, so such a token is shown only when it is on the bundled list or
+tracked. Every nonzero holding of a token shown is stored exactly, however
+small, but a holding below 0.000001 is left out of the balance lists, the
+send-screen token selector, the address total and the remove-address warning
 (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
@@ -1578,6 +1654,18 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 
+Changing "Use Blockscout" or "Check recipients on Etherscan" in Settings makes
+every screen but Settings count as not yet rendered. "Back" then renders again
+any screen that a reopened popup can render. A change to "Use Blockscout" also
+cuts the stack, as a network switch does (below). The cut drops Send, whose
+token dropdown was filled under the old setting. "Back" cannot render Send
+again. A change to "Check recipients on Etherscan" leaves the stack as it is.
+
+Any other open popup takes either change from the stored record, as it takes a
+network switch (below). That popup then redraws its top screen as a reopened
+popup would. A screen that a reopened popup cannot render, such as Send, is
+replaced by Home.
+
 A network switch leaves every screen on the page showing the previous network.
 The user makes it in Settings, or approves a site's request and the background
 saves it. Any other popup open meanwhile takes the switch from the stored
@@ -1619,8 +1707,17 @@ view would leave a wallet one click from deletion.
   screen in that case.
 - **Elements**:
     - "Welcome! To get started, add a wallet." text
+    - A well opening with "This wallet sends your data only to the Ethereum RPC
+      endpoint, unless you turn on one of these. You can change them later in
+      Settings."
+    - In the well, the "Use Blockscout" and "Check recipients on Etherscan"
+      checkboxes, the same two as in Settings. Under each, a sentence says what
+      the setting sends and to which service. Both are unticked until the user
+      ticks them
     - "Add wallet" button
 - **Transitions**:
+    - Ticking or unticking either checkbox → stores the setting, as Settings
+      does (no screen change)
     - "Add wallet" → **AddWallet**
 
 #### Home (`main`)
@@ -1641,6 +1738,8 @@ view would leave a wallet one click from deletion.
       holding more than one address); the ENS name, if resolved, is below it;
       then the full address on a row of its own, followed by the address USD
       total and a balance line for ETH and for each token shown for that address
+    - While "Use Blockscout" is off, a line under the wallet list: "Only tracked
+      tokens are listed, because "Use Blockscout" is off in Settings."
     - "Recent Transactions": up to 25 transactions merged across every address
       of every wallet, deduplicated by hash and filtered. Each row is three
       lines: age and direction, then the counterparty's colour dot (with our own
@@ -1648,7 +1747,11 @@ view would leave a wallet one click from deletion.
       counterparty's full address on a row of its own. A contract creation has
       no counterparty: its second line is the amount alone and its third line
       says "This transaction creates a new contract. It has no recipient." The
-      transaction lists on AddressDetail and AddressToken draw the same rows
+      transaction lists on AddressDetail and AddressToken draw the same rows.
+      The history comes from Blockscout. While "Use Blockscout" is off,
+      Blockscout is not asked. This list then shows only the line "No
+      transaction history is shown, because "Use Blockscout" is off in
+      Settings."
     - "Add additional wallet..." link at bottom
 - **Transitions**:
     - Tap address row → sets the active address and broadcasts
@@ -1717,9 +1820,13 @@ view would leave a wallet one click from deletion.
     - USD total for address (see [Partial USD totals](#partial-usd-totals))
     - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
       places, USD inline). Each balance row is clickable → **AddressToken**
+    - While "Use Blockscout" is off, a line under the balance list: "Only
+      tracked tokens are listed, because "Use Blockscout" is off in Settings."
     - Send / Receive / + Token buttons and a "···" menu button
     - "···" dropdown containing a single "Export Private Key" entry
-    - Transaction list (with ENS resolution for counterparties)
+    - Transaction list (with ENS resolution for counterparties). While "Use
+      Blockscout" is off, it shows only the line "No transaction history is
+      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
     - Tap balance row → **AddressToken** (for that token)
     - "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1787,10 +1894,13 @@ view would leave a wallet one click from deletion.
     - Token contract well (ERC-20 only): full contract address (tap to copy,
       etherscan link) plus name, symbol, decimals, holder count and project
       website where known. The "Holders:" row is left out, not shown as 0, when
-      the token's balance-list entry has no holder count: the explorer did not
-      report a readable one, the token is tracked, or the token is not in the
-      balance list
-    - Token-filtered transaction list (only this token's transfers)
+      the token's balance-list entry has no holder count. That happens when:
+        - the explorer did not report a readable one
+        - "Use Blockscout" is off
+        - the token is not in the balance list
+    - Token-filtered transaction list (only this token's transfers). While "Use
+      Blockscout" is off, it shows only the line "No transaction history is
+      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
     - "Send" → **Send** (token locked: the dropdown is replaced by a static
       symbol and contract address)
@@ -1807,6 +1917,9 @@ view would leave a wallet one click from deletion.
     - From: address with color dot + etherscan link
     - What to send: token dropdown (or static display with contract address when
       locked from AddressToken)
+    - While "Use Blockscout" is off, a line under the token dropdown: "Only
+      tracked tokens are listed, because "Use Blockscout" is off in Settings."
+      The line is hidden with the dropdown when Send is opened from AddressToken
     - To: address or ENS name input, with an inline validation message
     - Amount input with current balance display, which reads
       `Current balance: unknown (SYMBOL)` for a token whose scale is unknown, as
@@ -1826,13 +1939,14 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
     - "Review" (valid inputs, ENS resolved) → **ConfirmTx**
     - "Review" with an unresolvable ENS name or an invalid amount → flash
-      message, no screen change. An amount is valid when it is a number above
-      zero, written as digits with at most one decimal point, with nothing but
-      zeros after the token's last decimal place. ETH has 18 places, and a token
-      with more, or with an unknown number, is held to 18. Zeros past those
-      places leave the amount unchanged, so `1.0000000` of a 6-place token
-      passes and is sent as exactly 1. ConfirmTx makes the same check before
-      anything can be sent
+      message, no screen change. A name with no address, or one resolved
+      off-chain, gets "That ENS name has no on-chain address." An amount is
+      valid when it is a number above zero, written as digits with at most one
+      decimal point, with nothing but zeros after the token's last decimal
+      place. ETH has 18 places, and a token with more, or with an unknown
+      number, is held to 18. Zeros past those places leave the amount unchanged,
+      so `1.0000000` of a 6-place token passes and is sent as exactly 1.
+      ConfirmTx makes the same check before anything can be sent
     - "Back" → previous screen (Home, AddressDetail, or AddressToken)
 
 #### ConfirmTx (`confirm-tx`)
@@ -1876,7 +1990,12 @@ view would leave a wallet one click from deletion.
       recipient that has never sent a transaction and holds no ETH, recipient is
       a contract, burn address, and an Etherscan phishing/scam label. An address
       that has received ETH but never sent a transaction still holds that ETH,
-      so it gets no warning
+      so it gets no warning. The Etherscan label check is made only while "Check
+      recipients on Etherscan" is on. While the setting is off, the Etherscan
+      box is left out. A line in its place says "This address was not checked on
+      Etherscan, because "Check recipients on Etherscan" is off in Settings."
+      The box or the line is chosen when the screen is drawn, so neither moves
+      anything later
     - Errors (an invalid amount), plus five reserved error boxes, so the balance
       and the fee arriving later move nothing — the amount exceeds the balance
       (for a token whose scale is unknown it says the token's balance is
@@ -1953,6 +2072,9 @@ view would leave a wallet one click from deletion.
       `Unknown (could not be decoded)` with no symbol, not the transaction's ETH
       value. When that swap's `Token In` is `ETH (native)`, the transaction's
       ETH value in the network's currency, as for any other transaction
+    - A line under the amount, worded as on TxApproval. While "Use Blockscout"
+      is off, the line shows when the bundled list and the tracked tokens lack
+      the token's name or decimals.
     - To: color dot + full address + etherscan link; for a contract creation,
       which has no recipient, "This transaction creates a new contract. It has
       no recipient." instead
@@ -1985,7 +2107,9 @@ view would leave a wallet one click from deletion.
 - **Elements**:
     - "Transaction Confirmed" heading
     - Decoded action well (shown when the transaction carried recognized
-      calldata; the top-level Amount and To are hidden in that case)
+      calldata; the top-level Amount and To are hidden in that case). Each token
+      in the well gets TxApproval's line under it whenever TxApproval would show
+      that line.
     - Amount + symbol
     - To: color dot + full address + etherscan link, or for a contract creation
       the same sentence as on WaitTx
@@ -2008,6 +2132,7 @@ view would leave a wallet one click from deletion.
     - Amount + symbol, or for a swap the approval screen showed no `Amount` for,
       the same as on WaitTx: `Unknown (could not be decoded)`, unless its
       `Token In` is `ETH (native)`
+    - While "Use Blockscout" is off, the same line under the amount as on WaitTx
     - To: color dot + full address + etherscan link, or for a contract creation
       the same sentence as on WaitTx
     - Error message (dashed border box)
@@ -2042,7 +2167,11 @@ view would leave a wallet one click from deletion.
   AddressToken. The screen describes the transaction on the network it was sent
   on, whichever network is active: its block, network details, decoded details
   and raw data are read from that network's Blockscout, the one Settings has for
-  it, and its etherscan links open that network's explorer.
+  it, and its etherscan links open that network's explorer. While "Use
+  Blockscout" is off, Blockscout is not asked. One line then takes the place of
+  the block, network details, decoded details and raw data: "This screen shows
+  no block, decoded details, network details or raw data, because "Use
+  Blockscout" is off in Settings."
 - **Elements** (grouped into logical blocks using light well containers; field
   labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
@@ -2125,8 +2254,21 @@ view would leave a wallet one click from deletion.
       already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
-    - Blockscout API: endpoint URL input + "Save" button (validated against
-      `/stats` before being saved)
+    - Blockscout API:
+        - "Use Blockscout" checkbox, unticked until the user ticks it
+        - A sentence saying what the setting shows and what it sends. With the
+          setting on, the wallet sends the Blockscout API the user's addresses
+          and the hash of each transaction opened
+        - Endpoint URL input + "Save" button. "Save" asks the URL for `/stats`
+          and saves the URL only if that request succeeds. The request carries
+          no user data and is made whether or not "Use Blockscout" is ticked.
+    - Etherscan:
+        - "Check recipients on Etherscan" checkbox, unticked until the user
+          ticks it
+        - A sentence saying the setting sends each recipient's address to
+          Etherscan, to check the address for a phishing or scam label
+    - Each of the two settings applies to every network. Welcome offers the same
+      two checkboxes
     - Token Spam Protection:
         - "Hide fake tokens impersonating a known symbol" checkbox
         - "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2150,6 +2292,10 @@ view would leave a wallet one click from deletion.
     - Debug: hidden until revealed, then an "Enable debug mode" checkbox that
       turns on the red banner and verbose logging
 - **Transitions**:
+    - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
+      stores the setting (no screen change). From then on, every screen drawn
+      and every balance refresh uses the new setting. Unticking "Use Blockscout"
+      also drops every token the user has not tracked from every address
     - "+ Add wallet" → **AddWallet**
     - "+ Add token" → **SettingsAddToken**
     - `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2168,7 +2314,8 @@ view would leave a wallet one click from deletion.
       nothing and tells the background nothing
     - Ten clicks on the version → reveals the Debug well (no screen change)
     - "Back" (or Settings gear again) → previous screen (Home); after a network
-      switch, the stack is cut first (see the top of Screen Map)
+      switch or a change to "Use Blockscout", the stack is cut first (see the
+      top of Screen Map)
 
 #### ShowRecoveryPhrase (`show-phrase`)
 
@@ -2325,6 +2472,8 @@ view would leave a wallet one click from deletion.
       money. The predicate is `addressHoldsFunds()` in
       `src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
       warning, never a refusal.
+    - While "Use Blockscout" is off, a line under the warning: "Only tracked
+      tokens are listed, because "Use Blockscout" is off in Settings."
     - The rule that a wallet always keeps at least one address, and that
       removing the last one means deleting the wallet from Settings
     - Error line
@@ -2457,6 +2606,12 @@ view would leave a wallet one click from deletion.
       a swap pays only the From address, a `Paid to` line for each other address
       it pays, or saying that a token stays in the router or who it pays is
       unknown (see Transaction Decoding)
+    - A line under each token of the decoded action: "Blockscout's report of
+      your balances is not used to name this token, because "Use Blockscout" is
+      off in Settings." While "Use Blockscout" is off, the line shows when the
+      bundled list and the tracked tokens lack the token's name or decimals.
+      While the setting is on, Blockscout's report of the user's balances is a
+      third source of a token's name and decimals (see Unknown token scale).
     - From: color dot + full address + etherscan link
     - Contract: color dot + full address + etherscan link, token symbol label if
       known; for a contract creation, the same sentence as on WaitTx
@@ -2536,7 +2691,10 @@ view would leave a wallet one click from deletion.
       the site puts in the message, except a `Permit`'s token, which is the
       domain's `verifyingContract`; any those fields do not give is shown as
       `Unknown`, and the domain, type and message lines still follow. Only typed
-      data that cannot be read at all is shown as raw text.
+      data that cannot be read at all is shown as raw text. A token gets the
+      same line under it as on TxApproval, whenever TxApproval would show that
+      line. As there, Blockscout's report of the user's balances is a source of
+      a token's name and decimals only while "Use Blockscout" is on.
     - Raw data (`personal_sign` and `eth_sign`): the message's hex exactly as
       the site sent it. The bytes it encodes are what is signed, as an EIP-191
       personal message.
@@ -2666,17 +2824,36 @@ view would leave a wallet one click from deletion.
 
 ### External Services
 
-AutistMask is not a fully self-contained offline tool. It necessarily
-communicates with three external services to function as a wallet:
+AutistMask is not a fully self-contained offline tool. By default it sends the
+user's data only to the Ethereum RPC endpoint. It also asks the CoinDesk price
+API for prices, sending token symbols and nothing else.
+
+Two more services are sent none of the user's data until the user turns on a
+setting for each:
+
+- Blockscout, with "Use Blockscout"
+- Etherscan, with "Check recipients on Etherscan"
+
+Both settings are off in a new install. Welcome and Settings both offer them.
+Each setting applies to every network.
+
+Before each request that sends the user's data to Blockscout or Etherscan, the
+wallet reads that service's setting from storage. The wallet reads the setting
+again when the answer lands. While the setting is off, no such request is made,
+and an answer that lands after the setting went off is dropped.
+
+Contacted by default:
 
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
   balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
   them the balance of every tracked token at every address (`balanceOf`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
-  receipts. The default endpoint is a public RPC (configurable by the user to
-  any endpoint they prefer, including a local node). By default the extension
-  talks to `https://ethereum-rpc.publicnode.com`.
+  receipts. Every ENS lookup is made through the RPC endpoint alone. So a name
+  does not resolve when its resolver says the name is resolved off-chain. The
+  default endpoint is a public RPC (configurable by the user to any endpoint
+  they prefer, including a local node). By default the extension talks to
+  `https://ethereum-rpc.publicnode.com`.
     - **Data sent**: Ethereum addresses, transaction data, contract call
       parameters. The RPC endpoint can see all on-chain queries and submitted
       transactions.
@@ -2688,14 +2865,45 @@ communicates with three external services to function as a wallet:
     - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
       addresses or user-specific data.
 
-- **Blockscout block-explorer API**: Used to fetch transaction history (normal
-  transactions and ERC-20 token transfers), the balances of ERC-20 tokens the
-  user has not tracked, and token holder counts (for spam filtering). The
-  default endpoint is `https://eth.blockscout.com/api/v2` (configurable by the
-  user in Settings).
-    - **Data sent**: Ethereum addresses. Blockscout receives the user's
-      addresses to query their transaction history and token balances. No
-      private keys, passwords, or signing operations are sent.
+Sent the user's data only while its setting is on:
+
+- **Blockscout block-explorer API** ("Use Blockscout"): The default endpoint is
+  `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
+    - **Used for**:
+        - transaction history (normal transactions and ERC-20 token transfers),
+          for Home, AddressDetail and AddressToken
+        - the balances of the ERC-20 tokens the user has not tracked, for Home,
+          AddressDetail, Send and DeleteAddress
+        - the names and decimals of those tokens, for TxApproval, SignApproval,
+          WaitTx, SuccessTx and ErrorTx
+        - token holder counts, for spam filtering
+        - a transaction's block, network details and calldata, for
+          TransactionDetail
+    - **Contacted**, while the setting is on:
+        - on every balance refresh, in the popup and in the background
+        - when Home, AddressDetail or AddressToken loads its history
+        - when TransactionDetail opens
+    - **While the setting is off**: each of those screens shows a line saying
+      what the screen leaves out and that "Use Blockscout" is off. Only tracked
+      tokens are listed.
+    - **Saving the URL**: pressing "Save" beside the URL in Settings asks that
+      URL for `/stats`, whether or not the setting is on. This request carries
+      no user data.
+    - **Data sent**: Ethereum addresses, and the hash of each transaction the
+      user opens. Blockscout receives the user's addresses to query their
+      transaction history and token balances. No private keys, passwords, or
+      signing operations are sent.
+
+- **Etherscan address labels** ("Check recipients on Etherscan"): While the
+  setting is on, ConfirmTx looks up the recipient's address on Etherscan each
+  time the screen is shown. The lookup checks for a phishing or scam label,
+  best-effort. This is a direct page fetch with no API key; the user's browser
+  makes the request. While the setting is off, ConfirmTx says that no Etherscan
+  check was made.
+    - **Data sent**: the recipient's address and nothing else.
+
+The etherscan links on the screens open a page in the browser when the user
+clicks one. They are not requests the wallet makes.
 
 What the extension does NOT do:
 
@@ -2704,16 +2912,9 @@ What the extension does NOT do:
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
-In addition to the three user-configurable services above (RPC endpoint,
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
-
-- **Etherscan address labels**: When confirming a transaction, the extension
-  performs a best-effort lookup of the recipient address on Etherscan to check
-  for phishing/scam labels. This is a direct page fetch with no API key; the
-  user's browser makes the request.
-
-Users who want maximum privacy can point the RPC and Blockscout URLs at their
-own self-hosted instances (price fetching can be disabled in a future version).
+Users who want maximum privacy can point the RPC URL at their own node. With
+"Use Blockscout" on, they can point the Blockscout URL at their own instance
+too.
 
 ### Dependencies
 
@@ -2895,8 +3096,11 @@ logged.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
-- View ERC-20 token balances (tokens on the bundled known-token list, tokens
-  with 1,000 or more holders, and tokens the user adds by contract address)
+- View ERC-20 token balances:
+    - tokens the user adds by contract address
+    - while "Use Blockscout" is on, tokens on the bundled known-token list and
+      tokens with 1,000 or more holders
+- View transaction history and transaction details, while "Use Blockscout" is on
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)
@@ -2999,10 +3203,8 @@ indexes it as a real token transfer.
   excluded from the token selector on the send screen. This prevents users from
   accidentally interacting with a spoofed token that appeared in their balance
   via a fake Transfer event. A token whose holder count is unknown is kept in
-  the selector, and so is every token the user tracks, whose entry carries no
-  holder count (see Data Model). The selector offers only tokens in the balance
-  list, so a token with an unknown count is one on the bundled list or one the
-  user tracks.
+  the selector. The selector offers only tokens in the balance list, so such a
+  token is one on the bundled list or one the user tracks.
 
 - **Dust transaction filtering**: A second wave of the same attack used real
   native ETH transfers instead of fake tokens. Transaction

docs/README.md

@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No third-party token list APIs.** Token balances come from the same block
-  explorer you configure for transaction history, and the extension ships its
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
-  detection. Any token you want tracked across all your addresses, you add
-  yourself by contract address.
+- **No third-party token list APIs.** The balances of the tokens you track are
+  read from your RPC endpoint. While "Use Blockscout" is on, the other tokens
+  come from the same block explorer you configure for transaction history. The
+  extension ships its own hardcoded list of top ERC-20 contract addresses for
+  symbol-spoofing detection. Any token you want tracked across all your
+  addresses, you add yourself by contract address.
 
 - **No backend servers operated by the developer.** Nothing is sent to any
   server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,13 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
-three you configure yourself, and two fixed ones used for scam detection.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint. It also asks the CoinDesk price API for prices, sending
+token symbols and nothing else.
+
+Blockscout and Etherscan are sent none of your data until you turn on a setting
+for each. The settings are "Use Blockscout" and "Check recipients on Etherscan".
+Both are off in a new install. Welcome and Settings both offer them.
 
 ### External Services
 
@@ -83,11 +89,14 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-When it is contacted: on every balance refresh (every 10 seconds while the popup
-is open, every 60 seconds in the background), when you type an ENS name into the
-Send screen, when a send is prepared and broadcast, while a pending transaction
-is polled for its receipt, and for the reverse ENS lookups used to label
-addresses (cached for 12 hours).
+When it is contacted:
+
+- on every balance refresh (every 10 seconds while the popup is open, every 60
+  seconds in the background)
+- when you review a send to an ENS name
+- when a send is prepared and broadcast
+- while a pending transaction is polled for its receipt
+- for the reverse ENS lookups used to label addresses (cached for 12 hours)
 
 What gets sent: standard Ethereum JSON-RPC requests (balance queries,
 transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
@@ -96,16 +105,31 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
-Used to fetch token balances and transaction history. Blockscout is an
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
-transactions and token transfers. You can change this in Settings to a
-self-hosted Blockscout instance.
+Blockscout is an open-source blockchain explorer. AutistMask sends it your data
+only while "Use Blockscout" is on. AutistMask then asks Blockscout for:
 
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
+- your recent transactions and token transfers
+- the balances of the tokens you have not tracked, with the holder counts used
+  for spam filtering
+- the block, fees and calldata of a transaction you open
 
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+You can change the endpoint in Settings to a self-hosted Blockscout instance.
+While the setting is off, each screen that would show Blockscout's data says
+instead that the setting is off. Only the tokens you track are listed. When you
+turn the setting off, every other token leaves the lists at once.
+
+When it is contacted, while "Use Blockscout" is on:
+
+- on every balance refresh
+- whenever a screen showing transaction history is opened
+- when you open a transaction
+
+Pressing "Save" beside the Blockscout URL in Settings checks the URL by asking
+it for `/stats`. That happens whether or not the setting is on. The request
+sends none of your data.
+
+What gets sent: your Ethereum addresses (to look up balances and transactions)
+and the hash of each transaction you open.
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
@@ -122,16 +146,21 @@ address.
 
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
+While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
+public Etherscan address page when you review a send. AutistMask looks for a
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
+it finds one. This is a plain page fetch with no API key, made by your browser.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
+user-configurable.
 
-When it is contacted: each time you reach the send confirmation screen.
+The setting is off in a new install. While it is off, the confirmation screen
+says that no Etherscan check was made.
 
-What gets sent: the recipient address you are about to send to, and your IP
-address. Your own addresses are not sent.
+When it is contacted: only while "Check recipients on Etherscan" is on, each
+time you reach the send confirmation screen.
+
+What gets sent: the recipient's address and nothing else. As with any request,
+Etherscan sees your IP address.
 
 Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
 contracts) are ordinary links. They contact nothing until you click them.
@@ -185,6 +214,9 @@ password.
 
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+   On first use, the screen with "Add wallet" also offers "Use Blockscout" and
+   "Check recipients on Etherscan", both off. External Services above says what
+   each one does. You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
    recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +252,14 @@ always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-Tokens you hold show up automatically only if they are in the extension's
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
+The wallet looks for tokens you hold only while "Use Blockscout" is on. Even
+then, a token shows up only if it is in the extension's bundled list of
+well-known tokens or has at least 1,000 holders. Everything else is treated as
+spam and hidden.
+
+The wallet shows every token you track, whether or not "Use Blockscout" is on.
+By default a tracked token is shown at zero balance too (see Display in
+Settings). To track a token, add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -239,7 +275,9 @@ screen. Tokens can also be added from Settings, under "Tracked Tokens".
 1. Click "Send" from the home screen or an address detail view.
 2. Select what to send (ETH, or any ERC-20 token with a balance on this address
    that survives the spam filters).
-3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
+3. Enter the recipient address or ENS name (e.g. `vitalik.eth`). AutistMask does
+   not look up a name resolved off-chain. For such a name, enter the address
+   instead.
 4. Enter the amount, or click "Max" to fill it in: a token's balance, cut to 18
    decimal places, or your ETH balance minus the amount reserved for the network
    fee.
@@ -389,8 +427,9 @@ Click the gear icon on the home screen to access settings:
   that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
-- **Blockscout API**: Change the Blockscout instance used for token balances and
-  transaction history. You can use a self-hosted instance.
+- **Blockscout API**: the "Use Blockscout" checkbox, off until you tick it, and
+  the URL of the Blockscout instance. You can use a self-hosted instance.
+- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.

src/background/index.js

@@ -17,7 +17,11 @@ const { applyChainSwitchFields } = require("../shared/chainSwitchFields");
 // the same prohibition reported early, not the guarantee.
 const { getState, updateState } = require("./state");
 const { StateUnusableError } = require("../shared/stateSchema");
-const { refreshBalances, getProvider } = require("../shared/balances");
+const {
+    refreshBalances,
+    dropUntrackedTokens,
+    getProvider,
+} = require("../shared/balances");
 const { debugFetch, log } = require("../shared/log");
 const {
     verifySignedTx,
@@ -1386,6 +1390,10 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
 // lastBalanceRefresh is left as the switch set it, so the next tick refreshes
 // the new network.
+//
+// Blockscout may have answered just before the user turned "Use Blockscout"
+// off. So the save reads the stored setting again, and drops every token the
+// user has not tracked if the setting is off.
 async function backgroundRefresh() {
     const s = await getState();
     const now = Date.now();
@@ -1423,6 +1431,9 @@ async function backgroundRefresh() {
                 }
             }
         }
+        if (!fresh.useBlockscout) {
+            dropUntrackedTokens(fresh.wallets, fresh.trackedTokens);
+        }
         fresh.lastBalanceRefresh = now;
     });
 }

src/popup/index.html

@@ -43,6 +43,38 @@
             <!-- ============ WELCOME / FIRST USE ============ -->
             <div id="view-welcome" class="view hidden">
                 <p class="mb-3">Welcome! To get started, add a wallet.</p>
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <p class="text-xs mb-2">
+                        This wallet sends your data only to the Ethereum RPC
+                        endpoint, unless you turn on one of these. You can
+                        change them later in Settings.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="welcome-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Shows transaction history, transaction details and the
+                        tokens you have not tracked. Sends your addresses, and
+                        the hash of each transaction you open, to the Blockscout
+                        API.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="welcome-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends each recipient's address to Etherscan to check it
+                        for a phishing or scam label.
+                    </p>
+                </div>
                 <button
                     id="btn-welcome-add"
                     class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
@@ -272,6 +304,10 @@
 
                 <!-- wallet list -->
                 <div id="wallet-list"></div>
+                <p id="home-tokens-note" class="text-xs text-muted py-1 hidden">
+                    Only tracked tokens are listed, because "Use Blockscout" is
+                    off in Settings.
+                </p>
 
                 <!-- recent transactions across all addresses -->
                 <div>
@@ -336,6 +372,13 @@
                     <div id="address-balances" class="min-h-[1.25rem]">
                         &nbsp;
                     </div>
+                    <p
+                        id="address-tokens-note"
+                        class="text-xs text-muted hidden"
+                    >
+                        Only tracked tokens are listed, because "Use Blockscout"
+                        is off in Settings.
+                    </p>
                 </div>
 
                 <!-- actions -->
@@ -526,12 +569,23 @@
                 </div>
                 <div class="mb-2">
                     <label class="block mb-1">What to send</label>
-                    <select
-                        id="send-token"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                    >
-                        <option value="ETH">ETH</option>
-                    </select>
+                    <!-- The token dropdown and the line under it. Both are
+                    hidden when AddressToken opens Send for its own token. -->
+                    <div id="send-token-dropdown">
+                        <select
+                            id="send-token"
+                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        >
+                            <option value="ETH">ETH</option>
+                        </select>
+                        <p
+                            id="send-tokens-note"
+                            class="text-xs text-muted hidden"
+                        >
+                            Only tracked tokens are listed, because "Use
+                            Blockscout" is off in Settings.
+                        </p>
+                    </div>
                     <div id="send-token-static" class="text-sm hidden"></div>
                 </div>
                 <div class="mb-2">
@@ -660,6 +714,13 @@
                         phishing/scam. Do not send funds to this address.
                     </div>
                 </div>
+                <p
+                    id="confirm-etherscan-note"
+                    class="mb-2 text-xs text-muted hidden"
+                >
+                    This address was not checked on Etherscan, because "Check
+                    recipients on Etherscan" is off in Settings.
+                </p>
                 <div
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
@@ -750,6 +811,7 @@
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="wait-tx-summary" class="font-bold"></div>
+                    <div id="wait-tx-token-note"></div>
                 </div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">To</div>
@@ -796,6 +858,7 @@
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="error-tx-summary" class="font-bold"></div>
+                    <div id="error-tx-token-note"></div>
                 </div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">To</div>
@@ -1002,8 +1065,19 @@
 
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Blockscout API</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="settings-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Shows transaction history, transaction details and the
+                        tokens you have not tracked. Sends your addresses, and
+                        the hash of each transaction you open, to the Blockscout
+                        API below.
+                    </p>
                     <p class="text-xs text-muted mb-1">
-                        Used to fetch token balances and transaction history.
                         Change this if you run your own Blockscout instance.
                     </p>
                     <input
@@ -1019,6 +1093,23 @@
                     </button>
                 </div>
 
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <h3 class="font-bold mb-1">Etherscan</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends each recipient's address to Etherscan to check it
+                        for a phishing or scam label.
+                    </p>
+                </div>
+
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Token Spam Protection</h3>
                     <p class="text-xs text-muted mb-2">
@@ -1291,6 +1382,13 @@
                 >
                     &nbsp;
                 </div>
+                <p
+                    id="delete-address-tokens-note"
+                    class="text-xs text-muted mb-2 hidden"
+                >
+                    Only tracked tokens are listed, because "Use Blockscout" is
+                    off in Settings.
+                </p>
                 <p class="text-xs text-muted mb-3">
                     A wallet always keeps at least one address. To remove the
                     last one, delete the whole wallet from Settings instead.
@@ -1504,6 +1602,16 @@
                     </div>
                 </div>
 
+                <!-- Shown in place of the block, decoded details, network
+                details and raw data, which only Blockscout gives. -->
+                <p
+                    id="tx-detail-blockscout-note"
+                    class="text-xs text-muted mx-1 mb-3 hidden"
+                >
+                    This screen shows no block, decoded details, network details
+                    or raw data, because "Use Blockscout" is off in Settings.
+                </p>
+
                 <!-- ── Decoded details ── -->
                 <div id="tx-detail-calldata-section" class="hidden">
                     <div class="bg-well p-3 mx-1 mb-3">

src/popup/index.js

@@ -11,7 +11,7 @@ const {
 const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
-const { refreshBalances } = require("../shared/balances");
+const { refreshBalances, dropUntrackedTokens } = require("../shared/balances");
 const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
     $,
@@ -71,21 +71,28 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 
+// The refresh first takes the stored network, "Use Blockscout" and "Check
+// recipients on Etherscan" (followStoredSettings() below). So the screens it
+// draws reflect any change saved elsewhere.
+//
 // The refresh writes into a copy of the wallets. Inside the save, under the
 // lock, its results are copied onto the address records in `state` only if the
 // network it ran on is still the active one, on this page and in the stored
 // record; the background's switch, after the user approves a site's request,
-// reaches this page only after the stored record (followNetworkSwitch() below).
+// reaches this page only after the stored record (followStoredSettings()).
 // A switch while the refresh ran cleared every address's balances
 // (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
 // previous network's must not come back over them
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
 // recorded as done. Results are copied by address, so an address added or
-// removed meanwhile is left as it is.
+// removed meanwhile is left as it is. Blockscout may have answered before the
+// user turned "Use Blockscout" off. So the save drops every token the user has
+// not tracked if the stored setting is off by then.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
+        await followStoredSettings();
         const networkId = state.networkId;
         const wallets = structuredClone(state.wallets);
         await Promise.all([
@@ -117,6 +124,9 @@ async function doRefreshAndRender() {
                     }
                 }
             }
+            if (!stored.useBlockscout) {
+                dropUntrackedTokens(state.wallets, stored.trackedTokens);
+            }
             state.lastBalanceRefresh = Date.now();
             return true;
         });
@@ -228,17 +238,36 @@ function fallbackView() {
 // src/shared/chainSwitch.js), so a record naming a network other than this
 // page's always holds a switch saved elsewhere, and a switch the user picks
 // here while this waits for the lock is made after it.
-async function followNetworkSwitch() {
-    let switched = false;
+//
+// Another page may change "Use Blockscout" or "Check recipients on Etherscan".
+// This page takes either change the same way and draws its screens again. This
+// page's own changes to the two settings are made under the lock too
+// (views/settings.js, views/welcome.js).
+async function followStoredSettings() {
+    let changed = false;
     // A failed save is reported by saveState() itself: see onSaveFailure().
     await saveState((stored) => {
-        if (stored.networkId === state.networkId) return false;
-        settings.cutViewStack();
-        takeStoredNetwork(stored);
-        clearPopupCaches();
-        switched = true;
+        if (stored.networkId !== state.networkId) {
+            settings.cutViewStack();
+            takeStoredNetwork(stored);
+            clearPopupCaches();
+            changed = true;
+        }
+        if (stored.useBlockscout !== state.useBlockscout) {
+            settings.setUseBlockscout(stored.useBlockscout);
+            changed = true;
+        }
+        if (
+            stored.checkRecipientsOnEtherscan !==
+            state.checkRecipientsOnEtherscan
+        ) {
+            state.checkRecipientsOnEtherscan =
+                stored.checkRecipientsOnEtherscan;
+            changed = true;
+        }
+        if (!changed) return false;
     }).catch(() => {});
-    if (switched) settings.showNewNetwork();
+    if (changed) settings.showNewSettings();
 }
 
 // The background opens the approval window as wide as the page, but the
@@ -385,19 +414,27 @@ async function init() {
     settingsAddToken.init(ctx);
     deleteAddress.init(ctx);
 
-    // Only a record naming a network other than this page's is followed: the
-    // one this page's own switch in Settings saves names the network it
-    // already has, and a record naming none is no switch.
+    // This page follows a record only when its network, "Use Blockscout" or
+    // "Check recipients on Etherscan" differs from this page's. A record
+    // written by this page's own save matches this page. A record naming no
+    // network is no switch.
     onStorageChanged((changes) => {
         const written = changes.autistmask && changes.autistmask.newValue;
         if (!written || !written.networkId) return;
-        if (written.networkId !== state.networkId) followNetworkSwitch();
+        if (
+            written.networkId !== state.networkId ||
+            written.useBlockscout !== state.useBlockscout ||
+            written.checkRecipientsOnEtherscan !==
+                state.checkRecipientsOnEtherscan
+        ) {
+            followStoredSettings();
+        }
     });
-    // A switch saved since loadState() above, before there was a listener.
-    followNetworkSwitch();
+    // A change saved since loadState() above, before there was a listener.
+    followStoredSettings();
 
     if (!state.hasWallet) {
-        showView("welcome");
+        welcome.show();
     } else {
         renderWalletList();
         restoreView();

src/popup/viewRouter.js

@@ -38,11 +38,16 @@ function markViewRendered(view) {
     if (view) renderedViews.add(view);
 }
 
-// Begin a fresh page-load scope. The popup gets one by being loaded, and
-// asks for one after a network switch, because every screen then on the page
-// shows the previous network (showNewNetwork() in views/settings.js); the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one too.
+// Begin a fresh page-load scope. The popup gets one by being loaded. It also
+// asks for one when every screen on the page is out of date:
+//
+//   - after a network switch, since those screens show the previous network
+//     (showNewSettings() in views/settings.js)
+//   - after "Use Blockscout" or "Check recipients on Etherscan" changes, here
+//     or on another page, since those screens were drawn under the old setting
+//
+// The unit tests ask for one too. They simulate several page loads against one
+// module instance.
 function resetRenderedViews() {
     renderedViews.clear();
 }

src/popup/views/addressDetail.js

@@ -4,6 +4,7 @@ const {
     showFlash,
     balanceLinesForAddress,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -83,6 +84,8 @@ function show() {
                 ctx.showAddressToken();
             });
         });
+    // Only Blockscout reports the tokens the user has not tracked.
+    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     renderSendTokenSelect(addr);
     $("tx-list").innerHTML =
         '<div class="text-muted text-xs py-1">Loading...</div>';
@@ -155,6 +158,10 @@ async function loadTransactions(address) {
 
 function renderTransactions(txs) {
     const list = $("tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -229,7 +236,7 @@ function init(_ctx) {
         }
         $("send-to").value = "";
         $("send-amount").value = "";
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         updateSendBalance();
         resetSendValidation();

src/popup/views/addressToken.js

@@ -7,6 +7,7 @@ const {
     showFlash,
     flashCopyFeedback,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -239,6 +240,10 @@ async function loadTransactions(address, tokenId) {
 
 function renderTransactions(txs) {
     const list = $("address-token-tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -324,7 +329,7 @@ function init(_ctx) {
             $("send-token").value = tokenId;
         }
         // Hide dropdown, show static token display
-        $("send-token").classList.add("hidden");
+        $("send-token-dropdown").classList.add("hidden");
         let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
         if (tokenId !== "ETH") {
             staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;

src/popup/views/approval.js

@@ -11,6 +11,7 @@ const {
     onViewLeave,
     formatFee,
     tokenLabel,
+    blockscoutOffTokenNoteHtml,
     tokenSourcesByChainId,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
@@ -401,6 +402,10 @@ function showTxApproval(details) {
             if (d.address) {
                 if (d.isToken) {
                     detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
+                    detailsHtml += blockscoutOffTokenNoteHtml(
+                        d.address,
+                        approvedTx.chainId,
+                    );
                 }
                 detailsHtml += approvalAddressHtml(
                     d.address,
@@ -623,10 +628,7 @@ function permitWarningHtml(types, primaryType, domain, message) {
             return "";
     }
 
-    const sources = {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    };
+    const sources = tokenSourcesByChainId();
     const spender = addressOrNull(
         declaredField(types, primaryType, message, "spender")?.value,
     );
@@ -655,6 +657,7 @@ function permitWarningHtml(types, primaryType, domain, message) {
         html += `<div class="mb-2"><div>Token</div>`;
         if (token) {
             html += `<div>${escapeHtml(tokenLabel(token) || "Unknown token")}</div>`;
+            html += blockscoutOffTokenNoteHtml(token);
             html += approvalAddressHtml(token);
         } else {
             html += `<div>Unknown</div>`;

src/popup/views/confirmTx.js

@@ -334,6 +334,11 @@ function show(txInfo) {
     $("confirm-contract-warning").style.visibility = "hidden";
     $("confirm-burn-warning").style.visibility = "hidden";
     $("confirm-etherscan-warning").style.visibility = "hidden";
+    // While "Check recipients on Etherscan" is off, there is no Etherscan
+    // warning to reserve space for. A line in its place says the check is off.
+    const etherscanOn = !!state.checkRecipientsOnEtherscan;
+    $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
+    $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
 
     // Show burn warning via reserved element (in addition to inline warning)
     if (isBurnAddress(txInfo.to)) {

src/popup/views/deleteAddress.js

@@ -119,6 +119,11 @@ function show(walletIdx, addrIdx) {
 
     $("delete-address-recovery").textContent = recoveryPathText(wallet);
     $("delete-address-balance").innerHTML = balanceWarningHtml(addr);
+    // Only Blockscout reports the tokens the user has not tracked.
+    $("delete-address-tokens-note").classList.toggle(
+        "hidden",
+        !!state.useBlockscout,
+    );
 
     setFlash("");
     showView("delete-address-confirm");

src/popup/views/deleteWallet.js

@@ -16,6 +16,7 @@ const {
     broadcastActiveChanged,
 } = require("../../shared/walletDelete");
 const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
+const welcome = require("./welcome");
 
 let deleteWalletIndex = null;
 let lostPasswordIndex = null;
@@ -135,7 +136,7 @@ async function finishDelete(walletIdx) {
         // Save before broadcasting: the background reads the active
         // address back out of storage to build accountsChanged.
         if (activeAddressChanged) broadcastActiveChanged();
-        showView("welcome");
+        welcome.show();
         return;
     }
 

src/popup/views/helpers.js

@@ -21,7 +21,10 @@ const {
     truncateAmountNeverZero,
     isBelowOneMillionth,
 } = require("../../shared/amountDisplay");
-const { resolveTokenSymbol } = require("../../shared/approvalAmount");
+const {
+    resolveTokenDecimals,
+    resolveTokenSymbol,
+} = require("../../shared/approvalAmount");
 const { getProvider } = require("../../shared/balances");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
@@ -306,10 +309,16 @@ function nativeCurrency() {
 // names a token on one network only, and every token balance held is the
 // active network's, so another network gets the tokens tracked on it
 // (state.networkTrackedTokens, see applyChainSwitchFields()) and no balances.
+//
+// The wallets' balances hold what Blockscout reported for each token. So the
+// wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
     const net = chainId ? networkByChainId(chainId) : currentNetwork();
     if (net && net.id === state.networkId) {
-        return { trackedTokens: state.trackedTokens, wallets: state.wallets };
+        return {
+            trackedTokens: state.trackedTokens,
+            wallets: state.useBlockscout ? state.wallets : [],
+        };
     }
     return {
         trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
@@ -317,11 +326,39 @@ function tokenSourcesByChainId(chainId) {
     };
 }
 
-// The symbol shown for a token line on the network with `chainId`, or on the
-// active network when none is given: from the bundled list, the tokens the
-// user tracks, and the explorer's report, the sources the amount line's scale
-// comes from. Null when no source names one, so the token lines keep saying
-// `Unknown token` for a token nothing knows.
+// The line shown under a token while "Use Blockscout" is off. The token gets
+// the line only when the bundled list and the tracked tokens lack its name or
+// decimals. Otherwise this returns "". The token is a contract address on the
+// network with `chainId`, or on the active network when none is given. "ETH"
+// and null are no contract, and get "". A token that is not text also gets "":
+// WaitTx and ErrorTx pass a token restored from storage unchecked.
+function blockscoutOffTokenNoteHtml(token, chainId) {
+    if (typeof token !== "string") return "";
+    if (state.useBlockscout || !token || token === "ETH") return "";
+    const sources = tokenSourcesByChainId(chainId);
+    if (
+        resolveTokenSymbol(token, sources) !== null &&
+        resolveTokenDecimals(token, sources) !== null
+    ) {
+        return "";
+    }
+    return (
+        '<div class="text-xs text-muted">Blockscout\'s report of your balances' +
+        ' is not used to name this token, because "Use Blockscout" is off in' +
+        " Settings.</div>"
+    );
+}
+
+// The symbol shown for a token line, from these sources in order:
+//
+// - the bundled list
+// - the tokens the user tracks
+// - the explorer's report, while "Use Blockscout" is on
+//
+// The network is the one with `chainId`, or the active network when none is
+// given. The amount line's scale comes from the same sources. Null when no
+// source names one, so the token lines keep saying `Unknown token` for a token
+// nothing knows.
 function tokenLabel(address, chainId) {
     return resolveTokenSymbol(address, tokenSourcesByChainId(chainId));
 }
@@ -534,6 +571,12 @@ function addressTitle(address, wallets) {
 const CONTRACT_CREATION_TEXT =
     "This transaction creates a new contract. It has no recipient.";
 
+// The line shown in place of the transaction history on Home, AddressDetail and
+// AddressToken while "Use Blockscout" is off. That history comes from
+// Blockscout alone.
+const HISTORY_OFF_TEXT =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
 // The last two lines of a transaction history row: the counterparty's colour
 // dot and name beside the amount, then its full address. A contract creation
 // the user sent has no counterparty (its `to` is ""), so its row has the
@@ -791,6 +834,7 @@ module.exports = {
     unknownableAmount,
     nativeCurrency,
     tokenSourcesByChainId,
+    blockscoutOffTokenNoteHtml,
     tokenLabel,
     formatFee,
     addressDotHtml,
@@ -799,6 +843,7 @@ module.exports = {
     displaySymbol,
     addressTitle,
     CONTRACT_CREATION_TEXT,
+    HISTORY_OFF_TEXT,
     txCounterpartyHtml,
     formatAddressHtml,
     renderAddressHtml,

src/popup/views/home.js

@@ -7,6 +7,7 @@ const {
     timeAgo,
     addressDotHtml,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -100,6 +101,10 @@ let homeTxs = [];
 function renderHomeTxList(ctx) {
     const list = $("home-tx-list");
     if (!list) return;
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (homeTxs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -300,6 +305,8 @@ function walletListHtml() {
 
 function render(ctx) {
     const container = $("wallet-list");
+    // Only Blockscout reports the tokens the user has not tracked.
+    $("home-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     if (state.wallets.length === 0) {
         container.innerHTML =
             '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';
@@ -447,7 +454,7 @@ function init(ctx) {
         }
         $("send-to").value = "";
         $("send-amount").value = "";
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         renderSendTokenSelect(addr);
         updateSendBalance();

src/popup/views/send.js

@@ -10,6 +10,7 @@ const {
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
+    tokenSourcesByChainId,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
@@ -141,6 +142,8 @@ function updateToValidation() {
 }
 
 function renderSendTokenSelect(addr) {
+    // Only Blockscout reports the tokens the user has not tracked.
+    $("send-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     const sel = $("send-token");
     sel.innerHTML = `<option value="ETH">${escapeHtml(nativeCurrency())}</option>`;
     const fraudSet = new Set(
@@ -185,7 +188,9 @@ function renderSendTokenSelect(addr) {
 // so the transfer is encoded with the number the user read rather than with
 // whatever the contract answers at signing time (see
 // src/shared/transferAmount.js). balances.js is formatting one explorer row at
-// fetch time and cannot consult a state it is in the middle of replacing.
+// fetch time and cannot consult a state it is in the middle of replacing. As on
+// the approval screens, tokenSourcesByChainId() gives the wallets only while
+// "Use Blockscout" is on.
 //
 // The two resolutions can therefore differ, and where they do, the stored
 // `balance` is a quantity computed at a scale this screen has just declined to
@@ -198,10 +203,7 @@ function tokenBalanceAndDecimals(addr, token) {
     const tb = (addr.tokenBalances || []).find(
         (t) => t.address.toLowerCase() === token.toLowerCase(),
     );
-    const tokenDecimals = resolveTokenDecimals(token, {
-        trackedTokens: state.trackedTokens,
-        wallets: state.wallets,
-    });
+    const tokenDecimals = resolveTokenDecimals(token, tokenSourcesByChainId());
     if (!tb) return { tokenBalance: "0", tokenDecimals };
     if (tokenDecimals === null) return { tokenBalance: null, tokenDecimals };
     return { tokenBalance: tb.balance ?? null, tokenDecimals };
@@ -401,8 +403,11 @@ function init(_ctx) {
             try {
                 const provider = getProvider(state.rpcUrl, state.networkId);
                 const resolved = await provider.resolveName(to);
+                // getProvider() does not look up a name resolved off-chain,
+                // so such a name comes back with no address too. The message
+                // covers both, in the one line the flash area shows.
                 if (!resolved) {
-                    showFlash("That ENS name has no address.");
+                    showFlash("That ENS name has no on-chain address.");
                     return;
                 }
                 resolvedTo = resolved;
@@ -426,7 +431,7 @@ function init(_ctx) {
     });
 
     $("btn-send-back").addEventListener("click", () => {
-        $("send-token").classList.remove("hidden");
+        $("send-token-dropdown").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         goBack();
     });

src/popup/views/settings.js

@@ -17,6 +17,7 @@ const {
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { restorableStack } = require("../../shared/persistedState");
+const { dropUntrackedTokens } = require("../../shared/balances");
 const { resetRenderedViews, markViewRendered } = require("../viewRouter");
 const {
     log,
@@ -201,6 +202,10 @@ function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
     $("settings-network").value = state.networkId;
+    // Set on every show, not only at init: Welcome can change these two.
+    $("settings-use-blockscout").checked = state.useBlockscout;
+    $("settings-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -247,16 +252,20 @@ async function renderSiteLists() {
 
 // A network switch, made by the user here or saved by the background once the
 // user approved a site's request (src/popup/index.js), leaves every screen on
-// the page showing the previous network. These two leave the page as README's
-// Screen Map describes, the first before the switch is saved, so that save
-// keeps the cut for a popup closed straight after, the second once `state`
-// holds the new network.
+// the page showing the previous network. Two functions leave the page as
+// README's Screen Map describes:
+//
+// - cutViewStack(), before the switch is saved, so that save keeps the cut for
+//   a popup closed straight after
+// - showNewSettings(), once `state` holds the new network
 //
 // The stack is cut at the first screen that cannot be rendered from saved
 // state, such as Send or AddToken, and at AddressToken unless it shows the
 // native token: any other token there was picked on the previous network, so
 // it is no longer selected either. Without a wallet the stack starts at
 // Welcome, which that cut would drop, and Welcome shows nothing from a network.
+// A change to "Use Blockscout" cuts the stack the same way (setUseBlockscout()
+// below).
 function cutViewStack() {
     if (!state.hasWallet) return;
     if (state.selectedToken !== "ETH") {
@@ -269,18 +278,40 @@ function cutViewStack() {
     state.viewStack = restorableStack(state.viewStack, state.currentView);
 }
 
-// Every screen counts as not yet rendered, so "Back" renders the one it lands
-// on for the new network. Settings on top is brought up to date in place;
-// any other screen is drawn again as a reopened popup draws it, which is Home
-// for one that cannot be rendered from saved state. Without a wallet any other
-// screen is Welcome or AddWallet, which show nothing from a network.
-function showNewNetwork() {
+// Sets "Use Blockscout" to `on` on this page. It is called inside a save,
+// holding the lock, for the user's change here or another page's
+// (followStoredSettings() in src/popup/index.js).
+//
+// Send's token dropdown was filled under the old setting, and Back cannot draw
+// Send again. So the stack is cut, as for a network switch. Turning the setting
+// off also drops every token the user has not tracked.
+function setUseBlockscout(on) {
+    state.useBlockscout = on;
+    cutViewStack();
+    if (!on) dropUntrackedTokens(state.wallets, state.trackedTokens);
+}
+
+// Draws the page again after a network switch, or after another page changed
+// "Use Blockscout" or "Check recipients on Etherscan". Every screen counts as
+// not yet rendered, so "Back" renders again any screen that a reopened popup
+// can render. Settings on top is brought up to date in place. Any other screen
+// is drawn again as a reopened popup draws it, which is Home for one that
+// cannot be rendered from saved state. Without a wallet any other screen is
+// Welcome or AddWallet. Back only unhides Welcome, so its two checkboxes are
+// set here.
+function showNewSettings() {
     resetRenderedViews();
+    $("welcome-use-blockscout").checked = state.useBlockscout;
+    $("welcome-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
     if (state.currentView === "settings") {
         markViewRendered("settings");
         $("settings-network").value = state.networkId;
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
+        $("settings-use-blockscout").checked = state.useBlockscout;
+        $("settings-check-recipients-on-etherscan").checked =
+            state.checkRecipientsOnEtherscan;
         renderTrackedTokens();
     } else if (state.hasWallet) {
         ctx.restoreView();
@@ -363,6 +394,35 @@ function init(_ctx) {
         showFlash("Saved.");
     });
 
+    // Each change is made inside the save, holding the lock. So
+    // followStoredSettings() in src/popup/index.js never mistakes this page's
+    // unsaved change for one that another page saved.
+    //
+    // The screens under Settings were drawn under the old setting. So each
+    // change makes every screen but Settings count as not yet drawn, as a
+    // network switch does. Back then draws again any screen that a reopened
+    // popup can draw. Back only unhides Welcome, so its boxes are set here too.
+    $("settings-use-blockscout").addEventListener("change", async () => {
+        const on = $("settings-use-blockscout").checked;
+        await saveState(() => setUseBlockscout(on));
+        $("welcome-use-blockscout").checked = on;
+        resetRenderedViews();
+        markViewRendered("settings");
+    });
+
+    $("settings-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            const on = $("settings-check-recipients-on-etherscan").checked;
+            await saveState(() => {
+                state.checkRecipientsOnEtherscan = on;
+            });
+            $("welcome-check-recipients-on-etherscan").checked = on;
+            resetRenderedViews();
+            markViewRendered("settings");
+        },
+    );
+
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
         // Whether `state` already has the network picked is asked only once
@@ -376,7 +436,7 @@ function init(_ctx) {
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        showNewNetwork();
+        showNewSettings();
         showFlash("Switched to " + net.name + ".");
     });
 
@@ -516,5 +576,6 @@ module.exports = {
     show,
     renderSiteLists,
     cutViewStack,
-    showNewNetwork,
+    setUseBlockscout,
+    showNewSettings,
 };

src/popup/views/transactionDetail.js

@@ -26,6 +26,7 @@ const { state } = require("../../shared/state");
 const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("../../shared/log");
+const { storedSettingIsOn } = require("../../shared/storedSettings");
 const { decodeCalldata } = require("./approval");
 
 /**
@@ -172,7 +173,8 @@ function render() {
         }
     }
 
-    // Hide calldata and raw data sections; always fetch full tx details
+    // Hide the calldata and raw data sections. loadFullTxDetails() shows them
+    // once it has their data.
     const calldataSection = $("tx-detail-calldata-section");
     if (calldataSection) calldataSection.classList.add("hidden");
     const rawDataSection = $("tx-detail-rawdata-section");
@@ -191,6 +193,12 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
+    // The block, network details, decoded details and raw data come from
+    // Blockscout. While the setting is off, this line says why none is shown.
+    $("tx-detail-blockscout-note").classList.toggle(
+        "hidden",
+        !!state.useBlockscout,
+    );
     loadFullTxDetails(tx.hash, tx.chainId);
 
     const isoStr = isoDate(tx.timestamp);
@@ -303,7 +311,12 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
+// Reads the block, network details and calldata from Blockscout, and decodes
+// the calldata. While the stored "Use Blockscout" is off, Blockscout is not
+// asked. An answer that lands after the setting went off is dropped
+// (src/shared/storedSettings.js). Either way none of them is shown.
 async function loadFullTxDetails(txHash, chainId) {
+    if (!(await storedSettingIsOn("useBlockscout"))) return;
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -319,6 +332,7 @@ async function loadFullTxDetails(txHash, chainId) {
         );
         if (!resp.ok) return;
         const txData = await resp.json();
+        if (!(await storedSettingIsOn("useBlockscout"))) return;
 
         // Populate on-chain detail fields (block, nonce, gas, fee)
         populateOnChainDetails(txData, chainId);

src/popup/views/txStatus.js

@@ -14,6 +14,7 @@ const {
     displaySymbol,
     clearViewStack,
     tokenLabel,
+    blockscoutOffTokenNoteHtml,
     reviewedNetworkProvider,
 } = require("./helpers");
 const { state } = require("../../shared/state");
@@ -108,6 +109,10 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     }
     $("wait-tx-summary").textContent =
         txInfo.amount + (symbol ? " " + symbol : "");
+    $("wait-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
+        txInfo.token,
+        txInfo.chainId,
+    );
     $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to, txInfo.chainId);
     $("wait-tx-hash").innerHTML = txHashHtml(txHash, txInfo.chainId);
     attachCopyHandlers("view-wait-tx");
@@ -215,9 +220,10 @@ function showWait(txInfo, txHash) {
 // init and leaving wait-tx on screen with no back control. A non-numeric
 // broadcastTime leaves an unexitable wait counting "NaNs". txInfo.chainId picks
 // the node the receipt is asked of and the explorer the links open, so it has
-// to name a network. txInfo.token and txInfo.tokenSymbol are deliberately
-// unchecked: they are compared and coalesced rather than dereferenced, and
-// tokenSymbol is null for ETH.
+// to name a network. txInfo.token and txInfo.tokenSymbol are not checked here.
+// blockscoutOffTokenNoteHtml() shows no line for a token that is not text.
+// Everything else only compares and coalesces them, and tokenSymbol is null for
+// ETH.
 function restoreWait() {
     const d = state.viewData;
     if (!d || !d.pendingWait) return false;
@@ -282,6 +288,7 @@ function decodedDetailsHtml(decoded, chainId) {
             if (d.isToken) {
                 const sym = tokenLabel(d.address, chainId) || "Unknown token";
                 html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
+                html += blockscoutOffTokenNoteHtml(d.address, chainId);
                 html += toAddressHtml(d.address, chainId);
             } else {
                 html += toAddressHtml(d.address, chainId);
@@ -345,6 +352,7 @@ function showError(txInfo, txHash, message) {
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
+        token: txInfo.token,
         to: txInfo.to,
         hash: txHash || null,
         message: message,
@@ -358,6 +366,10 @@ function renderError() {
     if (!d || !d.message) return;
     $("error-tx-summary").textContent =
         d.amount + (d.symbol ? " " + d.symbol : "");
+    $("error-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
+        d.token,
+        d.chainId,
+    );
     $("error-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
     $("error-tx-message").textContent = d.message;
 

src/popup/views/welcome.js

@@ -1,7 +1,37 @@
-const { $ } = require("./helpers");
+// The first screen, shown while there is no wallet. It offers "Use Blockscout"
+// and "Check recipients on Etherscan", which Settings offers too. Both are off
+// until the user ticks them.
 
-function init(ctx) {
-    $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
+const { $, showView } = require("./helpers");
+const { state, saveState } = require("../../shared/state");
+
+function show() {
+    $("welcome-use-blockscout").checked = state.useBlockscout;
+    $("welcome-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
+    showView("welcome");
 }
 
-module.exports = { init };
+// Each change is made inside the save, holding the lock, as Settings makes it.
+function init(ctx) {
+    $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
+
+    $("welcome-use-blockscout").addEventListener("change", async () => {
+        const on = $("welcome-use-blockscout").checked;
+        await saveState(() => {
+            state.useBlockscout = on;
+        });
+    });
+
+    $("welcome-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            const on = $("welcome-check-recipients-on-etherscan").checked;
+            await saveState(() => {
+                state.checkRecipientsOnEtherscan = on;
+            });
+        },
+    );
+}
+
+module.exports = { init, show };

src/shared/balances.js

@@ -1,6 +1,10 @@
-// Balance fetching: ETH balances and the balances of the tokens the user
-// tracks via RPC, the other ERC-20 token balances via Blockscout, ENS reverse
-// lookup via RPC.
+// Balance fetching:
+//
+//   - ETH balances, and the balances of the tokens the user tracks, via RPC
+//   - the other ERC-20 token balances and the holder counts via Blockscout,
+//     while the user has "Use Blockscout" on. Those balances are dropped when
+//     the setting is off.
+//   - ENS reverse lookup via RPC
 
 const {
     JsonRpcProvider,
@@ -18,6 +22,7 @@ const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
 const { resolveTokenDecimals } = require("./approvalAmount");
+const { storedSettingIsOn } = require("./storedSettings");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -37,9 +42,18 @@ const { resolveTokenDecimals } = require("./approvalAmount");
 // ethers knows chains this wallet does not, so an id that is not one of ours
 // is a caller bug and must not resolve to a working provider for some other
 // chain.
+//
+// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. A resolver can
+// say a name is resolved off-chain and give a web address for it. By default
+// ethers then fetches that address straight from the browser, sending the name
+// being looked up. For the reverse lookup of the user's addresses, the name sent
+// is the user's own (https://git.eeqj.de/sneak/AutistMask/issues/668). With the
+// flag set, such a name does not resolve.
 function getProvider(rpcUrl, networkId) {
     const net = Network.from(requireNetworkId(networkId).id);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    provider.disableCcipRead = true;
+    return provider;
 }
 
 function requireNetworkId(networkId) {
@@ -81,10 +95,16 @@ function rawUnits(value) {
 
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
+//
+// While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
+// that lands after the setting went off is dropped
+// (src/shared/storedSettings.js). Either way this returns an empty list, so
+// only tracked tokens are listed.
+//
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders. refreshBalances()
-// keeps only the rows for tokens the user has not tracked: a tracked token's
-// balance is read through the RPC endpoint (fetchTrackedTokenBalances()).
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
+// balance is read through the RPC endpoint instead, and its row here gives that
+// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -99,6 +119,7 @@ async function fetchTokenBalances(
     trackedTokens,
     signal,
 ) {
+    if (!(await storedSettingIsOn("useBlockscout"))) return [];
     try {
         const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -108,6 +129,7 @@ async function fetchTokenBalances(
             return null;
         }
         const items = await resp.json();
+        if (!(await storedSettingIsOn("useBlockscout"))) return [];
         if (!Array.isArray(items)) return null;
 
         const trackedSet = new Set(
@@ -208,21 +230,24 @@ async function fetchTokenBalances(
     }
 }
 
-// The balance at `address` of each token the user tracks, read with balanceOf
-// through the RPC endpoint. Returns rows shaped as fetchTokenBalances() returns
-// them, for the tokens the address holds.
+// The entries at `address` of the tokens the user tracks, shaped as
+// fetchTokenBalances() returns them, for the tokens the address holds.
 //
-// A token whose balanceOf fails keeps its row from `previous`, the address's
-// rows before this refresh, as a failed ETH balance keeps its figure, and the
-// failure is logged. A balance of zero gets no row, as a zero Blockscout
-// reports gets none: the balance lists take a tracked token's zero from the
-// tracked list. A token whose symbol the spoof rule refuses gets no row either,
-// as in fetchTokenBalances().
-//
-// The balance is stated at the scale the screens read this token at
+// The balance is read with balanceOf through the RPC endpoint. The name and
+// symbol are the tracked token's. `decimals` and `holders` are those of
+// Blockscout's entry for the token in `explorerRequest`, this refresh's
+// fetchTokenBalances() for the address; while Blockscout fails they are kept
+// from the token's entry in `previous`, the address's entries before this
+// refresh. The balance is stated at the scale the screens read the token at
 // (resolveTokenDecimals()): the bundled list's, then the one the tracked token
-// records. `decimals` and `holders` hold what Blockscout reported for a token;
-// Blockscout is not asked about a tracked token, so both are null.
+// records, then Blockscout's, as in fetchTokenBalances().
+//
+// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
+// balance keeps its figure, or takes Blockscout's entry from this refresh when
+// it has none. The failure is logged. A balance of zero gets no entry, as a
+// zero Blockscout reports gets none: the balance lists take a tracked token's
+// zero from the tracked list. A token whose symbol the spoof rule refuses gets
+// no entry either, as in fetchTokenBalances().
 //
 // `signal` is as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
@@ -230,20 +255,22 @@ async function fetchTrackedTokenBalances(
     address,
     trackedTokens,
     previous,
+    explorerRequest,
     signal,
 ) {
-    const rows = await Promise.all(
-        trackedTokens.map(async (token) => {
-            if (isSpoofedSymbol(token.symbol, token.address)) return null;
-            const lower = token.address.toLowerCase();
-            let raw;
+    const listed = trackedTokens.filter(
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
+    );
+    // Each token's balanceOf answer, or null where it failed.
+    const balances = await Promise.all(
+        listed.map(async (token) => {
             try {
                 const contract = new Contract(
                     token.address,
                     ERC20_ABI,
                     provider,
                 );
-                raw = await contract.balanceOf(address);
+                return await contract.balanceOf(address);
             } catch (e) {
                 if (!signal?.aborted) {
                     log.errorf(
@@ -253,27 +280,41 @@ async function fetchTrackedTokenBalances(
                         e.shortMessage || e.message,
                     );
                 }
-                return (
-                    previous.find(
-                        (row) => String(row.address).toLowerCase() === lower,
-                    ) || null
-                );
+                return null;
             }
-            if (raw === 0n) return null;
-            const scale = resolveTokenDecimals(lower, { trackedTokens });
-            return {
-                address: token.address,
-                name: token.name || "",
-                symbol: token.symbol || "???",
-                decimals: null,
-                // null when nothing knows the scale: a holding whose amount
-                // cannot be stated, never a zero.
-                balance: scale === null ? null : formatTokenBalance(raw, scale),
-                holders: null,
-            };
         }),
     );
-    return rows.filter((row) => row !== null);
+    const explorerRows = await explorerRequest;
+    const reported = explorerRows ?? previous;
+
+    const rows = [];
+    listed.forEach((token, i) => {
+        const lower = token.address.toLowerCase();
+        const entryIn = (list) =>
+            list.find((row) => String(row.address).toLowerCase() === lower);
+        const raw = balances[i];
+        if (raw === null) {
+            const kept = entryIn(previous) || entryIn(explorerRows || []);
+            if (kept) rows.push(kept);
+            return;
+        }
+        if (raw === 0n) return;
+        const entry = entryIn(reported);
+        const decimals = entry ? entry.decimals : null;
+        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const scale = known !== null ? known : decimals;
+        rows.push({
+            address: token.address,
+            name: token.name || "",
+            symbol: token.symbol || "???",
+            decimals: decimals,
+            // null when nothing knows the scale: a holding whose amount
+            // cannot be stated, never a zero.
+            balance: scale === null ? null : formatTokenBalance(raw, scale),
+            holders: entry ? entry.holders : null,
+        });
+    });
+    return rows;
 }
 
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
@@ -341,10 +382,19 @@ async function refreshBalances(
             );
 
             // ERC-20 token balances: the tracked tokens' through the RPC
-            // endpoint, and from Blockscout only the tokens the user has not
+            // endpoint, and from Blockscout the tokens the user has not
             // tracked. When Blockscout fails, the untracked rows from before
-            // this refresh stay.
+            // this refresh stay. While "Use Blockscout" is off, there are no
+            // untracked rows. The Blockscout request is started first and
+            // handed to fetchTrackedTokenBalances() too, which waits for it
+            // after sending its balanceOf reads, so the two run side by side.
             const previous = addr.tokenBalances || [];
+            const explorerRequest = fetchTokenBalances(
+                addr.address,
+                blockscoutUrl,
+                tracked,
+                signal,
+            );
             updates.push(
                 Promise.all([
                     fetchTrackedTokenBalances(
@@ -352,14 +402,10 @@ async function refreshBalances(
                         addr.address,
                         tracked,
                         previous,
+                        explorerRequest,
                         signal,
                     ),
-                    fetchTokenBalances(
-                        addr.address,
-                        blockscoutUrl,
-                        tracked,
-                        signal,
-                    ),
+                    explorerRequest,
                 ]).then(([trackedRows, explorerRows]) => {
                     const untrackedRows = (explorerRows ?? previous).filter(
                         (row) =>
@@ -381,6 +427,20 @@ async function refreshBalances(
     log.debugf("refreshBalances done");
 }
 
+// Drops the balance of each token not in `trackedTokens` from every address.
+// Callers run it while "Use Blockscout" is off, since only Blockscout reports
+// those tokens.
+function dropUntrackedTokens(wallets, trackedTokens) {
+    const tracked = new Set(trackedTokens.map((t) => t.address.toLowerCase()));
+    for (const wallet of wallets) {
+        for (const addr of wallet.addresses || []) {
+            addr.tokenBalances = (addr.tokenBalances || []).filter((row) =>
+                tracked.has(String(row.address).toLowerCase()),
+            );
+        }
+    }
+}
+
 // Look up token metadata from its contract.
 // Calls symbol() and decimals() to verify it implements ERC-20.
 // `signal` is as for fetchTokenBalances().
@@ -499,6 +559,7 @@ async function scanForAddresses(xpub, rpcUrl, networkId, signal, gapLimit = 5) {
 module.exports = {
     fetchTokenBalances,
     refreshBalances,
+    dropUntrackedTokens,
     lookupTokenInfo,
     getProvider,
     scanForAddresses,

src/shared/chainSwitch.js

@@ -4,7 +4,7 @@
 //
 // - onChainSwitch() below makes the switch the user picks in Settings, with
 //   applyChainSwitchFields() (chainSwitchFields.js).
-// - followNetworkSwitch() in src/popup/index.js takes a switch the background
+// - followStoredSettings() in src/popup/index.js takes a switch the background
 //   or another popup page saved, from the stored record, with
 //   takeStoredNetwork() (state.js), which copies it with
 //   copyChainSwitchFields() (chainSwitchFields.js).
@@ -45,7 +45,7 @@ function clearPopupCaches() {
 //
 // `state` is switched inside the save that stores the switch, holding the
 // lock, so it is never switched while a follow of a switch saved elsewhere
-// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
+// waits for the lock (followStoredSettings() in src/popup/index.js): that
 // follow runs first, and this switch is made after it.
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");

src/shared/etherscanLabels.js

@@ -3,6 +3,7 @@
 // This is a best-effort enrichment: network failures return null silently.
 
 const { networkByChainId } = require("./networks");
+const { storedSettingIsOn } = require("./storedSettings");
 
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
@@ -78,12 +79,19 @@ function parseEtherscanPage(html) {
  * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
  * Sepolia.
  *
+ * While the stored "Check recipients on Etherscan" is off, Etherscan is not
+ * asked. An answer that lands after the setting went off is dropped
+ * (src/shared/storedSettings.js). Either way the answer is null.
+ *
  * @param {string} address - Ethereum address to check.
  * @param {string} [chainId] - Chain id of the network to look it up on.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
 async function checkEtherscanLabel(address, chainId) {
     try {
+        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
+            return null;
+        }
         // Lazy require to avoid pulling in chrome.storage at module scope
         // (which breaks unit tests that only exercise parseEtherscanPage).
         const { currentNetwork } = require("./state");
@@ -94,6 +102,9 @@ async function checkEtherscanLabel(address, chainId) {
         });
         if (!resp.ok) return null;
         const html = await resp.text();
+        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
+            return null;
+        }
         const result = parseEtherscanPage(html);
         if (result.isPhishing) {
             return {

src/shared/persistedState.js

@@ -48,6 +48,14 @@ const DEFAULT_STATE = {
     hideDustTransactions: true,
     dustThresholdGwei: 100000,
     utcTimestamps: false,
+    // "Use Blockscout" and "Check recipients on Etherscan" in Settings. Each
+    // setting applies to every network. Both are off until the user turns them
+    // on. With "Use Blockscout" on, Blockscout is sent the user's addresses and
+    // the hash of each transaction opened. With "Check recipients on
+    // Etherscan" on, Etherscan is sent the recipient's address and nothing
+    // else.
+    useBlockscout: false,
+    checkRecipientsOnEtherscan: false,
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
@@ -406,6 +414,10 @@ function normalizePersisted(saved) {
             : 100000;
     out.utcTimestamps =
         saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+    // Anything but true is off: each setting lets a request reach another
+    // service.
+    out.useBlockscout = saved.useBlockscout === true;
+    out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true;
     // A list of contract addresses, floored the same way: send.js builds its
     // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
     // and filterTransactions() maps the same list through normalizeAddress(),

src/shared/state.js

@@ -469,9 +469,11 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current. The
-// network is the exception: the popup takes a switch another context saved
-// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
+// before this fix; only the persisted record is guaranteed current. Three
+// fields are the exceptions: the network, "Use Blockscout" and "Check
+// recipients on Etherscan". Through `beforeWrite`, the popup takes a change to
+// any of them that another context saved (followStoredSettings() in
+// src/popup/index.js).
 async function saveStateOnce(beforeWrite) {
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written
@@ -603,7 +605,7 @@ function saveState(beforeWrite) {
 }
 
 // Give this page the network switch held by `stored`, a record a save of this
-// page has just read (followNetworkSwitch() in src/popup/index.js calls this
+// page has just read (followStoredSettings() in src/popup/index.js calls this
 // from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
 // with a whole record. The switch is then not this page's own change, even when
 // that save fails to write: a later switch back to the previous network still

src/shared/storedSettings.js

@@ -0,0 +1,26 @@
+// Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
+// profile.
+//
+// Before each request that sends the user's data to Blockscout or Etherscan, the
+// wallet reads that service's setting from storage. The wallet reads the setting
+// again when the answer lands. While the setting is off, no such request is
+// made, and an answer that lands after the setting went off is dropped. A page's
+// own copy of the setting is not used, because another page may have just
+// changed it.
+
+const { storageGet } = require("./browserApi");
+const { normalizePersisted } = require("./persistedState");
+
+// Whether `name`, "useBlockscout" or "checkRecipientsOnEtherscan", is on in the
+// stored profile. The profile is read through normalizePersisted(), as a load
+// reads it, so only a stored true is on. A failed read counts as off.
+async function storedSettingIsOn(name) {
+    try {
+        const { autistmask } = await storageGet("autistmask");
+        return normalizePersisted(autistmask)[name];
+    } catch {
+        return false;
+    }
+}
+
+module.exports = { storedSettingIsOn };

src/shared/transactions.js

@@ -21,6 +21,7 @@ const { toDecimals } = require("./transferAmount");
 // detail view is the authoritative record and already shows exact precision.
 const { truncateAmount: formatTxValue } = require("./amountDisplay");
 const { routerRelease } = require("./uniswap");
+const { storedSettingIsOn } = require("./storedSettings");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -235,12 +236,17 @@ function mergeTransactions(txs, tokenTransfers) {
 // `chainId` is the chain id of the network `blockscoutUrl` serves. Every entry
 // carries it, and a native entry is labelled with that network's
 // `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
+//
+// While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
+// that lands after the setting went off is dropped
+// (src/shared/storedSettings.js). Either way the answer is an empty list.
 async function fetchRecentTransactions(
     address,
     blockscoutUrl,
     chainId,
     count = 25,
 ) {
+    if (!(await storedSettingIsOn("useBlockscout"))) return [];
     log.debugf("fetchRecentTransactions", address);
     const addrLower = normalizeAddress(address);
 
@@ -271,6 +277,7 @@ async function fetchRecentTransactions(
 
     const txJson = txResp.ok ? await txResp.json() : {};
     const ttJson = ttResp.ok ? await ttResp.json() : {};
+    if (!(await storedSettingIsOn("useBlockscout"))) return [];
 
     const txs = mergeTransactions(
         (txJson.items || []).map((tx) => parseTx(tx, addrLower, chainId)),

tests/alarms.test.js

@@ -41,6 +41,8 @@ jest.mock("../src/shared/balances", () => ({
     refreshBalances: jest.fn(async () => {
         mockBalanceRefreshAt.push(Date.now());
     }),
+    dropUntrackedTokens: jest.requireActual("../src/shared/balances")
+        .dropUntrackedTokens,
     getProvider: jest.fn(() => ({})),
 }));
 

tests/approvalAmount.test.js

@@ -84,6 +84,9 @@ function walletsHolding(token, decimals) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
+    // The approval screen reads the explorer's report only while "Use
+    // Blockscout" is on.
+    state.useBlockscout = true;
 });
 
 describe("resolveTokenDecimals", () => {

tests/approvalUseBlockscoutOff.test.js

@@ -0,0 +1,308 @@
+// While "Use Blockscout" is off, the approval screens, and the screens that
+// follow TxApproval, take a token's name and scale from the bundled list and
+// the tracked tokens alone (https://git.eeqj.de/sneak/AutistMask/issues/668).
+// A token missing from both gets a line under it. The line says Blockscout's
+// report of the user's balances is not used to name the token. While the
+// setting is on, Blockscout's report of the user's holding is a source too, as
+// before.
+//
+// Booted through the real popup entry point, as the approval window or as a
+// popup reopened onto SuccessTx, WaitTx or ErrorTx. The vault is mocked so that
+// no password has to be hashed: the stored secret decrypts to the test key
+// below.
+
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+    encryptWithPassword: jest.fn(),
+}));
+
+const { Interface, Wallet } = require("ethers");
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+} = require("./support/popupBoot");
+
+// A published test key, never used for real funds.
+const SIGNER_KEY =
+    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
+const signer = new Wallet(SIGNER_KEY);
+const ORIGIN = "https://dapp.example";
+const RECIPIENT = "0x2222222222222222222222222222222222222222";
+const TX_HASH = "0x" + "ab".repeat(32);
+// Outside the bundled list, and not tracked.
+const TOKEN = "0xE2E0000000000000000000000000000000000E2e";
+// In the bundled list, at 6 decimals.
+const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
+
+const LINE =
+    'Blockscout\'s report of your balances is not used to name this token, because "Use Blockscout" is off in Settings.';
+
+// TOKEN as Blockscout reports the user's holding of it.
+const TOKEN_ROW = {
+    address: TOKEN,
+    name: "Novel",
+    symbol: "NOVEL",
+    decimals: "6",
+    balance: "5000.0",
+    holders: 5000,
+};
+
+// A transfer of 5,000 of a 6-decimal token to RECIPIENT.
+const TRANSFER_DATA = new Interface([
+    "function transfer(address to, uint256 amount)",
+]).encodeFunctionData("transfer", [RECIPIENT, 5000000000n]);
+
+// An EIP-2612 permit letting RECIPIENT take 5,000 of TOKEN.
+const PERMIT = {
+    types: {
+        EIP712Domain: [
+            { name: "name", type: "string" },
+            { name: "chainId", type: "uint256" },
+            { name: "verifyingContract", type: "address" },
+        ],
+        Permit: [
+            { name: "owner", type: "address" },
+            { name: "spender", type: "address" },
+            { name: "value", type: "uint256" },
+            { name: "nonce", type: "uint256" },
+            { name: "deadline", type: "uint256" },
+        ],
+    },
+    primaryType: "Permit",
+    domain: { name: "Novel", chainId: 1, verifyingContract: TOKEN },
+    message: {
+        owner: signer.address,
+        spender: RECIPIENT,
+        value: "5000000000",
+        nonce: "0",
+        deadline: "1790000000",
+    },
+};
+
+// The stored profile: the user's one address holds `tokenBalances`.
+function profile(useBlockscout, tokenBalances, extra) {
+    return unversionedValidProfile({
+        useBlockscout,
+        wallets: [
+            {
+                type: "key",
+                name: "Wallet 1",
+                encryptedSecret: "encrypted-key",
+                addresses: [
+                    {
+                        address: signer.address,
+                        balance: "1.0",
+                        tokenBalances,
+                    },
+                ],
+            },
+        ],
+        activeAddress: signer.address,
+        allowedSites: { [signer.address]: [ORIGIN] },
+        ...extra,
+    });
+}
+
+// The approval window for the site's request. The request is a transfer sent to
+// `token`, or a signature request when `signParams` is given. The background
+// answers the signed transaction with `txResponse`.
+function bootApproval(stored, { token = TOKEN, signParams, txResponse } = {}) {
+    return bootPopup(stored, {
+        search: "?approval=approval-1",
+        runtime: {
+            connect: () => ({ postMessage: () => {} }),
+            sendMessage: (msg, reply) => {
+                if (msg.type === "AUTISTMASK_GET_APPROVAL") {
+                    reply({
+                        type: signParams ? "sign" : "tx",
+                        origin: ORIGIN,
+                        isPhishingDomain: false,
+                        approvedFrom: signer.address,
+                        signParams,
+                        approvedTx: {
+                            type: 2,
+                            from: signer.address,
+                            chainId: "0x1",
+                            nonce: "0x7",
+                            gasLimit: "0x30d40",
+                            maxPriorityFeePerGas: "0x3b9aca00",
+                            maxFeePerGas: "0x77359400",
+                            to: token,
+                            value: "0x0",
+                            data: TRANSFER_DATA,
+                            accessList: [],
+                        },
+                    });
+                } else if (msg.type === "AUTISTMASK_TX_RESPONSE") {
+                    reply(txResponse);
+                } else {
+                    reply(undefined);
+                }
+            },
+        },
+    });
+}
+
+beforeEach(() => {
+    // The page logs its failed RPC reads; the stub node in popupBoot.js
+    // answers none.
+    jest.spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+    cleanupPopup();
+    jest.restoreAllMocks();
+});
+
+describe("TxApproval", () => {
+    test("has the line under a token it cannot name while Use Blockscout is off", async () => {
+        const page = await bootApproval(profile(false, []));
+        const details = page.node("approve-tx-decoded-details").innerHTML;
+        expect(details).toContain("Unknown token");
+        expect(details).toContain(LINE);
+        expect(details).toContain("5000000000 base units (decimals unknown)");
+        cleanupPopup();
+
+        // The bundled list names USDC, so there is nothing to say.
+        const bundled = await bootApproval(profile(false, []), {
+            token: USDC,
+        });
+        expect(
+            bundled.node("approve-tx-decoded-details").innerHTML,
+        ).not.toContain(LINE);
+        cleanupPopup();
+
+        const on = await bootApproval(profile(true, [TOKEN_ROW]));
+        const named = on.node("approve-tx-decoded-details").innerHTML;
+        expect(named).toContain("5000.0000 NOVEL");
+        expect(named).not.toContain(LINE);
+    });
+
+    test("names nothing from a Blockscout entry still in the balances while Use Blockscout is off", async () => {
+        const page = await bootApproval(profile(false, [TOKEN_ROW]));
+        const details = page.node("approve-tx-decoded-details").innerHTML;
+        expect(details).not.toContain("NOVEL");
+        expect(details).toContain("Unknown token");
+        expect(details).toContain(LINE);
+    });
+
+    test.each([
+        ["WaitTx", { txHash: TX_HASH }, "wait-tx"],
+        [
+            "ErrorTx",
+            { error: "The transaction could not be sent.", retryable: false },
+            "error-tx",
+        ],
+    ])(
+        "%s after it says so under the amount while Use Blockscout is off",
+        async (_name, txResponse, view) => {
+            const page = await bootApproval(profile(false, []), {
+                txResponse,
+            });
+            const { decryptWithPassword } = require("../src/shared/vault");
+            decryptWithPassword.mockResolvedValue(SIGNER_KEY);
+            page.node("approve-tx-password").value = "any password";
+            await page.click("btn-approve-tx");
+            expect(page.visibleViews()).toEqual([view]);
+            expect(page.node(view + "-token-note").innerHTML).toBe(
+                `<div class="text-xs text-muted">${LINE}</div>`,
+            );
+        },
+    );
+});
+
+test("SuccessTx says so under the decoded token while Use Blockscout is off", async () => {
+    const page = await bootPopup(
+        profile(false, [], {
+            currentView: "success-tx",
+            viewStack: ["main"],
+            viewData: {
+                amount: "5000000000 base units (decimals unknown)",
+                symbol: "?",
+                to: RECIPIENT,
+                hash: TX_HASH,
+                blockNumber: 21000000,
+                chainId: "0x1",
+                decoded: {
+                    name: "Token Transfer",
+                    description: "Transfer ERC-20 token",
+                    details: [
+                        {
+                            label: "Token",
+                            value: TOKEN,
+                            address: TOKEN,
+                            isToken: true,
+                        },
+                    ],
+                },
+            },
+        }),
+    );
+    expect(page.visibleViews()).toEqual(["success-tx"]);
+    const decoded = page.node("success-tx-decoded").innerHTML;
+    expect(decoded).toContain("Unknown token");
+    expect(decoded).toContain(LINE);
+});
+
+test.each([
+    [
+        "wait-tx",
+        {
+            pendingWait: {
+                hash: TX_HASH,
+                txInfo: {
+                    to: RECIPIENT,
+                    amount: "1",
+                    token: 42,
+                    chainId: "0x1",
+                },
+                broadcastTime: Date.now(),
+            },
+        },
+    ],
+    [
+        "error-tx",
+        {
+            amount: "1",
+            symbol: "?",
+            token: 42,
+            to: RECIPIENT,
+            hash: TX_HASH,
+            message: "The transaction failed.",
+            chainId: "0x1",
+        },
+    ],
+])(
+    "a popup reopened onto %s shows no line for a stored token that is not text",
+    async (view, viewData) => {
+        const page = await bootPopup(
+            profile(false, [], {
+                currentView: view,
+                viewStack: ["main"],
+                viewData,
+            }),
+        );
+        expect(page.pageErrors).toEqual([]);
+        expect(page.visibleViews()).toEqual([view]);
+        expect(page.node(view + "-token-note").innerHTML).toBe("");
+    },
+);
+
+test("SignApproval says so under a permit's token while Use Blockscout is off", async () => {
+    const signParams = {
+        method: "eth_signTypedData_v4",
+        typedData: JSON.stringify(PERMIT),
+        from: signer.address,
+    };
+    const page = await bootApproval(profile(false, []), { signParams });
+    const message = page.node("approve-sign-message").innerHTML;
+    expect(message).toContain("Unknown token");
+    expect(message).toContain(LINE);
+    cleanupPopup();
+
+    const on = await bootApproval(profile(true, [TOKEN_ROW]), { signParams });
+    const named = on.node("approve-sign-message").innerHTML;
+    expect(named).toContain("5000.0000 NOVEL");
+    expect(named).not.toContain(LINE);
+});

tests/backgroundStateIsolation.test.js

@@ -142,6 +142,8 @@ function loadWorker(networkId, opts) {
         },
         refreshBalances:
             options.refreshBalances || jest.fn(async () => undefined),
+        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
+            .dropUntrackedTokens,
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
         isPhishingDomain: () => false,
@@ -443,3 +445,54 @@ describe("a balance refresh under a network switch", () => {
         );
     });
 });
+
+describe("a balance refresh under a change of Use Blockscout", () => {
+    // Turning "Use Blockscout" off drops the tokens the user has not tracked
+    // (src/popup/views/settings.js). Blockscout may have answered a refresh
+    // just before. That refresh still saves its balances when it returns, but
+    // not those tokens. The same refresh in the popup is in
+    // tests/blockscoutEtherscanSettings.test.js.
+    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
+        const roundTrip = deferred();
+        const started = deferred();
+
+        const bg = loadWorker("mainnet", {
+            refreshBalances: async (wallets) => {
+                started.resolve();
+                await roundTrip.promise;
+                wallets[0].addresses[0].balance = "7.0";
+                wallets[0].addresses[0].tokenBalances = [
+                    {
+                        address: "0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+                        name: "Test Token",
+                        symbol: "TST",
+                        decimals: 18,
+                        balance: "5.0",
+                        holders: 50000,
+                    },
+                ];
+            },
+        });
+        global.chrome.storage.write("autistmask", {
+            ...bg.persisted(),
+            useBlockscout: true,
+        });
+
+        const refresh = bg.fireBalanceAlarm();
+        await started.promise;
+
+        // The user unticks "Use Blockscout" in Settings while the round trip
+        // is out.
+        global.chrome.storage.write("autistmask", {
+            ...bg.persisted(),
+            useBlockscout: false,
+        });
+
+        roundTrip.resolve();
+        await refresh;
+
+        const after = bg.persisted();
+        expect(after.wallets[0].addresses[0].balance).toBe("7.0");
+        expect(after.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    });
+});

tests/balanceRefreshCancelled.test.js

@@ -24,6 +24,12 @@ const TRACKED = {
     decimals: 6,
 };
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
+const { makeStorageStub } = require("./support/storageStub");
+globalThis.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+};
+
 const realFetch = globalThis.fetch;
 let logged;
 

tests/blockscoutEtherscanSettings.test.js

@@ -0,0 +1,848 @@
+// Blockscout and Etherscan are sent none of the user's data until the user
+// turns on a setting for each
+// (https://git.eeqj.de/sneak/AutistMask/issues/668). A new profile has "Use
+// Blockscout" and "Check recipients on Etherscan" both off. While a setting is
+// off, no request sends its service the user's data.
+//
+// One request still reaches Blockscout while "Use Blockscout" is off: the check
+// behind "Save" beside the Blockscout URL in Settings. That check asks the URL
+// only for `/stats` and sends none of the user's data.
+//
+// Before any other request to Blockscout or Etherscan, the wallet reads that
+// service's setting from storage, not the page's copy. The wallet reads the
+// setting again when the answer lands. So a change saved by another page
+// applies at once. An open page also takes such a change and draws its screens
+// again.
+//
+// Only Blockscout reports the tokens the user has not tracked. While "Use
+// Blockscout" is off, no address keeps them and no screen lists them.
+//
+// The functions that make the requests are driven directly, against a fetch()
+// that records every URL it is asked for. The screens are driven through the
+// real popup over a stored profile (tests/support/popupBoot.js). The fetch()
+// stub in popupBoot.js records the same way.
+
+"use strict";
+
+const { FetchRequest } = require("ethers");
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    ADDRESS,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+const { makeStorageStub } = require("./support/storageStub");
+const {
+    DEFAULT_STATE,
+    normalizePersisted,
+} = require("../src/shared/persistedState");
+const {
+    fetchTokenBalances,
+    refreshBalances,
+} = require("../src/shared/balances");
+const { fetchRecentTransactions } = require("../src/shared/transactions");
+const { getFullWarnings } = require("../src/shared/addressWarnings");
+const { checkEtherscanLabel } = require("../src/shared/etherscanLabels");
+const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
+
+const RPC_URL = "https://rpc.example.invalid";
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+const RECIPIENT = "0x2222222222222222222222222222222222222222";
+const TX_HASH = "0x" + "ab".repeat(32);
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+// USDC, from the bundled list, as Blockscout reports a holding of it.
+const USDC_ROW = {
+    value: "5000000",
+    token: {
+        type: "ERC-20",
+        address_hash: "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
+        symbol: "USDC",
+        name: "USD Coin",
+        decimals: "6",
+        holders_count: "50000",
+    },
+};
+
+// A transfer of 1 ETH from RECIPIENT to ADDRESS, as Blockscout lists it in
+// ADDRESS's history.
+const HISTORY_ITEM = {
+    hash: TX_HASH,
+    block_number: 21000000,
+    timestamp: "2026-02-27T12:00:00.000Z",
+    from: { hash: RECIPIENT },
+    to: { hash: ADDRESS, is_contract: false },
+    value: "1000000000000000000",
+    method: null,
+    status: "ok",
+};
+
+// Etherscan's page for RECIPIENT, which labels it a phishing address.
+const PHISHING_PAGE =
+    "<html><head><title>Fake_Phishing1 | Address: " +
+    RECIPIENT +
+    " | Etherscan</title></head><body></body></html>";
+
+const realFetch = globalThis.fetch;
+
+afterEach(() => {
+    cleanupPopup();
+    jest.restoreAllMocks();
+});
+
+describe("a new profile", () => {
+    test("has both settings off", () => {
+        expect(DEFAULT_STATE.useBlockscout).toBe(false);
+        expect(DEFAULT_STATE.checkRecipientsOnEtherscan).toBe(false);
+        const loaded = normalizePersisted(undefined);
+        expect(loaded.useBlockscout).toBe(false);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(false);
+    });
+
+    test("keeps either setting the user turned on", () => {
+        const loaded = normalizePersisted({
+            useBlockscout: true,
+            checkRecipientsOnEtherscan: true,
+        });
+        expect(loaded.useBlockscout).toBe(true);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(true);
+    });
+});
+
+describe("where each request is made", () => {
+    // Every URL that fetch() was asked for, in order.
+    let asked;
+
+    // What Blockscout and Etherscan answer: USDC among ADDRESS's tokens,
+    // HISTORY_ITEM in its history, and PHISHING_PAGE for RECIPIENT.
+    function answer(url) {
+        return {
+            ok: true,
+            status: 200,
+            json: async () => {
+                if (url.endsWith("/token-balances")) return [USDC_ROW];
+                if (url.endsWith("/transactions")) {
+                    return { items: [HISTORY_ITEM] };
+                }
+                return { items: [] };
+            },
+            text: async () => PHISHING_PAGE,
+        };
+    }
+
+    async function recordAndAnswer(url) {
+        asked.push(String(url));
+        return answer(String(url));
+    }
+
+    beforeEach(() => {
+        asked = [];
+        globalThis.fetch = jest.fn(recordAndAnswer);
+    });
+
+    afterEach(() => {
+        globalThis.fetch = realFetch;
+        delete globalThis.chrome;
+    });
+
+    // Storage holds `profile` as the stored profile, or nothing when it is
+    // undefined.
+    function storing(profile) {
+        globalThis.chrome = {
+            storage: makeStorageStub(
+                profile === undefined ? {} : { autistmask: profile },
+            ),
+        };
+    }
+
+    test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
+        storing({ useBlockscout: false });
+        expect(await fetchTokenBalances(ADDRESS, BLOCKSCOUT, [])).toEqual([]);
+        expect(asked).toEqual([]);
+
+        storing({ useBlockscout: true });
+        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, []);
+        expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
+        expect(asked).toEqual([
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+        ]);
+    });
+
+    test("the transaction history is asked for only while Use Blockscout is on", async () => {
+        storing({ useBlockscout: false });
+        expect(
+            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
+        ).toEqual([]);
+        expect(asked).toEqual([]);
+
+        storing({ useBlockscout: true });
+        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1");
+        expect(asked.sort()).toEqual([
+            BLOCKSCOUT +
+                "/addresses/" +
+                ADDRESS +
+                "/token-transfers?type=ERC-20",
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/transactions",
+        ]);
+    });
+
+    test("the Etherscan label check is made only while the stored profile has Check recipients on Etherscan on", async () => {
+        const provider = {
+            getCode: async () => "0x",
+            getTransactionCount: async () => 1,
+            getBalance: async () => 0n,
+        };
+        const checkWith = async (profile) => {
+            storing(profile);
+            await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
+        };
+
+        await checkWith(undefined);
+        await checkWith({ checkRecipientsOnEtherscan: false });
+        // Only a stored true is on, as when the profile is loaded.
+        await checkWith({ checkRecipientsOnEtherscan: "true" });
+        await checkWith({ checkRecipientsOnEtherscan: 42 });
+        expect(asked).toEqual([]);
+
+        await checkWith({ checkRecipientsOnEtherscan: true });
+        expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
+    });
+
+    // Asks with `setting` on in storage. Once every request is out, storage
+    // holds `after` for the setting, as when the user changes it here or on
+    // another page. Only then does each request get its answer.
+    async function answeredAfter(setting, after, ask) {
+        storing({ [setting]: true });
+        let release;
+        const held = new Promise((resolve) => {
+            release = resolve;
+        });
+        let requested;
+        const out = new Promise((resolve) => {
+            requested = resolve;
+        });
+        globalThis.fetch = jest.fn(async (url) => {
+            requested();
+            await held;
+            return recordAndAnswer(url);
+        });
+        const result = ask();
+        await out;
+        globalThis.chrome.storage.write("autistmask", { [setting]: after });
+        release();
+        return result;
+    }
+
+    // One row per request, giving:
+    //
+    //   - its name
+    //   - the setting that gates it
+    //   - how to make it
+    //   - its answer while that setting is off
+    test.each([
+        [
+            "Blockscout's token balances",
+            "useBlockscout",
+            () => fetchTokenBalances(ADDRESS, BLOCKSCOUT, []),
+            [],
+        ],
+        [
+            "the transaction history",
+            "useBlockscout",
+            () => fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
+            [],
+        ],
+        [
+            "the Etherscan label check",
+            "checkRecipientsOnEtherscan",
+            () => checkEtherscanLabel(RECIPIENT, "0x1"),
+            null,
+        ],
+    ])(
+        "%s keeps an answer that lands while its setting is on, and drops one that lands after it went off",
+        async (_what, setting, ask, dropped) => {
+            expect(await answeredAfter(setting, true, ask)).not.toEqual(
+                dropped,
+            );
+            expect(await answeredAfter(setting, false, ask)).toEqual(dropped);
+        },
+    );
+
+    describe("a balance refresh", () => {
+        // The RPC endpoint answers every balance with zero. The ENS reverse
+        // lookup makes the only other calls, and it finds no resolver.
+        beforeEach(() => {
+            FetchRequest.registerGetUrl(async (req) => {
+                const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+                const reply = (r) => ({
+                    jsonrpc: "2.0",
+                    id: r.id,
+                    result: r.method === "eth_getBalance" ? "0x0" : ZERO_WORD,
+                });
+                const answer = Array.isArray(body)
+                    ? body.map(reply)
+                    : reply(body);
+                return {
+                    statusCode: 200,
+                    statusMessage: "OK",
+                    headers: { "content-type": "application/json" },
+                    body: Buffer.from(JSON.stringify(answer)),
+                };
+            });
+        });
+
+        afterEach(() => {
+            FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+        });
+
+        // An address refreshed while "Use Blockscout" was on. It holds the USDC
+        // that Blockscout reported then.
+        function addressWithUsdc() {
+            return {
+                address: ADDRESS,
+                tokenBalances: [
+                    {
+                        address: USDC_ROW.token.address_hash,
+                        name: "USD Coin",
+                        symbol: "USDC",
+                        decimals: 6,
+                        balance: "5.0",
+                        holders: 50000,
+                    },
+                ],
+            };
+        }
+
+        async function refresh(addr, useBlockscout) {
+            storing({ useBlockscout });
+            await refreshBalances(
+                [{ addresses: [addr] }],
+                RPC_URL,
+                BLOCKSCOUT,
+                [],
+                "mainnet",
+            );
+        }
+
+        test("asks Blockscout nothing while Use Blockscout is off, and then lists no token the user has not tracked", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, false);
+            expect(asked).toEqual([]);
+            expect(addr.tokenBalances).toEqual([]);
+        });
+
+        test("asks Blockscout for the token balances while Use Blockscout is on", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, true);
+            expect(asked).toEqual([
+                BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+            ]);
+            expect(addr.tokenBalances.map((row) => row.symbol)).toEqual([
+                "USDC",
+            ]);
+        });
+    });
+});
+
+describe("the popup", () => {
+    // Every URL the booted page handed to fetch().
+    function fetched() {
+        return globalThis.fetch.mock.calls.map((call) => String(call[0]));
+    }
+
+    function blockscoutOrEtherscan(url) {
+        return url.includes("blockscout") || url.includes("etherscan");
+    }
+
+    beforeEach(() => {
+        // The screens below log their failed RPC reads; the stub node in
+        // popupBoot.js answers none.
+        jest.spyOn(console, "error").mockImplementation(() => {});
+    });
+
+    test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        expect(page.node("home-tx-list").innerHTML).toContain(
+            escapeHtml(HISTORY_OFF_TEXT),
+        );
+        expect(page.hidden("home-tokens-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            unversionedValidProfile({ useBlockscout: true }),
+        );
+        expect(on.node("home-tx-list").innerHTML).toContain(
+            "No transactions found.",
+        );
+        expect(on.hidden("home-tokens-note")).toBe(true);
+    });
+
+    // The transaction screen, as a reopened popup draws it.
+    function onTransactionScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "transaction",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                tx: {
+                    hash: TX_HASH,
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    value: "1.0000",
+                    exactValue: "1.0",
+                    symbol: "ETH",
+                    timestamp: 1790000000,
+                    isError: false,
+                    direction: "sent",
+                    directionLabel: "Sent",
+                    contractAddress: null,
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("TransactionDetail asks Blockscout for the transaction only while Use Blockscout is on", async () => {
+        const page = await bootPopup(onTransactionScreen());
+        expect(page.visibleViews()).toEqual(["transaction"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onTransactionScreen({ useBlockscout: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            BLOCKSCOUT + "/transactions/" + TX_HASH,
+        ]);
+        expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
+    });
+
+    // Another page turns "Use Blockscout" off while TransactionDetail's request
+    // to Blockscout is out. This page draws TransactionDetail again with its
+    // line, and only then does Blockscout answer.
+    test("TransactionDetail shows nothing from an answer that lands after another page turned Use Blockscout off", async () => {
+        const page = await bootPopup(
+            onTransactionScreen({ useBlockscout: true }),
+        );
+        let release;
+        const held = new Promise((resolve) => {
+            release = resolve;
+        });
+        globalThis.fetch = jest.fn(async () => {
+            await held;
+            return {
+                ok: true,
+                status: 200,
+                json: async () => ({
+                    block_number: 21000000,
+                    fee: { value: "21000000000000" },
+                    raw_input: "0x12345678",
+                    method: "doSomething",
+                }),
+            };
+        });
+        require("../src/popup/views/transactionDetail").render();
+        await page.settle();
+        expect(fetched()).toEqual([BLOCKSCOUT + "/transactions/" + TX_HASH]);
+
+        await anotherPageAnnounces(page, { useBlockscout: false });
+        release();
+        await page.settle();
+
+        expect(page.visibleViews()).toEqual(["transaction"]);
+        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
+        for (const id of [
+            "tx-detail-block-section",
+            "tx-detail-network-section",
+            "tx-detail-calldata-section",
+            "tx-detail-rawdata-section",
+        ]) {
+            expect(page.hidden(id)).toBe(true);
+        }
+        expect(fetched()).toHaveLength(1);
+    });
+
+    // The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
+    // reopened popup draws it.
+    function onConfirmScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "confirm-tx",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                pendingTx: {
+                    token: "ETH",
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    amount: "0.1",
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("ConfirmTx asks Etherscan about the recipient only while Check recipients on Etherscan is on", async () => {
+        const page = await bootPopup(onConfirmScreen());
+        expect(page.visibleViews()).toEqual(["confirm-tx"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("confirm-etherscan-note")).toBe(false);
+        expect(page.hidden("confirm-etherscan-warning")).toBe(true);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            "https://etherscan.io/address/" + RECIPIENT,
+        ]);
+        expect(on.hidden("confirm-etherscan-note")).toBe(true);
+        expect(on.hidden("confirm-etherscan-warning")).toBe(false);
+    });
+
+    // Ticks or unticks a checkbox on the page, as the user does.
+    async function setBox(page, id, checked) {
+        const box = page.node(id);
+        box.checked = checked;
+        for (const fn of box.listeners.change) await fn();
+        await page.settle();
+    }
+
+    test("Welcome offers both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(undefined);
+        expect(page.visibleViews()).toEqual(["welcome"]);
+        expect(page.node("welcome-use-blockscout").checked).toBe(false);
+        expect(page.node("welcome-check-recipients-on-etherscan").checked).toBe(
+            false,
+        );
+
+        await setBox(page, "welcome-use-blockscout", true);
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await setBox(page, "welcome-check-recipients-on-etherscan", true);
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+
+    test("Settings shows both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        expect(page.node("settings-use-blockscout").checked).toBe(false);
+        expect(
+            page.node("settings-check-recipients-on-etherscan").checked,
+        ).toBe(false);
+
+        await setBox(page, "settings-use-blockscout", true);
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await setBox(page, "settings-check-recipients-on-etherscan", true);
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+
+    // A token the user tracks, and an untracked one that Blockscout reported.
+    // Both are written in lower case, because the balance rows' and the
+    // dropdown's token ids are compared in lower case below.
+    const TRACKED = "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+    const UNTRACKED = TOKEN_ADDRESS.toLowerCase();
+    const SECOND_ADDRESS = "0x3333333333333333333333333333333333333333";
+
+    function tokenRow(address, symbol) {
+        return {
+            address,
+            name: symbol,
+            symbol,
+            decimals: 18,
+            balance: "5.0",
+            holders: 50000,
+        };
+    }
+
+    // AddressDetail of the first of two addresses, as a reopened popup draws
+    // it. Both addresses hold the tracked token. While "Use Blockscout" is on,
+    // both hold the untracked one too.
+    function onAddressDetail(useBlockscout) {
+        const profile = unversionedValidProfile({
+            useBlockscout,
+            currentView: "address",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            trackedTokens: [
+                { address: TRACKED, name: "TRK", symbol: "TRK", decimals: 18 },
+            ],
+        });
+        const wallet = profile.wallets[0];
+        wallet.nextIndex = 2;
+        wallet.addresses.push({ address: SECOND_ADDRESS, balance: "0.0" });
+        for (const addr of wallet.addresses) {
+            addr.tokenBalances = useBlockscout
+                ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
+                : [tokenRow(TRACKED, "TRK")];
+        }
+        return profile;
+    }
+
+    // The token ids of the options created after the first `from` elements.
+    // The page stub keeps no children, so this reads the options for Send's
+    // dropdown from the elements the page created.
+    function optionsSince(page, from) {
+        return page.document.created
+            .slice(from)
+            .filter((el) => el.tagName === "OPTION")
+            .map((el) => el.value.toLowerCase());
+    }
+
+    test("unticking Use Blockscout from AddressDetail's gear takes the untracked token off AddressDetail, Send's dropdown and Home on Back", async () => {
+        const page = await bootPopup(onAddressDetail(true));
+        expect(page.visibleViews()).toEqual(["address"]);
+        expect(page.node("address-balances").innerHTML).toContain(UNTRACKED);
+
+        await page.click("btn-settings");
+        await setBox(page, "settings-use-blockscout", false);
+        const from = page.document.created.length;
+        await page.click("btn-settings-back");
+
+        expect(page.visibleViews()).toEqual(["address"]);
+        const balances = page.node("address-balances").innerHTML;
+        expect(balances).toContain(TRACKED);
+        expect(balances).not.toContain(UNTRACKED);
+        expect(page.hidden("address-tokens-note")).toBe(false);
+        expect(optionsSince(page, from)).toEqual([TRACKED]);
+
+        await page.click("btn-send");
+        expect(page.visibleViews()).toEqual(["send"]);
+        expect(page.hidden("send-token-dropdown")).toBe(false);
+        expect(page.hidden("send-tokens-note")).toBe(false);
+
+        await page.click("btn-send-back");
+        await page.click("btn-address-back");
+        expect(page.visibleViews()).toEqual(["main"]);
+        const home = page.node("wallet-list").innerHTML;
+        expect(home).toContain(TRACKED);
+        expect(home).not.toContain(UNTRACKED);
+
+        const stored = page.storage.read("autistmask");
+        for (const addr of stored.wallets[0].addresses) {
+            expect(
+                addr.tokenBalances.map((row) => row.address.toLowerCase()),
+            ).toEqual([TRACKED]);
+        }
+    });
+
+    // Send's dropdown was filled under the old setting, and Back cannot draw
+    // Send again. So Back lands on the screen under it.
+    test.each([
+        ["unticking", true],
+        ["ticking", false],
+    ])(
+        "%s Use Blockscout from Send's gear lands Back on AddressDetail",
+        async (_how, before) => {
+            const page = await bootPopup(onAddressDetail(before));
+            await page.click("btn-send");
+            expect(page.visibleViews()).toEqual(["send"]);
+
+            await page.click("btn-settings");
+            await setBox(page, "settings-use-blockscout", !before);
+            await page.click("btn-settings-back");
+            expect(page.visibleViews()).toEqual(["address"]);
+            expect(page.hidden("address-tokens-note")).toBe(!before);
+        },
+    );
+
+    test("Send says under its token dropdown that only tracked tokens are listed while Use Blockscout is off", async () => {
+        const off = await bootPopup(onAddressDetail(false));
+        await off.click("btn-send");
+        expect(off.hidden("send-token-dropdown")).toBe(false);
+        expect(off.hidden("send-tokens-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(onAddressDetail(true));
+        await on.click("btn-send");
+        expect(on.hidden("send-token-dropdown")).toBe(false);
+        expect(on.hidden("send-tokens-note")).toBe(true);
+    });
+
+    test("Send opened from AddressToken shows neither the dropdown nor its line", async () => {
+        const page = await bootPopup({
+            ...onAddressDetail(false),
+            currentView: "address-token",
+            viewStack: ["main", "address"],
+            selectedToken: "ETH",
+        });
+        expect(page.visibleViews()).toEqual(["address-token"]);
+        await page.click("btn-address-token-send");
+        expect(page.visibleViews()).toEqual(["send"]);
+        expect(page.hidden("send-token-dropdown")).toBe(true);
+        expect(page.hidden("send-token-static")).toBe(false);
+    });
+
+    test("DeleteAddress says only tracked tokens are listed while Use Blockscout is off", async () => {
+        for (const useBlockscout of [false, true]) {
+            const page = await bootPopup(onAddressDetail(useBlockscout));
+            require("../src/popup/views/deleteAddress").show(0, 1);
+            expect(page.visibleViews()).toEqual(["delete-address-confirm"]);
+            expect(page.hidden("delete-address-tokens-note")).toBe(
+                useBlockscout,
+            );
+            cleanupPopup();
+        }
+    });
+
+    // The token ids of the first address's balances in the stored profile.
+    function storedTokens(page) {
+        return page.storage
+            .read("autistmask")
+            .wallets[0].addresses[0].tokenBalances.map((row) =>
+                row.address.toLowerCase(),
+            );
+    }
+
+    // Turning the setting off dropped the untracked token. A refresh that
+    // started while the setting was on still saves its balances when it
+    // returns, but not that token. The same refresh in the background is in
+    // tests/backgroundStateIsolation.test.js.
+    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
+        const page = await bootPopup(onAddressDetail(true));
+        const { refreshBalances: held } = require("../src/shared/balances");
+        let answer;
+        held.mockImplementationOnce(async (wallets) => {
+            await new Promise((resolve) => {
+                answer = resolve;
+            });
+            wallets[0].addresses[0].balance = "7.0";
+            wallets[0].addresses[0].tokenBalances = [
+                tokenRow(TRACKED, "TRK"),
+                tokenRow(UNTRACKED, "TST"),
+            ];
+        });
+        const ticking = page.tick();
+        await page.settle();
+
+        await page.click("btn-settings");
+        await setBox(page, "settings-use-blockscout", false);
+        answer();
+        await ticking;
+
+        expect(
+            page.storage.read("autistmask").wallets[0].addresses[0].balance,
+        ).toBe("7.0");
+        expect(storedTokens(page)).toEqual([TRACKED]);
+        await page.click("btn-settings-back");
+        expect(page.node("address-balances").innerHTML).not.toContain(
+            UNTRACKED,
+        );
+    });
+
+    // Another page saves `change` over the stored profile. The browser is not
+    // made to tell this page, so this page sees the change only by reading the
+    // stored profile.
+    function anotherPageSaves(page, change) {
+        page.storage.write("autistmask", {
+            ...page.storage.read("autistmask"),
+            ...change,
+        });
+    }
+
+    test.each([
+        ["off", true, false],
+        ["on", false, true],
+    ])(
+        "after another page turns Use Blockscout %s, this page takes the change and its next refresh is saved",
+        async (_how, before, after) => {
+            const page = await bootPopup(onAddressDetail(before));
+            // The refresh answers as it does under the stored setting.
+            const { refreshBalances: held } = require("../src/shared/balances");
+            held.mockImplementationOnce(async (wallets) => {
+                const addr = wallets[0].addresses[0];
+                addr.balance = "7.0";
+                addr.tokenBalances = after
+                    ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
+                    : [tokenRow(TRACKED, "TRK")];
+            });
+
+            anotherPageSaves(page, { useBlockscout: after });
+            await page.tick();
+
+            expect(
+                page.storage.read("autistmask").wallets[0].addresses[0].balance,
+            ).toBe("7.0");
+            expect(storedTokens(page)).toEqual(
+                after ? [TRACKED, UNTRACKED] : [TRACKED],
+            );
+            expect(page.hidden("address-tokens-note")).toBe(after);
+        },
+    );
+
+    test.each([
+        ["off", true, false],
+        ["on", false, true],
+    ])(
+        "after another page turns Check recipients on Etherscan %s, this page's next Etherscan check follows the stored setting",
+        async (_how, before, after) => {
+            const page = await bootPopup(
+                onConfirmScreen({ checkRecipientsOnEtherscan: before }),
+            );
+            anotherPageSaves(page, { checkRecipientsOnEtherscan: after });
+            const from = fetched().length;
+            require("../src/popup/views/confirmTx").show({
+                token: "ETH",
+                from: ADDRESS,
+                to: RECIPIENT,
+                amount: "0.1",
+                chainId: "0x1",
+            });
+            await page.settle();
+
+            // The page also takes the change and draws ConfirmTx again, which
+            // checks once more. So the test counts each URL once, however often
+            // it was asked for.
+            const asked = new Set(
+                fetched().slice(from).filter(blockscoutOrEtherscan),
+            );
+            expect([...asked]).toEqual(
+                after ? ["https://etherscan.io/address/" + RECIPIENT] : [],
+            );
+        },
+    );
+
+    // Another page's save of the whole profile with `change`, which the
+    // browser announces to this page as it announces any write.
+    async function anotherPageAnnounces(page, change) {
+        await page.storage.local.set({
+            autistmask: { ...page.storage.read("autistmask"), ...change },
+        });
+        await page.settle();
+    }
+
+    test("a page open on AddressDetail draws it again when another page turns Use Blockscout off", async () => {
+        const page = await bootPopup(onAddressDetail(true));
+        expect(page.hidden("address-tokens-note")).toBe(true);
+
+        await anotherPageAnnounces(page, { useBlockscout: false });
+
+        expect(page.visibleViews()).toEqual(["address"]);
+        expect(page.hidden("address-tokens-note")).toBe(false);
+        expect(page.node("address-balances").innerHTML).not.toContain(
+            UNTRACKED,
+        );
+        expect(storedTokens(page)).toEqual([TRACKED]);
+    });
+
+    test("a page open on ConfirmTx draws it again when another page turns Check recipients on Etherscan off", async () => {
+        const page = await bootPopup(
+            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
+        );
+        expect(page.hidden("confirm-etherscan-note")).toBe(true);
+
+        await anotherPageAnnounces(page, { checkRecipientsOnEtherscan: false });
+
+        expect(page.visibleViews()).toEqual(["confirm-tx"]);
+        expect(page.hidden("confirm-etherscan-note")).toBe(false);
+    });
+});

tests/coldWorkerChainId.test.js

@@ -73,6 +73,8 @@ function loadColdWorker(networkId, opts) {
     jest.doMock("../src/shared/balances", () => ({
         getProvider: () => ({}),
         refreshBalances: options.refreshBalances || jest.fn(async () => {}),
+        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
+            .dropUntrackedTokens,
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
         isPhishingDomain: () => false,

tests/confirmTxAmount.test.js

@@ -108,7 +108,10 @@ global.fetch = jest.fn(() => {
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -243,6 +246,10 @@ async function openSend(token, tokenUnits = null) {
     ];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
+    // Blockscout is asked only while the stored "Use Blockscout" is on. The
+    // screens save this page's copy of "Use Blockscout" over the stored one. So
+    // the page's copy is turned on here too.
+    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",

tests/confirmTxLateResult.test.js

@@ -50,8 +50,14 @@ function explorerPage(title) {
 // The explorer labels no address.
 global.fetch = jest.fn(async () => explorerPage("Etherscan"));
 
+// The Etherscan label check is made, so its box can be shown.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();

tests/confirmTxNetworkSwitch.test.js

@@ -142,13 +142,19 @@ jest.mock("../src/popup/views/txStatus", () => ({
 }));
 
 // The Etherscan label check is its only caller here: the explorer pages it
-// asks for are recorded, and nothing is fetched.
+// asks for are recorded, and nothing is fetched. The stored profile has the
+// check turned on.
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();

tests/contractCreation.test.js

@@ -297,6 +297,8 @@ describe.each([
         state.selectedWallet = 0;
         state.selectedAddress = 0;
         state.selectedToken = "ETH";
+        // The history is Blockscout's.
+        state.useBlockscout = true;
     });
 
     test("a contract creation's row says so, with no colour dot and no address line", async () => {

tests/e2e/network.js

@@ -653,6 +653,12 @@ function traceEnabled(raw) {
  *   confirmed receipt instead of null, so a wait screen resolves.
  * @param {boolean} [opts.failReceiptLookup]  answer eth_getTransactionReceipt
  *   with an error, so every receipt lookup fails; read at request time.
+ * @param {string} [opts.etherscanLabel]  the label Etherscan's page gives the
+ *   address asked about, such as "Fake_Phishing1"; none when unset. Read at
+ *   request time.
+ * @param {object[]} [opts.requests]  a list for the requests this handler
+ *   sees. Each is appended in order as { method, url, fromWorker }, whether it
+ *   came from a popup page or the background worker.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -691,6 +697,13 @@ async function installNetworkStubs(ctx, opts) {
             const origin = fromWorker ? "[sw] " : "[page] ";
             console.log("# routed " + origin + req.method() + " " + req.url());
         }
+        if (Array.isArray(opts.requests)) {
+            opts.requests.push({
+                method: req.method(),
+                url: req.url(),
+                fromWorker,
+            });
+        }
 
         // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
         if (req.method() === "POST") {
@@ -762,12 +775,20 @@ async function installNetworkStubs(ctx, opts) {
             return route.fulfill({ status: 204, body: "" });
         }
 
-        // Best-effort Etherscan address labels: served as an empty page.
+        // Best-effort Etherscan address labels: served as an empty page, or
+        // as a page labelling the address with opts.etherscanLabel.
         if (url.hostname.endsWith("etherscan.io")) {
+            const title = opts.etherscanLabel
+                ? "<title>" +
+                  opts.etherscanLabel +
+                  " | Address: " +
+                  p.split("/").pop() +
+                  " | Etherscan</title>"
+                : "";
             return route.fulfill({
                 status: 200,
                 contentType: "text/html",
-                body: "<html><body></body></html>",
+                body: "<html><head>" + title + "</head><body></body></html>",
             });
         }
 

tests/e2e/run.js

@@ -269,6 +269,69 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
     }
 });
 
+// ------------------ Blockscout and Etherscan are sent no user data (#668)
+//
+// A fresh install sends Blockscout and Etherscan none of the user's data until
+// the user turns on "Use Blockscout" or "Check recipients on Etherscan". One
+// request still reaches Blockscout while "Use Blockscout" is off: pressing
+// "Save" beside the Blockscout URL asks that URL for `/stats`. That request
+// carries no user data.
+//
+// The route handler in tests/e2e/network.js records in env.routeOpts.requests
+// every request the extension makes, from its pages and its background worker.
+// Recording starts when launch() in tests/e2e/harness.js installs that handler,
+// before the first popup page opens. The background worker starts earlier, but
+// it makes no request while it starts up.
+//
+// Before either setting is changed, these tests drive:
+//
+//   - Home, AddressDetail, AddressToken and ConfirmTx
+//   - the background's own balance refresh
+//
+// Then they turn each setting on and watch its requests start. "Use Blockscout"
+// is also turned off once and on again, to see an untracked token leave every
+// list. TransactionDetail, which also asks Blockscout, is left to the unit
+// tests in tests/blockscoutEtherscanSettings.test.js.
+
+// The line shown in place of the three transaction histories while "Use
+// Blockscout" is off. Written out here rather than imported, so the assertion
+// does not compare the popup with itself.
+const HISTORY_OFF =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
+// The requests made so far to Blockscout or Etherscan.
+function explorerRequests(env) {
+    return env.routeOpts.requests.filter(({ url }) => {
+        const host = new URL(url).hostname;
+        return host.endsWith("blockscout.com") || host.endsWith("etherscan.io");
+    });
+}
+
+// Waits until the list `listId` shows the line saying "Use Blockscout" is off.
+async function waitForHistoryOff(page, listId) {
+    await page.waitForFunction(
+        ([id, want]) => document.getElementById(id).textContent.trim() === want,
+        [listId, HISTORY_OFF],
+        { timeout: 15000 },
+    );
+}
+
+test("Welcome offers Use Blockscout and Check recipients on Etherscan, both unticked (#668)", async (env) => {
+    await visible(env.page, "#view-welcome");
+    for (const id of [
+        "welcome-use-blockscout",
+        "welcome-check-recipients-on-etherscan",
+    ]) {
+        const st = await controlState(env.page, id);
+        assert(st !== null, "Welcome has no #" + id);
+        assert(
+            st.tag === "input" && st.type === "checkbox",
+            "#" + id + " is a <" + st.tag + " type=" + st.type + ">",
+        );
+        assert(st.checked === false, "#" + id + " is ticked on a new install");
+    }
+});
+
 // The address scan that follows creating the wallet is held, so the popup
 // reloads while it is in flight. As for the reloads mid-refresh further down,
 // the assertion for that is the harness's own: a console.error from the page
@@ -296,6 +359,261 @@ test("wallet creation through the UI reaches the main view, and reloading mid-sc
     assert(addrCount > 0, "no addresses rendered in the wallet list");
 });
 
+test("with neither setting changed, Home, AddressDetail, AddressToken and ConfirmTx say what is off (#668)", async (env) => {
+    // Funded, so Send leads to the confirmation screen.
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    try {
+        await visible(env.page, "#view-main");
+        await waitForHistoryOff(env.page, "home-tx-list");
+        await visible(env.page, "#home-tokens-note");
+        await env.page.waitForFunction(
+            (want) =>
+                document
+                    .getElementById("wallet-list")
+                    .textContent.includes(want),
+            quantity(FUNDED_ETH_WEI),
+            { timeout: 60000 },
+        );
+
+        await openAddressDetail(env.page);
+        await waitForHistoryOff(env.page, "tx-list");
+        await visible(env.page, "#address-tokens-note");
+
+        await env.page.locator('#address-balances [data-token="ETH"]').click();
+        await visible(env.page, "#view-address-token");
+        await waitForHistoryOff(env.page, "address-token-tx-list");
+        await env.page.click("#btn-address-token-back");
+        await visible(env.page, "#view-address");
+
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await waitForEstimate(env.page);
+        await visible(env.page, "#confirm-etherscan-note");
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-warning")),
+            "ConfirmTx keeps the Etherscan warning's place while no Etherscan check is made",
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+    }
+});
+
+// The background refreshes balances on its alarm, once a minute. It skips a
+// refresh when the stored record says one ran in the last 30 seconds. The open
+// popup's own refresh runs every 10. So the popup is closed first. The test then
+// has the background worker set the stored time of the last refresh to 0, so
+// its next alarm runs a refresh.
+test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
+    await waitForPersisted(
+        env.page,
+        "currentView",
+        "address",
+        "before the popup is closed",
+    );
+    await env.page.close();
+    const [worker] = env.ctx.serviceWorkers();
+    await worker.evaluate(
+        () =>
+            new Promise((resolve) => {
+                chrome.storage.local.get("autistmask", (r) => {
+                    const record = r.autistmask;
+                    record.lastBalanceRefresh = 0;
+                    chrome.storage.local.set({ autistmask: record }, resolve);
+                });
+            }),
+    );
+    const before = env.routeOpts.requests.length;
+    const deadline = Date.now() + 75000;
+    while (
+        !env.routeOpts.requests
+            .slice(before)
+            .some((r) => r.fromWorker && r.method === "POST")
+    ) {
+        assert(
+            Date.now() < deadline,
+            "the background's balance refresh never asked the RPC endpoint",
+        );
+        await sleep(250);
+    }
+    // The refresh's RPC reads and any Blockscout request start together.
+    await sleep(3000);
+
+    const seen = explorerRequests(env);
+    assert(
+        seen.length === 0,
+        "a fresh install asked Blockscout or Etherscan: " +
+            JSON.stringify(seen),
+    );
+    // The watch saw the popup's own traffic as well as the worker's.
+    assert(
+        env.routeOpts.requests.some((r) => !r.fromWorker),
+        "no request from the popup was recorded",
+    );
+    // The popup reopens on the address screen the test above left it on.
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, "#view-address");
+});
+
+// Ticked from AddressDetail's gear, so Back lands on the screen that said the
+// setting is off.
+test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for that screen's history on Back, then for the tokens (#668)", async (env) => {
+    await openAddressDetail(env.page);
+    await waitForHistoryOff(env.page, "tx-list");
+    await openSettings(env.page);
+    await env.page.check("#settings-use-blockscout");
+    await waitForPersisted(env.page, "useBlockscout", true, "once ticked");
+    const historyAsked = env.page.waitForRequest(
+        (r) =>
+            r.url().includes("blockscout.com") &&
+            r.url().endsWith("/transactions"),
+    );
+    const tokensAsked = env.page.waitForRequest(
+        (r) => r.url().endsWith("/token-balances"),
+        { timeout: 30000 },
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+    await historyAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#address-tokens-note")),
+        "AddressDetail still says only tracked tokens are listed",
+    );
+
+    await goHome(env.page);
+    await tokensAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("home-tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#home-tokens-note")),
+        "Home still says only tracked tokens are listed",
+    );
+});
+
+// Unticked from AddressDetail's gear while the address holds the stub token,
+// which the user has not tracked and only Blockscout reports. Ticked again at
+// the end, so the rest of the run has Blockscout as before.
+test("turning off Use Blockscout from AddressDetail's gear takes an untracked token off AddressDetail, Send and Home on Back (#668)", async (env) => {
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    env.routeOpts.seedTokenBalance = true;
+    const tokenRow = '[data-token="' + STUB_TOKEN.address + '"]';
+    try {
+        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI, expectToken: true });
+        await openAddressDetail(env.page);
+        await visible(env.page, "#address-balances " + tokenRow);
+
+        await openSettings(env.page);
+        await env.page.uncheck("#settings-use-blockscout");
+        await waitForPersisted(
+            env.page,
+            "useBlockscout",
+            false,
+            "once unticked",
+        );
+        await env.page.click("#btn-settings-back");
+        await visible(env.page, "#view-address");
+        await visible(env.page, "#address-tokens-note");
+        assert(
+            (await env.page
+                .locator("#address-balances " + tokenRow)
+                .count()) === 0,
+            "AddressDetail still lists the untracked token",
+        );
+
+        await env.page.click("#btn-send");
+        await visible(env.page, "#view-send");
+        await visible(env.page, "#send-tokens-note");
+        const offered = await env.page.$$eval("#send-token option", (opts) =>
+            opts.map((opt) => opt.value.toLowerCase()),
+        );
+        assert(
+            !offered.includes(STUB_TOKEN.address),
+            "Send's dropdown still offers the untracked token",
+        );
+        await env.page.click("#btn-send-back");
+        await visible(env.page, "#view-address");
+
+        await goHome(env.page);
+        await visible(env.page, "#home-tokens-note");
+        assert(
+            (await env.page.locator("#wallet-list " + tokenRow).count()) === 0,
+            "Home still lists the untracked token",
+        );
+    } finally {
+        await openSettings(env.page);
+        await env.page.check("#settings-use-blockscout");
+        await waitForPersisted(env.page, "useBlockscout", true, "ticked again");
+        await env.page.click("#btn-settings-back");
+        env.routeOpts.ethBalanceWei = null;
+        env.routeOpts.seedTokenBalance = false;
+    }
+});
+
+// Ticked from ConfirmTx's gear, so Back lands on the screen that said no
+// Etherscan check was made. Left on for the rest of the run, so the later
+// confirmation screens are driven with the check made.
+test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    env.routeOpts.etherscanLabel = "Fake_Phishing668";
+    try {
+        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI });
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await visible(env.page, "#confirm-etherscan-note");
+
+        await openSettings(env.page);
+        await env.page.check("#settings-check-recipients-on-etherscan");
+        await waitForPersisted(
+            env.page,
+            "checkRecipientsOnEtherscan",
+            true,
+            "once ticked",
+        );
+        const before = env.routeOpts.requests.length;
+        await env.page.click("#btn-settings-back");
+        await visible(env.page, "#view-confirm-tx");
+        await visible(env.page, "#confirm-etherscan-warning", 30000);
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-note")),
+            "ConfirmTx says no Etherscan check was made, with the check on",
+        );
+        const asked = env.routeOpts.requests
+            .slice(before)
+            .map((r) => r.url.toLowerCase())
+            .filter((url) => url.includes("etherscan.io"));
+        assert(
+            asked.length === 1 &&
+                asked[0] ===
+                    "https://etherscan.io/address/" + STUB_COUNTERPARTY,
+            "ConfirmTx asked Etherscan for " + JSON.stringify(asked),
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+        env.routeOpts.etherscanLabel = null;
+    }
+});
+
 test("add token screen opens from address detail (#150)", async (env) => {
     await openAddressDetail(env.page);
     await env.page.click("#btn-add-token");
@@ -5258,10 +5576,17 @@ async function main() {
         seedReceipt: false,
         // Whether eth_getTransactionReceipt fails instead of answering (#315).
         failReceiptLookup: false,
+        // The label Etherscan's page gives an address, when it gives one
+        // (#668).
+        etherscanLabel: null,
         // Every raw signed transaction handed to eth_sendRawTransaction, in
         // order. The dApp transaction round trip asserts against these bytes
         // rather than against anything the extension reported about them.
         broadcastTransactions: [],
+        // Every request the extension makes, in order, from when launch()
+        // installs the route handler, before the first popup page opens
+        // (#668).
+        requests: [],
     };
 
     let session;

tests/ensOffchainLookup.test.js

@@ -0,0 +1,114 @@
+// ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
+// name is resolved off-chain, naming a web address to fetch the answer from.
+// ethers fetches that address unless the provider has `disableCcipRead` set.
+// That request would carry the name to a server other than the RPC endpoint
+// (https://git.eeqj.de/sneak/AutistMask/issues/668). With the flag set, such a
+// name does not resolve.
+//
+// The test builds its provider with getProvider() and runs it against a fake
+// JSON-RPC node. The fake node answers through ethers' own request hook. The
+// hook also records the address of every request ethers makes, the off-chain
+// fetch included.
+
+const { FetchRequest, Interface } = require("ethers");
+const { getProvider } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const RESOLVER = "0x5555555555555555555555555555555555555555";
+const USER = "0x1111111111111111111111111111111111111111";
+const NAME = "offchain.eth";
+
+// The ENS registry's resolver(), and the resolver's functions ethers calls:
+//
+//   - the registry names RESOLVER for every name
+//   - the resolver says it resolves names through resolve()
+//   - it gives NAME as the reverse record of any address
+//   - it answers resolve() with the OffchainLookup error, which says the name
+//     is resolved off-chain
+const ens = new Interface([
+    "function resolver(bytes32) view returns (address)",
+    "function supportsInterface(bytes4) view returns (bool)",
+    "function name(bytes32) view returns (string)",
+    "function resolve(bytes, bytes) view returns (bytes)",
+    "error OffchainLookup(address sender, string[] urls, bytes callData, bytes4 callbackFunction, bytes extraData)",
+]);
+
+let asked;
+
+// One JSON-RPC answer. Anything but a call to one of the functions above is
+// refused.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    const call =
+        req.method === "eth_call" ? ens.parseTransaction(req.params[0]) : null;
+    if (call === null) {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    if (call.name === "resolve") {
+        const offchain = ens.encodeErrorResult("OffchainLookup", [
+            RESOLVER,
+            ["https://gateway.example.invalid/{sender}/{data}.json"],
+            "0x1234",
+            "0x12345678",
+            "0x",
+        ]);
+        return {
+            ...envelope,
+            error: { code: 3, message: "execution reverted", data: offchain },
+        };
+    }
+    const answers = {
+        resolver: [RESOLVER],
+        supportsInterface: [true],
+        name: [NAME],
+    };
+    return {
+        ...envelope,
+        result: ens.encodeFunctionResult(call.name, answers[call.name]),
+    };
+}
+
+beforeEach(() => {
+    asked = [];
+    FetchRequest.registerGetUrl(async (req) => {
+        asked.push(req.url);
+        // Any other address is the off-chain fetch, answered as not found.
+        if (req.url !== RPC_URL) {
+            return {
+                statusCode: 404,
+                statusMessage: "Not Found",
+                headers: {},
+                body: null,
+            };
+        }
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+});
+
+test("a name typed into Send that is resolved off-chain does not resolve, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.resolveName(NAME)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});
+
+test("the reverse lookup of a user's address whose name is resolved off-chain finds no name, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.lookupAddress(USER)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});

tests/fabricatedDecimals.test.js

@@ -35,8 +35,11 @@ global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub() };
+global.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+};
 
 const { AbiCoder, Interface } = require("ethers");
 const { ERC20_ABI } = require("../src/shared/constants");
@@ -165,6 +168,9 @@ beforeEach(() => {
     debugFetch.mockReset();
     state.trackedTokens = [];
     state.wallets = [];
+    // The approval screens read the explorer's report only while the page's
+    // "Use Blockscout" is on.
+    state.useBlockscout = true;
 });
 
 describe("what fetchTokenBalances stores for an absent scale", () => {

tests/holders.test.js

@@ -21,7 +21,11 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
-global.chrome = { storage: { local: {} } };
+// Blockscout is asked only while the stored "Use Blockscout" is on.
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+};
 
 const {
     LOW_HOLDER_THRESHOLD,

tests/nativeCurrency.test.js

@@ -436,6 +436,13 @@ describe.each([
         });
 
         test("the transaction detail screen's type line and fee", async () => {
+            // The fee is Blockscout's, asked for only while the stored "Use
+            // Blockscout" is on.
+            state.useBlockscout = true;
+            global.chrome.storage.write("autistmask", {
+                ...global.chrome.storage.read("autistmask"),
+                useBlockscout: true,
+            });
             debugFetch.mockImplementationOnce(async () => ({
                 ok: true,
                 status: 200,

tests/persistedEntryFloors.test.js

@@ -286,8 +286,12 @@ describe("a malformed fraudContracts", () => {
     function stubSendDocument() {
         const select = { innerHTML: "", children: [] };
         select.appendChild = (child) => select.children.push(child);
+        const elements = {
+            "send-token": select,
+            "send-tokens-note": { classList: { toggle: () => {} } },
+        };
         globalThis.document = {
-            getElementById: (id) => (id === "send-token" ? select : null),
+            getElementById: (id) => elements[id] || null,
             createElement: () => ({ value: "", textContent: "" }),
         };
         return select;

tests/persistedFieldContract.test.js

@@ -629,6 +629,14 @@ const CONTRACT = [
         // the falsy answer is also the DEFAULT_STATE default.
         falsy: [0],
     })),
+    // Each lets a request reach another service, so anything but true is off.
+    ...["useBlockscout", "checkRecipientsOnEtherscan"].map((field) => ({
+        field,
+        kind: KIND.SCALAR,
+        hostile: [42, "notabool", { a: 1 }],
+        floorOnly: [0, null, "true"],
+        holds: (v) => v === false,
+    })),
 ];
 
 function siteMapHolds(v) {

tests/popupBoot.test.js

@@ -44,7 +44,9 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
 
 // A boot onto a screen that sends a request no mocked module answers: that
 // request reaches the boot's fetch() stub, never the internet
-// (https://git.eeqj.de/sneak/AutistMask/issues/559).
+// (https://git.eeqj.de/sneak/AutistMask/issues/559). TransactionDetail asks
+// Blockscout only while "Use Blockscout" is on. ConfirmTx asks Etherscan only
+// while "Check recipients on Etherscan" is on. So the profile turns both on.
 function restoringOnto(view, viewData) {
     return unversionedValidProfile({
         currentView: view,
@@ -52,6 +54,8 @@ function restoringOnto(view, viewData) {
         selectedAddress: 0,
         viewStack: ["main"],
         viewData,
+        useBlockscout: true,
+        checkRecipientsOnEtherscan: true,
     });
 }
 

tests/sendDisplayFloor.test.js

@@ -90,7 +90,7 @@ let approvalDetails = null;
 
 const { makeStorageStub } = require("./support/storageStub");
 global.chrome = {
-    storage: makeStorageStub(),
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
     runtime: {
         connect: () => ({
             postMessage() {},
@@ -220,6 +220,10 @@ async function refreshWith(balanceWei, tokenItems = []) {
     state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
+    // Blockscout is asked only while the stored "Use Blockscout" is on. The
+    // screens save this page's copy of "Use Blockscout" over the stored one. So
+    // the page's copy is turned on here too.
+    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",

tests/sendMax.test.js

@@ -100,7 +100,10 @@ global.fetch = jest.fn(() => {
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -213,6 +216,10 @@ async function refreshWith(balanceWei, tokenItems = []) {
     ];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
+    // Blockscout is asked only while the stored "Use Blockscout" is on. The
+    // screens save this page's copy of "Use Blockscout" over the stored one. So
+    // the page's copy is turned on here too.
+    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",

tests/sendTokenSelect.test.js

@@ -27,8 +27,12 @@ let select;
 function installStubDocument() {
     select = { innerHTML: "", children: [] };
     select.appendChild = (child) => select.children.push(child);
+    const elements = {
+        "send-token": select,
+        "send-tokens-note": { classList: { toggle: () => {} } },
+    };
     globalThis.document = {
-        getElementById: (id) => (id === "send-token" ? select : null),
+        getElementById: (id) => elements[id] || null,
         createElement: () => ({ value: "", textContent: "" }),
     };
 }

tests/stateRecovery.test.js

@@ -523,13 +523,16 @@ describe("a garbage value in a field the gate does not check", () => {
     });
 
     test("a malformed tokenBalances entry is dropped, and the wallet and its address survive", async () => {
-        const env = await bootPopup(
-            profileWithTokenBalances([
-                null,
-                42,
-                { address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
-            ]),
-        );
+        // "Use Blockscout" is on. Otherwise the boot's balance refresh would
+        // drop the well-formed entry too, since the user has not tracked its
+        // token.
+        const profile = profileWithTokenBalances([
+            null,
+            42,
+            { address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
+        ]);
+        profile.useBlockscout = true;
+        const env = await bootPopup(profile);
 
         const stored = env.storage.read("autistmask");
         expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");

tests/support/popupBoot.js

@@ -283,6 +283,8 @@ async function bootPopup(stored, options) {
     jest.doMock("../../src/shared/balances", () => ({
         fetchTokenBalances: jest.fn(async () => []),
         refreshBalances: jest.fn(async () => {}),
+        dropUntrackedTokens: jest.requireActual("../../src/shared/balances")
+            .dropUntrackedTokens,
         lookupTokenInfo: jest.fn(async () => null),
         getProvider: () => ({}),
         scanForAddresses: jest.fn(async () => ({

tests/symbolSpoof.test.js

@@ -52,8 +52,14 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 global.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
+        local: {
+            get: async () => ({ autistmask: { useBlockscout: true } }),
+            set: async () => {},
+        },
+    },
 };
 
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
@@ -485,8 +491,12 @@ describe("surface 2: the Send token selector", () => {
     function render(tokenBalances) {
         select = { innerHTML: "", children: [] };
         select.appendChild = (child) => select.children.push(child);
+        const elements = {
+            "send-token": select,
+            "send-tokens-note": { classList: { toggle: () => {} } },
+        };
         globalThis.document = {
-            getElementById: (id) => (id === "send-token" ? select : null),
+            getElementById: (id) => elements[id] || null,
             createElement: () => ({ value: "", textContent: "" }),
         };
         renderSendTokenSelect({

tests/timestampDisplay.test.js

@@ -134,6 +134,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 describe.each([

tests/tokenTransferDetail.test.js

@@ -38,8 +38,14 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
+        local: {
+            get: async () => ({ autistmask: { useBlockscout: true } }),
+            set: async () => {},
+        },
+    },
 };
 
 const { state } = require("../src/shared/state");
@@ -158,6 +164,7 @@ beforeEach(() => {
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" } };
     state.blockscoutUrl = EXPLORER;
+    state.useBlockscout = true;
     state.networkEndpoints = {};
     state.wallets = [
         {

tests/trackedTokenBalances.test.js

@@ -1,6 +1,7 @@
 // The balance of each token the user tracks is read with balanceOf through the
-// RPC endpoint, for every address, and Blockscout's answer adds only the tokens
-// the user has not tracked (https://git.eeqj.de/sneak/AutistMask/issues/669).
+// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
+// holder count and decimals, and adds the tokens the user has not tracked
+// (https://git.eeqj.de/sneak/AutistMask/issues/669).
 //
 // The real refreshBalances() runs against a fake JSON-RPC node, answered
 // through ethers' own request hook, and a fake Blockscout, answered through
@@ -8,6 +9,12 @@
 
 const { AbiCoder, FetchRequest } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");
+const { makeStorageStub } = require("./support/storageStub");
+
+// Blockscout is asked only while the stored "Use Blockscout" is on.
+globalThis.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+};
 
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
@@ -113,15 +120,16 @@ function explorerRow(address, symbol, value, holders = "50000") {
     };
 }
 
-// The row refreshBalances() writes for TOKEN from a balanceOf answer.
-function trackedRow(balance) {
+// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
+// decimals and holder count Blockscout reported for it, if any.
+function trackedRow(balance, decimals = null, holders = null) {
     return {
         address: TOKEN,
         name: "Tracked Token",
         symbol: "TRK",
-        decimals: null,
+        decimals: decimals,
         balance: balance,
-        holders: null,
+        holders: holders,
     };
 }
 
@@ -183,7 +191,7 @@ test("a tracked token Blockscout also reports shows the RPC figure, and an untra
         [TRACKED],
     );
     expect(first.tokenBalances).toEqual([
-        trackedRow("2.0"),
+        trackedRow("2.0", 6, 50000),
         {
             address: USDC,
             name: "USDC",
@@ -195,9 +203,30 @@ test("a tracked token Blockscout also reports shows the RPC figure, and an untra
     ]);
 });
 
-test("a failed balanceOf leaves the token's previous figure, and is logged", async () => {
-    explorerRows = [];
-    const before = trackedRow("7.0");
+test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
+    // through to Send's token list.
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const before = trackedRow("7.0", 6, 50000);
     const [first] = await refresh(
         [{ address: FIRST, tokenBalances: [before] }],
         [TRACKED],
@@ -208,6 +237,31 @@ test("a failed balanceOf leaves the token's previous figure, and is logged", asy
     );
 });
 
+test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
+    // balanceOf fails at FIRST and answers at SECOND.
+    holdings[TOKEN] = { [SECOND]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: TOKEN,
+            name: "TRK",
+            symbol: "TRK",
+            decimals: 6,
+            balance: "9.0",
+            holders: 50000,
+        },
+    ]);
+    // Where balanceOf answers, its figure stands.
+    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
 test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
     holdings[TOKEN] = { [FIRST]: 0n };
     const [first] = await refresh(
@@ -226,10 +280,29 @@ test("a tracked token whose scale nothing knows gets no quantity, not a zero", a
     expect(first.tokenBalances).toEqual([trackedRow(null)]);
 });
 
-test("a tracked token wearing a known symbol from another contract is not listed", async () => {
-    holdings[OTHER] = { [FIRST]: 5000000n };
+test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
     const [first] = await refresh(
         [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a tracked token wearing a known symbol from another contract is not listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    // Its entry from before goes too, although Blockscout fails.
+    const before = {
+        address: OTHER,
+        name: "Fake",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
         [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
     );
     expect(first.tokenBalances).toEqual([]);

tests/trackedTokensPerNetwork.test.js

@@ -287,6 +287,7 @@ describe("Back after a switch from the Settings gear", () => {
                 currentView: "confirm-tx",
                 selectedWallet: 0,
                 selectedAddress: 0,
+                checkRecipientsOnEtherscan: true,
                 viewData: {
                     pendingTx: {
                         token: "ETH",

tests/transactionListCancelled.test.js

@@ -125,6 +125,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 afterEach(() => {

tests/transactions.test.js

@@ -1215,6 +1215,8 @@ function respondWith(txItems, tokenTransferItems) {
 describe("fetchRecentTransactions merge and dedup", () => {
     beforeEach(() => {
         debugFetch.mockReset();
+        // Blockscout is asked only while the stored "Use Blockscout" is on.
+        global.chrome.storage.write("autistmask", { useBlockscout: true });
     });
 
     test("queries only the two Blockscout endpoints for the address", async () => {

tests/uniswapRecipient.test.js

@@ -42,8 +42,14 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
+        local: {
+            get: async () => ({ autistmask: { useBlockscout: true } }),
+            set: async () => {},
+        },
+    },
 };
 
 const uniswap = require("../src/shared/uniswap");
@@ -3456,6 +3462,7 @@ async function showDetail(data) {
     globalThis.window = { location: { search: "" } };
     state.networkId = "mainnet";
     state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.useBlockscout = true;
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;

tests/uniswapRouterAddress.test.js

@@ -34,8 +34,14 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
+    storage: {
+        local: {
+            get: async () => ({ autistmask: { useBlockscout: true } }),
+            set: async () => {},
+        },
+    },
 };
 
 const { state } = require("../src/shared/state");
@@ -208,6 +214,7 @@ async function showDetail(row, activeNetworkId) {
     globalThis.window = { location: { search: "" } };
     state.networkId = activeNetworkId;
     state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.useBlockscout = true;
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;

tests/uniswapUnknownDecimals.test.js

@@ -90,6 +90,9 @@ function swapDetail(data, label) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
+    // The approval screen reads the explorer's report only while "Use
+    // Blockscout" is on.
+    state.useBlockscout = true;
 });
 
 describe("a swap of a token outside the bundled list", () => {

tests/unknownScaleSend.test.js

@@ -72,8 +72,12 @@ global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
+// Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM. Every id in index.html that these two views touch resolves to a
 // fresh recording element; nothing here depends on layout, only on what the
@@ -268,6 +272,9 @@ beforeEach(() => {
     state.fraudContracts = [];
     state.hideLowHolderTokens = false;
     state.currentView = null;
+    // The screens save this page's copy of "Use Blockscout" over the stored
+    // one. So the page's copy is turned on here too.
+    state.useBlockscout = true;
 });
 
 describe("the Send screen resolves the scale rather than reading the stored one", () => {