feat: warn when sending to address with zero tx history (#82)

On the confirm-tx screen, asynchronously check the recipient address
via Blockscout API. If the address has never sent or received any
transactions, display a prominent red warning banner.

Closes #82

src/popup/views/confirmTx.js

@@ -25,7 +25,7 @@ const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
 const { isScamAddress } = require("../../shared/scamlist");
-const { hasZeroTransactionHistory } = require("../../shared/transactions");
+const { hasTransactionHistory } = require("../../shared/transactions");
 const { ERC20_ABI } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
@@ -289,20 +289,28 @@ async function estimateGas(txInfo) {
 }
 
 async function checkRecipientHistory(txInfo) {
-    const isNew = await hasZeroTransactionHistory(
+    try {
-        txInfo.to,
+        const hasHistory = await hasTransactionHistory(
-        state.blockscoutUrl,
+            txInfo.to,
-    );
+            state.blockscoutUrl,
-    if (!isNew) return;
+        );
-
+        if (hasHistory === false) {
-    const warningsEl = $("confirm-warnings");
+            const warningsEl = $("confirm-warnings");
-    const warningHtml =
+            const warningDiv = document.createElement("div");
-        `<div class="border border-red-500 border-dashed p-2 mb-1 text-xs font-bold text-red-500">` +
+            warningDiv.className =
-        `WARNING: This address has ZERO transaction history. ` +
+                "border border-dashed p-2 mb-1 text-xs font-bold";
-        `It has never sent or received any funds. ` +
+            warningDiv.style.color = "#dc2626";
-        `Double-check the address before sending.</div>`;
+            warningDiv.style.borderColor = "#dc2626";
-    warningsEl.innerHTML = warningHtml + warningsEl.innerHTML;
+            warningDiv.textContent =
-    warningsEl.classList.remove("hidden");
+                "WARNING: This address has ZERO transaction history on-chain. " +
+                "It has never sent or received any transactions. " +
+                "Double-check the address before sending.";
+            warningsEl.appendChild(warningDiv);
+            warningsEl.classList.remove("hidden");
+        }
+    } catch (e) {
+        log.errorf("recipient history check failed:", e.message);
+    }
 }
 
 function init(ctx) {

src/shared/transactions.js

@@ -251,40 +251,36 @@ function filterTransactions(txs, filters = {}) {
     return { transactions: filtered, newFraudContracts: newFraud };
 }
 
-/**
+async function hasTransactionHistory(address, blockscoutUrl) {
- * Check whether an address has any on-chain transaction history.
- * Returns true if the address has zero normal transactions AND zero
- * token transfers on the configured Blockscout instance.
- * Returns false on network errors (fail-open: don't block sends).
- */
-async function hasZeroTransactionHistory(address, blockscoutUrl) {
     try {
-        const resp = await debugFetch(
+        const resp = await debugFetch(blockscoutUrl + "/addresses/" + address);
-            blockscoutUrl + "/addresses/" + address + "/transactions?limit=1",
+        if (!resp.ok) {
-        );
+            // If Blockscout returns 404, the address has never been seen on-chain.
-        if (!resp.ok) return false;
+            if (resp.status === 404) return false;
-        const json = await resp.json();
+            log.errorf(
-        if ((json.items || []).length > 0) return false;
+                "blockscout address check:",
-
+                resp.status,
-        // Also check token transfers — an address may have only received
+                resp.statusText,
-        // ERC-20 tokens without any native ETH transactions.
+            );
-        const ttResp = await debugFetch(
+            return null; // unknown
-            blockscoutUrl +
+        }
-                "/addresses/" +
+        const data = await resp.json();
-                address +
+        // Blockscout v2 address endpoint returns tx counts.
-                "/token-transfers?type=ERC-20&limit=1",
+        // An address with no history may still exist (e.g. received ETH once
-        );
+        // but shows 0 outgoing). We check both transactions_count and
-        if (!ttResp.ok) return false;
+        // token_transfers_count to be thorough.
-        const ttJson = await ttResp.json();
+        const txCount =
-        return (ttJson.items || []).length === 0;
+            (parseInt(data.transactions_count, 10) || 0) +
+            (parseInt(data.token_transfers_count, 10) || 0);
+        return txCount > 0;
     } catch (e) {
-        log.errorf("hasZeroTransactionHistory check failed:", e.message);
+        log.errorf("hasTransactionHistory error:", e.message);
-        return false;
+        return null; // unknown, don't block the user
     }
 }
 
 module.exports = {
     fetchRecentTransactions,
     filterTransactions,
-    hasZeroTransactionHistory,
+    hasTransactionHistory,
 };