fix: strip wildcard prefixes from vendored blocklist entries

The MetaMask blocklist contains 2 entries with '*.' wildcard prefixes
(e.g. *.coinbase-563513.com). These were stored literally and never
matched because hostnameVariants() doesn't generate '*.' prefixed
strings. Fix: normalizeDomain() strips the '*.' prefix at load time
and during delta computation. The subdomain matching in
hostnameVariants() already handles child domains correctly.

Found during review.

.dockerignore

@@ -1,3 +1,4 @@
+.git
 node_modules
 .DS_Store
 dist

Dockerfile

@@ -1,7 +1,7 @@
 # node:22-slim (22.x LTS), 2026-02-24
 FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
 
-RUN apt-get update && apt-get install -y --no-install-recommends make git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
 RUN corepack enable && corepack prepare yarn@1.22.22 --activate
 
 WORKDIR /app

LICENSE

@@ -672,110 +672,3 @@ may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
 <https://www.gnu.org/licenses/why-not-lgpl.html>.
-
-===========================================================================
-THIRD-PARTY FILES
-===========================================================================
-
-The following files are not original to this project and are distributed
-under their own licenses. They are NOT covered by the GPL-3.0 license above.
-
----------------------------------------------------------------------------
-File: src/shared/phishingBlocklist.json
-Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
-Copyright: Copyright (c) 2018 kumavis
-License: Don't Be a Dick Public License (DBAD), Version 1.2
----------------------------------------------------------------------------
-
-DON'T BE A DICK PUBLIC LICENSE
-
-Version 1.2, February 2021
-
-Copyright (C) 2018 kumavis
-
-Everyone is permitted to copy and distribute verbatim or modified
-copies of this license document.
-
-DON'T BE A DICK PUBLIC LICENSE
-TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
- 1. Do whatever you like with the original work, just don't be a dick.
-
-     Being a dick includes - but is not limited to - the following instances:
-
-     1a. Outright copyright infringement - Don't just copy the original
-         work/works and change the name.
-     1b. Selling the unmodified original with no work done what-so-ever,
-         that's REALLY being a dick.
-     1c. Modifying the original work to contain hidden harmful content.
-         That would make you a PROPER dick.
-
- 2. If you become rich through modifications, related works/services, or
-    supporting the original work, share the love. Only a dick would make
-    loads off this work and not buy the original work's creator(s) a pint.
-
- 3. Code is provided with no warranty. Using somebody else's code and
-    bitching when it goes wrong makes you a DONKEY dick. Fix the problem
-    yourself. A non-dick would submit the fix back or submit a bug report.
-
- 4. If you use code, calling it your own would make you a ROYAL dick.
-    Alternatively, even just a comment giving attribution to where you found
-    the code would be OK.
-
----------------------------------------------------------------------------
-File: src/shared/scamlist.js (address data from MyEtherWallet ethereum-lists)
-Source: https://github.com/MyEtherWallet/ethereum-lists (addresses-darklist.json)
-Copyright: Copyright (c) 2020 MyEtherWallet
-License: MIT License
----------------------------------------------------------------------------
-
-MIT License
-
-Copyright (c) 2020 MyEtherWallet
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
----------------------------------------------------------------------------
-File: src/shared/scamlist.js (address data from EtherScamDB)
-Source: https://github.com/MrLuit/EtherScamDB (scams.yaml)
-Copyright: Copyright (c) 2018 Luit Hollander
-License: MIT License
----------------------------------------------------------------------------
-
-MIT License
-
-Copyright (c) 2018 Luit Hollander
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -15,12 +15,10 @@ Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
 Everything you need, nothing you don't. We import as few libraries as possible,
 don't implement any crypto, and don't send user-specific data anywhere but a
 (user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
-extension contacts three user-configurable services: the configured RPC node for
+extension contacts exactly three external services: the configured RPC node for
 blockchain interactions, a public CoinDesk API (no API key) for realtime price
 information, and a Blockscout block-explorer API for transaction history and
-token balances. It also fetches a community-maintained phishing domain blocklist
+token balances. All three endpoints are user-configurable.
-periodically and performs best-effort Etherscan address label lookups during
-transaction confirmation.
 
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -437,29 +435,16 @@ transitions.
 #### TransactionDetail
 
 - **When**: User tapped a transaction row from AddressDetail or AddressToken.
-- **Elements** (grouped into logical blocks using light well containers; field
+- **Elements**:
-  labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
-    - Transaction hash: full hash (tap to copy) + etherscan link
-    - Type: transaction classification — one of: Native ETH Transfer, ERC-20
-      Token Transfer, Swap, Token Approval, Contract Call, Contract Creation
     - Status: "Success" or "Failed"
-    - From: blockie + color dot + full address (tap to copy) + etherscan link;
-      ENS name if available
-    - To: blockie + color dot + full address (tap to copy) + etherscan link; ENS
-      name if available
     - Time: ISO datetime + relative age in parentheses
-    - Block: block number (tap to copy) + etherscan block link
     - Amount: value + symbol (bold)
-    - Native quantity: raw integer + unit (shown when available)
+    - From: blockie + color dot + full address (tap to copy) + etherscan link
-    - Token contract: shown for ERC-20 transfers — color dot + full contract
+        - ENS name if available
-      address (tap to copy) + etherscan token link
+    - To: blockie + color dot + full address (tap to copy) + etherscan link
-    - Decoded details (shown for contract calls): action name, decoded
+        - ENS name if available
-      parameters, token details, swap steps
+    - Transaction hash: full hash (tap to copy) + etherscan link
-    - Network details (shown when on-chain data is available): nonce, gas price,
-      gas used, transaction fee (all tap to copy)
-    - Raw data (shown when calldata is present): full calldata in monospace
-      dashed border
 - **Transitions**:
     - "Back" → **AddressToken** (if `selectedToken` set) or **AddressDetail**
 
@@ -582,25 +567,14 @@ What the extension does NOT do:
 
 - No analytics or telemetry services
 - No token list APIs (user adds tokens manually by contract address)
+- No phishing/blocklist APIs
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
-In addition to the three user-configurable services above (RPC endpoint,
+These three services (RPC endpoint, CoinDesk price API, and Blockscout API) are
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
+the only external services. All three endpoints are user-configurable. Users who
-
+want maximum privacy can point the RPC and Blockscout URLs at their own
-- **Phishing domain blocklist**: A community-maintained phishing domain
+self-hosted instances (price fetching can be disabled in a future version).
-  blocklist is vendored into the extension at build time. At runtime, the
-  extension fetches the live list once every 24 hours to detect newly added
-  domains. Only the delta (domains not already in the vendored list) is kept in
-  memory, keeping runtime memory usage small. The delta is persisted to
-  localStorage if it is under 256 KiB.
-- **Etherscan address labels**: When confirming a transaction, the extension
-  performs a best-effort lookup of the recipient address on Etherscan to check
-  for phishing/scam labels. This is a direct page fetch with no API key; the
-  user's browser makes the request.
-
-Users who want maximum privacy can point the RPC and Blockscout URLs at their
-own self-hosted instances (price fetching can be disabled in a future version).
 
 ### Dependencies
 
@@ -790,21 +764,6 @@ indexes it as a real token transfer.
   designed as a sharp tool — users who understand the risks can configure the
   wallet to show everything unfiltered, unix-style.
 
-#### Phishing Domain Protection
-
-AutistMask protects users from known phishing sites when they connect their
-wallet or approve transactions/signatures. A community-maintained domain
-blocklist is vendored into the extension at build time, providing immediate
-protection without any network requests. At runtime, the extension fetches the
-live list once every 24 hours and keeps only the delta (newly added domains not
-in the vendored list) in memory. This architecture keeps runtime memory usage
-small while ensuring fresh coverage of new phishing domains.
-
-When a dApp on a blocklisted domain requests a wallet connection, transaction
-approval, or signature, the approval popup displays a prominent red warning
-banner alerting the user. The domain checker matches exact hostnames and all
-parent domains (subdomain matching).
-
 #### Transaction Decoding
 
 When a dApp asks the user to approve a transaction, AutistMask attempts to
@@ -887,21 +846,6 @@ Currently supported:
 
 GPL-3.0. See [LICENSE](LICENSE).
 
-### Third-Party Data Files
-
-This repository includes data files from third-party projects that are not
-covered by the GPL-3.0 license above. These files, their copyright holders, and
-their licenses are:
-
-| File                                                       | Source                                                                                                                    | Copyright                         | License                                                        |
-| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
-| `src/shared/phishingBlocklist.json`                        | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis        | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
-| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json`                               | Copyright (c) 2020 MyEtherWallet  | MIT                                                            |
-| `src/shared/scamlist.js` (address data from EtherScamDB)   | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml`                                                         | Copyright (c) 2018 Luit Hollander | MIT                                                            |
-
-The full license texts for these third-party files are included in the
-[LICENSE](LICENSE) file.
-
 ## Author
 
 [@sneak](https://sneak.berlin)

build.js

@@ -11,51 +11,9 @@ function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
 }
 
-function getBuildInfo() {
-    const pkg = JSON.parse(
-        fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
-    );
-    let commitHash = "unknown";
-    try {
-        commitHash = execSync("git rev-parse --short HEAD", {
-            encoding: "utf8",
-        }).trim();
-    } catch (_) {
-        // not a git repo or git not available
-    }
-    let commitHashFull = "unknown";
-    try {
-        commitHashFull = execSync("git rev-parse HEAD", {
-            encoding: "utf8",
-        }).trim();
-    } catch (_) {
-        // not a git repo or git not available
-    }
-    return {
-        version: pkg.version,
-        license: pkg.license,
-        author: pkg.author,
-        commitHash,
-        commitHashFull,
-        buildDate: new Date().toISOString().slice(0, 10),
-    };
-}
-
 async function build() {
     console.log("Building AutistMask extension...");
 
-    const buildInfo = getBuildInfo();
-    console.log("Build info:", buildInfo);
-
-    const define = {
-        __BUILD_VERSION__: JSON.stringify(buildInfo.version),
-        __BUILD_LICENSE__: JSON.stringify(buildInfo.license),
-        __BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
-        __BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
-        __BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
-        __BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
-    };
-
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
@@ -80,7 +38,6 @@ async function build() {
             platform: "browser",
             target: ["chrome110", "firefox110"],
             minify: true,
-            define,
         });
 
         // bundle background script
@@ -92,7 +49,6 @@ async function build() {
             platform: "browser",
             target: ["chrome110", "firefox110"],
             minify: true,
-            define,
         });
 
         // bundle content script
@@ -104,7 +60,6 @@ async function build() {
             platform: "browser",
             target: ["chrome110", "firefox110"],
             minify: true,
-            define,
         });
 
         // bundle inpage script (injected into page context, separate file)
@@ -116,7 +71,6 @@ async function build() {
             platform: "browser",
             target: ["chrome110", "firefox110"],
             minify: true,
-            define,
         });
 
         // copy popup HTML

src/background/index.js

@@ -2,16 +2,12 @@
 // Handles EIP-1193 RPC requests from content scripts and proxies
 // non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
 
-const { DEFAULT_RPC_URL } = require("../shared/constants");
-const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
-const { onChainSwitch } = require("../shared/chainSwitch");
-const { getBytes } = require("ethers");
 const {
-    state,
+    ETHEREUM_MAINNET_CHAIN_ID,
-    loadState,
+    DEFAULT_RPC_URL,
-    saveState,
+} = require("../shared/constants");
-    currentNetwork,
+const { getBytes } = require("ethers");
-} = require("../shared/state");
+const { state, loadState, saveState } = require("../shared/state");
 const { refreshBalances, getProvider } = require("../shared/balances");
 const { debugFetch } = require("../shared/log");
 const { decryptWithPassword } = require("../shared/vault");
@@ -19,7 +15,6 @@ const { getSignerForAddress } = require("../shared/wallet");
 const {
     isPhishingDomain,
     updatePhishingList,
-    startPeriodicRefresh,
 } = require("../shared/phishingDomains");
 
 const storageApi =
@@ -333,43 +328,31 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "eth_chainId") {
-        return { result: currentNetwork().chainId };
+        return { result: ETHEREUM_MAINNET_CHAIN_ID };
     }
 
     if (method === "net_version") {
-        return { result: currentNetwork().networkVersion };
+        return { result: "1" };
     }
 
     if (method === "wallet_switchEthereumChain") {
         const chainId = params?.[0]?.chainId;
-        if (chainId === currentNetwork().chainId) {
+        if (chainId === ETHEREUM_MAINNET_CHAIN_ID) {
-            return { result: null };
-        }
-        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
-            const target = networkByChainId(chainId);
-            await onChainSwitch(target.id);
-            broadcastChainChanged(target.chainId);
             return { result: null };
         }
         return {
             error: {
                 code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
-                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
             },
         };
     }
 
     if (method === "wallet_addEthereumChain") {
-        const chainId = params?.[0]?.chainId;
-        if (SUPPORTED_CHAIN_IDS.has(chainId)) {
-            return { result: null };
-        }
         return {
             error: {
                 code: 4902,
-                message:
+                message: "AutistMask only supports Ethereum mainnet.",
-                    "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.",
             },
         };
     }
@@ -515,27 +498,6 @@ async function handleRpc(method, params, origin) {
     return { error: { message: "Unsupported method: " + method } };
 }
 
-// Broadcast chainChanged to all tabs when the network is switched.
-function broadcastChainChanged(chainId) {
-    tabsApi.query({}, (tabs) => {
-        for (const tab of tabs) {
-            tabsApi.sendMessage(
-                tab.id,
-                {
-                    type: "AUTISTMASK_EVENT",
-                    eventName: "chainChanged",
-                    data: chainId,
-                },
-                () => {
-                    if (runtime.lastError) {
-                        // expected for tabs without our content script
-                    }
-                },
-            );
-        }
-    });
-}
-
 // Broadcast accountsChanged to all tabs, respecting per-address permissions
 async function broadcastAccountsChanged() {
     // Clear non-remembered approvals on address switch
@@ -613,10 +575,9 @@ async function backgroundRefresh() {
 
 setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL);
 
-// Fetch the phishing domain blocklist delta on startup and refresh every 24h.
+// Fetch the MetaMask eth-phishing-detect domain blocklist on startup.
-// The vendored blocklist is bundled at build time; this fetches only new entries.
+// Refreshes every 24 hours automatically.
 updatePhishingList();
-startPeriodicRefresh();
 
 // When approval window is closed without a response, treat as rejection
 if (windowsApi && windowsApi.onRemoved) {

src/content/inpage.js

@@ -2,10 +2,7 @@
 // Creates window.ethereum (EIP-1193 provider) and announces via EIP-6963.
 
 (function () {
-    // Defaults to mainnet; updated dynamically via eth_chainId on init and
+    const CHAIN_ID = "0x1"; // Ethereum mainnet
-    // chainChanged events from the extension.
-    let currentChainId = "0x1";
-    let currentNetworkVersion = "1";
 
     const listeners = {};
     let nextId = 1;
@@ -31,12 +28,6 @@
         if (event.source !== window) return;
         if (event.data?.type !== "AUTISTMASK_EVENT") return;
         const { eventName, data } = event.data;
-        if (eventName === "chainChanged") {
-            currentChainId = data;
-            currentNetworkVersion = String(parseInt(data, 16));
-            provider.chainId = currentChainId;
-            provider.networkVersion = currentNetworkVersion;
-        }
         emit(eventName, data);
     });
 
@@ -66,8 +57,8 @@
     const provider = {
         isAutistMask: true,
         isMetaMask: true, // compatibility — many dApps check this
-        chainId: currentChainId,
+        chainId: CHAIN_ID,
-        networkVersion: currentNetworkVersion,
+        networkVersion: "1",
         selectedAddress: null,
 
         async request(args) {
@@ -84,12 +75,6 @@
                         ? result[0]
                         : null;
             }
-            if (args.method === "eth_chainId" && result) {
-                currentChainId = result;
-                currentNetworkVersion = String(parseInt(result, 16));
-                provider.chainId = currentChainId;
-                provider.networkVersion = currentNetworkVersion;
-            }
             return result;
         },
 
@@ -204,19 +189,4 @@
 
     window.addEventListener("eip6963:requestProvider", announceProvider);
     announceProvider();
-
-    // Fetch the current chain ID from the extension on load so the provider
-    // reflects the selected network immediately (covers Sepolia etc.).
-    sendRequest({ method: "eth_chainId", params: [] })
-        .then((chainId) => {
-            if (chainId) {
-                currentChainId = chainId;
-                currentNetworkVersion = String(parseInt(chainId, 16));
-                provider.chainId = currentChainId;
-                provider.networkVersion = currentNetworkVersion;
-            }
-        })
-        .catch(() => {
-            // Best-effort — keep defaults.
-        });
 })();

src/popup/index.html

@@ -882,24 +882,6 @@
                     </div>
                 </div>
 
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <h3 class="font-bold mb-1">Network</h3>
-                    <p class="text-xs text-muted mb-1">
-                        Select the Ethereum network. Switching networks will
-                        update the RPC and Blockscout endpoints to their
-                        defaults.
-                    </p>
-                    <div class="text-xs flex items-center gap-1">
-                        <select
-                            id="settings-network"
-                            class="border border-border p-1 bg-bg text-fg text-xs cursor-pointer"
-                        >
-                            <option value="mainnet">Ethereum Mainnet</option>
-                            <option value="sepolia">Sepolia Testnet</option>
-                        </select>
-                    </div>
-                </div>
-
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Ethereum RPC</h3>
                     <p class="text-xs text-muted mb-1">
@@ -1002,64 +984,6 @@
                     </p>
                     <div id="settings-denied-sites"></div>
                 </div>
-
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <h3 class="font-bold mb-1">About</h3>
-                    <p class="text-xs mb-2">
-                        <a
-                            href="https://git.eeqj.de/sneak/AutistMask"
-                            class="underline decoration-dashed"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            >AutistMask</a
-                        >
-                        — Minimal Ethereum wallet browser extension.
-                    </p>
-                    <div class="text-xs">
-                        <div class="mb-1">
-                            <span class="text-muted">License:</span>
-                            <span id="about-license"></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Author:</span>
-                            <span id="about-author"></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Version:</span>
-                            <span
-                                id="about-version"
-                                class="cursor-pointer select-none"
-                            ></span>
-                        </div>
-                        <div class="mb-1">
-                            <span class="text-muted">Release date:</span>
-                            <span id="about-release-date"></span>
-                        </div>
-                        <div>
-                            <span class="text-muted">Commit:</span>
-                            <a
-                                id="about-commit-link"
-                                class="underline decoration-dashed"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                            ></a>
-                        </div>
-                    </div>
-                </div>
-
-                <div
-                    id="settings-debug-well"
-                    class="bg-well p-3 mx-1 mb-3"
-                    style="display: none"
-                >
-                    <h3 class="font-bold mb-1">Debug</h3>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer"
-                    >
-                        <input type="checkbox" id="settings-debug-mode" />
-                        Enable debug mode
-                    </label>
-                </div>
             </div>
 
             <!-- ============ DELETE WALLET CONFIRM ============ -->
@@ -1177,84 +1101,39 @@
                 <h2 id="tx-detail-heading" class="font-bold mb-2">
                     Transaction
                 </h2>
-
+                <div id="tx-detail-type-section" class="mb-4 hidden">
-                <!-- ── Identity ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
-                        <div class="text-xs text-muted mb-1">
-                            Transaction hash
-                        </div>
-                        <div
-                            id="tx-detail-hash"
-                            class="text-xs break-all"
-                        ></div>
-                    </div>
-                    <div id="tx-detail-type-section" class="mb-2 hidden">
                     <div class="text-xs text-muted mb-1">Type</div>
-                        <div
+                    <div id="tx-detail-type" class="text-xs font-bold"></div>
-                            id="tx-detail-type"
-                            class="text-xs font-bold"
-                        ></div>
                 </div>
-                    <div class="mb-2">
+                <div class="mb-4">
                     <div class="text-xs text-muted mb-1">Status</div>
                     <div id="tx-detail-status" class="text-xs"></div>
                 </div>
-                    <div class="mb-2">
+                <div class="mb-4">
-                        <div class="text-xs text-muted mb-1">From</div>
-                        <div
-                            id="tx-detail-from"
-                            class="text-xs break-all"
-                        ></div>
-                    </div>
-                    <div class="mb-2">
-                        <div class="text-xs text-muted mb-1">To</div>
-                        <div id="tx-detail-to" class="text-xs break-all"></div>
-                    </div>
-                </div>
-
-                <!-- ── Timing ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Time</div>
                     <div id="tx-detail-time" class="text-xs"></div>
                 </div>
-                    <div id="tx-detail-block-section" class="mb-2 hidden">
+                <div class="mb-4">
-                        <div class="text-xs text-muted mb-1">Block</div>
-                        <div id="tx-detail-block" class="text-xs"></div>
-                    </div>
-                </div>
-
-                <!-- ── Value ── -->
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="tx-detail-value" class="text-xs"></div>
                 </div>
-                    <div class="mb-2 hidden">
+                <div class="mb-4 hidden">
-                        <div class="text-xs text-muted mb-1">
+                    <div class="text-xs text-muted mb-1">Native quantity</div>
-                            Native quantity
-                        </div>
                     <div id="tx-detail-native" class="text-xs"></div>
                 </div>
+                <div class="mb-4">
+                    <div class="text-xs text-muted mb-1">From</div>
+                    <div id="tx-detail-from" class="text-xs break-all"></div>
+                </div>
+                <div class="mb-4">
+                    <div class="text-xs text-muted mb-1">To</div>
+                    <div id="tx-detail-to" class="text-xs break-all"></div>
+                </div>
+                <div id="tx-detail-calldata-section" class="mb-4 hidden">
                     <div
-                        id="tx-detail-token-contract-section"
+                        id="tx-detail-calldata-well"
-                        class="mb-2 hidden"
+                        class="mb-3 border border-border border-dashed p-2"
                     >
-                        <div class="text-xs text-muted mb-1">
-                            Token contract
-                        </div>
-                        <div
-                            id="tx-detail-token-contract"
-                            class="text-xs break-all"
-                        ></div>
-                    </div>
-                </div>
-
-                <!-- ── Decoded details ── -->
-                <div id="tx-detail-calldata-section" class="hidden">
-                    <div class="bg-well p-3 mx-1 mb-3">
-                        <div id="tx-detail-calldata-well" class="mb-2">
                         <div class="text-xs text-muted mb-1">Action</div>
                         <div
                             id="tx-detail-calldata-action"
@@ -1266,39 +1145,11 @@
                         ></div>
                     </div>
                 </div>
+                <div class="mb-4">
+                    <div class="text-xs text-muted mb-1">Transaction hash</div>
+                    <div id="tx-detail-hash" class="text-xs break-all"></div>
                 </div>
-
+                <div id="tx-detail-rawdata-section" class="mb-4 hidden">
-                <!-- ── Network details ── -->
-                <div id="tx-detail-network-section" class="hidden">
-                    <div class="bg-well p-3 mx-1 mb-3">
-                        <div id="tx-detail-nonce-section" class="mb-2 hidden">
-                            <div class="text-xs text-muted mb-1">Nonce</div>
-                            <div id="tx-detail-nonce" class="text-xs"></div>
-                        </div>
-                        <div
-                            id="tx-detail-gasprice-section"
-                            class="mb-2 hidden"
-                        >
-                            <div class="text-xs text-muted mb-1">Gas price</div>
-                            <div id="tx-detail-gasprice" class="text-xs"></div>
-                        </div>
-                        <div id="tx-detail-gasused-section" class="mb-2 hidden">
-                            <div class="text-xs text-muted mb-1">Gas used</div>
-                            <div id="tx-detail-gasused" class="text-xs"></div>
-                        </div>
-                        <div id="tx-detail-fee-section" class="mb-2 hidden">
-                            <div class="text-xs text-muted mb-1">
-                                Transaction fee
-                            </div>
-                            <div id="tx-detail-fee" class="text-xs"></div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- ── Raw data ── -->
-                <div id="tx-detail-rawdata-section" class="hidden">
-                    <div class="bg-well p-3 mx-1 mb-3">
-                        <div class="mb-2">
                     <div class="text-xs text-muted mb-1">Raw data</div>
                     <div
                         id="tx-detail-rawdata"
@@ -1306,8 +1157,6 @@
                     ></div>
                 </div>
             </div>
-                </div>
-            </div>
 
             <!-- ============ TRANSACTION APPROVAL ============ -->
             <div id="view-approve-tx" class="view hidden">
@@ -1316,7 +1165,7 @@
                     id="approve-tx-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on a known phishing
+                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
                     blocklist. This transaction may steal your funds. Proceed
                     with extreme caution.
                 </div>
@@ -1390,7 +1239,7 @@
                     id="approve-sign-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on a known phishing
+                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
                     blocklist. Signing this message may authorize theft of your
                     funds. Proceed with extreme caution.
                 </div>
@@ -1467,7 +1316,7 @@
                     id="approve-site-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on a known phishing
+                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
                     blocklist. Connecting your wallet may result in loss of
                     funds. Proceed with extreme caution.
                 </div>

src/popup/index.js

@@ -1,24 +1,11 @@
 // AutistMask popup entry point.
 // Loads state, initializes views, triggers first render.
 
-const {
+const { DEBUG } = require("../shared/constants");
-    state,
+const { state, saveState, loadState } = require("../shared/state");
-    saveState,
-    loadState,
-    currentNetwork,
-} = require("../shared/state");
-const { isDebug, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
 const { refreshBalances } = require("../shared/balances");
-const {
+const { $, showView } = require("./views/helpers");
-    $,
-    showView,
-    updateDebugBanner,
-    setRenderMain,
-    pushCurrentView,
-    goBack,
-    clearViewStack,
-} = require("./views/helpers");
 const { applyTheme } = require("./theme");
 
 const home = require("./views/home");
@@ -66,42 +53,15 @@ async function doRefreshAndRender() {
 const ctx = {
     renderWalletList,
     doRefreshAndRender,
-    showAddWalletView: () => {
+    showAddWalletView: () => addWallet.show(),
-        pushCurrentView();
+    showAddressDetail: () => addressDetail.show(),
-        addWallet.show();
+    showAddressToken: () => addressToken.show(),
-    },
+    showAddTokenView: () => addToken.show(),
-    showAddressDetail: () => {
+    showConfirmTx: (txInfo) => confirmTx.show(txInfo),
-        pushCurrentView();
+    showReceive: () => receive.show(),
-        addressDetail.show();
+    showTransactionDetail: (tx) => transactionDetail.show(tx),
-    },
+    showSettingsView: () => settings.show(),
-    showAddressToken: () => {
+    showSettingsAddTokenView: () => settingsAddToken.show(),
-        pushCurrentView();
-        addressToken.show();
-    },
-    showAddTokenView: () => {
-        pushCurrentView();
-        addToken.show();
-    },
-    showConfirmTx: (txInfo) => {
-        pushCurrentView();
-        confirmTx.show(txInfo);
-    },
-    showReceive: () => {
-        pushCurrentView();
-        receive.show();
-    },
-    showTransactionDetail: (tx) => {
-        pushCurrentView();
-        transactionDetail.show(tx);
-    },
-    showSettingsView: () => {
-        pushCurrentView();
-        settings.show();
-    },
-    showSettingsAddTokenView: () => {
-        pushCurrentView();
-        settingsAddToken.show();
-    },
 };
 
 // Views that can be fully re-rendered from persisted state.
@@ -207,15 +167,18 @@ function fallbackView() {
 }
 
 async function init() {
+    if (DEBUG) {
+        const banner = document.createElement("div");
+        banner.id = "debug-banner";
+        banner.textContent = "DEBUG / INSECURE";
+        banner.style.cssText =
+            "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
+        document.body.prepend(banner);
+    }
+
     await loadState();
     applyTheme(state.theme);
 
-    // Sync runtime debug flag from persisted state before first render
-    setRuntimeDebug(state.debugMode);
-
-    // Create the debug/testnet banner if needed (uses runtime debug state)
-    updateDebugBanner();
-
     // Auto-default active address
     if (
         state.activeAddress === null &&
@@ -245,15 +208,13 @@ async function init() {
                 .getElementById("view-settings")
                 .classList.contains("hidden")
         ) {
-            goBack();
+            renderWalletList();
+            showView("main");
             return;
         }
-        pushCurrentView();
         settings.show();
     });
 
-    setRenderMain(renderWalletList);
-
     welcome.init(ctx);
     addWallet.init(ctx);
     home.init(ctx);

src/popup/styles/main.css

@@ -10,7 +10,7 @@
     --color-border: #000000;
     --color-border-light: #cccccc;
     --color-hover: #eeeeee;
-    --color-well: #e8e8e8;
+    --color-well: #f5f5f5;
     --color-danger-well: #fef2f2;
     --color-section: #dddddd;
 }

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -59,12 +59,7 @@ function init(ctx) {
             });
             await saveState();
             ctx.doRefreshAndRender();
-            // Pop the stack (back to address detail) and re-render it
+            ctx.showAddressDetail();
-            // so the newly added token is visible immediately.
-            if (state.viewStack.length > 0) {
-                state.viewStack.pop();
-            }
-            require("./addressDetail").show();
         } catch (e) {
             const detail = e.shortMessage || e.message || String(e);
             log.errorf("Token lookup failed for", contractAddr, detail);
@@ -74,9 +69,7 @@ function init(ctx) {
         }
     });
 
-    $("btn-add-token-back").addEventListener("click", () => {
+    $("btn-add-token-back").addEventListener("click", ctx.showAddressDetail);
-        goBack();
-    });
 }
 
 module.exports = { init, show };

src/popup/views/addWallet.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const {
     generateMnemonic,
     hdWalletFromMnemonic,
@@ -143,7 +143,6 @@ async function importMnemonic(ctx) {
     state.wallets.push(wallet);
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -199,7 +198,6 @@ async function importPrivateKey(ctx) {
     });
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -251,7 +249,6 @@ async function importXprvKey(ctx) {
     state.wallets.push(wallet);
     state.hasWallet = true;
     await saveState();
-    clearViewStack();
     ctx.renderWalletList();
     showView("main");
 
@@ -300,7 +297,12 @@ function init(ctx) {
 
     // Back button
     $("btn-add-wallet-back").addEventListener("click", () => {
-        goBack();
+        if (!state.hasWallet) {
+            showView("welcome");
+        } else {
+            ctx.renderWalletList();
+            showView("main");
+        }
     });
 }
 

src/popup/views/addressDetail.js

@@ -8,10 +8,6 @@ const {
     addressTitle,
     escapeHtml,
     truncateMiddle,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
-    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
@@ -32,6 +28,17 @@ const { getSignerForAddress } = require("../../shared/wallet");
 
 let ctx;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function show() {
     state.selectedToken = null;
     const wallet = state.wallets[state.selectedWallet];
@@ -49,18 +56,22 @@ function show() {
     img.style.imageRendering = "pixelated";
     img.style.borderRadius = "50%";
     blockieEl.appendChild(img);
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-etherscan-link").innerHTML =
-    $("address-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    attachCopyHandlers($("address-line"));
     const usdTotal = formatUsd(getAddressValueUsd(addr));
     $("address-usd-total").innerHTML = usdTotal || "&nbsp;";
     const ensEl = $("address-ens");
-    // ENS is now shown inside renderAddressHtml, hide the separate element
+    if (addr.ensName) {
+        ensEl.innerHTML =
+            addressDotHtml(addr.address) + escapeHtml(addr.ensName);
+        ensEl.classList.remove("hidden");
+    } else {
         ensEl.classList.add("hidden");
+    }
     $("address-balances").innerHTML = balanceLinesForAddress(
         addr,
         state.trackedTokens,
@@ -247,9 +258,18 @@ function renderTransactions(txs) {
 
 function init(_ctx) {
     ctx = _ctx;
+    $("address-full").addEventListener("click", () => {
+        const addr = $("address-full").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback($("address-full"));
+        }
+    });
 
     $("btn-address-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
+        showView("main");
     });
 
     $("btn-send").addEventListener("click", () => {
@@ -267,7 +287,6 @@ function init(_ctx) {
         $("send-token-static").classList.add("hidden");
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 
@@ -297,7 +316,6 @@ function init(_ctx) {
     $("btn-export-privkey").addEventListener("click", () => {
         moreDropdown.classList.add("hidden");
         moreBtn.classList.remove("bg-fg", "text-bg");
-        pushCurrentView();
         const wallet = state.wallets[state.selectedWallet];
         const addr = wallet.addresses[state.selectedAddress];
         const blockieEl = $("export-privkey-jazzicon");
@@ -311,9 +329,9 @@ function init(_ctx) {
         blockieEl.appendChild(bImg);
         $("export-privkey-title").textContent =
             wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
-        const exportAddrContainer = $("export-privkey-dot").parentElement;
+        $("export-privkey-dot").innerHTML = addressDotHtml(addr.address);
-        exportAddrContainer.innerHTML = renderAddressHtml(addr.address);
+        $("export-privkey-address").textContent = addr.address;
-        attachCopyHandlers(exportAddrContainer);
+        $("export-privkey-address").dataset.full = addr.address;
         $("export-privkey-password").value = "";
         $("export-privkey-flash").textContent = "";
         $("export-privkey-flash").style.visibility = "hidden";
@@ -367,10 +385,19 @@ function init(_ctx) {
         }
     });
 
+    $("export-privkey-address").addEventListener("click", () => {
+        const full = $("export-privkey-address").dataset.full;
+        if (full) {
+            navigator.clipboard.writeText(full);
+            showFlash("Copied!");
+            flashCopyFeedback($("export-privkey-address"));
+        }
+    });
+
     $("btn-export-privkey-back").addEventListener("click", () => {
         $("export-privkey-value").textContent = "";
         $("export-privkey-password").value = "";
-        goBack();
+        show();
     });
 }
 

src/popup/views/addressToken.js

@@ -11,10 +11,6 @@ const {
     escapeHtml,
     truncateMiddle,
     balanceLine,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
-    pushCurrentView,
 } = require("./helpers");
 const { state, currentAddress, saveState } = require("../../shared/state");
 const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
@@ -38,6 +34,17 @@ const makeBlockie = require("ethereum-blockies-base64");
 
 let ctx;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function isoDate(timestamp) {
     const d = new Date(timestamp * 1000);
     const pad = (n) => String(n).padStart(2, "0");
@@ -141,16 +148,15 @@ function show() {
     blockieEl.appendChild(img);
 
     // Address line
-    const addrTitle = addressTitle(addr.address, state.wallets);
+    $("address-token-dot").innerHTML = addressDotHtml(addr.address);
-    $("address-token-line").innerHTML = renderAddressHtml(addr.address, {
+    $("address-token-full").dataset.full = addr.address;
-        title: addrTitle,
+    $("address-token-full").textContent = addr.address;
-        ensName: addr.ensName,
+    const addrLink = etherscanAddressLink(addr.address);
-    });
+    $("address-token-etherscan-link").innerHTML =
-    $("address-token-line").dataset.full = addr.address;
+        `<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    attachCopyHandlers($("address-token-line"));
 
     // USD total for this token only
-    const usdVal = price ? amount * price : null;
+    const usdVal = price ? amount * price : 0;
     const usdStr = formatUsd(usdVal);
     $("address-token-usd-total").innerHTML = usdStr || "&nbsp;";
 
@@ -187,9 +193,15 @@ function show() {
                     ? knownToken.decimals
                     : null;
         const tokenHolders = tb && tb.holders != null ? tb.holders : null;
+        const dot = addressDotHtml(tokenId);
+        const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
         const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
         let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
-        infoHtml += `<div class="mb-2">${renderAddressHtml(tokenId)}</div>`;
+        infoHtml +=
+            `<div class="flex items-center mb-2">${dot}` +
+            `<span class="break-all underline decoration-dashed cursor-pointer" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
+            `<a href="${tokenLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
+            `</div>`;
         if (tokenName)
             infoHtml += `<div class="mb-1"><span class="text-muted">Name:</span> ${tokenName}</div>`;
         if (tokenSymbol)
@@ -201,7 +213,6 @@ function show() {
         if (projectUrl)
             infoHtml += `<div class="mb-1"><span class="text-muted">Website:</span> <a href="${escapeHtml(projectUrl)}" target="_blank" rel="noopener" class="underline decoration-dashed">${escapeHtml(projectUrl)}</a></div>`;
         contractInfo.innerHTML = infoHtml;
-        attachCopyHandlers(contractInfo);
         contractInfo.classList.remove("hidden");
     } else {
         contractInfo.innerHTML = "";
@@ -323,6 +334,15 @@ function renderTransactions(txs) {
 
 function init(_ctx) {
     ctx = _ctx;
+    $("address-token-full").addEventListener("click", () => {
+        const addr = $("address-token-full").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback($("address-token-full"));
+        }
+    });
+
     $("address-token-contract-info").addEventListener("click", (e) => {
         const copyEl = e.target.closest("[data-copy]");
         if (copyEl) {
@@ -333,7 +353,7 @@ function init(_ctx) {
     });
 
     $("btn-address-token-back").addEventListener("click", () => {
-        goBack();
+        ctx.showAddressDetail();
     });
 
     $("btn-address-token-send").addEventListener("click", () => {
@@ -360,14 +380,28 @@ function init(_ctx) {
         $("send-token").classList.add("hidden");
         let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
         if (tokenId !== "ETH") {
-            staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
+            const dot = addressDotHtml(tokenId);
+            const link = `https://etherscan.io/token/${tokenId}`;
+            const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+            staticHtml +=
+                `<div class="flex items-center text-xs">${dot}` +
+                `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
+                extLink +
+                `</div>`;
         }
         $("send-token-static").innerHTML = staticHtml;
         $("send-token-static").classList.remove("hidden");
-        attachCopyHandlers($("send-token-static"));
+        // Attach copy handler for the contract address
+        const copyEl = $("send-token-static").querySelector("[data-copy]");
+        if (copyEl) {
+            copyEl.addEventListener("click", () => {
+                navigator.clipboard.writeText(copyEl.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(copyEl);
+            });
+        }
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 

src/popup/views/approval.js

@@ -1,28 +1,45 @@
 const {
     $,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
     showView,
     showError,
     hideError,
-    renderAddressHtml,
-    attachCopyHandlers,
 } = require("./helpers");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
-const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
+const { isPhishingDomain } = require("../../shared/phishingDomains");
+
 const runtime =
     typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 const erc20Iface = new Interface(ERC20_ABI);
 
 function approvalAddressHtml(address) {
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    let html = "";
+    if (title) {
+        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+        html += `<div class="break-all">${escapeHtml(address)}${extLink}</div>`;
+    } else {
+        html += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
+    }
+    return html;
 }
 
 function formatTxValue(val) {
@@ -37,6 +54,10 @@ function tokenLabel(address) {
     return t ? t.symbol : null;
 }
 
+function etherscanTokenLink(address) {
+    return `https://etherscan.io/token/${address}`;
+}
+
 // Try to decode calldata using known ABIs.
 // Returns { name, description, details } or null.
 function decodeCalldata(data, toAddress) {
@@ -135,12 +156,11 @@ function decodeCalldata(data, toAddress) {
     return null;
 }
 
-function showPhishingWarning(elementId, isPhishing) {
+function showPhishingWarning(elementId, hostname, isPhishing) {
     const el = $(elementId);
     if (!el) return;
-    // The background script performs the authoritative phishing domain check
+    // Check both the flag from background and a local re-check
-    // and passes the result via the isPhishingDomain flag.
+    if (isPhishing || isPhishingDomain(hostname)) {
-    if (isPhishing) {
         el.classList.remove("hidden");
     } else {
         el.classList.add("hidden");
@@ -150,6 +170,7 @@ function showPhishingWarning(elementId, isPhishing) {
 function showTxApproval(details) {
     showPhishingWarning(
         "approve-tx-phishing-warning",
+        details.hostname,
         details.isPhishingDomain,
     );
 
@@ -215,19 +236,17 @@ function showTxApproval(details) {
             toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
         }
         toHtml += approvalAddressHtml(toAddr);
+        if (symbol) {
+            const link = etherscanTokenLink(toAddr);
+            toHtml = toHtml.replace("</div>", "") + ""; // approvalAddressHtml already has etherscan link
+        }
         $("approve-tx-to").innerHTML = toHtml;
     } else {
         $("approve-tx-to").innerHTML = escapeHtml("(contract creation)");
     }
 
-    const ethValueFormatted = formatTxValue(
-        formatEther(details.txParams.value || "0"),
-    );
-    const ethPrice = getPrice("ETH");
-    const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
-    const usdStr = formatUsd(ethUsd);
     $("approve-tx-value").textContent =
-        ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
+        formatTxValue(formatEther(details.txParams.value || "0")) + " ETH";
 
     // Decode calldata (reuse decoded from above)
     const decodedEl = $("approve-tx-decoded");
@@ -242,9 +261,12 @@ function showTxApproval(details) {
             detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
             if (d.address) {
                 if (d.isToken) {
+                    const tLink = etherscanTokenLink(d.address);
                     detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
-                }
                     detailsHtml += approvalAddressHtml(d.address);
+                } else {
+                    detailsHtml += approvalAddressHtml(d.address);
+                }
             } else {
                 detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
             }
@@ -268,7 +290,6 @@ function showTxApproval(details) {
     hideError("approve-tx-error");
 
     showView("approve-tx");
-    attachCopyHandlers("view-approve-tx");
 }
 
 function decodeHexMessage(hex) {
@@ -322,6 +343,7 @@ function formatTypedDataHtml(jsonStr) {
 function showSignApproval(details) {
     showPhishingWarning(
         "approve-sign-phishing-warning",
+        details.hostname,
         details.isPhishingDomain,
     );
 
@@ -366,7 +388,6 @@ function showSignApproval(details) {
     $("btn-approve-sign").classList.remove("text-muted");
 
     showView("approve-sign");
-    attachCopyHandlers("view-approve-sign");
 }
 
 function show(id) {
@@ -388,13 +409,13 @@ function show(id) {
         // Site connection approval
         showPhishingWarning(
             "approve-site-phishing-warning",
+            details.hostname,
             details.isPhishingDomain,
         );
         $("approve-hostname").textContent = details.hostname;
         $("approve-address").innerHTML = approvalAddressHtml(
             state.activeAddress,
         );
-        attachCopyHandlers("view-approve-site");
         $("approve-remember").checked = state.rememberSiteChoice;
     });
 }

src/popup/views/confirmTx.js

@@ -17,12 +17,10 @@ const {
     showFlash,
     flashCopyFeedback,
     addressTitle,
+    addressDotHtml,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -36,6 +34,13 @@ const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const txStatus = require("./txStatus");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let pendingTx = null;
 
 function restore() {
@@ -45,6 +50,14 @@ function restore() {
     }
 }
 
+function etherscanTokenLink(address) {
+    return `https://etherscan.io/token/${address}`;
+}
+
+function etherscanAddressLink(address) {
+    return `https://etherscan.io/address/${address}`;
+}
+
 function blockieHtml(address) {
     const src = makeBlockie(address);
     return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
@@ -52,10 +65,22 @@ function blockieHtml(address) {
 
 function confirmAddressHtml(address, ensName, title) {
     const blockie = blockieHtml(address);
-    return (
+    const dot = addressDotHtml(address);
-        `<div class="mb-1">${blockie}</div>` +
+    const link = etherscanAddressLink(address);
-        renderAddressHtml(address, { title, ensName })
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-    );
+    let html = `<div class="mb-1">${blockie}</div>`;
+    if (title) {
+        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+    }
+    if (ensName) {
+        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
+    }
+    html +=
+        `<div class="flex items-center">${title || ensName ? "" : dot}` +
+        `<span class="break-all">${escapeHtml(address)}</span>` +
+        extLink +
+        `</div>`;
+    return html;
 }
 
 function valueWithUsd(text, usdAmount) {
@@ -82,12 +107,23 @@ function show(txInfo) {
     // Token contract section (ERC-20 only)
     const tokenSection = $("confirm-token-section");
     if (isErc20) {
-        $("confirm-token-contract").innerHTML = renderAddressHtml(
+        const dot = addressDotHtml(txInfo.token);
-            txInfo.token,
+        const link = etherscanTokenLink(txInfo.token);
-            {},
+        $("confirm-token-contract").innerHTML =
-        );
+            `<div class="flex items-center">${dot}` +
+            `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
+            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
+            `</div>`;
         tokenSection.classList.remove("hidden");
-        attachCopyHandlers(tokenSection);
+        // Attach click-to-copy on the contract address
+        const copyEl = tokenSection.querySelector("[data-copy]");
+        if (copyEl) {
+            copyEl.onclick = () => {
+                navigator.clipboard.writeText(copyEl.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(copyEl);
+            };
+        }
     } else {
         tokenSection.classList.add("hidden");
     }
@@ -207,7 +243,6 @@ function show(txInfo) {
     $("confirm-fee-amount").textContent = "Estimating...";
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
-    attachCopyHandlers("view-confirm-tx");
 
     // Reset async warnings to hidden (space always reserved, no layout shift)
     $("confirm-recipient-warning").style.visibility = "hidden";
@@ -356,7 +391,7 @@ function init(ctx) {
     });
 
     $("btn-confirm-back").addEventListener("click", () => {
-        goBack();
+        showView("send");
     });
 }
 

src/popup/views/deleteWallet.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
 
@@ -21,7 +21,7 @@ function init(_ctx) {
 
     $("btn-delete-wallet-back").addEventListener("click", () => {
         deleteWalletIndex = null;
-        goBack();
+        ctx.showSettingsView();
     });
 
     $("btn-delete-wallet-confirm").addEventListener("click", async () => {
@@ -77,7 +77,6 @@ function init(_ctx) {
             state.selectedWallet = null;
             state.selectedAddress = null;
             state.activeAddress = null;
-            clearViewStack();
             await saveState();
             showView("welcome");
         } else {
@@ -87,14 +86,8 @@ function init(_ctx) {
             state.activeAddress =
                 state.wallets[0].addresses[0]?.address || null;
             await saveState();
-            // Reset stack to [main] so Settings back goes home.
-            // Use require() lazily to avoid circular dependency
-            // (settings.js requires deleteWallet.js).
-            clearViewStack();
-            state.viewStack.push("main");
             ctx.renderWalletList();
-            const settings = require("./settings");
+            ctx.showSettingsView();
-            settings.show();
             showFlash("Wallet deleted.");
         }
     });

src/popup/views/helpers.js

@@ -1,13 +1,12 @@
 // Shared DOM helpers used by all views.
 
 const { DEBUG } = require("../../shared/constants");
-const { isDebug } = require("../../shared/log");
 const {
     formatUsd,
     getPrice,
     getAddressValueUsd,
 } = require("../../shared/prices");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -60,75 +59,12 @@ function showView(name) {
     clearFlash();
     state.currentView = name;
     saveState();
-    updateDebugBanner(name);
+    if (DEBUG) {
-}
+        const banner = document.getElementById("debug-banner");
-
+        if (banner) {
-// Create or update the debug/insecure warning banner.
+            banner.textContent = "DEBUG / INSECURE (" + name + ")";
-// Called on every view switch and after the settings debug toggle changes.
-// The banner is shown when the compile-time DEBUG constant is true OR when
-// the user has enabled runtime debug mode via the settings easter egg, OR
-// when the active network is a testnet.
-function updateDebugBanner(viewName) {
-    const debug = isDebug();
-    const net = currentNetwork();
-    const show = debug || net.isTestnet;
-    let banner = document.getElementById("debug-banner");
-    if (show) {
-        if (!banner) {
-            banner = document.createElement("div");
-            banner.id = "debug-banner";
-            banner.style.cssText =
-                "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
-            document.body.prepend(banner);
-        }
-        const suffix = viewName ? " (" + viewName + ")" : "";
-        if (debug && net.isTestnet) {
-            banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
-        } else if (net.isTestnet) {
-            banner.textContent = "[TESTNET]" + suffix;
-        } else {
-            banner.textContent = "DEBUG / INSECURE" + suffix;
-        }
-    } else if (banner) {
-        banner.remove();
         }
     }
-
-// Callback to re-render the main/home view when navigating back to it.
-// Set once by index.js via setRenderMain().
-let _renderMain = null;
-
-function setRenderMain(fn) {
-    _renderMain = fn;
-}
-
-// Push the current view onto the navigation stack so goBack() can
-// return to it.  Call this before any forward navigation.
-function pushCurrentView() {
-    if (state.currentView) {
-        state.viewStack.push(state.currentView);
-    }
-}
-
-// Pop the navigation stack and show the previous view.  If the stack
-// is empty, fall back to the main (home) view.
-function goBack() {
-    let target;
-    if (state.viewStack.length > 0) {
-        target = state.viewStack.pop();
-    } else {
-        target = "main";
-    }
-    if (target === "main" && _renderMain) {
-        _renderMain();
-    }
-    showView(target);
-}
-
-// Clear the entire navigation stack (used when resetting to root,
-// e.g. after adding or deleting a wallet).
-function clearViewStack() {
-    state.viewStack = [];
 }
 
 let flashTimer = null;
@@ -272,9 +208,21 @@ function addressTitle(address, wallets) {
 // Render an address with color dot, optional ENS name, optional title,
 // and optional truncation. Title and ENS are shown as bold labels above
 // the full address.
-// Delegates to renderAddressHtml for consistent output.
 function formatAddressHtml(address, ensName, maxLen, title) {
-    return renderAddressHtml(address, { title, ensName, maxLen });
+    const dot = addressDotHtml(address);
+    const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
+    if (title || ensName) {
+        let html = "";
+        if (title) {
+            html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
+        }
+        if (ensName) {
+            html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
+        }
+        html += `<div class="break-all">${escapeHtml(displayAddr)}</div>`;
+        return html;
+    }
+    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(displayAddr)}</span></div>`;
 }
 
 function isoDate(timestamp) {
@@ -333,91 +281,6 @@ function timeAgo(timestamp) {
     return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 
-// Shared external-link icon SVG used across all views.
-const EXT_ICON =
-    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
-    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
-    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
-    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
-    `</svg></span>`;
-
-function etherscanAddressUrl(address) {
-    return `${currentNetwork().explorerUrl}/address/${address}`;
-}
-
-function etherscanLinkHtml(url) {
-    return (
-        `<a href="${url}" target="_blank" rel="noopener" ` +
-        `class="inline-flex items-center">${EXT_ICON}</a>`
-    );
-}
-
-// Render a copyable text span with dashed underline affordance.
-// The caller must attach click handlers via attachCopyHandlers() or
-// manually wire up [data-copy] elements after inserting the HTML.
-function copyableHtml(text, extraClass) {
-    const cls =
-        "underline decoration-dashed cursor-pointer" +
-        (extraClass ? " " + extraClass : "");
-    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
-}
-
-// Attach click-to-copy handlers to all [data-copy] elements within
-// a container.  Safe to call multiple times on the same container.
-function attachCopyHandlers(container) {
-    const root =
-        typeof container === "string"
-            ? document.getElementById(container)
-            : container;
-    if (!root) return;
-    root.querySelectorAll("[data-copy]").forEach((el) => {
-        el.onclick = () => {
-            navigator.clipboard.writeText(el.dataset.copy);
-            showFlash("Copied!");
-            flashCopyFeedback(el);
-        };
-    });
-}
-
-// Unified address rendering.
-//
-// Produces consistent HTML for any Ethereum address:
-//   • Color dot
-//   • Optional title (e.g. "Wallet 1 — Address 2") shown bold above address
-//   • Optional ENS name shown bold above address
-//   • Full address (or truncated via maxLen) with dashed-underline click-to-copy
-//   • Etherscan external link icon
-//
-// Options object:
-//   title    — wallet title string (from addressTitle)
-//   ensName  — ENS name string
-//   maxLen   — if set, truncate address display (min 32 chars enforced)
-//   noLink   — if true, omit etherscan link
-//
-// After inserting the returned HTML into the DOM, call
-// attachCopyHandlers() on the parent to wire up click-to-copy.
-function renderAddressHtml(address, opts) {
-    const { title, ensName, maxLen, noLink } = opts || {};
-    const dot = addressDotHtml(address);
-    const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
-    const link = etherscanAddressUrl(address);
-    const extLink = noLink ? "" : etherscanLinkHtml(link);
-
-    let html = "";
-    if (title) {
-        html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
-    }
-    if (ensName) {
-        html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
-    }
-    if (title || ensName) {
-        html += `<div class="flex items-center">${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
-    } else {
-        html += `<div class="flex items-center">${dot}${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
-    }
-    return html;
-}
-
 function flashCopyFeedback(el) {
     if (!el) return;
     el.classList.remove("copy-flash-fade");
@@ -436,11 +299,6 @@ module.exports = {
     showError,
     hideError,
     showView,
-    updateDebugBanner,
-    setRenderMain,
-    pushCurrentView,
-    goBack,
-    clearViewStack,
     showFlash,
     flashCopyFeedback,
     balanceLine,
@@ -450,12 +308,6 @@ module.exports = {
     escapeHtml,
     addressTitle,
     formatAddressHtml,
-    renderAddressHtml,
-    copyableHtml,
-    attachCopyHandlers,
-    etherscanAddressUrl,
-    etherscanLinkHtml,
-    EXT_ICON,
     truncateMiddle,
     isoDate,
     timeAgo,

src/popup/views/home.js

@@ -10,9 +10,6 @@ const {
     addressTitle,
     escapeHtml,
     truncateMiddle,
-    renderAddressHtml,
-    attachCopyHandlers,
-    pushCurrentView,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
 const {
@@ -72,12 +69,28 @@ function renderTotalValue() {
     }
 }
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function renderActiveAddress() {
     const el = $("active-address-display");
     if (!el) return;
     if (state.activeAddress) {
-        el.innerHTML = renderAddressHtml(state.activeAddress);
+        const addr = state.activeAddress;
-        attachCopyHandlers(el);
+        const dot = addressDotHtml(addr);
+        const link = `https://etherscan.io/address/${addr}`;
+        el.innerHTML =
+            `<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
+            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+        $("active-addr-copy").addEventListener("click", (e) => {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback(e.currentTarget);
+        });
     } else {
         el.textContent = "";
     }
@@ -382,7 +395,6 @@ function init(ctx) {
         renderSendTokenSelect(addr);
         updateSendBalance();
         resetSendValidation();
-        pushCurrentView();
         showView("send");
     });
 

src/popup/views/receive.js

@@ -5,12 +5,17 @@ const {
     flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
-const { state, currentAddress, currentNetwork } = require("../../shared/state");
+const { state, currentAddress } = require("../../shared/state");
 const QRCode = require("qrcode");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function show() {
     const addr = currentAddress();
     const address = addr ? addr.address : "";
@@ -20,8 +25,10 @@ function show() {
         ? formatAddressHtml(address, ensName, null, title)
         : "";
     $("receive-address-block").dataset.full = address;
-    // Etherscan link is now included in formatAddressHtml via renderAddressHtml
+    const link = address ? `https://etherscan.io/address/${address}` : "";
-    $("receive-etherscan-link").innerHTML = "";
+    $("receive-etherscan-link").innerHTML = link
+        ? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
+        : "";
     if (address) {
         QRCode.toCanvas($("receive-qr"), address, {
             width: 200,
@@ -45,19 +52,25 @@ function show() {
         warningEl.textContent =
             "This is an ERC-20 token. Only send " +
             symbol +
-            " on " +
+            " on the Ethereum network to this address. Sending tokens on other networks will result in permanent loss.";
-            currentNetwork().name +
-            " to this address. Sending tokens on other networks will result in permanent loss.";
         warningEl.style.visibility = "visible";
     } else {
         warningEl.textContent = "";
         warningEl.style.visibility = "hidden";
     }
     showView("receive");
-    attachCopyHandlers("view-receive");
 }
 
 function init(ctx) {
+    $("receive-address-block").addEventListener("click", (e) => {
+        const addr = $("receive-address-block").dataset.full;
+        if (addr) {
+            navigator.clipboard.writeText(addr);
+            showFlash("Copied!");
+            flashCopyFeedback(e.currentTarget);
+        }
+    });
+
     $("btn-receive-copy").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {
@@ -68,7 +81,11 @@ function init(ctx) {
     });
 
     $("btn-receive-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/send.js

@@ -3,11 +3,9 @@
 const {
     $,
     showFlash,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    goBack,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
@@ -115,6 +113,13 @@ function updateToValidation() {
     }
 }
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 function isSpoofedToken(t) {
     const upper = (t.symbol || "").toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) return false;
@@ -143,12 +148,24 @@ function renderSendTokenSelect(addr) {
 function updateSendBalance() {
     const addr = currentAddress();
     if (!addr) return;
+    const dot = addressDotHtml(addr.address);
+    const link = `https://etherscan.io/address/${addr.address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(addr.address, state.wallets);
-    $("send-from").innerHTML = renderAddressHtml(addr.address, {
+    let fromHtml = "";
-        title,
+    if (title) {
-        ensName: addr.ensName,
+        fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
-    });
+        if (addr.ensName) {
-    attachCopyHandlers($("send-from"));
+            fromHtml += `<div>${escapeHtml(addr.ensName)}</div>`;
+        }
+        fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
+    } else if (addr.ensName) {
+        fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(addr.ensName)}</div>`;
+        fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
+    } else {
+        fromHtml += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(addr.address)}</span>${extLink}</div>`;
+    }
+    $("send-from").innerHTML = fromHtml;
     const token = state.selectedToken || $("send-token").value;
     if (token === "ETH") {
         $("send-balance").textContent =
@@ -251,7 +268,11 @@ function init(_ctx) {
     $("btn-send-back").addEventListener("click", () => {
         $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/settings.js

@@ -1,34 +1,13 @@
-const {
+const { $, showView, showFlash, escapeHtml } = require("./helpers");
-    $,
-    showView,
-    updateDebugBanner,
-    showFlash,
-    escapeHtml,
-    flashCopyFeedback,
-    goBack,
-    pushCurrentView,
-} = require("./helpers");
 const { applyTheme } = require("../theme");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
-const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
+const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
-const { onChainSwitch } = require("../../shared/chainSwitch");
+const { log, debugFetch } = require("../../shared/log");
-const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
 const deleteWallet = require("./deleteWallet");
-const {
-    BUILD_VERSION,
-    BUILD_LICENSE,
-    BUILD_AUTHOR,
-    BUILD_COMMIT,
-    BUILD_DATE,
-    GITEA_COMMIT_URL,
-} = require("../../shared/buildInfo");
 
 const runtime =
     typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
-let versionClickCount = 0;
-let versionClickTimer = null;
-
 function renderSiteList(containerId, siteMap, stateKey) {
     const container = $(containerId);
     const hostnames = [...new Set(Object.values(siteMap).flat())];
@@ -106,7 +85,6 @@ function renderWalletListSettings() {
     container.querySelectorAll(".btn-delete-wallet").forEach((btn) => {
         btn.addEventListener("click", () => {
             const idx = parseInt(btn.dataset.idx, 10);
-            pushCurrentView();
             deleteWallet.show(idx);
         });
     });
@@ -147,36 +125,10 @@ function renderWalletListSettings() {
 function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
-    const networkSelect = $("settings-network");
-    if (networkSelect) {
-        networkSelect.value = state.networkId;
-    }
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
 
-    // Populate About well
-    $("about-license").textContent = BUILD_LICENSE;
-    // Show only the name part of the author field (strip email)
-    const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
-    $("about-author").textContent = authorName;
-    $("about-version").textContent = BUILD_VERSION;
-    $("about-release-date").textContent = BUILD_DATE;
-    $("about-commit-link").textContent = BUILD_COMMIT;
-    $("about-commit-link").href = GITEA_COMMIT_URL;
-
-    // Reset version click counter each time settings opens
-    versionClickCount = 0;
-
-    // Show debug well if debug mode is already enabled
-    const debugWell = $("settings-debug-well");
-    if (state.debugMode) {
-        debugWell.style.display = "";
-    } else {
-        debugWell.style.display = "none";
-    }
-    $("settings-debug-mode").checked = state.debugMode;
-
     showView("settings");
 }
 
@@ -216,12 +168,9 @@ function init(ctx) {
                 showFlash("Endpoint returned error: " + json.error.message);
                 return;
             }
-            const net = currentNetwork();
+            if (json.result !== ETHEREUM_MAINNET_CHAIN_ID) {
-            if (json.result !== net.chainId) {
                 showFlash(
-                    "Wrong network (expected " +
+                    "Wrong network (expected mainnet, got chain " +
-                        net.name +
-                        ", got chain " +
                         json.result +
                         ").",
                 );
@@ -260,17 +209,6 @@ function init(ctx) {
         showFlash("Saved.");
     });
 
-    const networkSelect = $("settings-network");
-    if (networkSelect) {
-        networkSelect.addEventListener("change", async () => {
-            const newId = networkSelect.value;
-            const net = await onChainSwitch(newId);
-            $("settings-rpc").value = state.rpcUrl;
-            $("settings-blockscout").value = state.blockscoutUrl;
-            showFlash("Switched to " + net.name + ".");
-        });
-    }
-
     $("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
     $("settings-show-zero-balances").addEventListener("change", async () => {
         state.showZeroBalanceTokens = $("settings-show-zero-balances").checked;
@@ -324,68 +262,9 @@ function init(ctx) {
         ctx.showSettingsAddTokenView,
     );
 
-    // Bright saturated colors for easter egg flashes (clicks 6–10)
-    const easterEggColors = [
-        "#ff0055", // hot pink
-        "#00cc44", // vivid green
-        "#3366ff", // electric blue
-        "#ff9900", // bright orange
-        "#aa00ff", // vivid purple
-    ];
-
-    // Easter egg: click version 10 times to reveal the debug well.
-    // Each click does a copy-flash animation. After 5 clicks, each
-    // additional click flashes a different bright saturated color.
-    $("about-version").addEventListener("click", () => {
-        versionClickCount++;
-        clearTimeout(versionClickTimer);
-        // Reset counter if user stops clicking for 3 seconds
-        versionClickTimer = setTimeout(() => {
-            versionClickCount = 0;
-        }, 3000);
-
-        const el = $("about-version");
-
-        if (versionClickCount > 5) {
-            // Colored flash for clicks 6–10
-            const colorIdx = versionClickCount - 6;
-            const color = easterEggColors[colorIdx % easterEggColors.length];
-            el.classList.remove("copy-flash-fade");
-            el.style.backgroundColor = color;
-            el.style.color = "#ffffff";
-            setTimeout(() => {
-                el.style.backgroundColor = "";
-                el.style.color = "";
-                el.classList.add("copy-flash-fade");
-                setTimeout(() => {
-                    el.classList.remove("copy-flash-fade");
-                }, 275);
-            }, 75);
-        } else {
-            // Standard copy-flash for clicks 1–5
-            flashCopyFeedback(el);
-        }
-
-        if (versionClickCount >= 10) {
-            versionClickCount = 0;
-            clearTimeout(versionClickTimer);
-            $("settings-debug-well").style.display = "";
-        }
-    });
-
-    // Debug mode toggle — update runtime flag, persist, and re-render banner
-    $("settings-debug-mode").addEventListener("change", async () => {
-        state.debugMode = $("settings-debug-mode").checked;
-        setRuntimeDebug(state.debugMode);
-        await saveState();
-        updateDebugBanner(state.currentView);
-    });
-
-    // Sync runtime debug flag on init
-    setRuntimeDebug(state.debugMode);
-
     $("btn-settings-back").addEventListener("click", () => {
-        goBack();
+        ctx.renderWalletList();
+        showView("main");
     });
 }
 

src/popup/views/settingsAddToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, goBack } = require("./helpers");
+const { $, showView, showFlash } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -84,7 +84,7 @@ function init(_ctx) {
     ctx = _ctx;
 
     $("btn-settings-addtoken-back").addEventListener("click", () => {
-        goBack();
+        ctx.showSettingsView();
     });
 
     $("btn-settings-addtoken-select").addEventListener("click", async () => {

src/popup/views/transactionDetail.js

@@ -6,41 +6,31 @@ const {
     showView,
     showFlash,
     flashCopyFeedback,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
     isoDate,
     timeAgo,
-    renderAddressHtml,
-    attachCopyHandlers,
-    copyableHtml,
-    etherscanLinkHtml,
-    goBack,
 } = require("./helpers");
-const { state, currentNetwork } = require("../../shared/state");
+const { state } = require("../../shared/state");
-const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
 const { decodeCalldata } = require("./approval");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let ctx;
 
-/**
+function copyableHtml(text, extraClass) {
- * Determine a human-readable transaction type string from tx fields.
+    const cls =
- */
+        "underline decoration-dashed cursor-pointer" +
-function getTransactionType(tx) {
+        (extraClass ? " " + extraClass : "");
-    if (!tx.to) return "Contract Creation";
+    return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
-    if (tx.direction === "contract") {
-        if (tx.directionLabel === "Swap") return "Swap";
-        if (
-            tx.method === "approve" ||
-            tx.directionLabel === "Approve" ||
-            tx.method === "setApprovalForAll"
-        )
-            return "Token Approval";
-        return "Contract Call";
-    }
-    if (tx.symbol && tx.symbol !== "ETH") return "ERC-20 Token Transfer";
-    return "Native ETH Transfer";
 }
 
 function blockieHtml(address) {
@@ -48,16 +38,44 @@ function blockieHtml(address) {
     return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
-function txAddressHtml(address, ensName, title) {
+function etherscanLinkHtml(url) {
-    const blockie = blockieHtml(address);
     return (
-        `<div class="mb-1">${blockie}</div>` +
+        `<a href="${url}" target="_blank" rel="noopener" ` +
-        renderAddressHtml(address, { title, ensName })
+        `class="inline-flex items-center"` +
+        `>${EXT_ICON}</a>`
     );
 }
 
+function txAddressHtml(address, ensName, title) {
+    const blockie = blockieHtml(address);
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = etherscanLinkHtml(link);
+    let html = `<div class="mb-1">${blockie}</div>`;
+    if (title) {
+        html += `<div class="font-bold">${escapeHtml(title)}</div>`;
+    }
+    if (ensName) {
+        html +=
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(ensName, "") +
+            `</div>` +
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(address, "break-all") +
+            extLink +
+            `</div>`;
+    } else {
+        html +=
+            `<div class="flex items-center">${dot}` +
+            copyableHtml(address, "break-all") +
+            extLink +
+            `</div>`;
+    }
+    return html;
+}
+
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -81,7 +99,6 @@ function show(tx) {
             direction: tx.direction || null,
             isContractCall: tx.isContractCall || false,
             method: tx.method || null,
-            contractAddress: tx.contractAddress || null,
         },
     };
     render();
@@ -118,152 +135,40 @@ function render() {
         nativeEl.parentElement.classList.add("hidden");
     }
 
-    // Always show transaction type as the first field
+    // Show type label for contract interactions (Swap, Execute, etc.)
     const typeSection = $("tx-detail-type-section");
     const typeEl = $("tx-detail-type");
     const headingEl = $("tx-detail-heading");
-    if (typeSection && typeEl) {
+    if (tx.direction === "contract" && tx.directionLabel) {
-        typeEl.textContent = getTransactionType(tx);
+        if (typeSection) {
+            typeEl.textContent = tx.directionLabel;
             typeSection.classList.remove("hidden");
         }
+    } else {
+        if (typeSection) typeSection.classList.add("hidden");
+    }
     if (headingEl) headingEl.textContent = "Transaction";
 
-    // Token contract address (for ERC-20 transfers)
+    // Hide calldata and raw data sections; re-fetch if this is a contract call
-    const tokenContractSection = $("tx-detail-token-contract-section");
-    const tokenContractEl = $("tx-detail-token-contract");
-    if (tokenContractSection && tokenContractEl) {
-        if (tx.contractAddress) {
-            const dot = addressDotHtml(tx.contractAddress);
-            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
-            tokenContractEl.innerHTML =
-                `<div class="flex items-center">${dot}` +
-                copyableHtml(tx.contractAddress, "break-all") +
-                etherscanLinkHtml(link) +
-                `</div>`;
-            tokenContractSection.classList.remove("hidden");
-        } else {
-            tokenContractSection.classList.add("hidden");
-        }
-    }
-
-    // Hide calldata and raw data sections; always fetch full tx details
     const calldataSection = $("tx-detail-calldata-section");
     if (calldataSection) calldataSection.classList.add("hidden");
     const rawDataSection = $("tx-detail-rawdata-section");
     if (rawDataSection) rawDataSection.classList.add("hidden");
 
-    // Hide on-chain detail sections until populated
+    if (tx.isContractCall || tx.direction === "contract") {
-    for (const id of [
+        loadCalldata(tx.hash, tx.to);
-        "tx-detail-block-section",
-        "tx-detail-nonce-section",
-        "tx-detail-fee-section",
-        "tx-detail-gasprice-section",
-        "tx-detail-gasused-section",
-        "tx-detail-network-section",
-    ]) {
-        const el = $(id);
-        if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
-
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
         copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
     $("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
     showView("transaction");
-    attachCopyHandlers("view-transaction");
-}
 
-function showDetailField(sectionId, contentId, value) {
+    document
-    const section = $(sectionId);
+        .getElementById("view-transaction")
-    const el = $(contentId);
+        .querySelectorAll("[data-copy]")
-    if (!section || !el) return;
+        .forEach((el) => {
-    el.innerHTML = copyableHtml(value, "");
-    section.classList.remove("hidden");
-}
-
-function populateOnChainDetails(txData) {
-    // Block number
-    if (txData.block_number != null) {
-        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
-        const blockSection = $("tx-detail-block-section");
-        const blockEl = $("tx-detail-block");
-        if (blockSection && blockEl) {
-            blockEl.innerHTML =
-                copyableHtml(String(txData.block_number), "") +
-                etherscanLinkHtml(blockLink);
-            blockSection.classList.remove("hidden");
-        }
-    }
-
-    // Nonce
-    if (txData.nonce != null) {
-        showDetailField(
-            "tx-detail-nonce-section",
-            "tx-detail-nonce",
-            String(txData.nonce),
-        );
-    }
-
-    // Transaction fee
-    const feeWei = txData.fee?.value || txData.tx_fee;
-    if (feeWei) {
-        const feeEth = formatEther(String(feeWei));
-        showDetailField(
-            "tx-detail-fee-section",
-            "tx-detail-fee",
-            feeEth + " ETH",
-        );
-    }
-
-    // Gas price
-    const gasPrice = txData.gas_price;
-    if (gasPrice) {
-        const gwei = formatUnits(String(gasPrice), "gwei");
-        showDetailField(
-            "tx-detail-gasprice-section",
-            "tx-detail-gasprice",
-            gwei + " Gwei",
-        );
-    }
-
-    // Gas used
-    const gasUsed = txData.gas_used;
-    if (gasUsed) {
-        showDetailField(
-            "tx-detail-gasused-section",
-            "tx-detail-gasused",
-            String(gasUsed),
-        );
-    }
-
-    // Show the network details wrapper if any child section is visible
-    const networkWrapper = $("tx-detail-network-section");
-    if (networkWrapper) {
-        const hasVisible = [
-            "tx-detail-nonce-section",
-            "tx-detail-fee-section",
-            "tx-detail-gasprice-section",
-            "tx-detail-gasused-section",
-        ].some((id) => {
-            const el = $(id);
-            return el && !el.classList.contains("hidden");
-        });
-        if (hasVisible) networkWrapper.classList.remove("hidden");
-    }
-
-    // Bind copy handlers for newly added elements
-    for (const id of [
-        "tx-detail-block-section",
-        "tx-detail-nonce-section",
-        "tx-detail-fee-section",
-        "tx-detail-gasprice-section",
-        "tx-detail-gasused-section",
-    ]) {
-        const section = $(id);
-        if (!section) continue;
-        section.querySelectorAll("[data-copy]").forEach((el) => {
             el.onclick = () => {
                 navigator.clipboard.writeText(el.dataset.copy);
                 showFlash("Copied!");
@@ -271,9 +176,8 @@ function populateOnChainDetails(txData) {
             };
         });
 }
-}
 
-async function loadFullTxDetails(txHash, toAddress, isContractCall) {
+async function loadCalldata(txHash, toAddress) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -288,10 +192,6 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
         );
         if (!resp.ok) return;
         const txData = await resp.json();
-
-        // Populate on-chain detail fields (block, nonce, gas, fee)
-        populateOnChainDetails(txData);
-
         const inputData = txData.raw_input || txData.input || null;
         if (!inputData || inputData === "0x") return;
 
@@ -307,14 +207,19 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
                 detailsHtml += `<div class="mb-2">`;
                 detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
                 if (d.address && d.isToken) {
-                    // Token entry: show symbol on its own line, then address via shared renderer
+                    // Token entry: show symbol on its own line, then dot + address + Etherscan link
+                    const dot = addressDotHtml(d.address);
                     const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                     if (tokenSymbol) {
                         detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                     }
-                    detailsHtml += renderAddressHtml(d.address);
+                    const etherscanUrl = `https://etherscan.io/token/${d.address}`;
+                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.address, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
                 } else if (d.address) {
-                    detailsHtml += renderAddressHtml(d.address);
+                    // Protocol/contract entry: show name + Etherscan link
+                    const dot = addressDotHtml(d.address);
+                    const etherscanUrl = `https://etherscan.io/address/${d.address}`;
+                    detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.value, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
                 } else {
                     detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
                 }
@@ -341,7 +246,13 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
         // Bind copy handlers for new elements (including raw data now outside section)
         const copyTargets = [section, rawSection].filter(Boolean);
         for (const container of copyTargets) {
-            attachCopyHandlers(container);
+            container.querySelectorAll("[data-copy]").forEach((el) => {
+                el.onclick = () => {
+                    navigator.clipboard.writeText(el.dataset.copy);
+                    showFlash("Copied!");
+                    flashCopyFeedback(el);
+                };
+            });
         }
     } catch (e) {
         log.errorf("loadCalldata failed:", e.message);
@@ -351,7 +262,11 @@ async function loadFullTxDetails(txHash, toAddress, isContractCall) {
 function init(_ctx) {
     ctx = _ctx;
     $("btn-tx-back").addEventListener("click", () => {
-        goBack();
+        if (state.selectedToken) {
+            ctx.showAddressToken();
+        } else {
+            ctx.showAddressDetail();
+        }
     });
 }
 

src/popup/views/txStatus.js

@@ -3,19 +3,24 @@
 const {
     $,
     showView,
+    showFlash,
+    flashCopyFeedback,
+    addressDotHtml,
     addressTitle,
     escapeHtml,
-    renderAddressHtml,
-    attachCopyHandlers,
-    copyableHtml,
-    etherscanLinkHtml,
-    clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
+const EXT_ICON =
+    `<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
+    `<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
+    `<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
+    `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
+    `</svg></span>`;
+
 let ctx;
 let elapsedTimer = null;
 let pollTimer = null;
@@ -32,19 +37,50 @@ function clearTimers() {
 }
 
 function toAddressHtml(address) {
+    const dot = addressDotHtml(address);
+    const link = `https://etherscan.io/address/${address}`;
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
     const title = addressTitle(address, state.wallets);
-    return renderAddressHtml(address, { title });
+    if (title) {
+        return (
+            `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>` +
+            `<div class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</div>` +
+            extLink
+        );
+    }
+    return `<div class="flex items-center">${dot}<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</span>${extLink}</div>`;
 }
 
 function txHashHtml(hash) {
-    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
+    const link = `https://etherscan.io/tx/${hash}`;
-    return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+    return (
+        `<span class="underline decoration-dashed cursor-pointer break-all" data-copy="${escapeHtml(hash)}">${escapeHtml(hash)}</span>` +
+        extLink
+    );
 }
 
 function blockNumberHtml(blockNumber) {
     const num = String(blockNumber);
-    const link = `${currentNetwork().explorerUrl}/block/${num}`;
+    const link = `https://etherscan.io/block/${num}`;
-    return copyableHtml(num) + etherscanLinkHtml(link);
+    const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
+    return (
+        `<span class="underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(num)}">${escapeHtml(num)}</span>` +
+        extLink
+    );
+}
+
+function attachCopyHandlers(viewId) {
+    document
+        .getElementById(viewId)
+        .querySelectorAll("[data-copy]")
+        .forEach((el) => {
+            el.onclick = () => {
+                navigator.clipboard.writeText(el.dataset.copy);
+                showFlash("Copied!");
+                flashCopyFeedback(el);
+            };
+        });
 }
 
 function showWait(txInfo, txHash) {
@@ -111,7 +147,7 @@ function tokenLabel(address) {
 }
 
 function etherscanTokenLink(address) {
-    return `${currentNetwork().explorerUrl}/token/${address}`;
+    return `https://etherscan.io/token/${address}`;
 }
 
 function decodedDetailsHtml(decoded) {
@@ -222,16 +258,10 @@ function navigateBack() {
         window.close();
         return;
     }
-    // After a completed transaction, reset the navigation stack
-    // and go directly to the address view (token or detail).
-    // Use require() lazily to call show() without the ctx push wrapper.
-    clearViewStack();
-    state.viewStack.push("main");
     if (state.selectedToken) {
-        state.viewStack.push("address");
+        ctx.showAddressToken();
-        require("./addressToken").show();
     } else {
-        require("./addressDetail").show();
+        ctx.showAddressDetail();
     }
 }
 

src/shared/balances.js

@@ -15,15 +15,10 @@ const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
-// Accepts an optional networkName ("mainnet" or "sepolia") for the static
+const mainnet = Network.from("mainnet");
-// network hint so ethers picks the right chain parameters.  When omitted,
+
-// reads the currently selected network from extension state.
+function getProvider(rpcUrl) {
-function getProvider(rpcUrl, networkName) {
+    return new JsonRpcProvider(rpcUrl, mainnet, { staticNetwork: mainnet });
-    // Lazy require to avoid circular dependency issues at module scope.
-    const { currentNetwork } = require("./state");
-    const name = networkName || currentNetwork().id;
-    const net = Network.from(name);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
 }
 
 function formatBalance(wei) {

src/shared/buildInfo.js

@@ -1,35 +0,0 @@
-// Build-time constants injected by esbuild define in build.js.
-// These globals are replaced at bundle time with string literals.
-
-/* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
-          __BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
-
-const BUILD_VERSION =
-    typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
-const BUILD_LICENSE =
-    typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
-const BUILD_AUTHOR =
-    typeof __BUILD_AUTHOR__ !== "undefined"
-        ? __BUILD_AUTHOR__
-        : "sneak <sneak@sneak.berlin>";
-const BUILD_COMMIT =
-    typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
-const BUILD_COMMIT_FULL =
-    typeof __BUILD_COMMIT_FULL__ !== "undefined"
-        ? __BUILD_COMMIT_FULL__
-        : "unknown";
-const BUILD_DATE =
-    typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
-
-const GITEA_COMMIT_URL =
-    "https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
-
-module.exports = {
-    BUILD_VERSION,
-    BUILD_LICENSE,
-    BUILD_AUTHOR,
-    BUILD_COMMIT,
-    BUILD_COMMIT_FULL,
-    BUILD_DATE,
-    GITEA_COMMIT_URL,
-};

src/shared/chainSwitch.js

@@ -1,57 +0,0 @@
-// Consolidated chain-switch handler.
-//
-// Every state change required when the active network changes is
-// performed here so that callers (settings UI, background
-// wallet_switchEthereumChain, future chain additions) all go
-// through a single code path.
-//
-// Adding a new chain (e.g. ETC) requires only a new entry in
-// networks.js — no per-caller wiring is needed.
-
-const { networkById } = require("./networks");
-const { clearPrices } = require("./prices");
-
-// Switch the active chain and reset all chain-specific cached state.
-// Returns the network configuration object for the new chain.
-async function onChainSwitch(newNetworkId) {
-    const { state, saveState } = require("./state");
-
-    const net = networkById(newNetworkId);
-
-    // --- core identity ---
-    state.networkId = net.id;
-    state.rpcUrl = net.defaultRpcUrl;
-    state.blockscoutUrl = net.defaultBlockscoutUrl;
-
-    // --- price cache ---
-    // Prices are chain-specific (testnet tokens are worthless,
-    // ETC has different pricing, etc.).
-    clearPrices();
-
-    // --- balance / refresh state ---
-    // Reset last-refresh timestamp so the next polling cycle
-    // triggers an immediate balance refresh on the new chain.
-    state.lastBalanceRefresh = 0;
-
-    // Clear per-address balances and token balances so stale data
-    // from the previous chain is never displayed while the first
-    // refresh on the new chain is in flight.
-    for (const wallet of state.wallets) {
-        for (const addr of wallet.addresses) {
-            addr.balance = "0";
-            addr.tokenBalances = [];
-        }
-    }
-
-    // --- chain-specific caches ---
-    // Token holder counts and fraud contract lists are
-    // chain-specific and must not carry over.
-    state.tokenHolderCache = {};
-    state.fraudContracts = [];
-
-    await saveState();
-
-    return net;
-}
-
-module.exports = { onChainSwitch };

src/shared/constants.js

@@ -3,7 +3,6 @@ const DEBUG_MNEMONIC =
     "cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
 
 const ETHEREUM_MAINNET_CHAIN_ID = "0x1";
-const ETHEREUM_SEPOLIA_CHAIN_ID = "0xaa36a7";
 
 const DEFAULT_RPC_URL = "https://ethereum-rpc.publicnode.com";
 
@@ -38,7 +37,6 @@ module.exports = {
     DEBUG,
     DEBUG_MNEMONIC,
     ETHEREUM_MAINNET_CHAIN_ID,
-    ETHEREUM_SEPOLIA_CHAIN_ID,
     DEFAULT_RPC_URL,
     DEFAULT_BLOCKSCOUT_URL,
     BIP44_ETH_PATH,

src/shared/etherscanLabels.js

@@ -2,6 +2,8 @@
 // Extension users make the requests directly to Etherscan — no proxy needed.
 // This is a best-effort enrichment: network failures return null silently.
 
+const ETHERSCAN_BASE = "https://etherscan.io/address/";
+
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
 const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
@@ -72,19 +74,12 @@ function parseEtherscanPage(html) {
  * Returns a warning object if the address is flagged, or null.
  * Network failures return null silently (best-effort check).
  *
- * Uses the current network's explorer URL so the lookup works on both
- * mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
- *
  * @param {string} address - Ethereum address to check.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
 async function checkEtherscanLabel(address) {
     try {
-        // Lazy require to avoid pulling in chrome.storage at module scope
+        const resp = await fetch(ETHERSCAN_BASE + address, {
-        // (which breaks unit tests that only exercise parseEtherscanPage).
-        const { currentNetwork } = require("./state");
-        const etherscanBase = currentNetwork().explorerUrl + "/address/";
-        const resp = await fetch(etherscanBase + address, {
             headers: { Accept: "text/html" },
         });
         if (!resp.ok) return null;

src/shared/log.js

@@ -1,27 +1,12 @@
 // Leveled logger. Outputs to console with [AutistMask] prefix.
-// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
+// Level is DEBUG when the DEBUG constant is true, INFO otherwise.
-// debugMode state flag is enabled.  The runtime flag is checked lazily so it
-// responds immediately when toggled in settings.
 
 const { DEBUG } = require("./constants");
 
 const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
-
+const threshold = DEBUG ? LEVELS.debug : LEVELS.info;
-// Runtime debug mode flag — set by settings.js when the user toggles debug
-// mode via the easter egg.  Kept here as a simple mutable reference so it can
-// be updated without circular dependency issues with state.js.
-let _runtimeDebug = false;
-
-function setRuntimeDebug(enabled) {
-    _runtimeDebug = enabled;
-}
-
-function isDebug() {
-    return DEBUG || _runtimeDebug;
-}
 
 function emit(level, method, args) {
-    const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
     if (LEVELS[level] >= threshold) {
         console[method]("[AutistMask]", ...args);
     }
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
     return resp;
 }
 
-module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
+module.exports = { log, debugFetch };

src/shared/networks.js

@@ -1,57 +0,0 @@
-// Network definitions for supported Ethereum networks.
-// Each network specifies its chain ID, default RPC and Blockscout endpoints,
-// and the block explorer base URL used for address/tx/token/block links.
-
-const NETWORKS = {
-    mainnet: {
-        id: "mainnet",
-        name: "Ethereum Mainnet",
-        chainId: "0x1",
-        networkVersion: "1",
-        nativeCurrency: "ETH",
-        defaultRpcUrl: "https://ethereum-rpc.publicnode.com",
-        defaultBlockscoutUrl: "https://eth.blockscout.com/api/v2",
-        explorerUrl: "https://etherscan.io",
-        isTestnet: false,
-    },
-    sepolia: {
-        id: "sepolia",
-        name: "Sepolia Testnet",
-        chainId: "0xaa36a7",
-        networkVersion: "11155111",
-        nativeCurrency: "SepoliaETH",
-        defaultRpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
-        defaultBlockscoutUrl: "https://eth-sepolia.blockscout.com/api/v2",
-        explorerUrl: "https://sepolia.etherscan.io",
-        isTestnet: true,
-    },
-};
-
-const SUPPORTED_CHAIN_IDS = new Set(
-    Object.values(NETWORKS).map((n) => n.chainId),
-);
-
-function networkById(id) {
-    return NETWORKS[id] || NETWORKS.mainnet;
-}
-
-function networkByChainId(chainId) {
-    for (const net of Object.values(NETWORKS)) {
-        if (net.chainId === chainId) return net;
-    }
-    return null;
-}
-
-// Build a block explorer link for the given path type and value.
-// type: "address" | "tx" | "token" | "block"
-function explorerLink(network, type, value) {
-    return `${network.explorerUrl}/${type}/${value}`;
-}
-
-module.exports = {
-    NETWORKS,
-    SUPPORTED_CHAIN_IDS,
-    networkById,
-    networkByChainId,
-    explorerLink,
-};

src/shared/phishingDomains.js

@@ -1,92 +1,68 @@
-// Domain-based phishing detection using a vendored blocklist with delta updates.
+// Domain-based phishing detection using MetaMask's eth-phishing-detect blocklist.
 //
-// A community-maintained phishing domain blocklist is vendored in
+// Architecture:
-// phishingBlocklist.json and bundled at build time. At runtime, we fetch
+//   1. A vendored copy of the blocklist ships with the extension
-// the live list periodically and keep only the delta (new entries not in
+//      (src/data/phishing-domains.json — sorted blacklist for binary search).
-// the vendored list) in memory. This keeps runtime memory usage small.
+//   2. Every 24h we fetch the latest list from MetaMask's repo and compute
+//      the delta (new domains not in the vendored snapshot).
+//   3. Only the delta is kept in memory / persisted to chrome.storage.local.
+//   4. Domain checks hit the delta first (fresh scam sites), then the
+//      vendored baseline via binary search.
 //
-// The domain-checker checks the in-memory delta first (fresh/recent scam
+// Source: https://github.com/MetaMask/eth-phishing-detect (src/config.json)
-// sites), then falls back to the vendored list.
-//
-// If the delta is under 256 KiB it is persisted to localStorage so it
-// survives extension/service-worker restarts.
 
-const vendoredConfig = require("./phishingBlocklist.json");
+const vendoredConfig = require("../data/phishing-domains.json");
 
 const BLOCKLIST_URL =
     "https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const DELTA_STORAGE_KEY = "phishing_domain_delta";
-const DELTA_STORAGE_KEY = "phishing-delta";
+const DELTA_MAX_BYTES = 256 * 1024; // 256 KiB
-const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
 
-// Vendored set — built once from the bundled JSON.
+// Vendored baseline — sorted arrays for binary search (no extra Set needed).
-const vendoredBlacklist = new Set(
+const vendoredBlacklist = vendoredConfig.blacklist; // pre-sorted lowercase
-    (vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
+const vendoredWhitelist = new Set(
+    (vendoredConfig.whitelist || []).map((d) => d.toLowerCase()),
 );
 
-// Delta set — only entries from live list that are NOT in vendored.
+// Delta state — only domains added upstream since the vendored snapshot.
-let deltaBlacklist = new Set();
+let deltaBlacklistSet = new Set();
+let deltaWhitelistSet = new Set();
 let lastFetchTime = 0;
 let fetchPromise = null;
-let refreshTimer = null;
+let persistedDeltaLoaded = false;
 
 /**
- * Load delta entries from localStorage on startup.
+ * Normalize a domain entry: lowercase and strip wildcard prefix ("*.").
- * Called once during module initialization in the background script.
+ * Wildcard domains like "*.evil.com" become "evil.com" — our subdomain
- */
+ * matching in hostnameVariants() already covers child domains.
-function loadDeltaFromStorage() {
-    try {
-        const raw = localStorage.getItem(DELTA_STORAGE_KEY);
-        if (!raw) return;
-        const data = JSON.parse(raw);
-        if (data.blacklist && Array.isArray(data.blacklist)) {
-            deltaBlacklist = new Set(
-                data.blacklist.map((d) => d.toLowerCase()),
-            );
-        }
-    } catch {
-        // localStorage unavailable or corrupt — start empty
-    }
-}
-
-/**
- * Persist delta to localStorage if it fits within MAX_DELTA_BYTES.
- */
-function saveDeltaToStorage() {
-    try {
-        const data = {
-            blacklist: Array.from(deltaBlacklist),
-        };
-        const json = JSON.stringify(data);
-        if (json.length < MAX_DELTA_BYTES) {
-            localStorage.setItem(DELTA_STORAGE_KEY, json);
-        } else {
-            // Too large — remove stale key if present
-            localStorage.removeItem(DELTA_STORAGE_KEY);
-        }
-    } catch {
-        // localStorage unavailable — skip silently
-    }
-}
-
-/**
- * Load a pre-parsed config and compute the delta against the vendored list.
- * Used for both live fetches and testing.
  *
- * @param {{ blacklist?: string[] }} config
+ * @param {string} domain
+ * @returns {string}
  */
-function loadConfig(config) {
+function normalizeDomain(domain) {
-    const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
+    const d = domain.toLowerCase();
+    return d.startsWith("*.") ? d.slice(2) : d;
+}
 
-    // Delta = entries in the live list that are NOT in the vendored list
+/**
-    deltaBlacklist = new Set(
+ * Binary search on a sorted string array.
-        liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
+ *
-    );
+ * @param {string[]} sorted - Sorted array of lowercase strings.
-
+ * @param {string} target - Lowercase string to find.
-    lastFetchTime = Date.now();
+ * @returns {boolean}
-    saveDeltaToStorage();
+ */
+function binarySearch(sorted, target) {
+    let lo = 0;
+    let hi = sorted.length - 1;
+    while (lo <= hi) {
+        const mid = (lo + hi) >>> 1;
+        if (sorted[mid] === target) return true;
+        if (sorted[mid] < target) lo = mid + 1;
+        else hi = mid - 1;
+    }
+    return false;
 }
 
 /**
@@ -100,7 +76,6 @@ function hostnameVariants(hostname) {
     const h = hostname.toLowerCase();
     const variants = [h];
     const parts = h.split(".");
-    // Parent domains: a.b.c.d -> b.c.d, c.d
     for (let i = 1; i < parts.length - 1; i++) {
         variants.push(parts.slice(i).join("."));
     }
@@ -109,7 +84,8 @@ function hostnameVariants(hostname) {
 
 /**
  * Check if a hostname is on the phishing blocklist.
- * Checks delta first (fresh/recent scam sites), then vendored list.
+ * Checks delta (fresh additions) first, then vendored baseline.
+ * Whitelisted domains (vendored + delta) are never flagged.
  *
  * @param {string} hostname - The hostname to check.
  * @returns {boolean}
@@ -118,22 +94,107 @@ function isPhishingDomain(hostname) {
     if (!hostname) return false;
     const variants = hostnameVariants(hostname);
 
-    // Check delta blacklist first (fresh/recent scam sites), then vendored
+    // Whitelist takes priority (both vendored and delta)
     for (const v of variants) {
-        if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
+        if (vendoredWhitelist.has(v) || deltaWhitelistSet.has(v)) return false;
     }
+
+    // Check delta first — fresh scam sites hit here
+    for (const v of variants) {
+        if (deltaBlacklistSet.has(v)) return true;
+    }
+
+    // Check vendored baseline via binary search
+    for (const v of variants) {
+        if (binarySearch(vendoredBlacklist, v)) return true;
+    }
+
     return false;
 }
 
 /**
- * Fetch the latest blocklist and compute delta against vendored data.
+ * Get the storage API if available (chrome.storage.local / browser.storage.local).
- * De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS.
+ *
+ * @returns {object|null}
+ */
+function getStorageApi() {
+    if (typeof browser !== "undefined" && browser.storage) {
+        return browser.storage.local;
+    }
+    if (typeof chrome !== "undefined" && chrome.storage) {
+        return chrome.storage.local;
+    }
+    return null;
+}
+
+/**
+ * Load persisted delta from chrome.storage.local.
+ * Called once on first update to restore delta across restarts.
+ *
+ * @returns {Promise<void>}
+ */
+async function loadPersistedDelta() {
+    const storage = getStorageApi();
+    if (!storage) return;
+
+    try {
+        const result = await storage.get(DELTA_STORAGE_KEY);
+        const data = result[DELTA_STORAGE_KEY];
+        if (data && data.blacklist && data.whitelist) {
+            deltaBlacklistSet = new Set(data.blacklist);
+            deltaWhitelistSet = new Set(data.whitelist);
+            if (data.fetchTime) {
+                lastFetchTime = data.fetchTime;
+            }
+        }
+    } catch {
+        // Storage unavailable or corrupted — start fresh.
+    }
+    persistedDeltaLoaded = true;
+}
+
+/**
+ * Persist the current delta to chrome.storage.local if it fits in 256 KiB.
+ *
+ * @returns {Promise<void>}
+ */
+async function persistDelta() {
+    const storage = getStorageApi();
+    if (!storage) return;
+
+    const data = {
+        blacklist: Array.from(deltaBlacklistSet),
+        whitelist: Array.from(deltaWhitelistSet),
+        fetchTime: lastFetchTime,
+    };
+
+    const serialized = JSON.stringify(data);
+    if (serialized.length > DELTA_MAX_BYTES) {
+        // Delta too large to persist — keep in memory only.
+        return;
+    }
+
+    try {
+        await storage.set({ [DELTA_STORAGE_KEY]: data });
+    } catch {
+        // Storage write failed — non-fatal.
+    }
+}
+
+/**
+ * Fetch the latest blocklist, compute delta against vendored baseline,
+ * and update in-memory state.  De-duplicates concurrent fetches.
  *
  * @returns {Promise<void>}
  */
 async function updatePhishingList() {
+    // Load persisted delta on first call
+    if (!persistedDeltaLoaded) {
+        await loadPersistedDelta();
+    }
+
     // Skip if recently fetched
-    if (Date.now() - lastFetchTime < CACHE_TTL_MS && lastFetchTime > 0) {
+    if (Date.now() - lastFetchTime < CACHE_TTL_MS) {
         return;
     }
 
@@ -145,10 +206,32 @@ async function updatePhishingList() {
             const resp = await fetch(BLOCKLIST_URL);
             if (!resp.ok) throw new Error("HTTP " + resp.status);
             const config = await resp.json();
-            loadConfig(config);
+
+            // Compute blacklist delta: remote items not in vendored baseline
+            const newDeltaBl = new Set();
+            for (const domain of config.blacklist || []) {
+                const d = normalizeDomain(domain);
+                if (!binarySearch(vendoredBlacklist, d)) {
+                    newDeltaBl.add(d);
+                }
+            }
+
+            // Compute whitelist delta: remote items not in vendored whitelist
+            const newDeltaWl = new Set();
+            for (const domain of config.whitelist || []) {
+                const d = normalizeDomain(domain);
+                if (!vendoredWhitelist.has(d)) {
+                    newDeltaWl.add(d);
+                }
+            }
+
+            deltaBlacklistSet = newDeltaBl;
+            deltaWhitelistSet = newDeltaWl;
+            lastFetchTime = Date.now();
+
+            await persistDelta();
         } catch {
-            // Silently fail — vendored list still provides coverage.
+            // Fetch failed — keep existing delta, retry next time.
-            // We'll retry next time.
         } finally {
             fetchPromise = null;
         }
@@ -158,58 +241,57 @@ async function updatePhishingList() {
 }
 
 /**
- * Start periodic refresh of the phishing list.
+ * Load a pre-parsed config directly into state (vendored + delta combined).
- * Should be called once from the background script on startup.
+ * Used for testing.
+ *
+ * @param {{ blacklist?: string[], whitelist?: string[] }} config
  */
-function startPeriodicRefresh() {
+function loadConfig(config) {
-    if (refreshTimer) return;
+    // For tests: treat the entire config as delta (overlaid on vendored).
-    refreshTimer = setInterval(updatePhishingList, REFRESH_INTERVAL_MS);
+    // Clear existing delta first.
+    deltaBlacklistSet = new Set((config.blacklist || []).map(normalizeDomain));
+    deltaWhitelistSet = new Set((config.whitelist || []).map(normalizeDomain));
+    lastFetchTime = Date.now();
+    persistedDeltaLoaded = true;
 }
 
 /**
- * Return the total blocklist size (vendored + delta) for diagnostics.
+ * Return total blocklist size (vendored + delta, for diagnostics).
  *
  * @returns {number}
  */
 function getBlocklistSize() {
-    return vendoredBlacklist.size + deltaBlacklist.size;
+    return vendoredBlacklist.length + deltaBlacklistSet.size;
 }
 
 /**
- * Return the delta blocklist size for diagnostics.
+ * Return delta size (for diagnostics).
  *
  * @returns {number}
  */
 function getDeltaSize() {
-    return deltaBlacklist.size;
+    return deltaBlacklistSet.size;
 }
 
 /**
  * Reset internal state (for testing).
  */
 function _reset() {
-    deltaBlacklist = new Set();
+    deltaBlacklistSet = new Set();
+    deltaWhitelistSet = new Set();
     lastFetchTime = 0;
     fetchPromise = null;
-    if (refreshTimer) {
+    persistedDeltaLoaded = false;
-        clearInterval(refreshTimer);
-        refreshTimer = null;
 }
-}
-
-// Load persisted delta on module initialization
-loadDeltaFromStorage();
 
 module.exports = {
     isPhishingDomain,
     updatePhishingList,
-    startPeriodicRefresh,
     loadConfig,
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,
+    binarySearch,
+    normalizeDomain,
     _reset,
-    // Exposed for testing only
-    _getVendoredBlacklistSize: () => vendoredBlacklist.size,
-    _getDeltaBlacklist: () => deltaBlacklist,
 };

src/shared/prices.js

@@ -8,13 +8,6 @@ const prices = {};
 let lastFetchedAt = 0;
 
 async function refreshPrices() {
-    // Testnet tokens have no real market value — skip price fetching
-    // and clear any stale mainnet prices so the UI shows no USD values.
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) {
-        clearPrices();
-        return;
-    }
     const now = Date.now();
     if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
     try {
@@ -26,19 +19,7 @@ async function refreshPrices() {
     }
 }
 
-// Clear all cached prices and reset the fetch timestamp so the
-// next refreshPrices() call will fetch fresh data.
-function clearPrices() {
-    for (const key of Object.keys(prices)) {
-        delete prices[key];
-    }
-    lastFetchedAt = 0;
-}
-
-// Return the USD price for a symbol, or null on testnet / unknown.
 function getPrice(symbol) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     return prices[symbol] || null;
 }
 
@@ -56,8 +37,6 @@ function formatUsd(amount) {
 }
 
 function getAddressValueUsd(addr) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     const ethBal = parseFloat(addr.balance || "0");
@@ -72,8 +51,6 @@ function getAddressValueUsd(addr) {
 }
 
 function getWalletValueUsd(wallet) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     for (const addr of wallet.addresses) {
@@ -83,8 +60,6 @@ function getWalletValueUsd(wallet) {
 }
 
 function getTotalValueUsd(wallets) {
-    const { currentNetwork } = require("./state");
-    if (currentNetwork().isTestnet) return null;
     if (!prices.ETH) return null;
     let total = 0;
     for (const wallet of wallets) {
@@ -96,7 +71,6 @@ function getTotalValueUsd(wallets) {
 module.exports = {
     prices,
     refreshPrices,
-    clearPrices,
     getPrice,
     formatUsd,
     getAddressValueUsd,

src/shared/state.js

@@ -1,7 +1,6 @@
 // State management and extension storage persistence.
 
 const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
-const { networkById } = require("./networks");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -12,7 +11,6 @@ const DEFAULT_STATE = {
     hasWallet: false,
     wallets: [],
     trackedTokens: [],
-    networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
     lastBalanceRefresh: 0,
@@ -29,7 +27,6 @@ const DEFAULT_STATE = {
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
-    debugMode: false,
 };
 
 const state = {
@@ -39,20 +36,13 @@ const state = {
     selectedAddress: null,
     selectedToken: null,
     viewData: {},
-    viewStack: [],
 };
 
-// Return the network configuration for the currently selected network.
-function currentNetwork() {
-    return networkById(state.networkId);
-}
-
 async function saveState() {
     const persisted = {
         hasWallet: state.hasWallet,
         wallets: state.wallets,
         trackedTokens: state.trackedTokens,
-        networkId: state.networkId,
         rpcUrl: state.rpcUrl,
         blockscoutUrl: state.blockscoutUrl,
         lastBalanceRefresh: state.lastBalanceRefresh,
@@ -69,13 +59,11 @@ async function saveState() {
         fraudContracts: state.fraudContracts,
         tokenHolderCache: state.tokenHolderCache,
         theme: state.theme,
-        debugMode: state.debugMode,
         currentView: state.currentView,
         selectedWallet: state.selectedWallet,
         selectedAddress: state.selectedAddress,
         selectedToken: state.selectedToken,
         viewData: state.viewData,
-        viewStack: state.viewStack,
     };
     await storageApi.set({ autistmask: persisted });
 }
@@ -87,7 +75,6 @@ async function loadState() {
         state.hasWallet = saved.hasWallet;
         state.wallets = saved.wallets || [];
         state.trackedTokens = saved.trackedTokens || [];
-        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
         state.blockscoutUrl =
             saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
@@ -130,8 +117,6 @@ async function loadState() {
         state.fraudContracts = saved.fraudContracts || [];
         state.tokenHolderCache = saved.tokenHolderCache || {};
         state.theme = saved.theme || "system";
-        state.debugMode =
-            saved.debugMode !== undefined ? saved.debugMode : false;
         state.currentView = saved.currentView || null;
         state.selectedWallet =
             saved.selectedWallet !== undefined ? saved.selectedWallet : null;
@@ -139,7 +124,6 @@ async function loadState() {
             saved.selectedAddress !== undefined ? saved.selectedAddress : null;
         state.selectedToken = saved.selectedToken || null;
         state.viewData = saved.viewData || {};
-        state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
     }
 }
 
@@ -150,10 +134,4 @@ function currentAddress() {
     return state.wallets[state.selectedWallet].addresses[state.selectedAddress];
 }
 
-module.exports = {
+module.exports = { state, saveState, loadState, currentAddress };
-    state,
-    saveState,
-    loadState,
-    currentAddress,
-    currentNetwork,
-};

src/shared/transactions.js

@@ -153,38 +153,24 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
 
     // When a token transfer shares a hash with a normal tx, the normal tx
     // is the contract call (0 ETH) and the token transfer has the real
-    // amount and symbol.  For contract calls (swaps), a single transaction
+    // amount and symbol.  A single transaction (e.g. a swap) can produce
-    // can produce multiple token transfers (input, intermediates, output).
+    // multiple token transfers (one per token involved), so we key token
-    // We consolidate these into the original tx entry using the token
+    // transfers by hash + contract address to keep all of them.  We also
-    // transfer where the user *receives* tokens (the swap output), so
+    // preserve contract-call metadata (direction, label, method) from the
-    // the transaction list shows the final result rather than confusing
+    // matching normal tx so swaps display correctly.
-    // intermediate hops.  We preserve the original tx's from/to so the
-    // user sees their own address, not a router or Permit2 contract.
     for (const tt of ttJson.items || []) {
         const parsed = parseTokenTransfer(tt, addrLower);
         const existing = txsByHash.get(parsed.hash);
         if (existing && existing.direction === "contract") {
-            // For contract calls (swaps), consolidate into the original
+            parsed.direction = "contract";
-            // tx entry.  Prefer the "received" transfer (swap output)
+            parsed.directionLabel = existing.directionLabel;
-            // for the display amount.  If no received transfer exists,
+            parsed.isContractCall = true;
-            // fall back to the first "sent" transfer (swap input).
+            parsed.method = existing.method;
-            const isReceived = parsed.direction === "received";
+            // Remove the bare-hash normal tx so it doesn't appear as a
-            const needsAmount = !existing.exactValue;
+            // duplicate with empty value; token transfers replace it.
-            if (isReceived || needsAmount) {
+            txsByHash.delete(parsed.hash);
-                existing.value = parsed.value;
-                existing.exactValue = parsed.exactValue;
-                existing.rawAmount = parsed.rawAmount;
-                existing.rawUnit = parsed.rawUnit;
-                existing.symbol = parsed.symbol;
-                existing.contractAddress = parsed.contractAddress;
-                existing.holders = parsed.holders;
         }
-            // Keep the original tx's from/to (the user's address and the
+        // Use composite key so multiple token transfers per tx are kept.
-            // contract they called), not the token transfer's from/to
-            // which may be a router or Permit2 contract.
-            continue;
-        }
-        // Non-contract token transfers get their own entries.
         const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
         txsByHash.set(ttKey, parsed);
     }

src/shared/uniswap.js

@@ -359,12 +359,9 @@ function decode(data, toAddress) {
                     const s = decodeV3SwapExactIn(inputs[i]);
                     if (s) {
                         if (!inputToken) inputToken = s.tokenIn;
+                        if (!outputToken) outputToken = s.tokenOut;
                         if (!inputAmount) inputAmount = s.amountIn;
-                        // Always update output: in multi-step swaps (V3 → V4),
+                        if (!minOutput) minOutput = s.amountOutMin;
-                        // the last swap step determines the final output token
-                        // and minimum received amount.
-                        outputToken = s.tokenOut;
-                        minOutput = s.amountOutMin;
                     }
                 }
 
@@ -372,9 +369,9 @@ function decode(data, toAddress) {
                     const s = decodeV2SwapExactIn(inputs[i]);
                     if (s) {
                         if (!inputToken) inputToken = s.tokenIn;
+                        if (!outputToken) outputToken = s.tokenOut;
                         if (!inputAmount) inputAmount = s.amountIn;
-                        outputToken = s.tokenOut;
+                        if (!minOutput) minOutput = s.amountOutMin;
-                        minOutput = s.amountOutMin;
                     }
                 }
 
@@ -391,11 +388,12 @@ function decode(data, toAddress) {
                     const v4 = decodeV4Swap(inputs[i]);
                     if (v4) {
                         if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
+                        if (!outputToken && v4.tokenOut)
+                            outputToken = v4.tokenOut;
                         if (!inputAmount && v4.amountIn)
                             inputAmount = v4.amountIn;
-                        // Always update output: last swap step wins
+                        if (!minOutput && v4.amountOutMin)
-                        if (v4.tokenOut) outputToken = v4.tokenOut;
+                            minOutput = v4.amountOutMin;
-                        if (v4.amountOutMin) minOutput = v4.amountOutMin;
                     }
                 }
 

tests/phishingDomains.test.js

@@ -1,59 +1,21 @@
-// Provide a localStorage mock for Node.js test environment.
-// Must be set before requiring the module since it calls loadDeltaFromStorage()
-// at module load time.
-const localStorageStore = {};
-global.localStorage = {
-    getItem: (key) =>
-        Object.prototype.hasOwnProperty.call(localStorageStore, key)
-            ? localStorageStore[key]
-            : null,
-    setItem: (key, value) => {
-        localStorageStore[key] = String(value);
-    },
-    removeItem: (key) => {
-        delete localStorageStore[key];
-    },
-};
-
 const {
     isPhishingDomain,
     loadConfig,
     getBlocklistSize,
     getDeltaSize,
     hostnameVariants,
+    binarySearch,
+    normalizeDomain,
     _reset,
-    _getVendoredBlacklistSize,
-    _getDeltaBlacklist,
 } = require("../src/shared/phishingDomains");
 
-// Reset delta state before each test to avoid cross-test contamination.
+// The vendored baseline is loaded automatically via require().
-// Note: vendored sets are immutable and always present.
+// _reset() clears only the delta state, not the vendored baseline.
 beforeEach(() => {
     _reset();
-    // Clear localStorage mock between tests
-    for (const key of Object.keys(localStorageStore)) {
-        delete localStorageStore[key];
-    }
 });
 
 describe("phishingDomains", () => {
-    describe("vendored blocklist", () => {
-        test("vendored blacklist is loaded from bundled JSON", () => {
-            // The vendored blocklist should have a large number of entries
-            expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
-        });
-
-        test("detects domains from vendored blacklist", () => {
-            // These are well-known phishing domains in the vendored list
-            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
-            expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
-        });
-
-        test("getBlocklistSize includes vendored entries", () => {
-            expect(getBlocklistSize()).toBeGreaterThan(100000);
-        });
-    });
-
     describe("hostnameVariants", () => {
         test("returns exact hostname plus parent domains", () => {
             const variants = hostnameVariants("sub.evil.com");
@@ -81,125 +43,205 @@ describe("phishingDomains", () => {
         });
     });
 
-    describe("delta computation via loadConfig", () => {
+    describe("binarySearch", () => {
-        test("loadConfig computes delta of new entries not in vendored list", () => {
+        const sorted = ["alpha.com", "beta.com", "gamma.com", "zeta.com"];
+
+        test("finds existing elements", () => {
+            expect(binarySearch(sorted, "alpha.com")).toBe(true);
+            expect(binarySearch(sorted, "gamma.com")).toBe(true);
+            expect(binarySearch(sorted, "zeta.com")).toBe(true);
+        });
+
+        test("returns false for missing elements", () => {
+            expect(binarySearch(sorted, "aaa.com")).toBe(false);
+            expect(binarySearch(sorted, "delta.com")).toBe(false);
+            expect(binarySearch(sorted, "zzz.com")).toBe(false);
+        });
+
+        test("handles empty array", () => {
+            expect(binarySearch([], "anything")).toBe(false);
+        });
+
+        test("handles single-element array", () => {
+            expect(binarySearch(["only.com"], "only.com")).toBe(true);
+            expect(binarySearch(["only.com"], "other.com")).toBe(false);
+        });
+    });
+
+    describe("normalizeDomain", () => {
+        test("strips *. wildcard prefix", () => {
+            expect(normalizeDomain("*.evil.com")).toBe("evil.com");
+            expect(normalizeDomain("*.sub.evil.com")).toBe("sub.evil.com");
+        });
+
+        test("lowercases domains", () => {
+            expect(normalizeDomain("Evil.COM")).toBe("evil.com");
+            expect(normalizeDomain("*.Evil.COM")).toBe("evil.com");
+        });
+
+        test("passes through normal domains unchanged", () => {
+            expect(normalizeDomain("example.com")).toBe("example.com");
+        });
+    });
+
+    describe("wildcard domain handling", () => {
+        test("wildcard blacklist entries match via loadConfig", () => {
             loadConfig({
-                blacklist: [
+                blacklist: ["*.scam-site.com", "normal-scam.com"],
-                    "brand-new-scam-site-xyz123.com",
+                whitelist: [],
-                    "hopprotocol.pro", // already in vendored
-                ],
             });
-            // Only the new domain should be in the delta
+            // *.scam-site.com is normalized to scam-site.com
-            expect(
+            expect(isPhishingDomain("scam-site.com")).toBe(true);
-                _getDeltaBlacklist().has("brand-new-scam-site-xyz123.com"),
+            expect(isPhishingDomain("sub.scam-site.com")).toBe(true);
-            ).toBe(true);
+            expect(isPhishingDomain("normal-scam.com")).toBe(true);
-            expect(_getDeltaBlacklist().has("hopprotocol.pro")).toBe(false);
-            expect(getDeltaSize()).toBe(1);
-        });
-
-        test("re-loading config replaces previous delta", () => {
-            loadConfig({
-                blacklist: ["first-scam-xyz.com"],
-            });
-            expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
-
-            loadConfig({
-                blacklist: ["second-scam-xyz.com"],
-            });
-            expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
-            expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
-        });
-
-        test("getBlocklistSize includes both vendored and delta", () => {
-            const baseSize = getBlocklistSize();
-            loadConfig({
-                blacklist: ["delta-only-scam-xyz.com"],
-            });
-            expect(getBlocklistSize()).toBe(baseSize + 1);
         });
     });
 
-    describe("isPhishingDomain with delta + vendored", () => {
+    describe("vendored baseline detection", () => {
-        test("detects domain from delta blacklist", () => {
+        // These tests verify that the vendored phishing-domains.json
-            loadConfig({
+        // is loaded and searchable without any delta loaded.
-                blacklist: ["fresh-scam-xyz.com"],
+
-            });
+        test("getBlocklistSize reflects vendored list (no delta)", () => {
-            expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
+            // The vendored list has 231k+ domains; delta is empty after reset.
+            expect(getBlocklistSize()).toBeGreaterThan(200000);
+            expect(getDeltaSize()).toBe(0);
         });
 
-        test("detects domain from vendored blacklist", () => {
+        test("returns false for clean domains against vendored list", () => {
-            // No delta loaded — vendored still works
+            expect(isPhishingDomain("google.com")).toBe(false);
-            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
+            expect(isPhishingDomain("github.com")).toBe(false);
-        });
-
-        test("returns false for clean domains", () => {
-            expect(isPhishingDomain("etherscan.io")).toBe(false);
-            expect(isPhishingDomain("example.com")).toBe(false);
-        });
-
-        test("detects subdomain of blacklisted domain (vendored)", () => {
-            expect(isPhishingDomain("app.hopprotocol.pro")).toBe(true);
-        });
-
-        test("detects subdomain of blacklisted domain (delta)", () => {
-            loadConfig({
-                blacklist: ["delta-phish-xyz.com"],
-            });
-            expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
-        });
-
-        test("case-insensitive matching", () => {
-            loadConfig({
-                blacklist: ["Delta-Scam-XYZ.COM"],
-            });
-            expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
-            expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
         });
 
         test("returns false for empty/null hostname", () => {
             expect(isPhishingDomain("")).toBe(false);
             expect(isPhishingDomain(null)).toBe(false);
         });
+    });
 
-        test("handles config with no blacklist key", () => {
+    describe("delta (loadConfig) + isPhishingDomain", () => {
+        test("detects domains loaded into delta via loadConfig", () => {
+            loadConfig({
+                blacklist: ["evil-phishing.com", "scam-swap.xyz"],
+                whitelist: [],
+            });
+            expect(isPhishingDomain("evil-phishing.com")).toBe(true);
+            expect(isPhishingDomain("scam-swap.xyz")).toBe(true);
+        });
+
+        test("detects subdomain of delta-blacklisted domain", () => {
+            loadConfig({
+                blacklist: ["evil-phishing.com"],
+                whitelist: [],
+            });
+            expect(isPhishingDomain("app.evil-phishing.com")).toBe(true);
+            expect(isPhishingDomain("sub.app.evil-phishing.com")).toBe(true);
+        });
+
+        test("delta whitelist overrides delta blacklist", () => {
+            loadConfig({
+                blacklist: ["metamask.io"],
+                whitelist: ["metamask.io"],
+            });
+            expect(isPhishingDomain("metamask.io")).toBe(false);
+        });
+
+        test("delta whitelist on parent domain overrides blacklist", () => {
+            loadConfig({
+                blacklist: ["sub.legit.com"],
+                whitelist: ["legit.com"],
+            });
+            expect(isPhishingDomain("sub.legit.com")).toBe(false);
+        });
+
+        test("case-insensitive matching in delta", () => {
+            loadConfig({
+                blacklist: ["Evil-Phishing.COM"],
+                whitelist: [],
+            });
+            expect(isPhishingDomain("evil-phishing.com")).toBe(true);
+            expect(isPhishingDomain("EVIL-PHISHING.COM")).toBe(true);
+        });
+
+        test("getDeltaSize reflects loaded delta", () => {
+            loadConfig({
+                blacklist: ["a.com", "b.com", "c.com"],
+                whitelist: ["d.com"],
+            });
+            expect(getDeltaSize()).toBe(3);
+        });
+
+        test("re-loading config replaces previous delta", () => {
+            loadConfig({
+                blacklist: ["old-scam.com"],
+                whitelist: [],
+            });
+            expect(isPhishingDomain("old-scam.com")).toBe(true);
+
+            loadConfig({
+                blacklist: ["new-scam.com"],
+                whitelist: [],
+            });
+            expect(isPhishingDomain("old-scam.com")).toBe(false);
+            expect(isPhishingDomain("new-scam.com")).toBe(true);
+        });
+
+        test("handles config with no blacklist/whitelist keys", () => {
             loadConfig({});
             expect(getDeltaSize()).toBe(0);
-            // Vendored list still works
-            expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
         });
     });
 
-    describe("localStorage persistence", () => {
+    describe("real-world MetaMask blocklist patterns (via delta)", () => {
-        test("saveDeltaToStorage persists delta under 256KiB", () => {
+        test("detects known phishing domains loaded as delta", () => {
             loadConfig({
-                blacklist: ["persisted-scam-xyz.com"],
+                blacklist: [
+                    "uniswap-trade.web.app",
+                    "hopprotocol.pro",
+                    "blast-pools.pages.dev",
+                ],
+                whitelist: [],
             });
-            const stored = localStorage.getItem("phishing-delta");
-            expect(stored).not.toBeNull();
-            const data = JSON.parse(stored);
-            expect(data.blacklist).toContain("persisted-scam-xyz.com");
-        });
-
-        test("delta is cleared on _reset", () => {
-            loadConfig({
-                blacklist: ["temp-scam-xyz.com"],
-            });
-            expect(getDeltaSize()).toBe(1);
-            _reset();
-            expect(getDeltaSize()).toBe(0);
-        });
-    });
-
-    describe("real-world blocklist patterns", () => {
-        test("detects known phishing domains from vendored list", () => {
             expect(isPhishingDomain("uniswap-trade.web.app")).toBe(true);
             expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
             expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
         });
 
-        test("does not flag legitimate domains", () => {
+        test("delta whitelist overrides vendored blacklist entries", () => {
+            // If a domain is in the vendored blacklist but a fresh whitelist
+            // update adds it, the whitelist should win.
+            loadConfig({
+                blacklist: [],
+                whitelist: ["opensea.io", "metamask.io", "etherscan.io"],
+            });
             expect(isPhishingDomain("opensea.io")).toBe(false);
+            expect(isPhishingDomain("metamask.io")).toBe(false);
             expect(isPhishingDomain("etherscan.io")).toBe(false);
         });
     });
+
+    describe("delta + vendored interaction", () => {
+        test("delta blacklist entries are found even with empty vendored match", () => {
+            // This domain is (almost certainly) not in the vendored list
+            const uniqueDomain =
+                "test-unique-domain-not-in-vendored-" +
+                Date.now() +
+                ".example.com";
+            expect(isPhishingDomain(uniqueDomain)).toBe(false);
+
+            loadConfig({
+                blacklist: [uniqueDomain],
+                whitelist: [],
+            });
+            expect(isPhishingDomain(uniqueDomain)).toBe(true);
+        });
+
+        test("getBlocklistSize includes both vendored and delta", () => {
+            const baseSize = getBlocklistSize();
+            loadConfig({
+                blacklist: ["new-a.com", "new-b.com"],
+                whitelist: [],
+            });
+            expect(getBlocklistSize()).toBe(baseSize + 2);
+        });
+    });
 });