harden: verify the signed transaction against what the popup displayed (closes #216 )

The signed artifact was compared with the dApp's request object, so every field the dApp left out — normally the nonce, the gas limit and every fee field, because populateTransaction() filled them in the popup — was checked by nothing but the absolute ceilings. A bare transfer at the fee ceiling hands the validator 2.1 ETH. The ceilings were never the defect: the thing being verified was not the thing the user approved. The transaction is now populated in the background, before the approval window opens, and that populated object is what is displayed, what the popup signs, and what the artifact is verified against. Every consequential field is compared exactly. - src/shared/approvalTx.js populates the request through a VoidSigner over the configured RPC and serializes the result to the fields its type serializes, as hex quantities that survive the JSON messaging boundary. Fields the wallet does not act on are dropped before ethers sees the page's object. - Population failure raises no approval and opens no window: the error goes back to the requesting page, bounded by a 20-second timeout. A half-initialised approval record would be exactly the state the settle interlock exists to keep out of that record, and the same estimate previously failed after the user had typed their password. - verifySignedTx compares the artifact field by field over SERIALIZED_FIELDS[type], plus the type itself. A quantity the approval does not fix is a refusal rather than a skipped comparison. The ceilings stay as a documented backstop and now also apply at population, where they bound what an RPC node can talk the wallet into displaying. - The approval pins the address it was raised for. Verification uses that address, not getActiveAddress(), and an address switch between approval and signing refuses rather than signing from an account the screen never named — including a switch during population, and on the message-signing path. A request naming an address that is not the active one is refused outright. - The approval screen shows the network, gas limit, fee per gas, maximum fee and nonce it now vouches for, and the popup signs the object it was given with no provider and no population of its own. The settle chokepoint is untouched: one delete of pendingApprovals and one approval.resolve(), both inside settleApproval(), the claim taken synchronously before the first await, and a refused settle still leaving the approval window standing.
2026-08-12 10:09:11 +00:00
23 changed files with 149 additions and 4000 deletions
--- a/.gitea/workflows/e2e.yml
+++ b/.gitea/workflows/e2e.yml
@@ -1,49 +0,0 @@
 name: e2e
 on: [push]
 # The browser end-to-end suites, one job per browser, deliberately kept out
 # of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
 # script/cibuild is a plain `docker build .` whose Dockerfile runs
 # make check, so folding a browser suite into either would blow that cap
 # and slow the local fast path. Before this workflow every browser-level
 # guarantee in this repo held only when a human remembered to run it.
 #
 # One job per browser rather than two steps in one job, so a Chrome failure
 # does not hide the Firefox result.
 #
 # Each job is one script and nothing else. Both scripts need docker and
 # nothing else — they deliver the repo to the daemon as a build context and
 # build the extension inside the pinned image — which is what makes them
 # runnable here at all: the runner executes the job in a container against
 # the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
 # by the host daemon and mounts an empty directory, and the runner image's
 # node is too old to install this repo's dependencies.
 #
 # These jobs REPORT, they do not gate. Whether a check blocks a merge is
 # Gitea branch protection, which this repo does not configure, so a failure
 # here is a red mark a reviewer has to account for rather than a hard
 # block. Making e2e-chrome a required check is blocked on the measured
 # flake in the dApp signing wait -- two of six runs of unmutated code on a
 # loaded machine -- tracked as
 # https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
 # random teaches people to merge past red.
 #
 # Nothing here may pass vacuously. There is no continue-on-error and no
 # `|| true`. Both scripts exit non-zero when docker is missing, when the
 # image build fails, and when the browser fails to start; the Chrome
 # harness aborts the suite outright if its network interception is not in
 # effect.
 jobs:
    e2e-chrome:
        runs-on: ubuntu-latest
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
            - run: script/test-e2e
    e2e-firefox:
        runs-on: ubuntu-latest
        steps:
            # actions/checkout v4.2.2, 2026-02-22
            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
            - run: script/test-e2e-firefox
--- a/7
+++ b/7
@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
+.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -16,13 +16,10 @@ install:
 test:
 	@script/test
-# Browser end-to-end suites. Both require docker; neither is part of check.
+# Browser end-to-end suite. Requires docker; not part of check.
 test-e2e:
 	@script/test-e2e
 test-e2e-firefox:
 	@script/test-e2e-firefox
 lint:
 	@script/lint
--- a/README.md
+++ b/README.md
@@ -83,11 +83,7 @@ provide:
  git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run the test suite (jest)
- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
+- `script/test-e2e` — run the browser end-to-end suite (docker required; see
  only prerequisite: it builds a pinned image that carries the repo and a fresh
  extension build, see [End-to-End Tests](#end-to-end-tests))
 - `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
  against an image with a pinned Firefox and geckodriver, see
  [End-to-End Tests](#end-to-end-tests))
 - `script/lint` — run the linter
 - `script/fmt` — format all files (writes)
@@ -127,22 +123,13 @@ The Makefile shims to those. It also carries a few targets that have no
 ## End-to-End Tests
 There are two suites, one per browser, and they share no code. Chrome runs on
 Playwright; Firefox has its own WebDriver client, because Playwright cannot
 observe errors on a Firefox extension page at all — see
 [Firefox](#firefox-make-test-e2e-firefox) below. Both require docker, and both
 are outside `make check`.
 ### Chrome (`make test-e2e`)
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
 Chrome**, loaded as an unpacked MV3 extension inside a pinned
-`mcr.microsoft.com/playwright` container (pinned by digest in
+`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
-`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
+docker is required and the suite fails loudly rather than skipping if it is
-required and the suite fails loudly rather than skipping if it is unavailable).
+unavailable). The suite lives in `tests/e2e/` and is driven by
-The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
+`playwright-core`, whose version must stay matched to the container's Playwright
-version must stay matched to the container's Playwright version — the browsers
+version — the browsers ship inside the image.
 ship inside the image.
 It covers popup load, WebAssembly compilation under the shipped CSP (see
 [Content Security Policy](#content-security-policy)), wallet creation through
@@ -171,34 +158,6 @@ reserve while sitting on the same side of the estimate, so swapping the two in
 what [#154](https://git.eeqj.de/sneak/AutistMask/issues/154) was, and it was
 previously correct by reading only.
 It also covers the **dApp approval round trips** — the one place where the
 content script, the inpage provider, the background worker and the approval
 popup all have to work together. A local test page is served by the route
 handler on a reserved-TLD origin, gets `window.ethereum` from the shipped
 `MAIN`-world content script like any other page, and drives
 `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
 `eth_sendTransaction` through the real prompts. Every signature is recovered in
 the runner and compared against the active address, the transaction assertions
 run against the raw signed transaction captured at `eth_sendRawTransaction`
 rather than against anything the extension reported, rejecting each prompt is
 required to return a rejection to the page rather than hang or resolve, and the
 password is required to be absent from every message the approval window sends
 to the background — with the message that would carry it required to be present,
 so that check cannot pass by observing nothing. That last one is the standing
 floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 Three limits of that coverage, none of them papered over. The RPC is stubbed
 throughout, so this is **not** a real dApp against a real network with real
 funds; that remains a human pass before 1.0.0. The site-connection prompt is
 raised through `chrome.action.openPopup()`, and headless Chromium's
 browser-action popup is not a page Playwright can see or click, so that one
 prompt is driven at the URL the extension itself puts on the action — the same
 page and the same approval id, but whether a real toolbar click shows it is not
 observable here. And the EIP-1193 error code does not survive the last hop: the
 rejection that crosses the boundary carries code 4001 and is asserted to, but
 `src/content/inpage.js` rebuilds it as `new Error(message)`, so the calling page
 catches an error with no `code` property.
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
 consumes exactly one matching record, and a declaration nothing matched fails
@@ -241,128 +200,13 @@ a `ReferenceError` from a used-but-not-imported identifier is invisible to
 `make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
 and this suite exists because exactly that class of bug shipped twice.
-### Firefox (`make test-e2e-firefox`)
+`make test-e2e` is deliberately **not** part of `make check` or `make test`.
-
+`REPO_POLICIES.md` caps `make test` at 20 seconds and a browser suite does not
-`make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
+fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot pick it up
-real Firefox**, installed as an unpacked MV2 temporary add-on via geckodriver.
+either. It is also not wired into the Gitea workflow yet — docker-in-docker in
-It covers popup load, wallet creation through the UI, and the Add Token screen.
+CI is a separate question. Run it locally before changing anything under
 The suite lives in `tests/e2e/firefox/` and has **no npm dependencies at all**:
 it is a small WebDriver client built on global `fetch` and `child_process`
 against geckodriver's HTTP API.
 Unlike the Chrome suite it builds its own container image rather than pulling a
 published one, because no published image carries both a pinned Firefox and a
 matching geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external
 artifacts by digest — the `node` base image, the Firefox 153.0.3 tarball, and
 geckodriver 0.36.0 — and the Firefox version in particular must not float:
 `-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
 Without that flag, both navigating to `moz-extension://` and running
 chrome-context script fail with `unsupported operation`. The flag grants the
 driver full chrome privileges over that browser, which is acceptable only
 because it is a throwaway container.
 The popup's `moz-extension://` uuid is **pinned, not discovered**: the profile
 pref `extensions.webextensions.uuids` maps the extension id that
 `manifest/firefox.json` already declares to a fixed uuid, so the popup URL is
 deterministic. Navigation uses **classic** WebDriver `POST /session/{id}/url`,
 because BiDi's `browsingContext.navigate` refuses `moz-extension://` outright.
 **Any uncaught error from a `moz-extension://` source fails the run**, including
 errors from the background page, which the suite never navigates to: a `throw`
 at the top of `src/background/index.js` kills the background page and fails
 step 1. Content-script errors should arrive by the same route, but this suite
 does not exercise it and does not claim it — with `--network none` there is no
 `http://` page for a content script to be injected into. Errors from add-on
 install and background startup are folded into step 1 rather than discarded.
 Errors are read from the privileged `nsIConsoleService` in Marionette's chrome
 context and filtered to non-warning entries whose `sourceName` is the extension
 origin. That mechanism is not a stylistic choice. WebDriver BiDi's
 `log.entryAdded` delivers **nothing** for extension pages: on a plain `http://`
 page it reports uncaught errors with stack traces, and on the `moz-extension://`
 popup it reports zero events, because Firefox's remote agent excludes extension
 browsing contexts from BiDi observation. Any harness built on Playwright-BiDi or
 Puppeteer-BiDi would therefore see nothing and report success, which is exactly
 the vacuous check this repo has already shipped twice. Do not migrate this suite
 to BiDi.
 Two limits are worth knowing, both real differences from the Chrome suite:
 - **Error capture is poll-based, not event-streamed.** The console is drained at
  each step boundary, so an error is attributed to the step it was drained
  after, not to a moment within it. The window that is drained runs from add-on
  install to **≈1.5s** after the last step returns — a 500ms settle, a 1000ms
  tail sleep and two drain round trips — and then the browser is torn down. That
  cut-off is not a hard boundary: with throws scheduled at fixed offsets, three
  runs reported everything up to +1.5s and one of the three also reported +1.6s,
  so an error landing near it may or may not be seen, and anything well past it
  is not. Inside the window there is no race — each drain reads and clears the
  console in a single chrome round trip, so an error logged mid-drain lands in
  that batch or the next rather than being destroyed unread — but there is a
  **capacity limit**: `nsIConsoleService` keeps a ring buffer of 250 messages
  and silently evicts the oldest, so more than 250 console messages between two
  drains destroys the excess unread. 400 throws inside one step are reported as
  exactly the newest 250, three runs running. That buffer is shared with
  Firefox's own console noise; a clean run peaks at 4 of 250 at the install
  drain and 0 at every later drain, so the three steps here have wide headroom,
  but a step that logs heavily could evict unread errors. What poll-based costs
  is location, not coverage: an error cannot be placed within a step the way the
  Chrome suite's `pageerror` events place it.
 - **Nothing is stubbed, which inverts the coverage of network-dependent code.**
  There is no fixture layer; the container runs with `--network none` instead,
  so the run is offline and deterministic and no request can escape. The
  extension swallows its own fetch failures, so the flows are unaffected — but
  every network call fails, so only the _failure_ branches of code that depends
  on one are ever executed. A `ReferenceError` in the success path of
  `renderTransactions`, or of price or balance rendering, passes this suite
  green. The offline run is also weaker than the Chrome suite's interception: it
  proves nothing got out, but it cannot report which requests were attempted.
  Closing that gap needs a fixture layer, deliberately out of scope for this
  harness.
 Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
 `make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
 suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
 pick it up either. Run them locally before changing anything under
 `src/popup/views/`.
 ### In CI
 `.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
 `e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
 20-second `make test` cap and the local fast path are untouched. Each job is a
 checkout and the matching `script/` entrypoint, nothing else.
 Docker is the only thing either job needs from the runner, and that is not an
 accident. The runner executes a job inside a container against the **host's**
 docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
 host and mounts an empty directory, and the runner image's node is too old to
 install this repo's dependencies. Both suites therefore ship the repo to the
 daemon as a build context and build the extension inside the image, which works
 identically on a laptop.
 The jobs **report, they do not gate.** A failure is a red mark against the
 commit that a reviewer has to account for, not a hard block: whether a check
 blocks a merge is Gitea branch protection, which this repo does not configure.
 That is not only a statement about configuration. The Chrome suite is
 **measurably flaky under load** — two of six runs of unmutated code on a busy
 machine lost the approval popup out from under the dApp signing wait, always in
 the `#183` section, tracked as
 [#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
 has to be read before it is believed, and that flake is the blocker to ever
 making this a required check. Do not answer it with a retry wrapper: a suite
 that reruns until it is green stops being evidence.
 Nothing in either job can pass vacuously. There is no `continue-on-error` and no
 `|| true`; both scripts exit non-zero when docker is missing, when the image
 build fails, and when the browser fails to start; the Chrome harness aborts the
 suite outright if its network interception is not in effect.
 Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
 the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
 once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
 Firefox and geckodriver downloads the same way.
 ## Rationale
 Common popular EVM wallets have become bloated with swap UIs, portfolio
@@ -677,21 +521,6 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 A reopened popup renders the wallet list and the one screen it restores onto,
 and nothing else, so every screen on the stack behind that one is still the
 blank template from `index.html`. "Back" therefore renders its target rather
 than only unhiding it, through the same dispatch and data guards as the restore
 (`src/popup/viewRouter.js`), and falls back to Home when the state the target
 would render is gone.
 It renders only a screen this page load has not rendered yet. Forward navigation
 renders as it goes, and `viewRouter.js` records every screen that reaches
 `showView()`, so "Back" onto a screen already on the page unhides it and nothing
 more — rendering it a second time would re-fetch and overwrite what it holds,
 such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret
--- a/TODO.md
+++ b/TODO.md
@@ -30,11 +30,9 @@ compiled off.
 The backlog lives on the
 [Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
-authoritative; this file does not duplicate it. Full policy file set present.
+authoritative; this file does not duplicate it. Full policy file set present. A
-Real-browser end-to-end suites (`make test-e2e` for Chrome,
+real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
-`make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
+which cannot see a runtime `ReferenceError` in a popup view.
 cannot see a runtime `ReferenceError` in a popup view, and
 `.gitea/workflows/e2e.yml` runs both of them on every push.
 # Next Step
@@ -46,112 +44,6 @@ undefined identifiers, which is how
 # Completed Steps
 - 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
  runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
  push, separate from `check`, so `make check` and its 20-second `make test` cap
  are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
  check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
  gate, the dApp approval round trips — was enforced only when a human
  remembered to run it by hand. The suites could not run on the runner as they
  stood: the runner executes a job in a container against the host's docker
  daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
  and the runner image's node cannot install this repo's dependencies. Both
  suites now ship the repo to the daemon as a build context and build the
  extension inside the pinned image, so docker is the only prerequisite on a
  runner or a laptop, and both run the image by ID rather than by tag so
  concurrent clones cannot swap it. The jobs report rather than gate — this repo
  configures no branch protection, and the Chrome suite is measurably flaky
  under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
  rather than papered over
  ([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
  rebuilt every failure as `new Error(error.message)`, so the code the
  background produced and the content script relayed intact was dropped in the
  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
  the user deliberately declined was indistinguishable from one that broke. The
  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
  boundary sent one, `data`, passed through verbatim rather than matched against
  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
  here. An error the background sent with no code stays a plain `Error` with no
  `code` property, and `message` is unchanged in every case. All four request
  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
  now requires it on the page's Error as well as on the wire, for all four
  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
  it. A reopened popup renders the wallet list and the one screen it restores
  onto, so every screen further down the stack was still the blank template from
  `index.html`, and Back walked straight onto it — an empty address, no
  balances, no QR code. The Back path now goes through the same per-view
  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
  with `restoreView()`), falling back to Home when the state the target would
  render is gone. It renders only a view this page load has not rendered yet:
  `viewRouter.js` records every view that reaches `showView()`, which is where
  forward navigation and the restore both end, so Back onto a view already on
  the page unhides it and nothing more. That is what keeps a second render from
  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
  a transaction list already loaded. Home is the exception and is always
  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
  and by three end-to-end cases against the real popup, each demonstrated
  failing on the unfixed build
  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
  that bear it, not to one of them. A ticker is not unique: seven of the 512
  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
  share a symbol with another bundled entry at a different real contract, and
  the table, built from the list first-wins, kept only the earlier one. The
  other seven were judged spoofs of their own symbol at their own address and
  hidden from the balance list, the history and the send selector, so a holder
  could not spend them. Both contracts of each pair come from the same CoinGecko
  fetch of 2026-02-27, so neither was stale and neither was dropped.
  `isSpoofedSymbol()` asks set membership instead of equality, which does not
  loosen the rule — a contract outside the set is still a spoof — and a test now
  walks `TOKENS` asserting no bundled token is filtered at its own address,
  which is the walk the suite lacked
  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
 - 2026-08-12: The dApp approval round trips are driven end to end in the
  browser. A test page served by the harness speaks EIP-1193 to the real inpage
  provider through the real content script, background worker and approval popup
  for `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
  `eth_sendTransaction`. Every signature is recovered and compared against the
  active address, the transaction is checked against the bytes handed to the
  stubbed RPC, each rejection must reach the page as a rejection, and the
  password must appear in no message the approval window sends — the assertion
  that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
  floor. This does not discharge a real dApp with real funds against mainnet
  ([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
 - 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
  sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
  character that paints nothing removed (the format and default-ignorable
  characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
  zero-width space, a Hangul filler, a variation selector, a DELETE and a
  fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
  send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
  bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
  in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
  knowingly open and are asserted as open in the suite. No bundled symbol
  contains whitespace or a non-ASCII character, so nothing legitimate is newly
  filtered; the balance list's token-type gate also became case-insensitive,
  which no longer drops a real holding if an explorer writes `erc-20`
  ([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
 - 2026-08-12: A containerized Firefox end-to-end harness
  (`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
  build installed as a temporary add-on. Zero npm dependencies — a WebDriver
  client over `fetch` against geckodriver — with `node`, Firefox 153.0.3 and
  geckodriver 0.36.0 all pinned by digest. Uncaught errors are read from the
  privileged console service in Marionette's chrome context, because BiDi
  `log.entryAdded` reports nothing at all for extension pages; each drain reads
  and clears the console in one chrome round trip, so no error is destroyed
  unread by the drain itself, and errors logged during add-on install and
  background startup are folded into step 1 instead of being cleared. The two
  measured limits are documented rather than claimed away: the console ring
  buffer holds 250 messages (a clean run peaks at 4), and the drained window
  ends ≈1.5s after the last step returns. Demonstrated discriminating by exiting
  1 on a `throw` at the top of `src/background/index.js`, on a build with one
  import removed, on a `setTimeout` throw whose UI assertions all pass, on an
  unhandled `Promise.reject` and on an undefined identifier in `home.js`, and 0
  on the branch as it stands
  ([#184](https://git.eeqj.de/sneak/AutistMask/issues/184)).
 - 2026-08-12: The transaction a dApp asks for is now populated in the background
  before the approval window opens, so the object the user is shown is the
  object the signed artifact is verified against — nonce, gas limit and every
@@ -387,5 +279,9 @@ tracker.
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
  input validation) before any 1.0rc tag. Individual filed issues are parts of
  it, but the review is broader than any of them.
 - Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
  workflow. Extending the suite itself is tracked as
  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
  [#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
  land.
--- a/script/test-e2e
+++ b/script/test-e2e
@@ -7,29 +7,17 @@
 # caps make test at 20 seconds and a browser suite does not fit. Run it
 # yourself before touching popup views; it is the only check that can see
 # a used-but-not-imported identifier blow up at runtime.
 # .gitea/workflows/e2e.yml also runs it on every push, in a job separate
 # from check so that cap and the local fast path both stay intact.
 #
 # Docker is the only prerequisite. The repo reaches the container as a
 # build context and the extension is built inside it (see
 # tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
 # on the machine that starts the run. That is not a convenience: a bind
 # mount cannot work under Gitea Actions, and the runner image's node is too
 # old to install this repo's dependencies.
 set -eu
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
-
+#
-IIDFILE=""
+# The playwright-core devDependency is pinned to the matching Playwright
-
+# version (1.56.0) and the two must be bumped together: the browsers ship
-cleanup() {
+# inside this image, and playwright-core looks for the exact browser
-    if [ -n "$IIDFILE" ]; then
+# revision its own version expects. A mismatch fails at launch.
-        rm -f "$IIDFILE"
+IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
    fi
 }
 main() {
    cd "$ROOT"
@@ -39,23 +27,14 @@ main() {
        exit 1
    fi
-    IIDFILE="$(mktemp)"
+    echo "Building extension for e2e..."
-    trap cleanup EXIT
+    yarn run build 2>&1
    trap 'cleanup; exit 130' INT TERM
    echo "Building the Chrome e2e image (extension included)..."
    docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
    echo "Running e2e suite in the pinned Playwright container..."
    # The image is run by ID, not by tag: where two clones of this repo run
    # the suite at once, the other build can move the tag between this
    # build and this run, and the suite would then silently test the other
    # checkout.
    #
    # --ipc=host: Chromium's shared-memory needs more than the default
    #   64MB /dev/shm or renderers crash.
-    # HOME=/tmp: the image's root home is not a reliable place for the
+    # --user: keep files the suite touches owned by the caller, not root.
-    #   browser profile.
+    # HOME=/tmp: the mapped uid has no home directory in the image.
    # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
    #   ctx.route() intercepts page requests only, and every fetch made by
    #   the MV3 background service worker — including the phishing
@@ -72,10 +51,13 @@ main() {
    #   on a deliberate bump.
    docker run --rm \
        --ipc=host \
        --user "$(id -u):$(id -g)" \
        -e HOME=/tmp \
        -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
        -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$(cat "$IIDFILE")" \
+        -v "$ROOT:/work" \
        -w /work \
        "$IMAGE" \
        node tests/e2e/run.js
 }
--- a/script/test-e2e-firefox
+++ b/script/test-e2e-firefox
@@ -1,77 +0,0 @@
 #!/bin/sh
 # script/test-e2e-firefox: build the extension and drive the real popup in
 # a real Firefox inside a pinned container. The Firefox counterpart to
 # script/test-e2e. Our own extension to scripts-to-rule-them-all.
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
 # and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
 # on every push, in a job separate from check.
 #
 # Unlike script/test-e2e this builds its base image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
 # All three external artifacts are pinned by digest inside the Dockerfile;
 # see tests/e2e/firefox/Dockerfile, which also explains why the repo and
 # the extension build are baked into the image rather than mounted.
 #
 # Docker is the only prerequisite: nothing here depends on the node, yarn
 # or make on the machine that starts the run.
 set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
 IIDFILE=""
 cleanup() {
    if [ -n "$IIDFILE" ]; then
        rm -f "$IIDFILE"
    fi
 }
 main() {
    cd "$ROOT"
    if ! command -v docker >/dev/null 2>&1; then
        echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
        exit 1
    fi
    IIDFILE="$(mktemp)"
    trap cleanup EXIT
    trap 'cleanup; exit 130' INT TERM
    echo "Building the pinned Firefox e2e image (extension included)..."
    docker build --iidfile "$IIDFILE" -t "$IMAGE" \
        -f tests/e2e/firefox/Dockerfile .
    echo "Running the Firefox e2e suite..."
    # The image is run by ID, not by tag: where two clones of this repo run
    # the suite at once, the other build can move the tag between this
    # build and this run, and the suite would then silently test the other
    # checkout.
    #
    # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
    # --network none: the suite stubs nothing, so this is what keeps the
    #   run offline and deterministic. The extension swallows its own
    #   fetch failures, so the popup flows work unchanged; see the
    #   network note in README.md. Weaker than the Chrome suite's
    #   fixture interception, and honestly so — it proves no request
    #   escaped, but it cannot report which ones were attempted.
    # HOME=/tmp: the image's root home is not a reliable place for the
    #   browser profile.
    #
    # No --privileged. Firefox's sandbox logs
    # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
    # it is cosmetic and headless Firefox runs fine without it.
    docker run --rm \
        --shm-size=1g \
        --network none \
        -e HOME=/tmp \
        "$(cat "$IIDFILE")" \
        node tests/e2e/firefox/run.js dist/firefox
 }
 main "$@"
--- a/src/content/inpage.js
+++ b/src/content/inpage.js
@@ -11,39 +11,6 @@
    let nextId = 1;
    const pending = {};
    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
    // rather than properties bolted onto an Error because this object crosses
    // no boundary after construction — it is built in the page's own realm and
    // handed straight to the caller's catch — so the prototype survives and
    // `error.name` is a stable thing for a dApp to see.
    class ProviderRpcError extends Error {
        constructor(code, message, data) {
            super(message);
            this.name = "ProviderRpcError";
            this.code = code;
            if (data !== undefined) this.data = data;
        }
    }
    // Rebuild a boundary error as the error the page catches, carrying the
    // code (and data) the extension reported. Without this a dApp cannot tell
    // a user's refusal (4001) from a wallet that broke, and retries or shows
    // an error instead of accepting the refusal.
    //
    // Whatever code arrived is passed through verbatim rather than being
    // matched against a list: the extension emits 4001, 4100 and 4902 today,
    // and a code this file has never heard of is still the truth about what
    // happened. An error reported with no code at all stays a plain Error —
    // a ProviderRpcError whose `code` is undefined would advertise a
    // conformance it does not have. `message` is untouched in every case.
    function toPageError(error) {
        const message = (error && error.message) || "Request failed";
        if (error && error.code !== undefined && error.code !== null) {
            return new ProviderRpcError(error.code, message, error.data);
        }
        return new Error(message);
    }
    // Listen for responses from the content script
    window.addEventListener("message", function onUuid(event) {
        if (event.source !== window) return;
@@ -53,7 +20,7 @@
        if (!p) return;
        delete pending[id];
        if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
        } else {
            p.resolve(result);
        }
--- a/src/popup/index.js
+++ b/src/popup/index.js
@@ -9,17 +9,16 @@ const {
    $,
    showView,
    updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Renders a view the popup lands on without having navigated to it forward:
+// Views that can be fully re-rendered from persisted state. All others fall
-// on restore here, and on Back. Only the views that can be fully re-rendered
+// back to the nearest restorable parent; see the module for why the
-// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
+// secret-bearing views are absent.
-// through it; anything else falls back to the nearest restorable parent.
+const { RESTORABLE_VIEWS } = require("./restorableViews");
 const { renderView, makeBackRenderer } = require("./viewRouter");
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -109,23 +108,92 @@ const ctx = {
    },
 };
-// The view modules the router renders through, keyed as it expects them.
+function needsAddress(view) {
-const viewModules = {
+    return (
-    main: { show: () => fallbackView() },
+        view === "address" ||
-    addressDetail,
+        view === "address-token" ||
-    addressToken,
+        view === "receive" ||
-    receive,
+        view === "transaction"
-    settings,
+    );
-    settingsAddToken,
+}
-    confirmTx,
+
-    transactionDetail,
+function hasValidAddress() {
-    txStatus,
+    return (
-};
+        state.selectedWallet !== null &&
        state.selectedAddress !== null &&
        state.wallets[state.selectedWallet] &&
        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
    );
 }
 function restoreView() {
-    if (!renderView(state.currentView, state, viewModules)) {
+    const view = state.currentView;
    if (!view || !RESTORABLE_VIEWS.has(view)) {
        return fallbackView();
    }
    if (needsAddress(view) && !hasValidAddress()) {
        return fallbackView();
    }
    if (view === "address-token" && !state.selectedToken) {
        return fallbackView();
    }
    switch (view) {
        case "address":
            addressDetail.show();
            break;
        case "address-token":
            addressToken.show();
            break;
        case "receive":
            receive.show();
            break;
        case "settings":
            settings.show();
            break;
        case "settings-addtoken":
            settingsAddToken.show();
            break;
        case "confirm-tx":
            if (state.viewData && state.viewData.pendingTx) {
                confirmTx.restore();
            } else {
                fallbackView();
            }
            break;
        case "transaction":
            if (state.viewData && state.viewData.tx) {
                transactionDetail.render();
            } else {
                fallbackView();
            }
            break;
        case "wait-tx":
            // Resumes the receipt poll from the persisted broadcast time.
            if (!txStatus.restoreWait()) {
                fallbackView();
            }
            break;
        case "success-tx":
            if (state.viewData && state.viewData.hash) {
                txStatus.renderSuccess();
            } else {
                fallbackView();
            }
            break;
        case "error-tx":
            if (state.viewData && state.viewData.message) {
                txStatus.renderError();
            } else {
                fallbackView();
            }
            break;
        default:
            fallbackView();
            break;
    }
 }
 function fallbackView() {
@@ -179,7 +247,7 @@ async function init() {
        settings.show();
    });
-    setBackRenderer(makeBackRenderer(state, viewModules));
+    setRenderMain(renderWalletList);
    welcome.init(ctx);
    addWallet.init(ctx);
--- a/src/popup/viewRouter.js
+++ b/src/popup/viewRouter.js
@@ -1,167 +0,0 @@
 // Rendering a view the popup lands on without having navigated to it
 // forward: on restore, and on Back. In both cases the view may never have
 // been rendered in this page load — a reopened popup renders only the
 // wallet list and the view it restores onto, so every other view is still
 // the blank static template from index.html — so unhiding it is not enough.
 //
 // Forward navigation renders as it goes and must NOT come through here:
 // rendering a second time would re-fetch and clobber whatever the view has
 // in flight.
 //
 // The view modules are injected and nothing here touches the DOM, so the
 // dispatch and its data guards can be tested directly; src/popup/index.js
 // cannot be required outside a browser.
 const { RESTORABLE_VIEWS } = require("./restorableViews");
 // The views this page load has rendered.
 //
 // The Back path cannot otherwise tell its two cases apart. A view the popup
 // never rendered is still the blank template from index.html and has to be
 // rendered; a view already on the page must NOT be rendered again, because
 // a second render re-fetches and overwrites whatever the user has typed
 // into it and not yet saved.
 //
 // Registration is showView() in views/helpers.js, which is the last thing
 // every render path runs — restoreView()'s, the Back path's, and every
 // forward show(). That is the point of putting it there rather than in the
 // individual views: a view added later registers itself with no one having
 // to remember it, so this cannot decay.
 //
 // Module scope is page-load scope: the popup loads this module once per
 // page load, and a reopened popup gets a fresh, empty set — which is
 // exactly the state that makes the Back path render.
 const renderedViews = new Set();
 function markViewRendered(view) {
    if (view) renderedViews.add(view);
 }
 // Begin a fresh page-load scope. The popup gets one by being loaded; the
 // unit tests, which simulate several page loads against one module
 // instance, ask for one.
 function resetRenderedViews() {
    renderedViews.clear();
 }
 // Home is the exception: Back re-renders it every time, which is what the
 // popup did before this router existed (index.js registered
 // renderWalletList() as setRenderMain(), and goBack() called it on every
 // Back onto "main"). It must stay that way — the wallet list has to reflect
 // what changed while the user was away from it, such as a wallet renamed or
 // an address removed in Settings — and Home holds no unsaved input to lose.
 const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
 // Views that render an address the user picked and cannot be rendered
 // without one.
 const ADDRESS_VIEWS = new Set([
    "address",
    "address-token",
    "receive",
    "transaction",
 ]);
 function needsAddress(view) {
    return ADDRESS_VIEWS.has(view);
 }
 function hasValidAddress(state) {
    return Boolean(
        state.selectedWallet !== null &&
        state.selectedAddress !== null &&
        state.wallets[state.selectedWallet] &&
        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
    );
 }
 // Render `view` from persisted state. Each view module shows itself, so a
 // true return means the view is both rendered and on screen.
 //
 // Returns false when the view is not one the popup renders from state, or
 // when the state it would render is gone — a token no longer selected, a
 // transaction no longer persisted. The caller falls back rather than
 // putting an empty template on screen.
 function renderView(view, state, views) {
    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
    if (needsAddress(view) && !hasValidAddress(state)) return false;
    if (view === "address-token" && !state.selectedToken) return false;
    const data = state.viewData || {};
    switch (view) {
        case "main":
            views.main.show();
            return true;
        case "address":
            views.addressDetail.show();
            return true;
        case "address-token":
            views.addressToken.show();
            return true;
        case "receive":
            views.receive.show();
            return true;
        case "settings":
            views.settings.show();
            return true;
        case "settings-addtoken":
            views.settingsAddToken.show();
            return true;
        case "confirm-tx":
            if (!data.pendingTx) return false;
            views.confirmTx.restore();
            return true;
        case "transaction":
            if (!data.tx) return false;
            views.transactionDetail.render();
            return true;
        case "wait-tx":
            // Resumes the receipt poll from the persisted broadcast time,
            // and answers false when there is nothing resumable left.
            return Boolean(views.txStatus.restoreWait());
        case "success-tx":
            if (!data.hash) return false;
            views.txStatus.renderSuccess();
            return true;
        case "error-tx":
            if (!data.message) return false;
            views.txStatus.renderError();
            return true;
        default:
            return false;
    }
 }
 // The Back-path renderer, registered with setBackRenderer() in
 // views/helpers.js.
 //
 // Returns false — leaving goBack() to unhide the view, as it always did —
 // in the two cases where the view is known to be on the page already:
 //
 //   - It is not one the popup renders from persisted state. The restored
 //     stack is filtered against RESTORABLE_VIEWS, so such a view can only
 //     be on the stack from this page load, where forward navigation
 //     rendered it on the way in.
 //   - This page load has rendered it. Re-rendering would re-fetch and
 //     clobber what it holds; Home is rendered anyway, see above.
 //
 // What is left is the case the router exists for: a view on the stack that
 // this page load has never rendered, whose template is still blank.
 function makeBackRenderer(state, views) {
    return function renderBack(view) {
        if (!RESTORABLE_VIEWS.has(view)) return false;
        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
            return false;
        }
        if (!renderView(view, state, views)) {
            views.main.show();
        }
        return true;
    };
 }
 module.exports = {
    renderView,
    makeBackRenderer,
    markViewRendered,
    resetRenderedViews,
 };
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -7,7 +7,6 @@ const {
    getAddressValueUsd,
 } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { markViewRendered } = require("../viewRouter");
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -77,10 +76,6 @@ function showView(name) {
    }
    clearFlash();
    state.currentView = name;
    // A view's show() ends here, so this is where the Back path learns the
    // view is no longer the blank template from index.html and must not be
    // rendered a second time. See viewRouter.js.
    markViewRendered(name);
    saveState();
    updateDebugBanner(name);
 }
@@ -116,19 +111,12 @@ function updateDebugBanner(viewName) {
    }
 }
-// Callback that renders a view being navigated BACK onto. Set once by
+// Callback to re-render the main/home view when navigating back to it.
-// index.js via setBackRenderer(), which routes the view through the same
+// Set once by index.js via setRenderMain().
-// per-view render and data guards restoreView() uses.
+let _renderMain = null;
 //
 // It answers true when it took the navigation — the view is rendered and
 // shown, or its backing data was gone and it fell back — and false for a
 // view the popup does not render from persisted state. Those can only be
 // on the stack from this page load, because the stack is filtered on load,
 // so they have already been rendered and only need unhiding.
 let _renderBack = null;
-function setBackRenderer(fn) {
+function setRenderMain(fn) {
-    _renderBack = fn;
+    _renderMain = fn;
 }
 // Push the current view onto the navigation stack so goBack() can
@@ -148,11 +136,9 @@ function goBack() {
    } else {
        target = "main";
    }
-    // A popped view is landed on, not navigated to. If the popup has been
+    if (target === "main" && _renderMain) {
-    // closed and reopened since the view was pushed, nothing has ever
+        _renderMain();
-    // rendered it in this page load and its template is still blank, so it
+    }
    // has to be rendered here rather than merely unhidden.
    if (_renderBack && _renderBack(target)) return;
    showView(target);
 }
@@ -484,7 +470,7 @@ module.exports = {
    showView,
    onViewLeave,
    updateDebugBanner,
-    setBackRenderer,
+    setRenderMain,
    pushCurrentView,
    goBack,
    clearViewStack,
--- a/src/shared/balances.js
+++ b/src/shared/balances.js
@@ -66,12 +66,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
        const balances = [];
        for (const item of items) {
-            // Case-insensitive: the token type is an explorer's label, not a
+            if (item.token?.type !== "ERC-20") continue;
            // protocol value, and an exact comparison silently drops a real
            // holding if one ever writes "erc-20".  Which types are admitted
            // is unchanged.
            const type = String(item.token?.type || "").toUpperCase();
            if (type !== "ERC-20") continue;
            const decimals = parseInt(item.token.decimals || "18", 10);
            const bal = formatTokenBalance(item.value || "0", decimals);
            if (bal === "0.0") continue;
--- a/src/shared/symbolSpoof.js
+++ b/src/shared/symbolSpoof.js
@@ -8,23 +8,11 @@
 // either verdict alone, because the balance list is where the user forms
 // their belief about what they own (issue #235).
 //
-// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
+// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
-// that may bear it, or to null.  Null means the symbol belongs to the native
+// bear it, or to null.  Null means the symbol belongs to the native asset,
-// asset, which has no contract at all, so no contract may bear it and every
+// which has no contract at all, so no contract may bear it and every one
-// one that does is a spoof.  "ETH" is the only such entry today; the rule is
+// that does is a spoof.  "ETH" is the only such entry today; the rule is
 // written so that a second one needs no change here or at any call site.
 //
 // The value is a set because a ticker is not unique: seven symbols in the
 // bundled list belong to two real contracts each, and answering with one of
 // them hid the other one's holders' money (issue #276).  Membership, not
 // equality, is therefore the question — but it is the same question, asked of
 // a table that can now state the truth.  Every address in a set is one the
 // wallet ships as a real token; a contract outside the set is still a spoof.
 //
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
 // question is whether the symbol reaches the user's eye as a known one,
 // since that is what the user acts on.
 const { KNOWN_SYMBOLS } = require("./tokenList");
@@ -34,59 +22,6 @@ function normalizeAddress(addr) {
    return (addr || "").toLowerCase();
 }
 // Fold a symbol onto what a user actually sees, and no further:
 //
 //   NFKC        collapses compatibility variants that render as the ASCII
 //               letters they imitate — fullwidth ETH, styled mathematical
 //               letters — and maps the non-ASCII spaces onto U+0020.
 //   strip       drops what paints nothing: \p{Cf} plus
 //               \p{Default_Ignorable_Code_Point} plus U+007F.  That covers
 //               the format characters (zero-width space, joiner and
 //               non-joiner, word joiner, soft hyphen, byte-order mark, bidi
 //               marks and overrides), the variation selectors, the Hangul
 //               fillers, and DELETE.  Removed everywhere, not merely at the
 //               ends.
 //   trim        removes surrounding whitespace, which HTML collapses:
 //               `" ETH "` is painted next to the user's real ETH as `ETH`.
 //   toUpperCase makes the comparison case-insensitive, as before.
 //
 // The rule is "strip what paints nothing".  The Unicode classes are how
 // that is spelled, not what it means, which is why U+007F is named on its
 // own: it is a control rather than a default-ignorable character, so no
 // class here reaches it, yet it paints nothing all the same.  Measured in
 // the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
 // so an invisible prefix leaves 32.00px):
 //
 //   U+007F, U+3164, U+115F, U+FE0F, U+FE00   32.00px — invisible
 //   U+FFA0                                   40.00px — a box
 //   U+1160                                   48.00px — a box
 //   U+0001, U+0085, U+0090                   48.00px — a box
 //
 // U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
 // fallback nonetheless draws, and they are stripped anyway: erring toward
 // hiding a token that does not look like `ETH` is the harmless direction of
 // the two.  The other controls are left alone for the same reason read the
 // other way — a symbol carrying a visible box does not reach the eye as
 // `ETH`, so filtering it would hide a token the user could not have
 // confused with the native asset.
 //
 // Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
 // interior whitespace (`E T H` renders as `E T H`, so folding it would filter
 // a token nobody could confuse with the native asset), confusables that are
 // distinct letters rather than compatibility variants (Cyrillic capital Ie,
 // U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
 // bidi algorithm rather than a character filter, and the visible controls.
 //
 // This decides only how the question is asked.  Nothing here changes what a
 // surface displays; a token still shows the symbol it reports.
 function normalizeSymbol(symbol) {
    return String(symbol || "")
        .normalize("NFKC")
        .replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
        .trim()
        .toUpperCase();
 }
 // True when a token bearing `symbol` from contract `contractAddress` is
 // impersonating a known symbol.
 //
@@ -96,11 +31,11 @@ function normalizeSymbol(symbol) {
 function isSpoofedSymbol(symbol, contractAddress) {
    const contract = normalizeAddress(contractAddress);
    if (!contract) return false;
-    const sym = normalizeSymbol(symbol);
+    const sym = (symbol || "").toUpperCase();
    if (!KNOWN_SYMBOLS.has(sym)) return false;
    const legit = KNOWN_SYMBOLS.get(sym);
    if (legit === null) return true;
-    return !legit.has(contract);
+    return contract !== normalizeAddress(legit);
 }
 module.exports = {
--- a/src/shared/tokenList.js
+++ b/src/shared/tokenList.js
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
    TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
-// Build a map of symbol (uppercased) -> the set of contract addresses
+// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
-// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
+// Used for spoofed-symbol detection. "ETH" maps to null (native token).
 // "ETH" maps to null: the native asset has no contract, so no contract may
 // bear its symbol.
 //
 // The value is a set and not a single address because tickers are not unique
 // and the list above proves it: seven of these 512 tokens share a symbol with
 // another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
 // different real contracts each, all of them from the same source fetch.  A
 // one-address-per-symbol table can only answer that by picking a winner, and
 // the loser is then a token in our own bundled list that the spoof filter
 // hides from the balance list, the history and the send selector at its own
 // address, so the user cannot spend it (issue #276).  Naming every address
 // that bears the symbol is the only shape that says what is true; it does not
 // loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
    const upper = t.symbol.toUpperCase();
    if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, new Set());
+        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
    }
    const addresses = KNOWN_SYMBOLS.get(upper);
    // A null entry is the native asset and stays null: an ERC-20 that reports
    // the native symbol does not thereby become entitled to it.
    if (addresses !== null) {
        addresses.add(t.address.toLowerCase());
    }
 }
--- a/tests/backNavigation.test.js
+++ b/tests/backNavigation.test.js
@@ -1,329 +0,0 @@
 // Back after reopening the popup (#268).
 //
 // A reopened popup renders the wallet list and the one view it restores
 // onto; every other view is still the blank static template from
 // index.html. goBack() used to only unhide its target, so Back landed on
 // that blank template for any view the popup had not rendered in this page
 // load. These tests drive the real goBack() with the real router wired to
 // recording view modules, so what is asserted is which view render ran —
 // the thing that was missing.
 //
 // The rendering itself is asserted against the real popup in a real
 // browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
 // only needs showView() to work.
 const els = new Map();
 function fakeEl() {
    return {
        textContent: "",
        innerHTML: "",
        classList: {
            toggle() {},
            add() {},
            remove() {},
            contains: () => false,
        },
        remove() {},
    };
 }
 globalThis.document = {
    getElementById(id) {
        if (!els.has(id)) els.set(id, fakeEl());
        return els.get(id);
    },
 };
 // helpers.js pulls in state.js, which reads chrome.storage.local at load.
 globalThis.chrome = {
    storage: { local: { get: async () => ({}), set: async () => {} } },
 };
 const {
    showView,
    goBack,
    setBackRenderer,
    pushCurrentView,
 } = require("../src/popup/views/helpers");
 const {
    makeBackRenderer,
    markViewRendered,
    resetRenderedViews,
 } = require("../src/popup/viewRouter");
 const { state } = require("../src/shared/state");
 const ADDRESS = "0x1111111111111111111111111111111111111111";
 const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
 let calls;
 // Stand-ins for the view modules. Each records itself and then shows its
 // view, which is what every real view render ends with — so the assertions
 // can tell "rendered and shown" apart from "merely unhidden".
 function recorder(name, view) {
    return () => {
        calls.push(name);
        showView(view);
    };
 }
 function makeViews() {
    return {
        main: { show: recorder("main", "main") },
        addressDetail: { show: recorder("addressDetail", "address") },
        addressToken: { show: recorder("addressToken", "address-token") },
        receive: { show: recorder("receive", "receive") },
        settings: { show: recorder("settings", "settings") },
        settingsAddToken: {
            show: recorder("settingsAddToken", "settings-addtoken"),
        },
        confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
        transactionDetail: {
            render: recorder("transactionDetail", "transaction"),
        },
        txStatus: {
            restoreWait: () => {
                calls.push("waitTx");
                showView("wait-tx");
                return true;
            },
            renderSuccess: recorder("successTx", "success-tx"),
            renderError: recorder("errorTx", "error-tx"),
        },
    };
 }
 // The popup as it stands just after a reopen: one wallet with one address,
 // the view the popup restored onto, and the stack behind it.
 //
 // A reopen is a fresh page load, so the record of what has been rendered
 // starts empty — that emptiness is what makes the Back path render at all.
 // Returns the view modules so a test can drive forward navigation through
 // the same recorders the router renders through.
 function reopenedOn(view, stack, extra) {
    calls = [];
    resetRenderedViews();
    state.wallets = [
        {
            name: "Wallet 1",
            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
        },
    ];
    state.selectedWallet = 0;
    state.selectedAddress = 0;
    state.selectedToken = null;
    state.viewData = null;
    state.currentView = view;
    state.viewStack = stack.slice();
    Object.assign(state, extra || {});
    // Restoring onto a view renders it, so the reopened popup has that one
    // view on the page and nothing else.
    markViewRendered(view);
    const views = makeViews();
    setBackRenderer(makeBackRenderer(state, views));
    return views;
 }
 // The reproduction from the issue, step for step.
 describe("Back onto a view the reopened popup never rendered", () => {
    test("Back from settings renders the address detail underneath", () => {
        reopenedOn("settings", ["main", "address"]);
        goBack();
        expect(calls).toEqual(["addressDetail"]);
        expect(state.currentView).toBe("address");
        expect(state.viewStack).toEqual(["main"]);
    });
    test("Back onto the token detail renders it", () => {
        reopenedOn("settings", ["main", "address", "address-token"], {
            selectedToken: TOKEN,
        });
        goBack();
        expect(calls).toEqual(["addressToken"]);
        expect(state.currentView).toBe("address-token");
    });
    test("Back onto Receive renders it", () => {
        reopenedOn("settings", ["main", "address", "receive"]);
        goBack();
        expect(calls).toEqual(["receive"]);
        expect(state.currentView).toBe("receive");
    });
    test("Back onto the transaction detail renders it", () => {
        reopenedOn("settings", ["main", "transaction"], {
            viewData: { tx: { hash: "0xdead" } },
        });
        goBack();
        expect(calls).toEqual(["transactionDetail"]);
        expect(state.currentView).toBe("transaction");
    });
    test("Back onto the transaction confirmation restores it", () => {
        reopenedOn("settings", ["main", "confirm-tx"], {
            viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
        });
        goBack();
        expect(calls).toEqual(["confirmTx"]);
        expect(state.currentView).toBe("confirm-tx");
    });
    test("Back onto the success screen renders it", () => {
        reopenedOn("settings", ["main", "success-tx"], {
            viewData: { hash: "0xdead" },
        });
        goBack();
        expect(calls).toEqual(["successTx"]);
        expect(state.currentView).toBe("success-tx");
    });
    test("Back onto the failure screen renders it", () => {
        reopenedOn("settings", ["main", "error-tx"], {
            viewData: { message: "execution reverted" },
        });
        goBack();
        expect(calls).toEqual(["errorTx"]);
        expect(state.currentView).toBe("error-tx");
    });
    test("Back onto Home renders the wallet list", () => {
        reopenedOn("settings", ["main"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("Back with an empty stack renders Home", () => {
        reopenedOn("settings", []);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
 // The guards are restoreView()'s, so a popped view whose backing data is
 // gone lands on Home rather than on an empty template.
 describe("Back onto a view whose backing data is gone", () => {
    test("the token detail with no token selected falls back to Home", () => {
        reopenedOn("settings", ["main", "address-token"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the transaction detail with no transaction falls back to Home", () => {
        reopenedOn("settings", ["main", "transaction"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the confirmation with no pending transaction falls back to Home", () => {
        reopenedOn("settings", ["main", "confirm-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("an address view with no address selected falls back to Home", () => {
        reopenedOn("settings", ["main", "receive"], {
            selectedAddress: null,
        });
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the success screen with no transaction hash falls back to Home", () => {
        reopenedOn("settings", ["main", "success-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("the failure screen with no message falls back to Home", () => {
        reopenedOn("settings", ["main", "error-tx"]);
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
    test("a wait that can no longer be resumed falls back to Home", () => {
        reopenedOn("settings", ["main", "wait-tx"]);
        const views = makeViews();
        views.txStatus.restoreWait = () => false;
        setBackRenderer(makeBackRenderer(state, views));
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
 // Forward navigation renders as it goes, and a second render would re-fetch
 // and clobber whatever the view holds — an unsaved edit, a request in
 // flight. So the Back path renders only a view this page load has never
 // rendered, and merely unhides every other one: the views it does not
 // render from persisted state, and the views already on the page.
 describe("what the Back path leaves alone", () => {
    test("forward navigation renders nothing by itself", () => {
        reopenedOn("address", ["main"]);
        pushCurrentView();
        showView("send");
        expect(calls).toEqual([]);
        expect(state.viewStack).toEqual(["main", "address"]);
    });
    test("Back onto a live-session view only unhides it", () => {
        reopenedOn("confirm-tx", ["main", "address", "send"]);
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("send");
    });
    test("Back renders its target exactly once", () => {
        reopenedOn("settings", ["main", "address"]);
        goBack();
        expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
    });
    test("Back onto a view this page load already rendered only unhides it", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.addressDetail.show();
        pushCurrentView();
        views.settings.show();
        calls = [];
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("address");
    });
    // The unit mirror of the regression the browser suite pins: Settings
    // reassigns its fields from persisted state on every render, so a
    // re-render on the way back discards an edit the user has not saved.
    test("Back onto Settings visited earlier in this page load does not re-render it", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.settings.show();
        pushCurrentView();
        views.settingsAddToken.show();
        calls = [];
        goBack();
        expect(calls).toEqual([]);
        expect(state.currentView).toBe("settings");
    });
    // Home is the deliberate exception, unchanged from the popup's
    // behaviour before the router existed: it re-renders on every Back so
    // the wallet list reflects what changed while the user was away.
    test("Back onto Home renders it again even when it is already on the page", () => {
        const views = reopenedOn("main", []);
        pushCurrentView();
        views.addressDetail.show();
        calls = [];
        goBack();
        expect(calls).toEqual(["main"]);
        expect(state.currentView).toBe("main");
    });
 });
--- a/tests/e2e/Dockerfile
+++ b/tests/e2e/Dockerfile
@@ -1,34 +0,0 @@
 # Chrome end-to-end image: the pinned Playwright image with this repo and a
 # freshly built extension inside it, built by script/test-e2e. The suite is
 # still started with `docker run`, so every runtime flag the harness needs
 # (--ipc=host in particular) applies as before.
 #
 # The repo is baked in rather than bind-mounted because a bind mount does
 # not resolve under Gitea Actions: the runner runs the job in a container
 # against the HOST's docker socket, so the source side of a -v is resolved
 # by the host daemon while the job's checkout lives on a docker volume that
 # is not a host path -- the mount silently succeeds and /work is empty. A
 # build context is streamed to the daemon and so works from anywhere.
 # Building the extension here too means the machine starting a run needs
 # docker and nothing else.
 # mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
 #
 # The playwright-core devDependency is pinned to the matching Playwright
 # version (1.56.0) and the two must be bumped together: the browsers ship
 # inside this image, and playwright-core looks for the exact browser
 # revision its own version expects. A mismatch fails at launch.
 FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
 WORKDIR /work
 # Same layering as the root Dockerfile: script/bootstrap installs the
 # prerequisites and the dependencies, and the manifests are copied first so
 # that layer is cached until they change.
 COPY script/ script/
 COPY package.json yarn.lock ./
 RUN script/bootstrap
 COPY . .
 RUN make build
--- a/tests/e2e/firefox/Dockerfile
+++ b/tests/e2e/firefox/Dockerfile
@@ -1,77 +0,0 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
 # with this repo and a freshly built extension inside it, built by
 # script/test-e2e-firefox. The harness itself has no dependencies, so
 # nothing is installed for it.
 #
 # The build context is the repo root. The repo is baked in rather than
 # bind-mounted because a bind mount does not resolve under Gitea Actions:
 # the runner runs the job in a container against the HOST's docker socket,
 # so the source side of a -v is resolved by the host daemon while the job's
 # checkout lives on a docker volume that is not a host path -- the mount
 # silently succeeds and /work is empty. Baking the build in is also the
 # only way this suite can have both a built extension and the
 # `--network none` it runs under, since a container with no network cannot
 # install anything.
 #
 # All three external artifacts are pinned by digest, and are fetched in
 # layers above the repo copy, so editing the harness or any source file
 # re-runs only the two cheap layers at the bottom. The Firefox version in
 # particular must not float: -remote-allow-system-access is mandatory on
 # 153 and was not on 142, so the flag the harness passes is
 # version-coupled.
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
 ENV DEBIAN_FRONTEND=noninteractive
 # Firefox's shared-library dependencies on a slim base, plus the two tools
 # needed to fetch and unpack the pinned tarballs.
 RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        libasound2 \
        libdbus-glib-1-2 \
        libgtk-3-0 \
        libx11-xcb1 \
        libxt6 \
        libxtst6 \
        xz-utils \
    && rm -rf /var/lib/apt/lists/*
 # Firefox 153.0.3, linux-x86_64, en-US
 ARG FIREFOX_URL=https://ftp.mozilla.org/pub/firefox/releases/153.0.3/linux-x86_64/en-US/firefox-153.0.3.tar.xz
 ARG FIREFOX_SHA256=22b312280900bfb174b685ece32c7b3c6d72e7f8e53d6d30f21ac41a8dc500a2
 RUN curl -fsSL -o /tmp/firefox.tar.xz "$FIREFOX_URL" \
    && echo "$FIREFOX_SHA256  /tmp/firefox.tar.xz" | sha256sum -c - \
    && tar -xJf /tmp/firefox.tar.xz -C /opt \
    && rm /tmp/firefox.tar.xz \
    && /opt/firefox/firefox --version
 # geckodriver v0.36.0, linux64
 ARG GECKODRIVER_URL=https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
 ARG GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
 RUN curl -fsSL -o /tmp/geckodriver.tar.gz "$GECKODRIVER_URL" \
    && echo "$GECKODRIVER_SHA256  /tmp/geckodriver.tar.gz" | sha256sum -c - \
    && tar -xzf /tmp/geckodriver.tar.gz -C /usr/local/bin \
    && rm /tmp/geckodriver.tar.gz \
    && geckodriver --version
 ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 WORKDIR /work
 # Same layering as the root Dockerfile: script/bootstrap installs the
 # prerequisites and the dependencies, and the manifests are copied first so
 # that layer is cached until they change.
 COPY script/ script/
 COPY package.json yarn.lock ./
 RUN script/bootstrap
 COPY . .
 RUN make build
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]
--- a/tests/e2e/firefox/driver.js
+++ b/tests/e2e/firefox/driver.js
@@ -1,464 +0,0 @@
 // A minimal WebDriver client for geckodriver, plus the privileged console
 // reader the error assertions are built on. No npm dependencies: global
 // fetch and child_process against geckodriver's HTTP API is less code than
 // a driver library and keeps the harness at zero packages.
 //
 // Run through script/test-e2e-firefox, which builds dist/firefox/ and the
 // pinned container around this. FIREFOX_BIN and GECKODRIVER locate the two
 // binaries; the image sets both.
 "use strict";
 const { spawn } = require("child_process");
 const net = require("net");
 const FIREFOX_BIN = process.env.FIREFOX_BIN || "firefox";
 const GECKODRIVER = process.env.GECKODRIVER || "geckodriver";
 // The extension id declared in manifest/firefox.json, and the uuid the
 // popup is served from. Firefox normally assigns that uuid randomly per
 // profile, which would make the popup URL undiscoverable without querying
 // privileged state; setting extensions.webextensions.uuids before launch
 // pins it instead. This only works because the manifest declares a fixed
 // browser_specific_settings.gecko.id — without one the mapping has no key.
 const EXTENSION_ID = "autistmask@sneak.berlin";
 const EXTENSION_UUID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
 const EXTENSION_ORIGIN = "moz-extension://" + EXTENSION_UUID;
 // The W3C web element identifier. Getting the last character wrong yields
 // an element reference of "undefined" and a bewildering "element with the
 // reference undefined is not known" from geckodriver, so findElement()
 // below checks for the key rather than indexing blindly.
 const WEB_ELEMENT_KEY = "element-6066-11e4-a52e-4f735466cecf";
 const SCRIPT_TIMEOUT_MS = 120000;
 const DEFAULT_WAIT_MS = 20000;
 const POLL_INTERVAL_MS = 100;
 function sleep(ms) {
    return new Promise((resolve) => setTimeout(resolve, ms));
 }
 // An ephemeral port picked by the kernel, then handed to geckodriver.
 // There is a race between closing this listener and geckodriver binding,
 // but this host runs many sessions at once and a fixed 4444 is a
 // guaranteed collision rather than a possible one.
 function freePort() {
    return new Promise((resolve, reject) => {
        const srv = net.createServer();
        srv.on("error", reject);
        srv.listen(0, "127.0.0.1", () => {
            const { port } = srv.address();
            srv.close(() => resolve(port));
        });
    });
 }
 class WebDriverError extends Error {
    constructor(command, body) {
        const v = (body && body.value) || {};
        super(
            command +
                " failed: " +
                (v.error || "unknown error") +
                ": " +
                (v.message || JSON.stringify(body)),
        );
        this.name = "WebDriverError";
        this.error = v.error;
    }
 }
 class Driver {
    constructor(proc, base) {
        this.proc = proc;
        this.base = base;
        this.sessionId = null;
        this.context = "content";
    }
    async send(method, path, body) {
        const url = this.base + path;
        const res = await fetch(url, {
            method,
            headers: { "Content-Type": "application/json" },
            body: body === undefined ? undefined : JSON.stringify(body),
        });
        const text = await res.text();
        let parsed;
        try {
            parsed = JSON.parse(text);
        } catch (_) {
            throw new Error(
                method + " " + path + ": non-JSON response: " + text,
            );
        }
        if (!res.ok) throw new WebDriverError(method + " " + path, parsed);
        return parsed.value;
    }
    session(method, path, body) {
        return this.send(method, "/session/" + this.sessionId + path, body);
    }
    // ------------------------------------------------------------ setup
    async newSession() {
        const prefs = {
            // See EXTENSION_UUID above. The pref is a string pref whose
            // value is itself JSON.
            "extensions.webextensions.uuids": JSON.stringify({
                [EXTENSION_ID]: EXTENSION_UUID,
            }),
        };
        const value = await this.send("POST", "/session", {
            capabilities: {
                alwaysMatch: {
                    browserName: "firefox",
                    "moz:firefoxOptions": {
                        binary: FIREFOX_BIN,
                        args: [
                            "-headless",
                            // Mandatory on Firefox 153: without it,
                            // navigating to moz-extension:// and running
                            // chrome-context script both fail with
                            // "unsupported operation".
                            //
                            // It grants the driver FULL CHROME PRIVILEGES
                            // over this browser. Acceptable only because
                            // the browser is a throwaway in a CI
                            // container; never point a session with this
                            // flag at anything you care about.
                            "-remote-allow-system-access",
                        ],
                        prefs,
                    },
                },
            },
        });
        this.sessionId = value.sessionId;
        await this.session("POST", "/timeouts", { script: SCRIPT_TIMEOUT_MS });
        return value;
    }
    // Installs the unpacked MV2 build straight from a directory.
    // temporary:true bypasses signature checks, so no XPI and no signing
    // are involved, and the add-on dies with the profile.
    async installAddon(dir) {
        return this.session("POST", "/moz/addon/install", {
            path: dir,
            temporary: true,
        });
    }
    // Classic navigation on purpose. BiDi's browsingContext.navigate
    // refuses moz-extension:// URLs outright.
    async navigate(url) {
        await this.session("POST", "/url", { url });
    }
    async quit() {
        if (this.sessionId) {
            await this.session("DELETE", "").catch(() => {});
            this.sessionId = null;
        }
        this.proc.kill("SIGTERM");
    }
    // ---------------------------------------------------------- scripts
    async setContext(context) {
        if (this.context === context) return;
        await this.session("POST", "/moz/context", { context });
        this.context = context;
    }
    async execute(script, args = []) {
        await this.setContext("content");
        return this.session("POST", "/execute/sync", { script, args });
    }
    // Runs in the privileged chrome scope, where Services and Ci exist.
    async executeChrome(script, args = []) {
        await this.setContext("chrome");
        try {
            return await this.session("POST", "/execute/sync", {
                script,
                args,
            });
        } finally {
            await this.setContext("content");
        }
    }
    // ------------------------------------------------------- page waits
    // Polls a content-context expression until it returns truthy. Every
    // wait in the suite goes through here so a timeout always says which
    // condition it was waiting on rather than "timed out".
    async waitFor(what, script, args = [], timeout = DEFAULT_WAIT_MS) {
        const deadline = Date.now() + timeout;
        let last = null;
        for (;;) {
            try {
                const v = await this.execute(script, args);
                if (v) return v;
                last = null;
            } catch (e) {
                // A navigation or view swap in flight makes execute
                // throw; that is a not-yet, not a failure, until the
                // deadline says otherwise.
                last = e.message;
            }
            if (Date.now() >= deadline) {
                throw new Error(
                    "timed out after " +
                        timeout +
                        "ms waiting for " +
                        what +
                        (last ? " (last error: " + last + ")" : ""),
                );
            }
            await sleep(POLL_INTERVAL_MS);
        }
    }
    // Shown means shown: in the popup a view is switched by toggling a
    // "hidden" class, and an element that is present but collapsed is not
    // the thing a test means by visible.
    async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
        return this.waitFor(
            "selector " + selector + " to be visible",
            `const el = document.querySelector(arguments[0]);
             if (!el) return false;
             const r = el.getBoundingClientRect();
             return r.width > 0 && r.height > 0;`,
            [selector],
            timeout,
        );
    }
    async isVisible(selector) {
        return this.execute(
            `const el = document.querySelector(arguments[0]);
             if (!el) return false;
             const r = el.getBoundingClientRect();
             return r.width > 0 && r.height > 0;`,
            [selector],
        );
    }
    async count(selector) {
        return this.execute(
            "return document.querySelectorAll(arguments[0]).length;",
            [selector],
        );
    }
    async text(selector) {
        return this.execute(
            `const el = document.querySelector(arguments[0]);
             return el ? el.textContent : null;`,
            [selector],
        );
    }
    async title() {
        return this.session("GET", "/title");
    }
    // The id of the view element currently on top, which is what a
    // failing step needs to report: "the screen did not change" is only
    // useful if it says which screen it stayed on.
    async currentView() {
        return this.execute(
            `const views = document.querySelectorAll('[id^="view-"]');
             for (const v of views) {
                 const r = v.getBoundingClientRect();
                 if (r.width > 0 && r.height > 0) return v.id;
             }
             return null;`,
        );
    }
    // ----------------------------------------------------- interactions
    async findElement(selector) {
        const value = await this.session("POST", "/element", {
            using: "css selector",
            value: selector,
        });
        const ref = value && value[WEB_ELEMENT_KEY];
        if (typeof ref !== "string") {
            throw new Error(
                "no " +
                    WEB_ELEMENT_KEY +
                    " in the element response for " +
                    selector +
                    ": " +
                    JSON.stringify(value),
            );
        }
        return ref;
    }
    // Real WebDriver clicks and real key events rather than in-page
    // .click() and value assignment: the popup's handlers are wired to
    // events, and synthesising them from inside the page would test the
    // harness's idea of the UI instead of the UI.
    async click(selector) {
        await this.waitVisible(selector);
        const id = await this.findElement(selector);
        await this.session("POST", "/element/" + id + "/click", {});
    }
    async fill(selector, value) {
        await this.waitVisible(selector);
        const id = await this.findElement(selector);
        await this.session("POST", "/element/" + id + "/clear", {});
        await this.session("POST", "/element/" + id + "/value", {
            text: String(value),
        });
    }
    async value(selector) {
        return this.execute(
            `const el = document.querySelector(arguments[0]);
             return el ? el.value : null;`,
            [selector],
        );
    }
 }
 // ------------------------------------------------------- error capture
 // Uncaught errors from extension code, read out of the privileged console
 // service.
 //
 // This is not the obvious mechanism, and the obvious one does not work:
 // WebDriver BiDi's log.entryAdded delivers NOTHING for extension pages.
 // Verified on Firefox 142 and 153 against a same-session control — a plain
 // http:// page yields uncaught errors with stack traces, the
 // moz-extension:// popup yields zero events, because the remote agent
 // excludes extension browsing contexts from BiDi observation. A harness
 // built on Playwright-BiDi or Puppeteer-BiDi therefore sees nothing and
 // reports success. Do not "simplify" this back to BiDi.
 //
 // nsIConsoleService is not per-page: it also carries errors from the
 // background page, which BiDi would not have covered even if it worked.
 // Background-page capture is verified by probe — a throw at the top of
 // src/background/index.js, which kills the background page outright, fails
 // the run. Content-script errors should arrive by the same route, but that
 // is UNVERIFIED here and must not be claimed: the container runs with
 // --network none, so there is no http:// page for a content script to be
 // injected into and this suite never exercises one.
 //
 // Warnings are excluded so the semantics match Playwright's pageerror:
 // uncaught errors only.
 //
 // The read and the clear are ONE chrome script on purpose. Splitting them
 // into two round trips leaves a blind window between them in which an
 // error is logged into a buffer that is about to be discarded, and is
 // destroyed unread rather than deferred to the next drain. That was not
 // theoretical: with a separate reset() call, a probe of 100 sequenced
 // throws at 20ms spacing lost one of them outright.
 const DRAIN_ERRORS_SCRIPT = `
    const origin = arguments[0];
    const out = [];
    for (const raw of Services.console.getMessageArray() || []) {
        let e;
        try {
            e = raw.QueryInterface(Ci.nsIScriptError);
        } catch (_) {
            continue;
        }
        if (e.flags & Ci.nsIScriptError.warningFlag) continue;
        const src = e.sourceName || "";
        if (!src.startsWith(origin)) continue;
        out.push({
            msg: e.errorMessage,
            src: src,
            line: e.lineNumber,
            cat: e.category,
        });
    }
    Services.console.reset();
    return out;
 `;
 class ConsoleErrors {
    constructor(driver, originPrefix) {
        this.driver = driver;
        this.originPrefix = originPrefix;
    }
    // Everything logged since the last take, read and cleared atomically
    // in a single chrome round trip. Poll-based, so an error is attributed
    // to the step that was running when it was drained, not to the moment
    // inside that step at which it happened — see the limitation note in
    // run.js. An error that arrives mid-drain is not lost — it makes this
    // batch or the next one — but the console service ring buffer holds
    // only 250 messages, so more than that between two takes evicts the
    // oldest unread. A clean run peaks at 4.
    async take() {
        const found = await this.driver.executeChrome(DRAIN_ERRORS_SCRIPT, [
            this.originPrefix,
        ]);
        return found || [];
    }
 }
 // ------------------------------------------------------------- startup
 async function waitForDriverReady(base, timeoutMs) {
    const deadline = Date.now() + timeoutMs;
    for (;;) {
        try {
            const res = await fetch(base + "/status");
            if (res.ok) {
                const body = await res.json();
                if (body && body.value && body.value.ready !== false) return;
            }
        } catch (_) {
            // not listening yet
        }
        if (Date.now() >= deadline) {
            throw new Error(
                "geckodriver did not become ready within " + timeoutMs + "ms",
            );
        }
        await sleep(POLL_INTERVAL_MS);
    }
 }
 async function start() {
    const port = await freePort();
    const proc = spawn(
        GECKODRIVER,
        ["--port", String(port), "--host", "127.0.0.1"],
        { stdio: ["ignore", "inherit", "inherit"] },
    );
    proc.on("error", (e) => {
        console.error("geckodriver failed to spawn: " + e.message);
    });
    const base = "http://127.0.0.1:" + port;
    try {
        await waitForDriverReady(base, 30000);
    } catch (e) {
        proc.kill("SIGKILL");
        throw e;
    }
    return new Driver(proc, base);
 }
 module.exports = {
    ConsoleErrors,
    Driver,
    EXTENSION_ID,
    EXTENSION_ORIGIN,
    EXTENSION_UUID,
    start,
    sleep,
 };
--- a/tests/e2e/firefox/run.js
+++ b/tests/e2e/firefox/run.js
@@ -1,288 +0,0 @@
 // Firefox end-to-end suite: drives the real popup in a real Firefox with
 // the unpacked MV2 build installed as a temporary add-on, and fails the run
 // on any uncaught error coming from an extension source.
 //
 // Run via script/test-e2e-firefox, which builds dist/firefox/ and the pinned
 // container. The extension directory is the one argument.
 //
 //   node tests/e2e/firefox/run.js [dist/firefox]
 //
 // Deliberately not part of script/check, and deliberately not named
 // *.test.js: REPO_POLICIES.md caps make test at 20 seconds and a browser
 // suite does not fit.
 //
 // This shares no driver layer with the Chrome suite in tests/e2e/, and the
 // UI steps below are written twice on purpose. Chrome runs on Playwright,
 // which cannot see extension-page errors in Firefox at all (see the BiDi
 // note in driver.js), so the two backends have no common substrate to
 // abstract over. Three duplicated steps do not pay for a shim; revisit if
 // this suite grows to where they do.
 //
 // LIMITATION, and the difference from the Chrome suite worth knowing: error
 // capture here is POLL-BASED, not event-streamed. The console service is
 // drained at each step boundary, so an error is attributed to the step it
 // was drained after, never to a moment within that step. What is drained
 // covers the whole run from add-on install to the last drain below, which
 // lands ~1.5s after the last step returns (500ms settle + 1000ms sleep +
 // two drain round trips). That cut-off jitters run to run: three runs of
 // throws at fixed offsets reported everything to +1.5s and one of them
 // also +1.6s, and past it the browser is torn down first. Inside the
 // window there is no race — the drain reads and clears in one chrome
 // round trip — but there is a capacity limit: nsIConsoleService keeps
 // only the newest 250 messages, so 400 throws in one step report as
 // exactly 250. A clean run peaks at 4 of 250, so that is headroom today
 // and not a guarantee for a step that logs heavily. The Chrome harness
 // receives pageerror events as they happen and can say more. Do not read
 // a green Firefox run as the same claim.
 "use strict";
 const fs = require("fs");
 const path = require("path");
 const { ConsoleErrors, EXTENSION_ORIGIN, start, sleep } = require("./driver");
 const REPO_ROOT = path.resolve(__dirname, "..", "..", "..");
 const POPUP_URL = EXTENSION_ORIGIN + "/src/popup/index.html";
 const PASSWORD = "e2e-harness-password";
 // Firefox installs the add-on and starts its background page asynchronously
 // after the install call returns. Nothing observable marks the end of that,
 // so the popup's own first render is the signal we wait on instead.
 const STEP_TIMEOUT_MS = 120000;
 const steps = [];
 function step(name, fn) {
    steps.push({ name, fn });
 }
 function assert(cond, message) {
    if (!cond) throw new Error(message);
 }
 function withTimeout(promise, name) {
    let timer;
    const timeout = new Promise((_, reject) => {
        timer = setTimeout(
            () =>
                reject(
                    new Error(
                        name + " timed out after " + STEP_TIMEOUT_MS + "ms",
                    ),
                ),
            STEP_TIMEOUT_MS,
        );
    });
    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
 // ------------------------------------------------------------- steps
 step("popup loads and reaches the welcome view", async (env) => {
    const d = env.driver;
    await d.navigate(POPUP_URL);
    await d.waitVisible("#view-welcome", STEP_TIMEOUT_MS);
    const title = await d.title();
    assert(title === "AutistMask", "unexpected popup title: " + title);
 });
 step("wallet creation through the UI reaches the main view", async (env) => {
    const d = env.driver;
    await d.click("#btn-welcome-add");
    await d.waitVisible("#view-add-wallet");
    await d.click("#btn-generate-phrase");
    await d.waitFor(
        "a generated recovery phrase of at least 12 words",
        `const el = document.getElementById("wallet-mnemonic");
         return !!el && el.value.trim().split(/\\s+/).length >= 12;`,
    );
    env.phrase = (await d.value("#wallet-mnemonic")).trim();
    await d.fill("#add-wallet-password", PASSWORD);
    await d.fill("#add-wallet-password-confirm", PASSWORD);
    await d.click("#btn-add-wallet-confirm");
    // Argon2id under libsodium, for real, so this is the slow one.
    await d.waitVisible("#view-main", STEP_TIMEOUT_MS);
    assert(
        env.phrase.split(/\s+/).length >= 12,
        "wallet creation did not yield a recovery phrase",
    );
    const addrs = await d.count("#wallet-list .btn-addr-info");
    assert(addrs > 0, "no addresses rendered in the wallet list");
 });
 step("add token screen opens from address detail", async (env) => {
    const d = env.driver;
    if (!(await d.isVisible("#view-address"))) {
        await d.waitVisible("#view-main");
        await d.click("#wallet-list .btn-addr-info");
    }
    await d.waitVisible("#view-address");
    await d.click("#btn-add-token");
    // Reported with the view it actually stayed on: a screen that does
    // not change is the symptom a missing import produces, and naming
    // the screen is what makes that diagnosable.
    try {
        await d.waitVisible("#view-add-token");
    } catch (e) {
        throw new Error(
            e.message + "; current view is " + (await d.currentView()),
        );
    }
    const picks = await d.count("#common-token-list .common-token");
    assert(picks > 0, "no common-token quick-pick buttons rendered");
 });
 // ------------------------------------------------------------- runner
 function formatError(e) {
    return (
        e.msg + " (" + e.src + ":" + e.line + (e.cat ? ", " + e.cat : "") + ")"
    );
 }
 async function main() {
    // A suite that runs nothing must never report success.
    if (steps.length === 0) {
        console.log("1..0");
        console.log("# FAILED: the Firefox e2e suite registered no steps");
        process.exitCode = 1;
        return;
    }
    const extDir = path.resolve(REPO_ROOT, process.argv[2] || "dist/firefox");
    if (!fs.existsSync(path.join(extDir, "manifest.json"))) {
        console.error(
            "e2e-firefox: no unpacked build at " +
                extDir +
                " — run make build first",
        );
        process.exitCode = 1;
        return;
    }
    let driver;
    try {
        driver = await start();
        await driver.newSession();
        await driver.installAddon(extDir);
    } catch (e) {
        // A browser we cannot start is a failure of the suite, not an
        // absent suite. Never skip and report success.
        console.error("e2e-firefox: cannot run the suite: " + e.message);
        if (driver) await driver.quit().catch(() => {});
        process.exitCode = 1;
        return;
    }
    const errors = new ConsoleErrors(driver, EXTENSION_ORIGIN);
    const env = { driver, phrase: null };
    console.log("# extension origin: " + EXTENSION_ORIGIN);
    console.log("1.." + steps.length);
    let failed = 0;
    let n = 0;
    try {
        // Drain, never reset: anything the add-on logged while installing
        // and starting its background page has no earlier step to belong
        // to, so it is folded into step 1 below. Services.console.reset()
        // here would DELETE it instead, and a background page that throws
        // at the top of the file — a dead background page — would then
        // produce a fully green run.
        let installErrors = [];
        let installFailure = null;
        try {
            installErrors = await errors.take();
        } catch (e) {
            installFailure =
                "could not read the console after install: " + e.message;
        }
        for (const s of steps) {
            n += 1;
            let failure = null;
            try {
                await withTimeout(s.fn(env), s.name);
            } catch (e) {
                failure = e.message;
            }
            // Let anything the step provoked reach the console service
            // before draining it. Without this a failure logged on the
            // way out of the step lands in the next step's drain, which
            // still fails the run but blames the wrong step.
            await sleep(500);
            let found = [];
            try {
                found = await errors.take();
            } catch (e) {
                failure = failure || "could not read the console: " + e.message;
            }
            if (n === 1) {
                found = installErrors.concat(found);
                installErrors = [];
                failure = failure || installFailure;
                installFailure = null;
            }
            // Any uncaught error from an extension source fails the step
            // that provoked it, whether or not its assertions passed.
            if (!failure && found.length > 0) {
                failure =
                    n === 1
                        ? "uncaught extension errors during add-on install, " +
                          "background startup or this step"
                        : "uncaught extension errors during this step";
            }
            if (failure) {
                failed += 1;
                console.log("not ok " + n + " - " + s.name);
                console.log("  " + failure);
                for (const e of found) console.log("  " + formatError(e));
            } else {
                console.log("ok " + n + " - " + s.name);
            }
        }
        // The tail: errors logged after the last step returned cannot be
        // blamed on any one step, but they are still reported and they
        // still fail the run.
        await sleep(1000);
        const trailing = await errors.take();
        console.log(
            "# " +
                (steps.length - failed) +
                "/" +
                steps.length +
                " steps passed",
        );
        if (trailing.length > 0) {
            console.log(
                "# " +
                    trailing.length +
                    " extension error(s) recorded after the last step, not " +
                    "attributable to any single step:",
            );
            for (const e of trailing) console.log("#   " + formatError(e));
        }
        if (failed > 0 || trailing.length > 0) {
            console.log("# FAILED");
            process.exitCode = 1;
        }
    } finally {
        await driver.quit().catch(() => {});
    }
 }
 main().catch((e) => {
    console.error("e2e-firefox: " + (e && e.stack ? e.stack : e));
    process.exitCode = 1;
 });
--- a/tests/e2e/network.js
+++ b/tests/e2e/network.js
@@ -23,8 +23,6 @@
 "use strict";
 const { Transaction } = require("ethers");
 // Fictional ERC-20 used to seed the transaction-detail test. The symbol
 // must not collide with any entry in src/shared/tokenList.js, or
 // isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
@@ -64,87 +62,6 @@ function word(value) {
    return "0x" + BigInt(value).toString(16).padStart(64, "0");
 }
 // -------------------------------------------------------- dApp fixture
 //
 // The origin the EIP-1193 test page is served from, and the page itself.
 //
 // It is a fixture like every other one in this file: the route handler
 // fulfils the navigation from the string below, so the page never comes
 // from a remote origin and nothing about the dApp round trips leaves the
 // container. `.test` is reserved by RFC 6761 and has no owner to reach in
 // the first place; the launch arguments map every host to NOTFOUND anyway.
 //
 // What the page deliberately does NOT do is load a provider. window.ethereum
 // is put there by the shipped manifest's MAIN-world content script, exactly
 // as it is on any http(s) page a user visits, so what these tests speak to
 // is the real inpage provider and not a copy the harness wired up.
 const DAPP_ORIGIN = "https://dapp.e2e.test";
 const DAPP_URL = DAPP_ORIGIN + "/";
 // Requests are parked rather than awaited. An approval prompt only exists
 // while its call is in flight, so a test that awaited the promise could
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
 // The rejection branch records the whole observable shape of the error as it
 // arrives — name, message, and whether a `code` is present at all as distinct
 // from its value. EIP-1193 says a user rejection is a ProviderRpcError
 // carrying code 4001; what the page can actually see is recorded here rather
 // than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
 // script, in both directions, verbatim.
 const DAPP_HTML = [
    "<!doctype html>",
    '<html lang="en">',
    "<head>",
    '<meta charset="utf-8">',
    "<title>AutistMask e2e dApp</title>",
    // Inline and empty: without it Chromium asks for /favicon.ico, which
    // the unstubbed-request guard would report as escaping traffic.
    '<link rel="icon" href="data:,">',
    "</head>",
    "<body>",
    "<h1>AutistMask e2e dApp</h1>",
    "<script>",
    "window.__dapp = {",
    "    messages: [],",
    "    calls: {},",
    "    start: function (key, method, params) {",
    "        window.__dapp.calls[key] = window.ethereum",
    "            .request({ method: method, params: params })",
    "            .then(",
    "                function (result) {",
    "                    return { settled: 'resolved', result: result };",
    "                },",
    "                function (error) {",
    "                    return {",
    "                        settled: 'rejected',",
    "                        message: String((error && error.message) || error),",
    "                        name: error ? error.name : undefined,",
    "                        hasCode: !!error && 'code' in Object(error),",
    "                        code: error ? error.code : undefined,",
    "                    };",
    "                },",
    "            );",
    "    },",
    "    settle: function (key) {",
    "        return window.__dapp.calls[key];",
    "    },",
    "};",
    "window.addEventListener('message', function (event) {",
    "    if (event.source !== window) return;",
    "    var d = event.data;",
    "    if (!d || typeof d.type !== 'string') return;",
    "    if (d.type.indexOf('AUTISTMASK') !== 0) return;",
    "    window.__dapp.messages.push(d);",
    "});",
    "</script>",
    "</body>",
    "</html>",
 ].join("\n");
 // ------------------------------------------------------------ fee fixture
 //
 // The confirmation screen carries two different numbers for the same
@@ -184,11 +101,6 @@ const RPC_RESULTS = {
    eth_estimateGas: hex(GAS_LIMIT),
    eth_getTransactionCount: "0x0",
    eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
    // "not mined yet", which is what a node answers for a transaction it has
    // only just accepted. The wait screen the dApp transaction approval hands
    // off to polls this every 10 seconds; leaving it unstubbed would report
    // the poll as escaping traffic the moment a test outlived one tick.
    eth_getTransactionReceipt: null,
 };
 // The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
@@ -352,31 +264,6 @@ function rpcReply(req, opts, report) {
    if (req.method === "eth_getBlockByNumber") {
        return Object.assign(envelope, { result: latestBlock() });
    }
    // The end of the dApp transaction round trip: the raw signed transaction
    // the background hands to the node. It is recorded verbatim so a test can
    // recover the signer from the exact bytes that were broadcast, rather than
    // from anything the extension reported about them.
    //
    // The reply must be the transaction's real hash. ethers compares the hash
    // the node returns against the one it computes itself and throws on a
    // mismatch, so a constant here would fail the broadcast for a reason that
    // has nothing to do with what is being tested.
    if (req.method === "eth_sendRawTransaction") {
        const raw = Array.isArray(req.params) ? req.params[0] : null;
        let parsed;
        try {
            parsed = Transaction.from(raw);
        } catch {
            report("eth_sendRawTransaction with an undecodable transaction");
            return Object.assign(envelope, {
                error: { code: -32000, message: "undecodable transaction" },
            });
        }
        if (Array.isArray(opts.broadcastTransactions)) {
            opts.broadcastTransactions.push(raw);
        }
        return Object.assign(envelope, { result: parsed.hash });
    }
    if (req.method === "eth_estimateGas" && opts.failGasEstimate) {
        // A refusal the node itself would produce, not a transport error:
        // this is the shape the confirmation screen has to turn into
@@ -488,8 +375,6 @@ function traceEnabled(raw) {
 *   node-side refusal.
 * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
 *   eth_estimateGas until this is cleared again.
 * @param {string[]} [opts.broadcastTransactions]  every raw signed
 *   transaction handed to eth_sendRawTransaction, appended in order.
 * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
 *   Promise<string|null>}>}
 */
@@ -535,18 +420,6 @@ async function installNetworkStubs(ctx, opts) {
            return handleRpc(route, req.postData(), opts, report);
        }
        // The local EIP-1193 test page. Served from here so the dApp round
        // trips run against a real http(s) origin — which is what makes the
        // shipped content scripts inject at all — without any remote origin
        // being involved.
        if (url.origin === DAPP_ORIGIN && p === "/") {
            return route.fulfill({
                status: 200,
                contentType: "text/html; charset=utf-8",
                body: DAPP_HTML,
            });
        }
        // Blockscout v2
        if (p.includes("/api/v2/")) {
            if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
@@ -635,8 +508,6 @@ async function installNetworkStubs(ctx, opts) {
 module.exports = {
    installNetworkStubs,
    DAPP_ORIGIN,
    DAPP_URL,
    FEE_ESTIMATE_WEI,
    FEE_RESERVE_WEI,
    STUB_COUNTERPARTY,
--- a/tests/e2e/run.js
+++ b/tests/e2e/run.js
--- a/tests/inpageErrors.test.js
+++ b/tests/inpageErrors.test.js
@@ -1,310 +0,0 @@
 // The EIP-1193 error the page actually catches (src/content/inpage.js).
 //
 // The bug this pins down (issue #274): the provider rebuilt every failure as
 // `new Error(error.message)`, so the `code` the background produced and the
 // content script relayed intact was thrown away in the last hop. A dApp
 // checking `err.code === 4001` — the standard way to tell "the user said no"
 // from "the wallet broke" — saw undefined, and well-behaved sites showed an
 // error or retried instead of accepting the refusal.
 //
 // inpage.js is a bare IIFE injected into the page's JS context, not a module:
 // it takes no import and exports nothing, and reaches for `window` at load.
 // So it is evaluated here the way the browser evaluates it, against a stub
 // window, and the provider is collected from `window.ethereum`. The globals it
 // touches are passed in as function parameters rather than assigned to
 // globalThis: nothing leaks between tests, and the source is compiled in this
 // realm, so the errors it constructs are comparable against this file's own
 // `Error` — which a second realm's intrinsics would silently defeat.
 //
 // There is no jsdom in this repo; see tests/txStatus.test.js.
 const fs = require("fs");
 const path = require("path");
 const { webcrypto } = require("crypto");
 const SOURCE = fs.readFileSync(
    path.join(__dirname, "..", "src", "content", "inpage.js"),
    "utf8",
 );
 const loadInto = new Function(
    "window",
    "self",
    "crypto",
    "Event",
    "CustomEvent",
    SOURCE,
 );
 class StubEvent {
    constructor(type) {
        this.type = type;
    }
 }
 class StubCustomEvent extends StubEvent {
    constructor(type, init) {
        super(type);
        this.detail = init && init.detail;
    }
 }
 // Every code the background emits on the RPC path today, read out of
 // src/background/index.js. The provider must not know this list — it passes
 // through whatever arrived — but the cases below are the real ones.
 const REJECTED = 4001; // user rejected the request
 const UNAUTHORIZED = 4100; // site not connected / wrong address
 const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
 // A stub window with the four things inpage.js touches: message listeners,
 // postMessage out to the content script, window.ethereum, and dispatchEvent
 // for the EIP-6963 announcement.
 function loadProvider() {
    const messageListeners = [];
    const posted = [];
    const win = {
        addEventListener(type, fn) {
            if (type === "message") messageListeners.push(fn);
        },
        removeEventListener(type, fn) {
            const i = messageListeners.indexOf(fn);
            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
        },
        postMessage(data) {
            posted.push(data);
        },
        dispatchEvent() {
            return true;
        },
    };
    win.window = win;
    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
    // Deliver the content script's answer to an outstanding request. The id is
    // read back off the wire rather than assumed: inpage.js issues its own
    // eth_chainId at load, so the first id a test sees is not 1.
    function respond(response) {
        const request = posted
            .filter((m) => m.type === "AUTISTMASK_REQUEST")
            .pop();
        expect(request).toBeDefined();
        const event = {
            source: win,
            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
        };
        for (const fn of messageListeners.slice()) fn(event);
    }
    return { provider: win.ethereum, posted, respond };
 }
 // Start a request, answer it with `response`, and hand back the rejection.
 // Fails the test if the call resolves instead.
 async function rejectionFrom(start, response) {
    const { provider, respond } = loadProvider();
    const settled = start(provider).then(
        (result) => ({ resolved: result }),
        (error) => ({ error }),
    );
    // The provider posts synchronously, so the request is already on the wire.
    respond(response);
    const outcome = await settled;
    expect(outcome).not.toHaveProperty("resolved");
    return outcome.error;
 }
 describe("an EIP-1193 code reaches the page", () => {
    test("a user rejection arrives as code 4001", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
    test("it is a ProviderRpcError, and an Error", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect(err).toBeInstanceOf(Error);
        expect(err.name).toBe("ProviderRpcError");
    });
    test("4100 unauthorized arrives intact", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
        );
        expect(err.code).toBe(UNAUTHORIZED);
        expect(err.message).toBe("Unauthorized");
    });
    test("4902 unrecognized chain arrives intact", async () => {
        const message =
            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "wallet_switchEthereumChain" }),
            { error: { code: UNRECOGNIZED_CHAIN, message } },
        );
        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
        expect(err.message).toBe(message);
    });
    // The provider is not allowed to know the list above: a code added to the
    // background later must reach the page without this file being edited.
    test("a code the provider has never heard of is passed through", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_accounts" }),
            { error: { code: 4900, message: "Disconnected" } },
        );
        expect(err.code).toBe(4900);
    });
    test("data is carried when the boundary sent it", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_call" }),
            {
                error: {
                    code: -32000,
                    message: "execution reverted",
                    data: "0x08c379a0",
                },
            },
        );
        expect(err.code).toBe(-32000);
        expect(err.data).toBe("0x08c379a0");
    });
    test("no data property is invented when the boundary sent none", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            {
                error: {
                    code: REJECTED,
                    message: "User rejected the request.",
                },
            },
        );
        expect("data" in err).toBe(false);
    });
 });
 describe("the message is untouched", () => {
    test("a coded error keeps the message byte for byte", async () => {
        const message =
            "This site asked to sign as an address that is not " +
            "the active one.";
        const err = await rejectionFrom(
            (p) => p.request({ method: "personal_sign" }),
            { error: { code: UNAUTHORIZED, message } },
        );
        expect(err.message).toBe(message);
    });
    test("an error the background sent with no code keeps its message", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err.message).toBe("No accounts available");
    });
    // A ProviderRpcError whose code is undefined would claim a conformance it
    // does not have, and `'code' in err` is exactly what a careful dApp asks.
    test("an error with no code gets no code property at all", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { message: "No accounts available" } },
        );
        expect(err).toBeInstanceOf(Error);
        expect("code" in err).toBe(false);
    });
    test("an error with no message keeps the generic fallback", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_sendTransaction" }),
            { error: { code: REJECTED } },
        );
        expect(err.message).toBe("Request failed");
        expect(err.code).toBe(REJECTED);
    });
 });
 // Every entry point the provider exposes, not just eth_requestAccounts. They
 // all funnel through the same response listener, and this is what says so.
 describe("every request path carries the code", () => {
    const rejection = {
        error: { code: REJECTED, message: "User rejected the request." },
    };
    test("request()", async () => {
        const err = await rejectionFrom(
            (p) => p.request({ method: "eth_requestAccounts" }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("enable()", async () => {
        const err = await rejectionFrom((p) => p.enable(), rejection);
        expect(err.code).toBe(REJECTED);
    });
    test("send(method, params)", async () => {
        const err = await rejectionFrom(
            (p) => p.send("eth_requestAccounts", []),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("send({ method, params })", async () => {
        const err = await rejectionFrom(
            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
            rejection,
        );
        expect(err.code).toBe(REJECTED);
    });
    test("sendAsync() hands the code to its callback", async () => {
        const { provider, respond } = loadProvider();
        const called = new Promise((resolve) => {
            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
                resolve(e),
            );
        });
        respond(rejection);
        const err = await called;
        expect(err.name).toBe("ProviderRpcError");
        expect(err.code).toBe(REJECTED);
        expect(err.message).toBe("User rejected the request.");
    });
 });
 describe("the success path is unchanged", () => {
    test("a result still resolves", async () => {
        const { provider, respond } = loadProvider();
        const settled = provider.request({ method: "eth_requestAccounts" });
        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
        await expect(settled).resolves.toEqual([
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        ]);
        expect(provider.selectedAddress).toBe(
            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
        );
    });
 });
--- a/tests/symbolSpoof.test.js
+++ b/tests/symbolSpoof.test.js
@@ -56,7 +56,7 @@ global.chrome = {
 };
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
-const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { filterTransactions } = require("../src/shared/transactions");
 const {
    fetchTokenBalances,
@@ -124,301 +124,6 @@ describe("the shared rule", () => {
    });
 });
 // Issue #260: the symbol is whatever the ERC-20 contract returns, and HTML
 // collapses leading and trailing whitespace, so a token calling itself
 // `" ETH "` reaches the user's eye as `ETH` while missing a raw
 // KNOWN_SYMBOLS lookup.  Normalizing inside the shared rule fixes all three
 // surfaces at once, which is what consolidating the rule bought.
 //
 // Every character under test here is built from its code point rather than
 // pasted in: most of them are invisible, and an invisible character in a
 // test file is unreviewable.
 const cp = (...codes) => String.fromCodePoint(...codes);
 const NBSP = cp(0x00a0); // no-break space
 const FIGURE_SPACE = cp(0x2007);
 const IDEOGRAPHIC_SPACE = cp(0x3000);
 const ZWSP = cp(0x200b); // zero-width space
 const BOM = cp(0xfeff); // zero-width no-break space
 const WORD_JOINER = cp(0x2060);
 const SOFT_HYPHEN = cp(0x00ad);
 const LRM = cp(0x200e); // left-to-right mark
 const RLO = cp(0x202e); // right-to-left override
 const HANGUL_FILLER = cp(0x3164);
 const CHOSEONG_FILLER = cp(0x115f);
 const VS16 = cp(0xfe0f); // variation selector-16
 const VS1 = cp(0xfe00); // variation selector-1
 const NEL = cp(0x0085); // next line, a C1 control
 const DEL = cp(0x007f);
 const FULLWIDTH_ETH = cp(0xff25, 0xff34, 0xff28);
 const FULLWIDTH_USDC = cp(0xff55, 0xff53, 0xff44, 0xff43); // lowercase
 const CYRILLIC_CAPITAL_IE = cp(0x0415);
 describe("the shared rule: symbols that render as a known symbol", () => {
    test("ASCII padding does not buy a pass", () => {
        expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
        expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT)).toBe(true);
    });
    test("non-breaking and other Unicode spaces do not either", () => {
        expect(isSpoofedSymbol(NBSP + "ETH" + NBSP, FAKE_ETH_CONTRACT)).toBe(
            true,
        );
        expect(
            isSpoofedSymbol(
                FIGURE_SPACE + "ETH" + IDEOGRAPHIC_SPACE,
                FAKE_ETH_CONTRACT,
            ),
        ).toBe(true);
    });
    // These render as nothing at all, in any position, so they are removed
    // wherever they sit rather than only at the ends.
    test("zero-width characters are stripped wherever they sit", () => {
        expect(isSpoofedSymbol("E" + ZWSP + "TH", FAKE_ETH_CONTRACT)).toBe(
            true,
        );
        expect(isSpoofedSymbol(BOM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
        expect(
            isSpoofedSymbol("ET" + WORD_JOINER + "H", FAKE_ETH_CONTRACT),
        ).toBe(true);
        expect(
            isSpoofedSymbol("E" + SOFT_HYPHEN + "TH", FAKE_ETH_CONTRACT),
        ).toBe(true);
    });
    // An LRM is invisible and, in all-Latin text, moves nothing: dropping it
    // leaves exactly the string the user saw.
    test("an invisible bidi mark does not hide a known symbol", () => {
        expect(isSpoofedSymbol(LRM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
    });
    // Invisibility is not confined to \p{Cf}.  A Hangul filler is Lo and a
    // variation selector is Mn, yet each of these four measures 32.00px in
    // the repo's pinned e2e Chromium at 16px sans-serif — exactly the width
    // of a plain `ETH` — so each reaches the user's eye as `ETH`.  They are
    // caught by \p{Default_Ignorable_Code_Point}, not by \p{Cf}.
    test("invisible non-format characters are stripped too", () => {
        expect(isSpoofedSymbol(HANGUL_FILLER + "ETH", FAKE_ETH_CONTRACT)).toBe(
            true,
        );
        expect(
            isSpoofedSymbol(CHOSEONG_FILLER + "ETH", FAKE_ETH_CONTRACT),
        ).toBe(true);
        expect(isSpoofedSymbol("ETH" + VS16, FAKE_ETH_CONTRACT)).toBe(true);
        expect(isSpoofedSymbol("E" + VS1 + "TH", FAKE_ETH_CONTRACT)).toBe(true);
    });
    // Nor is it confined to the Unicode classes.  U+007F is a control (Cc)
    // and is not default-ignorable, so neither class reaches it, but it
    // measures 32.00px in the same browser — it paints nothing, so a
    // symbol carrying it reaches the eye as `ETH`.  It is named on its own
    // in the strip for exactly that reason.
    test("U+007F paints nothing and is stripped", () => {
        expect(isSpoofedSymbol(DEL + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
    });
    // The other side of the boundary, which is not the class boundary but
    // the visibility one: the remaining C0 and C1 controls render as a
    // visible 48.00px box in the same browser, so a symbol carrying one
    // does not look like `ETH` and must not be judged a spoof.  Widening
    // the strip to \p{Cc} — the obvious over-correction once U+007F is in
    // it — fails this test.
    test("visible control characters do not make a symbol a spoof", () => {
        expect(isSpoofedSymbol(NEL + "ETH", FAKE_ETH_CONTRACT)).toBe(false);
        expect(isSpoofedSymbol(cp(0x0001) + "ETH", FAKE_ETH_CONTRACT)).toBe(
            false,
        );
        expect(isSpoofedSymbol(cp(0x0090) + "ETH", FAKE_ETH_CONTRACT)).toBe(
            false,
        );
    });
    test("compatibility forms fold onto the symbol they imitate", () => {
        expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
        expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
    });
    // The two knowingly open classes, asserted here so that the boundary is
    // a fact in the suite and not a claim in a PR body.  A Cyrillic capital
    // Ie is a distinct letter rather than a compatibility variant, so NFKC
    // leaves it alone; and a right-to-left override reverses the rendering
    // of what follows it, which dropping the control character does not
    // undo.  Closing either needs a confusables table or a bidi resolver,
    // and both are a separate change from this one.
    test("a Cyrillic homoglyph is knowingly still not caught", () => {
        expect(
            isSpoofedSymbol(CYRILLIC_CAPITAL_IE + "TH", FAKE_ETH_CONTRACT),
        ).toBe(false);
    });
    test("a bidi-reordered symbol is knowingly still not caught", () => {
        expect(isSpoofedSymbol(RLO + "HTE", FAKE_ETH_CONTRACT)).toBe(false);
    });
    // Normalization does not reach the native-asset exemption, which turns
    // on the absence of a contract address and never on the symbol.
    test("a padded symbol with no contract is still not a spoof", () => {
        expect(isSpoofedSymbol(" ETH ", null)).toBe(false);
        expect(isSpoofedSymbol(NBSP + "ETH", "")).toBe(false);
    });
    test("a genuine contract still bears its own padded symbol", () => {
        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
    });
    // Normalization must not invent a match.  Interior ASCII whitespace is
    // left alone: `E T H` renders as `E T H`, not as `ETH`, so folding it
    // would filter a token no user could confuse with the native asset.
    test("a symbol that renders differently is not judged a spoof", () => {
        expect(isSpoofedSymbol("E T H", FAKE_ETH_CONTRACT)).toBe(false);
        expect(isSpoofedSymbol("ETH2", FAKE_ETH_CONTRACT)).toBe(false);
        expect(isSpoofedSymbol("MY ETH", FAKE_ETH_CONTRACT)).toBe(false);
    });
    // The false-positive question, answered against the shipped data rather
    // than by assertion: no bundled symbol carries whitespace or a
    // non-ASCII character, so the normalization cannot newly filter one.
    // The character class starts at `!` rather than at the space so that it
    // asserts the claim it stands for — `[ -~]` would admit an interior
    // space and let a whitespace-bearing entry through the guard.
    test("no bundled symbol is touched by the normalization", () => {
        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
            expect(symbol).toBe(symbol.trim());
            expect(symbol).toMatch(/^[!-~]+$/);
            if (addresses === null) continue;
            for (const address of addresses) {
                expect(isSpoofedSymbol(symbol, address)).toBe(false);
            }
        }
    });
 });
 // Issue #276: the guard that was missing.  The suite walked KNOWN_SYMBOLS,
 // which is built from TOKENS, so it could only ever assert that the table
 // agrees with itself.  Seven symbols appear twice in the bundled list at two
 // different real contracts, and the table kept whichever came first, so the
 // other seven contracts — tokens in our own shipped list, at their own
 // addresses — were judged spoofs and hidden from the balance list, the
 // history and the send selector.  That is the over-filtering direction: it
 // hides a holding the user cannot then spend.
 //
 // This walk is over TOKENS, the data the wallet actually ships, so it fails
 // whenever a bundled token would be filtered at its own address no matter
 // which side of the table the mistake is on.
 describe("the shipped token list", () => {
    test("no bundled token is filtered at its own address", () => {
        const filtered = TOKENS.filter((t) =>
            isSpoofedSymbol(t.symbol, t.address),
        ).map((t) => t.symbol + " @ " + t.address);
        expect(filtered).toEqual([]);
    });
    // The third failure mode the issue asks about: a symbol whose table entry
    // names an address that is in neither the table nor the list would be a
    // contract we vouch for and do not ship.  There is none, and the table is
    // built from the list, so this asserts the derivation has not acquired a
    // hand-written entry.
    test("every address the table vouches for is a bundled token", () => {
        const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
            if (addresses === null) continue;
            expect(addresses.size).toBeGreaterThan(0);
            for (const address of addresses) {
                expect(address).toBe(address.toLowerCase());
                expect(bundled.has(address)).toBe(true);
                // And it is the token that actually reports that symbol.
                const token = TOKENS.find(
                    (t) => t.address.toLowerCase() === address,
                );
                expect(token.symbol.toUpperCase()).toBe(symbol);
            }
        }
    });
    // Both contracts behind a shared ticker must pass, from either side: a
    // rule that admits only the one the table happens to visit first is the
    // bug, not the fix.
    test("both contracts behind a shared ticker are admitted", () => {
        const bySymbol = new Map();
        for (const t of TOKENS) {
            const upper = t.symbol.toUpperCase();
            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
            bySymbol.get(upper).push(t);
        }
        const shared = [...bySymbol].filter(([, list]) => list.length > 1);
        // The shared tickers are a fact about the shipped data; if a future
        // list has none, this test would silently assert nothing.
        expect(shared.length).toBeGreaterThan(0);
        for (const [, list] of shared) {
            for (const t of list) {
                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
            }
        }
    });
    // The seven from issue #276, named so that the reconciliation is a fact
    // in the suite: each is two real contracts from the same source fetch,
    // and the table now holds both rather than the one that came first.
    test("the seven shared tickers each name both bundled contracts", () => {
        const expected = {
            TON: [
                "0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
                "0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
            ],
            FRAX: [
                "0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
                "0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
            ],
            REUSD: [
                "0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
                "0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
            ],
            EURE: [
                "0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
                "0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
            ],
            MSUSD: [
                "0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
                "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
            ],
            MUSD: [
                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
                "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
            ],
            JPYC: [
                "0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
                "0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
            ],
        };
        for (const [symbol, addresses] of Object.entries(expected)) {
            expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
                [...addresses].sort(),
            );
            for (const address of addresses) {
                expect(isSpoofedSymbol(symbol, address)).toBe(false);
            }
        }
    });
    // The other direction, on the same symbols: widening the table to hold
    // every bundled address for a ticker must not turn it into a pass for
    // any other contract.
    test("a shared ticker from a third contract is still a spoof", () => {
        const bySymbol = new Map();
        for (const t of TOKENS) {
            const upper = t.symbol.toUpperCase();
            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
            bySymbol.get(upper).push(t);
        }
        for (const [symbol, list] of bySymbol) {
            if (list.length < 2) continue;
            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
        }
    });
 });
 describe("surface 1: the transaction history", () => {
    function fakeEthTransfer() {
        return {
@@ -442,22 +147,6 @@ describe("surface 1: the transaction history", () => {
        expect(result.transactions).toEqual([]);
    });
    // Issue #260 on this surface: the same transfer with a padded symbol.
    test("a padded fake ETH token transfer is filtered too", () => {
        const padded = { ...fakeEthTransfer(), symbol: " ETH " };
        const result = filterTransactions([padded], {
            hideSpoofedSymbols: true,
            hideFraudContracts: true,
            hideLowHolderTokens: true,
            hideDustTransactions: true,
            dustThresholdGwei: 100000,
        });
        expect(result.transactions).toEqual([]);
        // The contract is learned as fraudulent, exactly as for the
        // unpadded symbol: the padding must not cost the blocklist entry.
        expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
    });
    test("a real native ETH transfer survives", () => {
        const native = {
            hash: "0x" + "2".repeat(64),
@@ -512,36 +201,6 @@ describe("surface 2: the Send token selector", () => {
        expect(select.children).toEqual([]);
    });
    // Issue #260 on this surface: the option text is rendered into HTML,
    // which collapses the padding, so an unfiltered padded token would sit
    // in the selector reading exactly `ETH`.
    test("a padded fake ETH token is not selectable either", () => {
        render([
            {
                address: FAKE_ETH_CONTRACT,
                symbol: " ETH ",
                decimals: 18,
                balance: "0.005",
                holders: 900000,
            },
        ]);
        expect(select.children).toEqual([]);
    });
    test("a genuine token with a padded symbol stays selectable", () => {
        render([
            {
                address: USDC_CONTRACT,
                symbol: " USDC ",
                decimals: 6,
                balance: "12.5",
                holders: 900000,
            },
        ]);
        expect(select.children).toHaveLength(1);
        expect(select.children[0].value).toBe(USDC_CONTRACT);
    });
    test("native ETH remains the always-present option", () => {
        render([]);
        expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
@@ -592,35 +251,6 @@ describe("surface 3: the balance list", () => {
        expect(balances).toEqual([]);
    });
    // Issue #260 on this surface: the balance list is where the user forms
    // their belief about what they own, and it renders the symbol into HTML.
    test("a padded fake ETH token is filtered too", async () => {
        respondWith([fakeEthItem({ symbol: " ETH " })]);
        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
    });
    test("a fake ETH token padded with a no-break space is filtered", async () => {
        respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
    });
    // The false-positive direction on the surface that matters most: a real
    // holding whose symbol happens to carry padding is still listed, and the
    // list still shows the symbol the token actually reports.
    test("a genuine token with a padded symbol is not newly filtered", async () => {
        respondWith([
            fakeEthItem({
                address_hash: USDC_CONTRACT,
                symbol: " USDC ",
                name: "USD Coin",
                decimals: "6",
            }),
        ]);
        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
        expect(balances).toHaveLength(1);
        expect(balances[0].symbol).toBe(" USDC ");
    });
    test("a genuine token keeps its place in the list", async () => {
        respondWith([
            fakeEthItem({
@@ -644,33 +274,6 @@ describe("surface 3: the balance list", () => {
        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
    });
    // The adjacent finding from the same review as issue #260: the type gate
    // compared exactly, so an explorer that ever varied the casing would
    // silently drop a real holding before any filter ran.  The comparison is
    // now case-insensitive, which changes nothing about which types are
    // admitted.
    test("a differently-cased ERC-20 type still lists a real holding", async () => {
        respondWith([
            fakeEthItem({
                type: "erc-20",
                address_hash: USDC_CONTRACT,
                symbol: "USDC",
                name: "USD Coin",
                decimals: "6",
            }),
        ]);
        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
        expect(balances).toHaveLength(1);
        expect(balances[0].symbol).toBe("USDC");
    });
    test("case insensitivity does not admit another token type", async () => {
        respondWith([fakeEthItem({ type: "erc-721" })]);
        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
        respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
    });
    // The money test: the user holds real ETH and has been airdropped a fake
    // ETH ERC-20.  The fake is gone from the list of tokens; the real balance
    // is exactly what the node reported.
--- a/tests/transactions.test.js
+++ b/tests/transactions.test.js
@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
    });
    test("USDC and WETH map to their genuine lowercased contracts", () => {
-        expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
-        expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
    });
    test("the spam fixture symbol is not in the known token list", () => {