feat: expand warning types for send confirmation

- Combine MEW darklist (652) and CryptoScamDB (2043) into 2314 scam addresses
- Add null/burn address detection with permanent loss warning
- Add contract address detection warning (sending directly to contracts)
- Unify all warnings into single warnings element (sync + async)
- Zero-history warning now uses unified warning system

Closes #114

src/popup/styles/main.css

@@ -19,16 +19,3 @@ body {
     width: 396px;
     overflow-x: hidden;
 }
-
-/* Copy-flash feedback: inverts colors then fades back */
-.copy-flash-active {
-    background-color: var(--color-fg) !important;
-    color: var(--color-bg) !important;
-    transition: none;
-}
-
-.copy-flash-fade {
-    transition:
-        background-color 300ms ease-out,
-        color 300ms ease-out;
-}

src/popup/views/addWallet.js

@@ -11,25 +11,6 @@ const { encryptWithPassword } = require("../../shared/vault");
 const { state, saveState } = require("../../shared/state");
 const { scanForAddresses } = require("../../shared/balances");
 
-/**
- * Check if an address already exists in ANY wallet (hd, xprv, or key).
- * Returns the wallet object if found, or undefined.
- */
-function findWalletByAddress(addr) {
-    const lower = addr.toLowerCase();
-    return state.wallets.find((w) =>
-        w.addresses.some((a) => a.address.toLowerCase() === lower),
-    );
-}
-
-/**
- * Check if an xpub already exists in any HD-type wallet (hd or xprv).
- * Returns the wallet object if found, or undefined.
- */
-function findWalletByXpub(xpub) {
-    return state.wallets.find((w) => w.xpub && w.xpub === xpub);
-}
-
 let currentMode = "mnemonic";
 
 const MODES = ["mnemonic", "privkey", "xprv"];
@@ -116,18 +97,18 @@ async function importMnemonic(ctx) {
     const pw = validatePassword();
     if (!pw) return;
     const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
-    const xpubDup = findWalletByXpub(xpub);
-    if (xpubDup) {
+    const duplicate = state.wallets.find(
+        (w) =>
+            w.type === "hd" &&
+            w.addresses[0] &&
+            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
+    );
+    if (duplicate) {
         showFlash(
-            "This recovery phrase is already added (" + xpubDup.name + ").",
+            "This recovery phrase is already added (" + duplicate.name + ").",
         );
         return;
     }
-    const addrDup = findWalletByAddress(firstAddress);
-    if (addrDup) {
-        showFlash("Address already exists in wallet (" + addrDup.name + ").");
-        return;
-    }
     const encrypted = await encryptWithPassword(mnemonic, pw);
     const walletNum = state.wallets.length + 1;
     const wallet = {
@@ -181,10 +162,15 @@ async function importPrivateKey(ctx) {
     }
     const pw = validatePassword();
     if (!pw) return;
-    const duplicate = findWalletByAddress(addr);
+    const duplicate = state.wallets.find(
+        (w) =>
+            w.type === "key" &&
+            w.addresses[0] &&
+            w.addresses[0].address.toLowerCase() === addr.toLowerCase(),
+    );
     if (duplicate) {
         showFlash(
-            "This address already exists in wallet (" + duplicate.name + ").",
+            "This private key is already added (" + duplicate.name + ").",
         );
         return;
     }
@@ -222,14 +208,14 @@ async function importXprvKey(ctx) {
         return;
     }
     const { xpub, firstAddress } = result;
-    const xpubDup = findWalletByXpub(xpub);
-    if (xpubDup) {
-        showFlash("This key is already added (" + xpubDup.name + ").");
-        return;
-    }
-    const addrDup = findWalletByAddress(firstAddress);
-    if (addrDup) {
-        showFlash("Address already exists in wallet (" + addrDup.name + ").");
+    const duplicate = state.wallets.find(
+        (w) =>
+            (w.type === "hd" || w.type === "xprv") &&
+            w.addresses[0] &&
+            w.addresses[0].address.toLowerCase() === firstAddress.toLowerCase(),
+    );
+    if (duplicate) {
+        showFlash("This key is already added (" + duplicate.name + ").");
         return;
     }
     const pw = validatePassword();

src/popup/views/addressDetail.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     addressDotHtml,
     addressTitle,
@@ -95,10 +94,6 @@ function show() {
 function isoDate(timestamp) {
     const d = new Date(timestamp * 1000);
     const pad = (n) => String(n).padStart(2, "0");
-    const off = -d.getTimezoneOffset();
-    const sign = off >= 0 ? "+" : "-";
-    const absOff = Math.abs(off);
-    const tz = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
     return (
         d.getFullYear() +
         "-" +
@@ -110,8 +105,7 @@ function isoDate(timestamp) {
         ":" +
         pad(d.getMinutes()) +
         ":" +
-        pad(d.getSeconds()) +
-        tz
+        pad(d.getSeconds())
     );
 }
 
@@ -247,7 +241,6 @@ function init(_ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("address-full"));
         }
     });
 
@@ -365,7 +358,6 @@ function init(_ctx) {
         if (key) {
             navigator.clipboard.writeText(key);
             showFlash("Copied!");
-            flashCopyFeedback($("export-privkey-value"));
         }
     });
 
@@ -374,7 +366,6 @@ function init(_ctx) {
         if (full) {
             navigator.clipboard.writeText(full);
             showFlash("Copied!");
-            flashCopyFeedback($("export-privkey-address"));
         }
     });
 

src/popup/views/addressToken.js

@@ -5,7 +5,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -48,10 +47,6 @@ function etherscanAddressLink(address) {
 function isoDate(timestamp) {
     const d = new Date(timestamp * 1000);
     const pad = (n) => String(n).padStart(2, "0");
-    const off = -d.getTimezoneOffset();
-    const sign = off >= 0 ? "+" : "-";
-    const absOff = Math.abs(off);
-    const tz = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
     return (
         d.getFullYear() +
         "-" +
@@ -63,8 +58,7 @@ function isoDate(timestamp) {
         ":" +
         pad(d.getMinutes()) +
         ":" +
-        pad(d.getSeconds()) +
-        tz
+        pad(d.getSeconds())
     );
 }
 
@@ -323,7 +317,6 @@ function init(_ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("address-token-full"));
         }
     });
 
@@ -332,7 +325,6 @@ function init(_ctx) {
         if (copyEl) {
             navigator.clipboard.writeText(copyEl.dataset.copy);
             showFlash("Copied!");
-            flashCopyFeedback(copyEl);
         }
     });
 
@@ -381,7 +373,6 @@ function init(_ctx) {
             copyEl.addEventListener("click", () => {
                 navigator.clipboard.writeText(copyEl.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(copyEl);
             });
         }
         updateSendBalance();

src/popup/views/confirmTx.js

@@ -15,7 +15,6 @@ const {
     hideError,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressTitle,
     addressDotHtml,
     escapeHtml,
@@ -25,7 +24,7 @@ const { getSignerForAddress } = require("../../shared/wallet");
 const { decryptWithPassword } = require("../../shared/vault");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { getProvider } = require("../../shared/balances");
-const { isScamAddress } = require("../../shared/scamlist");
+const { isScamAddress, isNullOrBurnAddress } = require("../../shared/scamlist");
 const { ERC20_ABI } = require("../../shared/constants");
 const { log } = require("../../shared/log");
 const makeBlockie = require("ethereum-blockies-base64");
@@ -39,6 +38,28 @@ const EXT_ICON =
     `</svg></span>`;
 
 let pendingTx = null;
+// Track active warnings so async checks can append without overwriting.
+let activeWarnings = [];
+
+function renderWarnings(el, warnings) {
+    activeWarnings = warnings.slice();
+    if (warnings.length > 0) {
+        el.innerHTML = warnings
+            .map(
+                (w) =>
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
+            )
+            .join("");
+        el.classList.remove("hidden");
+    } else {
+        el.classList.add("hidden");
+    }
+}
+
+function appendWarning(el, message) {
+    activeWarnings.push(message);
+    renderWarnings(el, activeWarnings);
+}
 
 function restore() {
     const d = state.viewData;
@@ -118,7 +139,6 @@ function show(txInfo) {
             copyEl.onclick = () => {
                 navigator.clipboard.writeText(copyEl.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(copyEl);
             };
         }
     } else {
@@ -167,29 +187,24 @@ function show(txInfo) {
         $("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
     }
 
-    // Check for warnings
+    // Check for warnings (synchronous checks first, async checks added later)
     const warnings = [];
     if (isScamAddress(txInfo.to)) {
         warnings.push(
             "This address is on a known scam/fraud list. Do not send funds to this address.",
         );
     }
+    if (isNullOrBurnAddress(txInfo.to)) {
+        warnings.push(
+            "This is a null or burn address. Funds sent here will be permanently lost.",
+        );
+    }
     if (txInfo.to.toLowerCase() === txInfo.from.toLowerCase()) {
         warnings.push("You are sending to your own address.");
     }
 
     const warningsEl = $("confirm-warnings");
-    if (warnings.length > 0) {
-        warningsEl.innerHTML = warnings
-            .map(
-                (w) =>
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
-            )
-            .join("");
-        warningsEl.classList.remove("hidden");
-    } else {
-        warningsEl.classList.add("hidden");
-    }
+    renderWarnings(warningsEl, warnings);
 
     // Check for errors
     const errors = [];
@@ -245,8 +260,11 @@ function show(txInfo) {
     state.viewData = { pendingTx: txInfo };
     showView("confirm-tx");
 
-    // Reset recipient warning to hidden (space always reserved, no layout shift)
-    $("confirm-recipient-warning").style.visibility = "hidden";
+    // Hide the legacy recipient warning element (warnings now unified)
+    const legacyWarningEl = $("confirm-recipient-warning");
+    if (legacyWarningEl) {
+        legacyWarningEl.style.display = "none";
+    }
 
     estimateGas(txInfo);
     checkRecipientHistory(txInfo);
@@ -293,19 +311,24 @@ async function estimateGas(txInfo) {
 }
 
 async function checkRecipientHistory(txInfo) {
-    const el = $("confirm-recipient-warning");
+    const warningsEl = $("confirm-warnings");
     try {
         const provider = getProvider(state.rpcUrl);
-        // Skip warning for contract addresses — they may legitimately
-        // have zero outgoing transactions (getTransactionCount returns
-        // the nonce, i.e. sent-tx count only).
         const code = await provider.getCode(txInfo.to);
         if (code && code !== "0x") {
+            // Recipient is a contract address — warn the user
+            appendWarning(
+                warningsEl,
+                "The recipient is a contract address. Sending tokens directly to a contract may result in permanent loss of funds.",
+            );
             return;
         }
         const txCount = await provider.getTransactionCount(txInfo.to);
         if (txCount === 0) {
-            el.style.visibility = "visible";
+            appendWarning(
+                warningsEl,
+                "The recipient address has ZERO transaction history. This may indicate a fresh or unused address. Double-check the address before sending.",
+            );
         }
     } catch (e) {
         log.errorf("recipient history check failed:", e.message);

src/popup/views/helpers.js

@@ -226,10 +226,6 @@ function formatAddressHtml(address, ensName, maxLen, title) {
 function isoDate(timestamp) {
     const d = new Date(timestamp * 1000);
     const pad = (n) => String(n).padStart(2, "0");
-    const off = -d.getTimezoneOffset();
-    const sign = off >= 0 ? "+" : "-";
-    const absOff = Math.abs(off);
-    const tz = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
     return (
         d.getFullYear() +
         "-" +
@@ -241,8 +237,7 @@ function isoDate(timestamp) {
         ":" +
         pad(d.getMinutes()) +
         ":" +
-        pad(d.getSeconds()) +
-        tz
+        pad(d.getSeconds())
     );
 }
 
@@ -263,26 +258,12 @@ function timeAgo(timestamp) {
     return years + " year" + (years !== 1 ? "s" : "") + " ago";
 }
 
-function flashCopyFeedback(el) {
-    if (!el) return;
-    el.classList.remove("copy-flash-fade");
-    el.classList.add("copy-flash-active");
-    setTimeout(() => {
-        el.classList.remove("copy-flash-active");
-        el.classList.add("copy-flash-fade");
-        setTimeout(() => {
-            el.classList.remove("copy-flash-fade");
-        }, 350);
-    }, 100);
-}
-
 module.exports = {
     $,
     showError,
     hideError,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
     addressColor,

src/popup/views/home.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     balanceLinesForAddress,
     isoDate,
     timeAgo,
@@ -86,10 +85,9 @@ function renderActiveAddress() {
         el.innerHTML =
             `<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
             `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
-        $("active-addr-copy").addEventListener("click", (e) => {
+        $("active-addr-copy").addEventListener("click", () => {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback(e.currentTarget);
         });
     } else {
         el.textContent = "";

src/popup/views/receive.js

@@ -2,7 +2,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
 } = require("./helpers");
@@ -61,12 +60,11 @@ function show() {
 }
 
 function init(ctx) {
-    $("receive-address-block").addEventListener("click", (e) => {
+    $("receive-address-block").addEventListener("click", () => {
         const addr = $("receive-address-block").dataset.full;
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback(e.currentTarget);
         }
     });
 
@@ -75,7 +73,6 @@ function init(ctx) {
         if (addr) {
             navigator.clipboard.writeText(addr);
             showFlash("Copied!");
-            flashCopyFeedback($("receive-address-block"));
         }
     });
 

src/popup/views/transactionDetail.js

@@ -5,7 +5,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -172,7 +171,6 @@ function render() {
             el.onclick = () => {
                 navigator.clipboard.writeText(el.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(el);
             };
         });
 }
@@ -250,7 +248,6 @@ async function loadCalldata(txHash, toAddress) {
                 el.onclick = () => {
                     navigator.clipboard.writeText(el.dataset.copy);
                     showFlash("Copied!");
-                    flashCopyFeedback(el);
                 };
             });
         }

src/popup/views/txStatus.js

@@ -4,7 +4,6 @@ const {
     $,
     showView,
     showFlash,
-    flashCopyFeedback,
     addressDotHtml,
     addressTitle,
     escapeHtml,
@@ -78,7 +77,6 @@ function attachCopyHandlers(viewId) {
             el.onclick = () => {
                 navigator.clipboard.writeText(el.dataset.copy);
                 showFlash("Copied!");
-                flashCopyFeedback(el);
             };
         });
 }

src/shared/uniswap.js

@@ -487,10 +487,7 @@ function decode(data, toAddress) {
         const deadlineDate = new Date(Number(deadline) * 1000);
         details.push({
             label: "Deadline",
-            value: deadlineDate
-                .toISOString()
-                .replace("T", " ")
-                .replace(".000Z", "Z"),
+            value: deadlineDate.toISOString().replace("T", " ").slice(0, 19),
         });
 
         return {