Merge branch 'main' into fix/67-validate-send-address

- Validate Ethereum addresses (0x + 40 hex chars) and ENS names
- EIP-55 checksum validation for mixed-case addresses
- Block sending to zero address (0x0000...0000)
- Warn when sending to own address (allow but show warning)
- Inline error messages with reserved space (no layout shift)
- Disable Review button while address is invalid

Closes #67

src/popup/index.html

@@ -581,23 +581,11 @@
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 hidden"
                 ></div>
-                <div class="mb-2">
-                    <label class="block mb-1 text-xs">Password</label>
-                    <input
-                        type="password"
-                        id="confirm-tx-password"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                    />
-                </div>
-                <div
-                    id="confirm-tx-password-error"
-                    class="text-xs mb-2 min-h-[1.25rem]"
-                ></div>
                 <button
                     id="btn-confirm-send"
                     class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
                 >
-                    Sign &amp; Send
+                    Send
                 </button>
             </div>
 
@@ -676,6 +664,42 @@
                 </button>
             </div>
 
+            <!-- ============ PASSWORD MODAL ============ -->
+            <div
+                id="password-modal"
+                class="hidden fixed inset-0 bg-bg flex items-center justify-center z-50"
+            >
+                <div class="border border-border p-4 bg-bg w-80">
+                    <h2 class="font-bold mb-2">Enter Password</h2>
+                    <p class="text-xs text-muted mb-2">
+                        Your password is needed to authorize this transaction.
+                    </p>
+                    <input
+                        type="password"
+                        id="modal-password"
+                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg mb-2"
+                    />
+                    <div
+                        id="modal-password-error"
+                        class="text-xs mb-2 border border-border border-dashed p-1 hidden"
+                    ></div>
+                    <div class="flex gap-2">
+                        <button
+                            id="btn-modal-confirm"
+                            class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                        >
+                            Confirm
+                        </button>
+                        <button
+                            id="btn-modal-cancel"
+                            class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                        >
+                            Cancel
+                        </button>
+                    </div>
+                </div>
+            </div>
+
             <!-- ============ RECEIVE ============ -->
             <div id="view-receive" class="view hidden">
                 <button
@@ -1115,10 +1139,7 @@
                         class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
                     />
                 </div>
-                <div
+                <div id="approve-tx-error" class="text-xs hidden mb-2"></div>
-                    id="approve-tx-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.25rem] hidden"
-                ></div>
                 <div class="flex justify-between">
                     <button
                         id="btn-approve-tx"
@@ -1181,10 +1202,7 @@
                         class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
                     />
                 </div>
-                <div
+                <div id="approve-sign-error" class="text-xs hidden mb-2"></div>
-                    id="approve-sign-error"
-                    class="text-xs mb-2 border border-border border-dashed p-1 min-h-[1.25rem] hidden"
-                ></div>
                 <div class="flex justify-between">
                     <button
                         id="btn-approve-sign"

src/popup/index.js

@@ -74,7 +74,6 @@ const RESTORABLE_VIEWS = new Set([
     "receive",
     "settings",
     "settings-addtoken",
-    "confirm-tx",
     "transaction",
     "success-tx",
     "error-tx",
@@ -128,13 +127,6 @@ function restoreView() {
         case "settings-addtoken":
             settingsAddToken.show();
             break;
-        case "confirm-tx":
-            if (state.viewData && state.viewData.pendingTx) {
-                confirmTx.restore();
-            } else {
-                fallbackView();
-            }
-            break;
         case "transaction":
             if (state.viewData && state.viewData.tx) {
                 transactionDetail.render();

src/popup/views/addressDetail.js

@@ -15,11 +15,7 @@ const {
     filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
-    updateSendBalance,
-    renderSendTokenSelect,
-    resetSendValidation,
-} = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 const { decryptWithPassword } = require("../../shared/vault");
@@ -263,7 +259,6 @@ function init(_ctx) {
         $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         updateSendBalance();
-        resetSendValidation();
         showView("send");
     });
 
@@ -325,9 +320,6 @@ function init(_ctx) {
             $("export-privkey-flash").classList.remove("hidden");
             return;
         }
-        const btn = $("btn-export-privkey-confirm");
-        btn.disabled = true;
-        btn.classList.add("text-muted");
         const wallet = state.wallets[state.selectedWallet];
         try {
             const secret = await decryptWithPassword(
@@ -347,9 +339,6 @@ function init(_ctx) {
         } catch {
             $("export-privkey-flash").textContent = "Wrong password.";
             $("export-privkey-flash").classList.remove("hidden");
-        } finally {
-            btn.disabled = false;
-            btn.classList.remove("text-muted");
         }
     });
 

src/popup/views/addressToken.js

@@ -23,11 +23,7 @@ const {
     filterTransactions,
 } = require("../../shared/transactions");
 const { resolveEnsNames } = require("../../shared/ens");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
-    updateSendBalance,
-    renderSendTokenSelect,
-    resetSendValidation,
-} = require("./send");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
 
@@ -376,7 +372,6 @@ function init(_ctx) {
             });
         }
         updateSendBalance();
-        resetSendValidation();
         showView("send");
     });
 

src/popup/views/approval.js

@@ -4,8 +4,6 @@ const {
     addressTitle,
     escapeHtml,
     showView,
-    showError,
-    hideError,
 } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
@@ -172,8 +170,6 @@ function showTxApproval(details) {
     // If this is an ERC-20 call, try to extract the real recipient and amount
     const decoded = decodeCalldata(details.txParams.data, toAddr || "");
     if (decoded && decoded.details) {
-        let decodedTokenAddr = null;
-        let decodedTokenSymbol = null;
         for (const d of decoded.details) {
             if (d.label === "Recipient" && d.address) {
                 pendingTxDetails.to = d.address;
@@ -181,20 +177,10 @@ function showTxApproval(details) {
             if (d.label === "Amount") {
                 pendingTxDetails.amount = d.rawValue || d.value;
             }
-            if (d.label === "Token In" && d.isToken && d.address) {
-                const t = TOKEN_BY_ADDRESS.get(d.address.toLowerCase());
-                if (t) {
-                    decodedTokenAddr = d.address;
-                    decodedTokenSymbol = t.symbol;
-                }
-            }
         }
         if (token) {
             pendingTxDetails.token = toAddr;
             pendingTxDetails.tokenSymbol = token.symbol;
-        } else if (decodedTokenAddr) {
-            pendingTxDetails.token = decodedTokenAddr;
-            pendingTxDetails.tokenSymbol = decodedTokenSymbol;
         }
     }
 
@@ -268,9 +254,6 @@ function showTxApproval(details) {
         $("approve-tx-data-section").classList.add("hidden");
     }
 
-    $("approve-tx-password").value = "";
-    $("approve-tx-error").classList.add("hidden");
-
     showView("approve-tx");
 }
 
@@ -359,7 +342,7 @@ function showSignApproval(details) {
     }
 
     $("approve-sign-password").value = "";
-    hideError("approve-sign-error");
+    $("approve-sign-error").classList.add("hidden");
     $("btn-approve-sign").disabled = false;
     $("btn-approve-sign").classList.remove("text-muted");
 
@@ -424,10 +407,11 @@ function init(ctx) {
     $("btn-approve-tx").addEventListener("click", () => {
         const password = $("approve-tx-password").value;
         if (!password) {
-            showError("approve-tx-error", "Please enter your password.");
+            $("approve-tx-error").textContent = "Please enter your password.";
+            $("approve-tx-error").classList.remove("hidden");
             return;
         }
-        hideError("approve-tx-error");
+        $("approve-tx-error").classList.add("hidden");
         $("btn-approve-tx").disabled = true;
         $("btn-approve-tx").classList.add("text-muted");
 
@@ -463,10 +447,11 @@ function init(ctx) {
     $("btn-approve-sign").addEventListener("click", () => {
         const password = $("approve-sign-password").value;
         if (!password) {
-            showError("approve-sign-error", "Please enter your password.");
+            $("approve-sign-error").textContent = "Please enter your password.";
+            $("approve-sign-error").classList.remove("hidden");
             return;
         }
-        hideError("approve-sign-error");
+        $("approve-sign-error").classList.add("hidden");
         $("btn-approve-sign").disabled = true;
         $("btn-approve-sign").classList.add("text-muted");
 
@@ -484,7 +469,8 @@ function init(ctx) {
                 } else {
                     const msg =
                         (response && response.error) || "Signing failed.";
-                    showError("approve-sign-error", msg);
+                    $("approve-sign-error").textContent = msg;
+                    $("approve-sign-error").classList.remove("hidden");
                     $("btn-approve-sign").disabled = false;
                     $("btn-approve-sign").classList.remove("text-muted");
                 }

src/popup/views/confirmTx.js

@@ -1,6 +1,6 @@
-// Transaction confirmation view with inline password.
+// Transaction confirmation view + password modal.
-// Shows transaction details, warnings, errors. On Sign & Send,
+// Shows transaction details, warnings, errors. On proceed, opens
-// reads inline password, decrypts secret, signs and broadcasts.
+// password modal, decrypts secret, signs and broadcasts.
 
 const {
     parseEther,
@@ -14,7 +14,6 @@ const {
     showError,
     hideError,
     showView,
-    showFlash,
     addressTitle,
     addressDotHtml,
     escapeHtml,
@@ -25,7 +24,6 @@ const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
-const { hasZeroTransactionHistory } = require("../../shared/transactions");
 const { ERC20_ABI } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
@@ -40,13 +38,6 @@ const EXT_ICON =
 
 let pendingTx = null;
 
-function restore() {
-    const d = state.viewData;
-    if (d && d.pendingTx) {
-        show(d.pendingTx);
-    }
-}
-
 function etherscanTokenLink(address) {
     return `https://etherscan.io/token/${address}`;
 }
@@ -104,22 +95,11 @@ function show(txInfo) {
     // Token contract section (ERC-20 only)
     const tokenSection = $("confirm-token-section");
     if (isErc20) {
-        const dot = addressDotHtml(txInfo.token);
         const link = etherscanTokenLink(txInfo.token);
         $("confirm-token-contract").innerHTML =
-            `<div class="flex items-center">${dot}` +
+            escapeHtml(txInfo.token) +
-            `<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
+            ` <a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-            `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
-            `</div>`;
         tokenSection.classList.remove("hidden");
-        // Attach click-to-copy on the contract address
-        const copyEl = tokenSection.querySelector("[data-copy]");
-        if (copyEl) {
-            copyEl.onclick = () => {
-                navigator.clipboard.writeText(copyEl.dataset.copy);
-                showFlash("Copied!");
-            };
-        }
     } else {
         tokenSection.classList.add("hidden");
     }
@@ -234,18 +214,12 @@ function show(txInfo) {
         sendBtn.classList.remove("text-muted");
     }
 
-    // Reset password field and error
-    $("confirm-tx-password").value = "";
-    hideError("confirm-tx-password-error");
-
     // Gas estimate — show placeholder then fetch async
     $("confirm-fee").classList.remove("hidden");
     $("confirm-fee-amount").textContent = "Estimating...";
-    state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
 
     estimateGas(txInfo);
-    checkRecipientHistory(txInfo);
 }
 
 async function estimateGas(txInfo) {
@@ -288,37 +262,39 @@ async function estimateGas(txInfo) {
     }
 }
 
-async function checkRecipientHistory(txInfo) {
+function showPasswordModal() {
-    const isNew = await hasZeroTransactionHistory(
+    $("modal-password").value = "";
-        txInfo.to,
+    hideError("modal-password-error");
-        state.blockscoutUrl,
+    $("password-modal").classList.remove("hidden");
-    );
+}
-    if (!isNew) return;
 
-    const warningsEl = $("confirm-warnings");
+function hidePasswordModal() {
-    const warningHtml =
+    $("password-modal").classList.add("hidden");
-        `<div class="border border-red-500 border-dashed p-2 mb-1 text-xs font-bold text-red-500">` +
-        `WARNING: This address has ZERO transaction history. ` +
-        `It has never sent or received any funds. ` +
-        `Double-check the address before sending.</div>`;
-    warningsEl.innerHTML = warningHtml + warningsEl.innerHTML;
-    warningsEl.classList.remove("hidden");
 }
 
 function init(ctx) {
-    $("btn-confirm-send").addEventListener("click", async () => {
+    $("btn-confirm-send").addEventListener("click", () => {
-        const password = $("confirm-tx-password").value;
+        showPasswordModal();
+    });
+
+    $("btn-confirm-back").addEventListener("click", () => {
+        showView("send");
+    });
+
+    $("btn-modal-cancel").addEventListener("click", () => {
+        hidePasswordModal();
+    });
+
+    $("btn-modal-confirm").addEventListener("click", async () => {
+        const password = $("modal-password").value;
         if (!password) {
-            showError(
+            showError("modal-password-error", "Please enter your password.");
-                "confirm-tx-password-error",
-                "Please enter your password.",
-            );
             return;
         }
 
         const wallet = state.wallets[state.selectedWallet];
         let decryptedSecret;
-        hideError("confirm-tx-password-error");
+        hideError("modal-password-error");
 
         try {
             decryptedSecret = await decryptWithPassword(
@@ -326,12 +302,11 @@ function init(ctx) {
                 password,
             );
         } catch (e) {
-            showError("confirm-tx-password-error", "Wrong password.");
+            showError("modal-password-error", "Wrong password.");
             return;
         }
 
-        $("btn-confirm-send").disabled = true;
+        hidePasswordModal();
-        $("btn-confirm-send").classList.add("text-muted");
 
         let tx;
         try {
@@ -368,15 +343,8 @@ function init(ctx) {
             decryptedSecret = null;
             const hash = tx ? tx.hash : null;
             txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
-        } finally {
-            $("btn-confirm-send").disabled = false;
-            $("btn-confirm-send").classList.remove("text-muted");
         }
     });
-
-    $("btn-confirm-back").addEventListener("click", () => {
-        showView("send");
-    });
 }
 
-module.exports = { init, show, restore };
+module.exports = { init, show };

src/popup/views/deleteWallet.js

@@ -40,10 +40,6 @@ function init(_ctx) {
             return;
         }
 
-        const btn = $("btn-delete-wallet-confirm");
-        btn.disabled = true;
-        btn.classList.add("text-muted");
-
         const walletIdx = deleteWalletIndex;
         const wallet = state.wallets[walletIdx];
 
@@ -53,8 +49,6 @@ function init(_ctx) {
         } catch (_e) {
             $("delete-wallet-flash").textContent = "Wrong password.";
             $("delete-wallet-flash").classList.remove("hidden");
-            btn.disabled = false;
-            btn.classList.remove("text-muted");
             return;
         }
 

src/popup/views/home.js

@@ -11,11 +11,7 @@ const {
     truncateMiddle,
 } = require("./helpers");
 const { state, saveState, currentAddress } = require("../../shared/state");
-const {
+const { updateSendBalance, renderSendTokenSelect } = require("./send");
-    updateSendBalance,
-    renderSendTokenSelect,
-    resetSendValidation,
-} = require("./send");
 const { deriveAddressFromXpub } = require("../../shared/wallet");
 const {
     formatUsd,
@@ -392,7 +388,6 @@ function init(ctx) {
         $("send-token-static").classList.add("hidden");
         renderSendTokenSelect(addr);
         updateSendBalance();
-        resetSendValidation();
         showView("send");
     });
 

src/popup/views/send.js

@@ -276,19 +276,4 @@ function init(_ctx) {
     });
 }
 
-function resetSendValidation() {
+module.exports = { init, updateSendBalance, renderSendTokenSelect };
-    const errorEl = $("send-to-error");
-    const btn = $("btn-send-review");
-    if (errorEl) errorEl.textContent = "";
-    if (btn) {
-        btn.disabled = true;
-        btn.classList.add("opacity-50");
-    }
-}
-
-module.exports = {
-    init,
-    updateSendBalance,
-    renderSendTokenSelect,
-    resetSendValidation,
-};

src/popup/views/txStatus.js

@@ -43,11 +43,10 @@ function toAddressHtml(address) {
     if (title) {
         return (
             `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>` +
-            `<div class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</div>` +
+            `<div class="break-all">${escapeHtml(address)}${extLink}</div>`
-            extLink
         );
     }
-    return `<div class="flex items-center">${dot}<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(address)}">${escapeHtml(address)}</span>${extLink}</div>`;
+    return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
 }
 
 function txHashHtml(hash) {
@@ -140,7 +139,7 @@ function etherscanTokenLink(address) {
 
 function decodedDetailsHtml(decoded) {
     if (!decoded || !decoded.details) return "";
-    let html = `<div class="border border-border border-dashed p-2 mb-3">`;
+    let html = "";
     if (decoded.name) {
         html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
         html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
@@ -165,36 +164,20 @@ function decodedDetailsHtml(decoded) {
         }
         html += `</div>`;
     }
-    html += `</div>`;
     return html;
 }
 
 function renderSuccess() {
     const d = state.viewData;
     if (!d || !d.hash) return;
-
+    $("success-tx-summary").textContent = d.amount + " " + d.symbol;
-    const hasDecoded = d.decoded && d.decoded.details;
+    $("success-tx-to").innerHTML = toAddressHtml(d.to);
-
-    // When decoded details are present, the Amount and To are already
-    // shown inside the decoded well — hide the top-level duplicates.
-    const summarySection = $("success-tx-summary").parentElement;
-    const toSection = $("success-tx-to").parentElement;
-    if (hasDecoded) {
-        summarySection.classList.add("hidden");
-        toSection.classList.add("hidden");
-    } else {
-        summarySection.classList.remove("hidden");
-        toSection.classList.remove("hidden");
-        $("success-tx-summary").textContent = d.amount + " " + d.symbol;
-        $("success-tx-to").innerHTML = toAddressHtml(d.to);
-    }
-
     $("success-tx-block").textContent = String(d.blockNumber);
     $("success-tx-hash").innerHTML = txHashHtml(d.hash);
 
     // Show decoded calldata details if present
     const decodedEl = $("success-tx-decoded");
-    if (decodedEl && hasDecoded) {
+    if (decodedEl && d.decoded) {
         decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
         decodedEl.classList.remove("hidden");
     } else if (decodedEl) {

src/shared/transactions.js

@@ -153,11 +153,9 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
 
     // When a token transfer shares a hash with a normal tx, the normal tx
     // is the contract call (0 ETH) and the token transfer has the real
-    // amount and symbol.  A single transaction (e.g. a swap) can produce
+    // amount and symbol. Replace the normal tx with the token transfer,
-    // multiple token transfers (one per token involved), so we key token
+    // but preserve contract call metadata (direction, label, method) so
-    // transfers by hash + contract address to keep all of them.  We also
+    // swaps and other contract interactions display correctly.
-    // preserve contract-call metadata (direction, label, method) from the
-    // matching normal tx so swaps display correctly.
     for (const tt of ttJson.items || []) {
         const parsed = parseTokenTransfer(tt, addrLower);
         const existing = txsByHash.get(parsed.hash);
@@ -166,13 +164,8 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
             parsed.directionLabel = existing.directionLabel;
             parsed.isContractCall = true;
             parsed.method = existing.method;
-            // Remove the bare-hash normal tx so it doesn't appear as a
-            // duplicate with empty value; token transfers replace it.
-            txsByHash.delete(parsed.hash);
         }
-        // Use composite key so multiple token transfers per tx are kept.
+        txsByHash.set(parsed.hash, parsed);
-        const ttKey = parsed.hash + ":" + (parsed.contractAddress || "");
-        txsByHash.set(ttKey, parsed);
     }
 
     const txs = [...txsByHash.values()];
@@ -251,40 +244,4 @@ function filterTransactions(txs, filters = {}) {
     return { transactions: filtered, newFraudContracts: newFraud };
 }
 
-/**
+module.exports = { fetchRecentTransactions, filterTransactions };
- * Check whether an address has any on-chain transaction history.
- * Returns true if the address has zero normal transactions AND zero
- * token transfers on the configured Blockscout instance.
- * Returns false on network errors (fail-open: don't block sends).
- */
-async function hasZeroTransactionHistory(address, blockscoutUrl) {
-    try {
-        const resp = await debugFetch(
-            blockscoutUrl + "/addresses/" + address + "/transactions?limit=1",
-        );
-        if (!resp.ok) return false;
-        const json = await resp.json();
-        if ((json.items || []).length > 0) return false;
-
-        // Also check token transfers — an address may have only received
-        // ERC-20 tokens without any native ETH transactions.
-        const ttResp = await debugFetch(
-            blockscoutUrl +
-                "/addresses/" +
-                address +
-                "/token-transfers?type=ERC-20&limit=1",
-        );
-        if (!ttResp.ok) return false;
-        const ttJson = await ttResp.json();
-        return (ttJson.items || []).length === 0;
-    } catch (e) {
-        log.errorf("hasZeroTransactionHistory check failed:", e.message);
-        return false;
-    }
-}
-
-module.exports = {
-    fetchRecentTransactions,
-    filterTransactions,
-    hasZeroTransactionHistory,
-};

src/shared/uniswap.js

@@ -445,18 +445,12 @@ function decode(data, toAddress) {
             const maxUint160 = BigInt(
                 "0xffffffffffffffffffffffffffffffffffffffff",
             );
-            const isUnlimited = inputAmount >= maxUint160;
+            const amountStr =
-            const amountRaw = isUnlimited
+                inputAmount >= maxUint160
-                ? "Unlimited"
+                    ? "Unlimited"
-                : formatAmount(inputAmount, inInfo.decimals);
+                    : formatAmount(inputAmount, inInfo.decimals) +
-            const amountStr = isUnlimited
+                      (inSymbol ? " " + inSymbol : "");
-                ? "Unlimited"
+            details.push({ label: "Amount", value: amountStr });
-                : amountRaw + (inSymbol ? " " + inSymbol : "");
-            details.push({
-                label: "Amount",
-                value: amountStr,
-                rawValue: amountRaw,
-            });
         }
 
         if (outSymbol) {