test: drive the EIP-1193 dApp approval round trips in the browser (closes #183)

The seam between the content script, the inpage provider, the background worker
and the approval popup had no coverage at all. The unit suite covers each side
in isolation, so a wallet that signed the wrong payload, handed back a signature
from the wrong key, hung on a rejected prompt, or put the user's password back
on the extension messaging boundary would have passed everything.

Ten end-to-end tests now drive it. The route handler serves a local test page on
a reserved-TLD origin; window.ethereum arrives there from the shipped MAIN-world
content script, not from anything the fixture installs, and the page's own
EIP-6963 announcement is required to be that provider by object identity. The
page then speaks eth_requestAccounts, personal_sign, eth_signTypedData_v4 and
eth_sendTransaction through the real prompts, approved and rejected.

The assertions are the point:

  - every signature is recovered in the runner with verifyMessage,
    verifyTypedData and Transaction.from(), and compared against the active
    address read out of extension storage. The background verifies too; nothing
    here leans on its verdict.
  - the transaction is checked against the raw signed bytes captured at
    eth_sendRawTransaction, which the RPC stub now records and answers with the
    transaction's real hash. Signer, recipient, value, call data and chain id
    are all compared there, and the hash the page received is required to be the
    hash of those bytes.
  - a rejected prompt must reach the page as a rejection rather than hang or
    resolve, and must carry EIP-1193 code 4001 across the boundary. The code is
    asserted on the wire because that is where it survives: the inpage provider
    rebuilds the rejection as a bare Error, so the calling page catches a message
    and no code. Reported, not asserted either way.
  - the password must appear in no message the approval window sends to the
    background, observed directly by wrapping chrome.runtime.sendMessage before
    Approve is clicked, with the response message that would carry it required
    to be present so the check cannot pass on an empty record.

Every one of those was run against a deliberately broken variant and seen to
fail: a corrupted recovered signer, a payload carrying the password again, a
provider that resolves instead of rejecting, and approval screens displaying the
wrong message, value and call data.

Two honest limits. The RPC is stubbed throughout, so this does not discharge a
real dApp with real funds against a real network. And the site-connection prompt
goes through chrome.action.openPopup(), whose browser-action popup headless
Chromium will not expose as a page, so that one prompt is driven at the URL the
extension puts on the action instead — same page, same approval id, but a real
toolbar click is not observable from a headless harness. Both are stated in
README.md rather than presented as covered.

Test-only: nothing under src/ changes.

TODO.md

@@ -45,53 +45,6 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-14: A background message handler that throws now rejects the page
-  instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
-  and `sendResponse` is the only thing that settles the dApp's
-  `window.ethereum.request()` promise — so any throw inside `handleRpc` left
-  that promise pending forever, with no error and no timeout, indistinguishable
-  from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
-  internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
-  describes "the wallet broke" and none was invented) and logs the method and
-  the throw to the background console rather than swallowing them. The two async
-  IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
-  same shape one level down — every statement inside a `try`, but a throw out of
-  a `catch` block escaping unhandled — and each got a last-resort `.catch()`
-  settling the approval through `settleApproval()` and answering the popup; the
-  transaction one reports the broadcast stage, because it cannot tell whether
-  the transaction reached the network. Every other handler on the path is
-  synchronous. All three are driven by real failures — a rejecting storage read,
-  and a failure classifier that throws while classifying a genuine verification
-  failure — and were demonstrated failing first, the RPC one with `sendResponse`
-  at zero calls ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
-- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
-  rebuilt every failure as `new Error(error.message)`, so the code the
-  background produced and the content script relayed intact was dropped in the
-  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
-  the user deliberately declined was indistinguishable from one that broke. The
-  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
-  boundary sent one, `data`, passed through verbatim rather than matched against
-  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
-  here. An error the background sent with no code stays a plain `Error` with no
-  `code` property, and `message` is unchanged in every case. All four request
-  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
-  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
-  now requires it on the page's Error as well as on the wire, for all four
-  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
-- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
-  that bear it, not to one of them. A ticker is not unique: seven of the 512
-  bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
-  share a symbol with another bundled entry at a different real contract, and
-  the table, built from the list first-wins, kept only the earlier one. The
-  other seven were judged spoofs of their own symbol at their own address and
-  hidden from the balance list, the history and the send selector, so a holder
-  could not spend them. Both contracts of each pair come from the same CoinGecko
-  fetch of 2026-02-27, so neither was stale and neither was dropped.
-  `isSpoofedSymbol()` asks set membership instead of equality, which does not
-  loosen the rule — a contract outside the set is still a spoof — and a test now
-  walks `TOKENS` asserting no bundled token is filtered at its own address,
-  which is the walk the suite lacked
-  ([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
 - 2026-08-12: The dApp approval round trips are driven end to end in the
   browser. A test page served by the harness speaks EIP-1193 to the real inpage
   provider through the real content script, background worker and approval popup
@@ -103,20 +56,6 @@ undefined identifiers, which is how
   that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
   floor. This does not discharge a real dApp with real funds against mainnet
   ([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
-- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
-  sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
-  character that paints nothing removed (the format and default-ignorable
-  characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
-  zero-width space, a Hangul filler, a variation selector, a DELETE and a
-  fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
-  send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
-  bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
-  in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
-  knowingly open and are asserted as open in the suite. No bundled symbol
-  contains whitespace or a non-ASCII character, so nothing legitimate is newly
-  filtered; the balance list's token-type gate also became case-insensitive,
-  which no longer drops a real holding if an explorer writes `erc-20`
-  ([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
 - 2026-08-12: A containerized Firefox end-to-end harness
   (`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
   build installed as a temporary add-on. Zero npm dependencies — a WebDriver

src/background/index.js

@@ -57,16 +57,6 @@ const connectedSites = {};
 // Pending approval requests: { id: { origin, hostname, resolve } }
 const pendingApprovals = {};
 
-// What the page is told when a request failed in a way the wallet has no
-// specific answer for. -32603 is the JSON-RPC internal error EIP-1474 defines
-// and EIP-1193 defers to for RPC-layer failures; no EIP-1193 4xxx code
-// describes "the wallet broke", and one is not invented here. The cause is
-// logged rather than put in the message: the page gets a stable sentence, the
-// background console gets the throw.
-const INTERNAL_ERROR_CODE = -32603;
-const INTERNAL_ERROR_MESSAGE =
-    "AutistMask could not complete this request because of an internal error.";
-
 async function getState() {
     const result = await storageApi.get("autistmask");
     return (
@@ -875,26 +865,9 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // keep fallback
             }
         }
-        handleRpc(msg.method, msg.params, trustedOrigin)
+        handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
-            .then((response) => {
+            sendResponse(response);
-                sendResponse(response);
+        });
-            })
-            .catch((err) => {
-                // Without this the page's window.ethereum.request() promise
-                // stays pending forever: no response is sent, the content
-                // script posts nothing back, and the dApp cannot tell the
-                // failure from a slow wallet. handleRpc does real work —
-                // state loads, provider calls, transaction population — so
-                // "it does not throw today" is not a property anyone is
-                // maintaining.
-                log.errorf("RPC request failed:", msg.method, err);
-                sendResponse({
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                });
-            });
         return true;
     }
 
@@ -1078,31 +1051,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     stage: TX_STAGE_BROADCAST,
                 });
             }
-        })().catch((e) => {
+        })();
-            // Every statement above is inside a try, but a throw from one of
-            // the catch blocks escapes as an unhandled rejection and neither
-            // the popup nor the page is ever answered. Settle both, through
-            // the same chokepoint as every other retirement. The stage is
-            // broadcast because this cannot tell whether the transaction
-            // reached the network, and that is the wording that does not
-            // invite a second send.
-            log.errorf("transaction approval response failed:", e);
-            settleApproval(
-                msg.id,
-                {
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                },
-                { holdsClaim: true },
-            );
-            sendResponse({
-                error: INTERNAL_ERROR_MESSAGE,
-                retryable: false,
-                stage: TX_STAGE_BROADCAST,
-            });
-        });
         return true;
     }
 
@@ -1186,25 +1135,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 }
                 sendResponse({ error: errMsg, retryable });
             }
-        })().catch((e) => {
+        })();
-            // Same shape as the transaction path: a throw out of the catch
-            // block above would leave the popup and the page both waiting.
-            log.errorf("sign approval response failed:", e);
-            settleApproval(
-                msg.id,
-                {
-                    error: {
-                        code: INTERNAL_ERROR_CODE,
-                        message: INTERNAL_ERROR_MESSAGE,
-                    },
-                },
-                { holdsClaim: true },
-            );
-            sendResponse({
-                error: INTERNAL_ERROR_MESSAGE,
-                retryable: false,
-            });
-        });
         return true;
     }
 

src/content/inpage.js

@@ -11,39 +11,6 @@
     let nextId = 1;
     const pending = {};
 
-    // EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
-    // rather than properties bolted onto an Error because this object crosses
-    // no boundary after construction — it is built in the page's own realm and
-    // handed straight to the caller's catch — so the prototype survives and
-    // `error.name` is a stable thing for a dApp to see.
-    class ProviderRpcError extends Error {
-        constructor(code, message, data) {
-            super(message);
-            this.name = "ProviderRpcError";
-            this.code = code;
-            if (data !== undefined) this.data = data;
-        }
-    }
-
-    // Rebuild a boundary error as the error the page catches, carrying the
-    // code (and data) the extension reported. Without this a dApp cannot tell
-    // a user's refusal (4001) from a wallet that broke, and retries or shows
-    // an error instead of accepting the refusal.
-    //
-    // Whatever code arrived is passed through verbatim rather than being
-    // matched against a list: the extension emits 4001, 4100 and 4902 today,
-    // and a code this file has never heard of is still the truth about what
-    // happened. An error reported with no code at all stays a plain Error —
-    // a ProviderRpcError whose `code` is undefined would advertise a
-    // conformance it does not have. `message` is untouched in every case.
-    function toPageError(error) {
-        const message = (error && error.message) || "Request failed";
-        if (error && error.code !== undefined && error.code !== null) {
-            return new ProviderRpcError(error.code, message, error.data);
-        }
-        return new Error(message);
-    }
-
     // Listen for responses from the content script
     window.addEventListener("message", function onUuid(event) {
         if (event.source !== window) return;
@@ -53,7 +20,7 @@
         if (!p) return;
         delete pending[id];
         if (error) {
-            p.reject(toPageError(error));
+            p.reject(new Error(error.message || "Request failed"));
         } else {
             p.resolve(result);
         }

src/shared/balances.js

@@ -66,12 +66,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
 
         const balances = [];
         for (const item of items) {
-            // Case-insensitive: the token type is an explorer's label, not a
+            if (item.token?.type !== "ERC-20") continue;
-            // protocol value, and an exact comparison silently drops a real
-            // holding if one ever writes "erc-20".  Which types are admitted
-            // is unchanged.
-            const type = String(item.token?.type || "").toUpperCase();
-            if (type !== "ERC-20") continue;
             const decimals = parseInt(item.token.decimals || "18", 10);
             const bal = formatTokenBalance(item.value || "0", decimals);
             if (bal === "0.0") continue;

src/shared/symbolSpoof.js

@@ -8,23 +8,11 @@
 // either verdict alone, because the balance list is where the user forms
 // their belief about what they own (issue #235).
 //
-// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
+// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
-// that may bear it, or to null.  Null means the symbol belongs to the native
+// bear it, or to null.  Null means the symbol belongs to the native asset,
-// asset, which has no contract at all, so no contract may bear it and every
+// which has no contract at all, so no contract may bear it and every one
-// one that does is a spoof.  "ETH" is the only such entry today; the rule is
+// that does is a spoof.  "ETH" is the only such entry today; the rule is
 // written so that a second one needs no change here or at any call site.
-//
-// The value is a set because a ticker is not unique: seven symbols in the
-// bundled list belong to two real contracts each, and answering with one of
-// them hid the other one's holders' money (issue #276).  Membership, not
-// equality, is therefore the question — but it is the same question, asked of
-// a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token; a contract outside the set is still a spoof.
-//
-// The symbol is attacker-controlled — it is whatever the ERC-20 contract
-// returns — so the lookup is done on a normalized form (issue #260): the
-// question is whether the symbol reaches the user's eye as a known one,
-// since that is what the user acts on.
 
 const { KNOWN_SYMBOLS } = require("./tokenList");
 
@@ -34,59 +22,6 @@ function normalizeAddress(addr) {
     return (addr || "").toLowerCase();
 }
 
-// Fold a symbol onto what a user actually sees, and no further:
-//
-//   NFKC        collapses compatibility variants that render as the ASCII
-//               letters they imitate — fullwidth ETH, styled mathematical
-//               letters — and maps the non-ASCII spaces onto U+0020.
-//   strip       drops what paints nothing: \p{Cf} plus
-//               \p{Default_Ignorable_Code_Point} plus U+007F.  That covers
-//               the format characters (zero-width space, joiner and
-//               non-joiner, word joiner, soft hyphen, byte-order mark, bidi
-//               marks and overrides), the variation selectors, the Hangul
-//               fillers, and DELETE.  Removed everywhere, not merely at the
-//               ends.
-//   trim        removes surrounding whitespace, which HTML collapses:
-//               `" ETH "` is painted next to the user's real ETH as `ETH`.
-//   toUpperCase makes the comparison case-insensitive, as before.
-//
-// The rule is "strip what paints nothing".  The Unicode classes are how
-// that is spelled, not what it means, which is why U+007F is named on its
-// own: it is a control rather than a default-ignorable character, so no
-// class here reaches it, yet it paints nothing all the same.  Measured in
-// the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
-// so an invisible prefix leaves 32.00px):
-//
-//   U+007F, U+3164, U+115F, U+FE0F, U+FE00   32.00px — invisible
-//   U+FFA0                                   40.00px — a box
-//   U+1160                                   48.00px — a box
-//   U+0001, U+0085, U+0090                   48.00px — a box
-//
-// U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
-// fallback nonetheless draws, and they are stripped anyway: erring toward
-// hiding a token that does not look like `ETH` is the harmless direction of
-// the two.  The other controls are left alone for the same reason read the
-// other way — a symbol carrying a visible box does not reach the eye as
-// `ETH`, so filtering it would hide a token the user could not have
-// confused with the native asset.
-//
-// Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
-// interior whitespace (`E T H` renders as `E T H`, so folding it would filter
-// a token nobody could confuse with the native asset), confusables that are
-// distinct letters rather than compatibility variants (Cyrillic capital Ie,
-// U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
-// bidi algorithm rather than a character filter, and the visible controls.
-//
-// This decides only how the question is asked.  Nothing here changes what a
-// surface displays; a token still shows the symbol it reports.
-function normalizeSymbol(symbol) {
-    return String(symbol || "")
-        .normalize("NFKC")
-        .replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
-        .trim()
-        .toUpperCase();
-}
-
 // True when a token bearing `symbol` from contract `contractAddress` is
 // impersonating a known symbol.
 //
@@ -96,11 +31,11 @@ function normalizeSymbol(symbol) {
 function isSpoofedSymbol(symbol, contractAddress) {
     const contract = normalizeAddress(contractAddress);
     if (!contract) return false;
-    const sym = normalizeSymbol(symbol);
+    const sym = (symbol || "").toUpperCase();
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
-    return !legit.has(contract);
+    return contract !== normalizeAddress(legit);
 }
 
 module.exports = {

src/shared/tokenList.js

@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// Build a map of symbol (uppercased) -> the set of contract addresses
+// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
-// (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
+// Used for spoofed-symbol detection. "ETH" maps to null (native token).
-// "ETH" maps to null: the native asset has no contract, so no contract may
-// bear its symbol.
-//
-// The value is a set and not a single address because tickers are not unique
-// and the list above proves it: seven of these 512 tokens share a symbol with
-// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
-// different real contracts each, all of them from the same source fetch.  A
-// one-address-per-symbol table can only answer that by picking a winner, and
-// the loser is then a token in our own bundled list that the spoof filter
-// hides from the balance list, the history and the send selector at its own
-// address, so the user cannot spend it (issue #276).  Naming every address
-// that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const t of TOKENS) {
     const upper = t.symbol.toUpperCase();
     if (!KNOWN_SYMBOLS.has(upper)) {
-        KNOWN_SYMBOLS.set(upper, new Set());
+        KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
-    }
-    const addresses = KNOWN_SYMBOLS.get(upper);
-    // A null entry is the native asset and stays null: an ERC-20 that reports
-    // the native symbol does not thereby become entitled to it.
-    if (addresses !== null) {
-        addresses.add(t.address.toLowerCase());
     }
 }
 

tests/backgroundApproval.test.js

@@ -133,14 +133,6 @@ function loadBackground(options) {
         ensureRecurringAlarms: jest.fn(async () => {}),
         registerAlarmHandlers: jest.fn(),
     }));
-    // The real verification module, except where a test replaces one export
-    // with a throw to drive the handler's own error handling into failing.
-    if (opts.approvalVerify) {
-        jest.doMock("../src/shared/approvalVerify", () => ({
-            ...jest.requireActual("../src/shared/approvalVerify"),
-            ...opts.approvalVerify,
-        }));
-    }
 
     const persisted = {
         wallets: [
@@ -160,10 +152,7 @@ function loadBackground(options) {
     global.chrome = {
         storage: {
             local: {
-                get: jest.fn(
+                get: jest.fn(async () => ({ autistmask: persisted })),
-                    opts.storageGet ||
-                        (async () => ({ autistmask: persisted })),
-                ),
                 set: jest.fn(async () => {}),
             },
         },
@@ -291,25 +280,6 @@ async function settle() {
     for (let i = 0; i < 50; i++) await Promise.resolve();
 }
 
-// Node aborts the worker process on an unhandled rejection; an extension
-// service worker does not — the promise is simply never settled, nothing is
-// sent back, and the page's window.ethereum.request() waits forever. Recording
-// them instead of dying on them keeps that difference visible: the assertion
-// that the page WAS answered is what reports the failure, and the recording is
-// asserted empty alongside it.
-const unhandledRejections = [];
-process.on("unhandledRejection", (reason) => {
-    unhandledRejections.push(reason);
-});
-
-// Node reports an unhandled rejection on the macrotask turn after the promise
-// was left unhandled, which is past everything settle() waits for.
-async function settleIncludingRejections() {
-    await settle();
-    await new Promise((resolve) => setImmediate(resolve));
-    await new Promise((resolve) => setImmediate(resolve));
-}
-
 afterEach(() => {
     delete global.chrome;
     jest.resetModules();
@@ -1064,147 +1034,6 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 });
 
-// A handler that throws must still answer. `sendResponse` is the only thing
-// that settles the page's window.ethereum.request() promise, so a throw that
-// escapes a handler leaves that promise pending forever — no error, no
-// timeout, indistinguishable from a slow wallet. Each case below drives a real
-// throw out of a handler rather than asserting the catch block exists.
-describe("a handler that throws still settles the page", () => {
-    const INTERNAL_ERROR = {
-        code: -32603,
-        message:
-            "AutistMask could not complete this request because of an internal error.",
-    };
-
-    let errorLog;
-    beforeEach(() => {
-        errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
-        unhandledRejections.length = 0;
-    });
-    afterEach(() => {
-        errorLog.mockRestore();
-    });
-
-    // getState() awaits extension storage unguarded, and every read path in
-    // handleRpc goes through it. A storage read that rejects is the whole
-    // failure — no hook in the handler itself.
-    test("a rejected handleRpc rejects the page instead of hanging it", async () => {
-        const bg = loadBackground({
-            storageGet: async () => {
-                throw new Error("storage unavailable");
-            },
-        });
-
-        const answer = bg.send(
-            { type: "AUTISTMASK_RPC", method: "eth_accounts", params: [] },
-            { origin: ORIGIN },
-        );
-        await settleIncludingRejections();
-
-        // The channel is held open for the async answer, and the answer
-        // arrives.
-        expect(answer.kept).toBe(true);
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR,
-        });
-        expect(unhandledRejections).toEqual([]);
-        // Not swallowed: the throw is on the background console, which is how
-        // this class gets caught in future.
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "RPC request failed:",
-            "eth_accounts",
-            expect.objectContaining({ message: "storage unavailable" }),
-        );
-    });
-
-    // The transaction response handler wraps every statement in a try, so what
-    // escapes it is a throw from inside one of its catch blocks. Here the
-    // failure classifier itself throws while classifying a real verification
-    // failure — the approval is left claimed, so nothing else can settle it.
-    test("a throw while handling a failed transaction settles both the page and the popup", async () => {
-        const bg = loadBackground({
-            approvalVerify: {
-                describeTxFailure: () => {
-                    throw new Error("classifier broke");
-                },
-            },
-        });
-        const pending = bg.requestTx();
-        await settle();
-        const id = pending.id();
-
-        // A real verification failure: the artifact is signed at a nonce the
-        // approval never displayed.
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id,
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE + 1),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settleIncludingRejections();
-
-        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
-        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR.message,
-            retryable: false,
-            // The handler cannot tell whether the transaction reached the
-            // network, so the popup must not say "start again from the site".
-            stage: "broadcast",
-        });
-        expect(unhandledRejections).toEqual([]);
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "transaction approval response failed:",
-            expect.objectContaining({ message: "classifier broke" }),
-        );
-    });
-
-    test("a throw while handling a failed signature settles both the page and the popup", async () => {
-        const bg = loadBackground({
-            approvalVerify: {
-                failureIsRetryable: () => {
-                    throw new Error("classifier broke");
-                },
-            },
-        });
-        const pending = bg.requestSign();
-        await settle();
-
-        // A real verification failure: the active address moved after the
-        // approval was raised.
-        bg.setActiveAddress(other.address);
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                signature: await signer.signMessage(
-                    Buffer.from(MESSAGE.slice(2), "hex"),
-                ),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settleIncludingRejections();
-
-        expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: INTERNAL_ERROR.message,
-            retryable: false,
-        });
-        expect(unhandledRejections).toEqual([]);
-        expect(errorLog).toHaveBeenCalledWith(
-            "[AutistMask]",
-            "sign approval response failed:",
-            expect.objectContaining({ message: "classifier broke" }),
-        );
-    });
-});
-
 describe("popup-only messages", () => {
     test("a page sender cannot answer an approval", async () => {
         const bg = loadBackground();

tests/e2e/network.js

@@ -86,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
 // never drive the popup that has to settle it; start() files the promise
 // under a key and settle() collects it once the prompt has been dealt with.
 //
-// The rejection branch records the whole observable shape of the error as it
+// The rejection branch records `code` as it arrives. EIP-1193 says a user
-// arrives — name, message, and whether a `code` is present at all as distinct
+// rejection is a ProviderRpcError carrying code 4001; what the page can
-// from its value. EIP-1193 says a user rejection is a ProviderRpcError
+// actually see is recorded here rather than assumed, and asserted in run.js.
-// carrying code 4001; what the page can actually see is recorded here rather
-// than assumed, and asserted in run.js.
 //
 // The message log is the page's half of the boundary observation: every
 // AUTISTMASK_* message that crosses between this page and the content
@@ -122,7 +120,6 @@ const DAPP_HTML = [
     "                    return {",
     "                        settled: 'rejected',",
     "                        message: String((error && error.message) || error),",
-    "                        name: error ? error.name : undefined,",
     "                        hasCode: !!error && 'code' in Object(error),",
     "                        code: error ? error.code : undefined,",
     "                    };",

tests/e2e/run.js

@@ -1591,14 +1591,15 @@ async function lastResponseError(page) {
 }
 
 // A rejected prompt, asserted at both ends: the page's promise rejected
-// rather than hanging or resolving, and EIP-1193 code 4001 is present both
+// rather than hanging or resolving, and the response that crossed the
-// on the wire and on the Error the calling page catches.
+// boundary carried EIP-1193 code 4001.
 //
-// Both ends matter because they used to disagree. The code crossed the
+// The code is asserted on the wire because that is the only place it
-// boundary correctly and src/content/inpage.js then threw it away, rebuilding
+// survives. src/content/inpage.js rebuilds the rejection as `new
-// every rejection as `new Error(error.message)` — so a dApp branching on
+// Error(error.message)`, so the Error the calling page catches carries the
-// `err.code === 4001` saw undefined and could not tell a refusal from a
+// message and no code. That is reported rather than asserted either way —
-// failure (#274). Asserting only the wire would leave that gap invisible.
+// locking in the current behaviour would make the gap permanent, and
+// asserting the code on the Error would fail today.
 async function assertUserRejection(page, key, label) {
     const outcome = await settleRequest(page, key);
     assert(
@@ -1620,32 +1621,15 @@ async function assertUserRejection(page, key, label) {
             " did not carry EIP-1193 code 4001 across the boundary: " +
             JSON.stringify(error),
     );
-    assert(
-        outcome.hasCode,
-        label +
-            " reached the page as an error with no code property at all, so a " +
-            "dApp cannot tell the user's refusal from a failure: " +
-            JSON.stringify(outcome),
-    );
-    assert(
-        outcome.code === 4001,
-        label +
-            " reached the page with code " +
-            JSON.stringify(outcome.code) +
-            " rather than EIP-1193 4001",
-    );
-    assert(
-        outcome.name === "ProviderRpcError",
-        label +
-            " reached the page as " +
-            JSON.stringify(outcome.name) +
-            " rather than an EIP-1193 ProviderRpcError",
-    );
     console.log(
         "# " +
             label +
-            ": code 4001 on the wire and on the page's " +
+            ": boundary code=" +
-            outcome.name,
+            error.code +
+            " page Error.code=" +
+            JSON.stringify(outcome.code) +
+            " page Error carries a code=" +
+            outcome.hasCode,
     );
     return outcome;
 }

tests/inpageErrors.test.js

@@ -1,310 +0,0 @@
-// The EIP-1193 error the page actually catches (src/content/inpage.js).
-//
-// The bug this pins down (issue #274): the provider rebuilt every failure as
-// `new Error(error.message)`, so the `code` the background produced and the
-// content script relayed intact was thrown away in the last hop. A dApp
-// checking `err.code === 4001` — the standard way to tell "the user said no"
-// from "the wallet broke" — saw undefined, and well-behaved sites showed an
-// error or retried instead of accepting the refusal.
-//
-// inpage.js is a bare IIFE injected into the page's JS context, not a module:
-// it takes no import and exports nothing, and reaches for `window` at load.
-// So it is evaluated here the way the browser evaluates it, against a stub
-// window, and the provider is collected from `window.ethereum`. The globals it
-// touches are passed in as function parameters rather than assigned to
-// globalThis: nothing leaks between tests, and the source is compiled in this
-// realm, so the errors it constructs are comparable against this file's own
-// `Error` — which a second realm's intrinsics would silently defeat.
-//
-// There is no jsdom in this repo; see tests/txStatus.test.js.
-
-const fs = require("fs");
-const path = require("path");
-const { webcrypto } = require("crypto");
-
-const SOURCE = fs.readFileSync(
-    path.join(__dirname, "..", "src", "content", "inpage.js"),
-    "utf8",
-);
-
-const loadInto = new Function(
-    "window",
-    "self",
-    "crypto",
-    "Event",
-    "CustomEvent",
-    SOURCE,
-);
-
-class StubEvent {
-    constructor(type) {
-        this.type = type;
-    }
-}
-
-class StubCustomEvent extends StubEvent {
-    constructor(type, init) {
-        super(type);
-        this.detail = init && init.detail;
-    }
-}
-
-// Every code the background emits on the RPC path today, read out of
-// src/background/index.js. The provider must not know this list — it passes
-// through whatever arrived — but the cases below are the real ones.
-const REJECTED = 4001; // user rejected the request
-const UNAUTHORIZED = 4100; // site not connected / wrong address
-const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
-
-// A stub window with the four things inpage.js touches: message listeners,
-// postMessage out to the content script, window.ethereum, and dispatchEvent
-// for the EIP-6963 announcement.
-function loadProvider() {
-    const messageListeners = [];
-    const posted = [];
-
-    const win = {
-        addEventListener(type, fn) {
-            if (type === "message") messageListeners.push(fn);
-        },
-        removeEventListener(type, fn) {
-            const i = messageListeners.indexOf(fn);
-            if (type === "message" && i !== -1) messageListeners.splice(i, 1);
-        },
-        postMessage(data) {
-            posted.push(data);
-        },
-        dispatchEvent() {
-            return true;
-        },
-    };
-    win.window = win;
-
-    loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
-
-    // Deliver the content script's answer to an outstanding request. The id is
-    // read back off the wire rather than assumed: inpage.js issues its own
-    // eth_chainId at load, so the first id a test sees is not 1.
-    function respond(response) {
-        const request = posted
-            .filter((m) => m.type === "AUTISTMASK_REQUEST")
-            .pop();
-        expect(request).toBeDefined();
-        const event = {
-            source: win,
-            data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
-        };
-        for (const fn of messageListeners.slice()) fn(event);
-    }
-
-    return { provider: win.ethereum, posted, respond };
-}
-
-// Start a request, answer it with `response`, and hand back the rejection.
-// Fails the test if the call resolves instead.
-async function rejectionFrom(start, response) {
-    const { provider, respond } = loadProvider();
-    const settled = start(provider).then(
-        (result) => ({ resolved: result }),
-        (error) => ({ error }),
-    );
-    // The provider posts synchronously, so the request is already on the wire.
-    respond(response);
-    const outcome = await settled;
-    expect(outcome).not.toHaveProperty("resolved");
-    return outcome.error;
-}
-
-describe("an EIP-1193 code reaches the page", () => {
-    test("a user rejection arrives as code 4001", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-
-    test("it is a ProviderRpcError, and an Error", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect(err.name).toBe("ProviderRpcError");
-    });
-
-    test("4100 unauthorized arrives intact", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign", params: ["0x00"] }),
-            { error: { code: UNAUTHORIZED, message: "Unauthorized" } },
-        );
-        expect(err.code).toBe(UNAUTHORIZED);
-        expect(err.message).toBe("Unauthorized");
-    });
-
-    test("4902 unrecognized chain arrives intact", async () => {
-        const message =
-            "AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "wallet_switchEthereumChain" }),
-            { error: { code: UNRECOGNIZED_CHAIN, message } },
-        );
-        expect(err.code).toBe(UNRECOGNIZED_CHAIN);
-        expect(err.message).toBe(message);
-    });
-
-    // The provider is not allowed to know the list above: a code added to the
-    // background later must reach the page without this file being edited.
-    test("a code the provider has never heard of is passed through", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_accounts" }),
-            { error: { code: 4900, message: "Disconnected" } },
-        );
-        expect(err.code).toBe(4900);
-    });
-
-    test("data is carried when the boundary sent it", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_call" }),
-            {
-                error: {
-                    code: -32000,
-                    message: "execution reverted",
-                    data: "0x08c379a0",
-                },
-            },
-        );
-        expect(err.code).toBe(-32000);
-        expect(err.data).toBe("0x08c379a0");
-    });
-
-    test("no data property is invented when the boundary sent none", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            {
-                error: {
-                    code: REJECTED,
-                    message: "User rejected the request.",
-                },
-            },
-        );
-        expect("data" in err).toBe(false);
-    });
-});
-
-describe("the message is untouched", () => {
-    test("a coded error keeps the message byte for byte", async () => {
-        const message =
-            "This site asked to sign as an address that is not " +
-            "the active one.";
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "personal_sign" }),
-            { error: { code: UNAUTHORIZED, message } },
-        );
-        expect(err.message).toBe(message);
-    });
-
-    test("an error the background sent with no code keeps its message", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err.message).toBe("No accounts available");
-    });
-
-    // A ProviderRpcError whose code is undefined would claim a conformance it
-    // does not have, and `'code' in err` is exactly what a careful dApp asks.
-    test("an error with no code gets no code property at all", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { message: "No accounts available" } },
-        );
-        expect(err).toBeInstanceOf(Error);
-        expect("code" in err).toBe(false);
-    });
-
-    test("an error with no message keeps the generic fallback", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_sendTransaction" }),
-            { error: { code: REJECTED } },
-        );
-        expect(err.message).toBe("Request failed");
-        expect(err.code).toBe(REJECTED);
-    });
-});
-
-// Every entry point the provider exposes, not just eth_requestAccounts. They
-// all funnel through the same response listener, and this is what says so.
-describe("every request path carries the code", () => {
-    const rejection = {
-        error: { code: REJECTED, message: "User rejected the request." },
-    };
-
-    test("request()", async () => {
-        const err = await rejectionFrom(
-            (p) => p.request({ method: "eth_requestAccounts" }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("enable()", async () => {
-        const err = await rejectionFrom((p) => p.enable(), rejection);
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send(method, params)", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send("eth_requestAccounts", []),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("send({ method, params })", async () => {
-        const err = await rejectionFrom(
-            (p) => p.send({ method: "personal_sign", params: ["0x00"] }),
-            rejection,
-        );
-        expect(err.code).toBe(REJECTED);
-    });
-
-    test("sendAsync() hands the code to its callback", async () => {
-        const { provider, respond } = loadProvider();
-        const called = new Promise((resolve) => {
-            provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
-                resolve(e),
-            );
-        });
-        respond(rejection);
-        const err = await called;
-        expect(err.name).toBe("ProviderRpcError");
-        expect(err.code).toBe(REJECTED);
-        expect(err.message).toBe("User rejected the request.");
-    });
-});
-
-describe("the success path is unchanged", () => {
-    test("a result still resolves", async () => {
-        const { provider, respond } = loadProvider();
-        const settled = provider.request({ method: "eth_requestAccounts" });
-        respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
-        await expect(settled).resolves.toEqual([
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        ]);
-        expect(provider.selectedAddress).toBe(
-            "0xb61264DEFB0c4B8afb3D73724be15310036743a5",
-        );
-    });
-});

tests/symbolSpoof.test.js

@@ -56,7 +56,7 @@ global.chrome = {
 };
 
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
-const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
+const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
 const { filterTransactions } = require("../src/shared/transactions");
 const {
     fetchTokenBalances,
@@ -124,301 +124,6 @@ describe("the shared rule", () => {
     });
 });
 
-// Issue #260: the symbol is whatever the ERC-20 contract returns, and HTML
-// collapses leading and trailing whitespace, so a token calling itself
-// `" ETH "` reaches the user's eye as `ETH` while missing a raw
-// KNOWN_SYMBOLS lookup.  Normalizing inside the shared rule fixes all three
-// surfaces at once, which is what consolidating the rule bought.
-//
-// Every character under test here is built from its code point rather than
-// pasted in: most of them are invisible, and an invisible character in a
-// test file is unreviewable.
-const cp = (...codes) => String.fromCodePoint(...codes);
-const NBSP = cp(0x00a0); // no-break space
-const FIGURE_SPACE = cp(0x2007);
-const IDEOGRAPHIC_SPACE = cp(0x3000);
-const ZWSP = cp(0x200b); // zero-width space
-const BOM = cp(0xfeff); // zero-width no-break space
-const WORD_JOINER = cp(0x2060);
-const SOFT_HYPHEN = cp(0x00ad);
-const LRM = cp(0x200e); // left-to-right mark
-const RLO = cp(0x202e); // right-to-left override
-const HANGUL_FILLER = cp(0x3164);
-const CHOSEONG_FILLER = cp(0x115f);
-const VS16 = cp(0xfe0f); // variation selector-16
-const VS1 = cp(0xfe00); // variation selector-1
-const NEL = cp(0x0085); // next line, a C1 control
-const DEL = cp(0x007f);
-const FULLWIDTH_ETH = cp(0xff25, 0xff34, 0xff28);
-const FULLWIDTH_USDC = cp(0xff55, 0xff53, 0xff44, 0xff43); // lowercase
-const CYRILLIC_CAPITAL_IE = cp(0x0415);
-
-describe("the shared rule: symbols that render as a known symbol", () => {
-    test("ASCII padding does not buy a pass", () => {
-        expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT)).toBe(true);
-    });
-
-    test("non-breaking and other Unicode spaces do not either", () => {
-        expect(isSpoofedSymbol(NBSP + "ETH" + NBSP, FAKE_ETH_CONTRACT)).toBe(
-            true,
-        );
-        expect(
-            isSpoofedSymbol(
-                FIGURE_SPACE + "ETH" + IDEOGRAPHIC_SPACE,
-                FAKE_ETH_CONTRACT,
-            ),
-        ).toBe(true);
-    });
-
-    // These render as nothing at all, in any position, so they are removed
-    // wherever they sit rather than only at the ends.
-    test("zero-width characters are stripped wherever they sit", () => {
-        expect(isSpoofedSymbol("E" + ZWSP + "TH", FAKE_ETH_CONTRACT)).toBe(
-            true,
-        );
-        expect(isSpoofedSymbol(BOM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(
-            isSpoofedSymbol("ET" + WORD_JOINER + "H", FAKE_ETH_CONTRACT),
-        ).toBe(true);
-        expect(
-            isSpoofedSymbol("E" + SOFT_HYPHEN + "TH", FAKE_ETH_CONTRACT),
-        ).toBe(true);
-    });
-
-    // An LRM is invisible and, in all-Latin text, moves nothing: dropping it
-    // leaves exactly the string the user saw.
-    test("an invisible bidi mark does not hide a known symbol", () => {
-        expect(isSpoofedSymbol(LRM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
-    });
-
-    // Invisibility is not confined to \p{Cf}.  A Hangul filler is Lo and a
-    // variation selector is Mn, yet each of these four measures 32.00px in
-    // the repo's pinned e2e Chromium at 16px sans-serif — exactly the width
-    // of a plain `ETH` — so each reaches the user's eye as `ETH`.  They are
-    // caught by \p{Default_Ignorable_Code_Point}, not by \p{Cf}.
-    test("invisible non-format characters are stripped too", () => {
-        expect(isSpoofedSymbol(HANGUL_FILLER + "ETH", FAKE_ETH_CONTRACT)).toBe(
-            true,
-        );
-        expect(
-            isSpoofedSymbol(CHOSEONG_FILLER + "ETH", FAKE_ETH_CONTRACT),
-        ).toBe(true);
-        expect(isSpoofedSymbol("ETH" + VS16, FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("E" + VS1 + "TH", FAKE_ETH_CONTRACT)).toBe(true);
-    });
-
-    // Nor is it confined to the Unicode classes.  U+007F is a control (Cc)
-    // and is not default-ignorable, so neither class reaches it, but it
-    // measures 32.00px in the same browser — it paints nothing, so a
-    // symbol carrying it reaches the eye as `ETH`.  It is named on its own
-    // in the strip for exactly that reason.
-    test("U+007F paints nothing and is stripped", () => {
-        expect(isSpoofedSymbol(DEL + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
-    });
-
-    // The other side of the boundary, which is not the class boundary but
-    // the visibility one: the remaining C0 and C1 controls render as a
-    // visible 48.00px box in the same browser, so a symbol carrying one
-    // does not look like `ETH` and must not be judged a spoof.  Widening
-    // the strip to \p{Cc} — the obvious over-correction once U+007F is in
-    // it — fails this test.
-    test("visible control characters do not make a symbol a spoof", () => {
-        expect(isSpoofedSymbol(NEL + "ETH", FAKE_ETH_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol(cp(0x0001) + "ETH", FAKE_ETH_CONTRACT)).toBe(
-            false,
-        );
-        expect(isSpoofedSymbol(cp(0x0090) + "ETH", FAKE_ETH_CONTRACT)).toBe(
-            false,
-        );
-    });
-
-    test("compatibility forms fold onto the symbol they imitate", () => {
-        expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
-    });
-
-    // The two knowingly open classes, asserted here so that the boundary is
-    // a fact in the suite and not a claim in a PR body.  A Cyrillic capital
-    // Ie is a distinct letter rather than a compatibility variant, so NFKC
-    // leaves it alone; and a right-to-left override reverses the rendering
-    // of what follows it, which dropping the control character does not
-    // undo.  Closing either needs a confusables table or a bidi resolver,
-    // and both are a separate change from this one.
-    test("a Cyrillic homoglyph is knowingly still not caught", () => {
-        expect(
-            isSpoofedSymbol(CYRILLIC_CAPITAL_IE + "TH", FAKE_ETH_CONTRACT),
-        ).toBe(false);
-    });
-
-    test("a bidi-reordered symbol is knowingly still not caught", () => {
-        expect(isSpoofedSymbol(RLO + "HTE", FAKE_ETH_CONTRACT)).toBe(false);
-    });
-
-    // Normalization does not reach the native-asset exemption, which turns
-    // on the absence of a contract address and never on the symbol.
-    test("a padded symbol with no contract is still not a spoof", () => {
-        expect(isSpoofedSymbol(" ETH ", null)).toBe(false);
-        expect(isSpoofedSymbol(NBSP + "ETH", "")).toBe(false);
-    });
-
-    test("a genuine contract still bears its own padded symbol", () => {
-        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
-    });
-
-    // Normalization must not invent a match.  Interior ASCII whitespace is
-    // left alone: `E T H` renders as `E T H`, not as `ETH`, so folding it
-    // would filter a token no user could confuse with the native asset.
-    test("a symbol that renders differently is not judged a spoof", () => {
-        expect(isSpoofedSymbol("E T H", FAKE_ETH_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol("ETH2", FAKE_ETH_CONTRACT)).toBe(false);
-        expect(isSpoofedSymbol("MY ETH", FAKE_ETH_CONTRACT)).toBe(false);
-    });
-
-    // The false-positive question, answered against the shipped data rather
-    // than by assertion: no bundled symbol carries whitespace or a
-    // non-ASCII character, so the normalization cannot newly filter one.
-    // The character class starts at `!` rather than at the space so that it
-    // asserts the claim it stands for — `[ -~]` would admit an interior
-    // space and let a whitespace-bearing entry through the guard.
-    test("no bundled symbol is touched by the normalization", () => {
-        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
-            expect(symbol).toBe(symbol.trim());
-            expect(symbol).toMatch(/^[!-~]+$/);
-            if (addresses === null) continue;
-            for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
-            }
-        }
-    });
-});
-
-// Issue #276: the guard that was missing.  The suite walked KNOWN_SYMBOLS,
-// which is built from TOKENS, so it could only ever assert that the table
-// agrees with itself.  Seven symbols appear twice in the bundled list at two
-// different real contracts, and the table kept whichever came first, so the
-// other seven contracts — tokens in our own shipped list, at their own
-// addresses — were judged spoofs and hidden from the balance list, the
-// history and the send selector.  That is the over-filtering direction: it
-// hides a holding the user cannot then spend.
-//
-// This walk is over TOKENS, the data the wallet actually ships, so it fails
-// whenever a bundled token would be filtered at its own address no matter
-// which side of the table the mistake is on.
-describe("the shipped token list", () => {
-    test("no bundled token is filtered at its own address", () => {
-        const filtered = TOKENS.filter((t) =>
-            isSpoofedSymbol(t.symbol, t.address),
-        ).map((t) => t.symbol + " @ " + t.address);
-        expect(filtered).toEqual([]);
-    });
-
-    // The third failure mode the issue asks about: a symbol whose table entry
-    // names an address that is in neither the table nor the list would be a
-    // contract we vouch for and do not ship.  There is none, and the table is
-    // built from the list, so this asserts the derivation has not acquired a
-    // hand-written entry.
-    test("every address the table vouches for is a bundled token", () => {
-        const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
-        for (const [symbol, addresses] of KNOWN_SYMBOLS) {
-            if (addresses === null) continue;
-            expect(addresses.size).toBeGreaterThan(0);
-            for (const address of addresses) {
-                expect(address).toBe(address.toLowerCase());
-                expect(bundled.has(address)).toBe(true);
-                // And it is the token that actually reports that symbol.
-                const token = TOKENS.find(
-                    (t) => t.address.toLowerCase() === address,
-                );
-                expect(token.symbol.toUpperCase()).toBe(symbol);
-            }
-        }
-    });
-
-    // Both contracts behind a shared ticker must pass, from either side: a
-    // rule that admits only the one the table happens to visit first is the
-    // bug, not the fix.
-    test("both contracts behind a shared ticker are admitted", () => {
-        const bySymbol = new Map();
-        for (const t of TOKENS) {
-            const upper = t.symbol.toUpperCase();
-            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
-            bySymbol.get(upper).push(t);
-        }
-        const shared = [...bySymbol].filter(([, list]) => list.length > 1);
-        // The shared tickers are a fact about the shipped data; if a future
-        // list has none, this test would silently assert nothing.
-        expect(shared.length).toBeGreaterThan(0);
-        for (const [, list] of shared) {
-            for (const t of list) {
-                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
-            }
-        }
-    });
-
-    // The seven from issue #276, named so that the reconciliation is a fact
-    // in the suite: each is two real contracts from the same source fetch,
-    // and the table now holds both rather than the one that came first.
-    test("the seven shared tickers each name both bundled contracts", () => {
-        const expected = {
-            TON: [
-                "0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
-                "0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
-            ],
-            FRAX: [
-                "0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
-                "0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
-            ],
-            REUSD: [
-                "0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
-                "0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
-            ],
-            EURE: [
-                "0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
-                "0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
-            ],
-            MSUSD: [
-                "0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
-                "0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
-            ],
-            MUSD: [
-                "0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
-                "0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
-            ],
-            JPYC: [
-                "0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
-                "0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
-            ],
-        };
-        for (const [symbol, addresses] of Object.entries(expected)) {
-            expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
-                [...addresses].sort(),
-            );
-            for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address)).toBe(false);
-            }
-        }
-    });
-
-    // The other direction, on the same symbols: widening the table to hold
-    // every bundled address for a ticker must not turn it into a pass for
-    // any other contract.
-    test("a shared ticker from a third contract is still a spoof", () => {
-        const bySymbol = new Map();
-        for (const t of TOKENS) {
-            const upper = t.symbol.toUpperCase();
-            if (!bySymbol.has(upper)) bySymbol.set(upper, []);
-            bySymbol.get(upper).push(t);
-        }
-        for (const [symbol, list] of bySymbol) {
-            if (list.length < 2) continue;
-            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
-        }
-    });
-});
-
 describe("surface 1: the transaction history", () => {
     function fakeEthTransfer() {
         return {
@@ -442,22 +147,6 @@ describe("surface 1: the transaction history", () => {
         expect(result.transactions).toEqual([]);
     });
 
-    // Issue #260 on this surface: the same transfer with a padded symbol.
-    test("a padded fake ETH token transfer is filtered too", () => {
-        const padded = { ...fakeEthTransfer(), symbol: " ETH " };
-        const result = filterTransactions([padded], {
-            hideSpoofedSymbols: true,
-            hideFraudContracts: true,
-            hideLowHolderTokens: true,
-            hideDustTransactions: true,
-            dustThresholdGwei: 100000,
-        });
-        expect(result.transactions).toEqual([]);
-        // The contract is learned as fraudulent, exactly as for the
-        // unpadded symbol: the padding must not cost the blocklist entry.
-        expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
-    });
-
     test("a real native ETH transfer survives", () => {
         const native = {
             hash: "0x" + "2".repeat(64),
@@ -512,36 +201,6 @@ describe("surface 2: the Send token selector", () => {
         expect(select.children).toEqual([]);
     });
 
-    // Issue #260 on this surface: the option text is rendered into HTML,
-    // which collapses the padding, so an unfiltered padded token would sit
-    // in the selector reading exactly `ETH`.
-    test("a padded fake ETH token is not selectable either", () => {
-        render([
-            {
-                address: FAKE_ETH_CONTRACT,
-                symbol: " ETH ",
-                decimals: 18,
-                balance: "0.005",
-                holders: 900000,
-            },
-        ]);
-        expect(select.children).toEqual([]);
-    });
-
-    test("a genuine token with a padded symbol stays selectable", () => {
-        render([
-            {
-                address: USDC_CONTRACT,
-                symbol: " USDC ",
-                decimals: 6,
-                balance: "12.5",
-                holders: 900000,
-            },
-        ]);
-        expect(select.children).toHaveLength(1);
-        expect(select.children[0].value).toBe(USDC_CONTRACT);
-    });
-
     test("native ETH remains the always-present option", () => {
         render([]);
         expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
@@ -592,35 +251,6 @@ describe("surface 3: the balance list", () => {
         expect(balances).toEqual([]);
     });
 
-    // Issue #260 on this surface: the balance list is where the user forms
-    // their belief about what they own, and it renders the symbol into HTML.
-    test("a padded fake ETH token is filtered too", async () => {
-        respondWith([fakeEthItem({ symbol: " ETH " })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
-    });
-
-    test("a fake ETH token padded with a no-break space is filtered", async () => {
-        respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
-    });
-
-    // The false-positive direction on the surface that matters most: a real
-    // holding whose symbol happens to carry padding is still listed, and the
-    // list still shows the symbol the token actually reports.
-    test("a genuine token with a padded symbol is not newly filtered", async () => {
-        respondWith([
-            fakeEthItem({
-                address_hash: USDC_CONTRACT,
-                symbol: " USDC ",
-                name: "USD Coin",
-                decimals: "6",
-            }),
-        ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
-        expect(balances).toHaveLength(1);
-        expect(balances[0].symbol).toBe(" USDC ");
-    });
-
     test("a genuine token keeps its place in the list", async () => {
         respondWith([
             fakeEthItem({
@@ -644,33 +274,6 @@ describe("surface 3: the balance list", () => {
         expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
     });
 
-    // The adjacent finding from the same review as issue #260: the type gate
-    // compared exactly, so an explorer that ever varied the casing would
-    // silently drop a real holding before any filter ran.  The comparison is
-    // now case-insensitive, which changes nothing about which types are
-    // admitted.
-    test("a differently-cased ERC-20 type still lists a real holding", async () => {
-        respondWith([
-            fakeEthItem({
-                type: "erc-20",
-                address_hash: USDC_CONTRACT,
-                symbol: "USDC",
-                name: "USD Coin",
-                decimals: "6",
-            }),
-        ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
-        expect(balances).toHaveLength(1);
-        expect(balances[0].symbol).toBe("USDC");
-    });
-
-    test("case insensitivity does not admit another token type", async () => {
-        respondWith([fakeEthItem({ type: "erc-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
-        respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
-    });
-
     // The money test: the user holds real ETH and has been airdropped a fake
     // ETH ERC-20.  The fake is gone from the list of tokens; the real balance
     // is exactly what the node reported.

tests/transactions.test.js

@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
     });
 
     test("USDC and WETH map to their genuine lowercased contracts", () => {
-        expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
-        expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
+        expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
     });
 
     test("the spam fixture symbol is not in the known token list", () => {