fix: gate the chain switch and remember endpoints per network (closes #308)

wallet_switchEthereumChain was answered for any origin at all, with no
connection check and no prompt, so a page the user had never connected to
could move the active chain — clearing the [TESTNET] banner under someone
who believed they were on Sepolia. It now takes the same
allowedSites/connectedSites gate the signing methods take, ahead of the
same-chain and unsupported-chain answers, and refuses an unconnected origin
with 4100.

The switch also overwrote state.rpcUrl and state.blockscoutUrl with the
network defaults, so a user running their own node lost that url
permanently and silently to a public endpoint that then sees every address
they hold. Endpoints are now remembered per network in
state.networkEndpoints: the switch snapshots the network being left and
restores the network being entered, falling back to that network's
defaults. state.rpcUrl and state.blockscoutUrl remain the live endpoints of
the active network, so no reader changed; for the active network they are
authoritative and the map entry may be stale, and the snapshot is what
reconciles them. A profile written before the map existed has its stored
pair adopted for the network it was stored under, so nothing is lost on
first load.

README.md

@@ -992,13 +992,6 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
 - **Transitions**:
     - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
     - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
-    - "Sign & Send" on an ERC-20 whose contract answers `decimals()` with a
-      different number than the amount above was displayed with → nothing is
-      signed → **ErrorTx** naming both numbers. The transfer is encoded from the
-      decimals the screen rendered, carried forward on the pending transaction;
-      the contract's own answer is read at signing time only to be compared with
-      it, and a disagreement is a refusal rather than a preference for either
-      value (`src/shared/transferAmount.js`)
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Back" → **Send**
@@ -1464,44 +1457,10 @@ policy, but as of now there are none.
 
 ### Content Security Policy
 
-Both manifests declare the same policy for extension pages, as an object under
+Both manifests declare the same policy for extension pages —
+`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
 `content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
-a bare string in `manifest/firefox.json` (MV2):
+a bare string in `manifest/firefox.json` (MV2).
-
-```
-default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
-style-src 'self' 'unsafe-inline'; img-src 'self' data:;
-connect-src 'self' https: http:; frame-src 'none'; form-action 'none';
-base-uri 'none'
-```
-
-`default-src 'self'` is the floor. Without it the policy governed script and
-plugins only, and everything else — frames above all — was unrestricted, which
-is what let an unescaped token symbol paint a cross-origin iframe over the
-wallet's own UI. Escaping is the primary fix for that (see
-`src/shared/html.js`); this is the second line, so an escape that does slip
-cannot reach the network.
-
-Four directives are looser than `'self'`, each for a reason that does not
-generalise:
-
-- `style-src 'unsafe-inline'` — `src/popup/index.html` and the view helpers set
-  presentation through `style="..."` attributes, which CSP blocks without this.
-  Chrome enforces `style-src` on attributes, not only on `<style>` blocks, and
-  Firefox has never implemented `style-src-attr`, so there is no narrower
-  spelling that works on both targets. It permits inline **style**; script stays
-  under `script-src`, which does not allow `'unsafe-inline'`.
-- `img-src data:` — identicons are generated in the popup by
-  `ethereum-blockies-base64` and assigned to `img.src` as `data:` PNGs.
-- `connect-src https: http:` — the RPC endpoint is user-configurable and a local
-  node over `http://127.0.0.1` is a supported configuration, which the Firefox
-  end-to-end suite depends on. The wallet's outbound traffic is constrained by
-  what it is written to contact (see External Communication), not by this
-  directive.
-- `frame-src 'none'`, `form-action 'none'`, `base-uri 'none'` — named rather
-  than inherited. `form-action` and `base-uri` do not fall back to `default-src`
-  at all, so they would have stayed unrestricted; `frame-src 'none'` is what
-  refuses the framed-overlay attack outright.
 
 `'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
 build and a `wasm2js` translation of it in one file, tries WASM first, and
@@ -1519,10 +1478,9 @@ strings, not inline script, not remote script. Using it requires already
 executing script in an extension page, which is complete compromise on its own.
 `'unsafe-eval'` is a different proposition and is not granted.
 
-The policy is pinned in both directions. `tests/manifest.test.js` asserts the
+The grant is pinned in both directions. `tests/manifest.test.js` asserts the
-exact directive set and the exact token set of each directive in both manifests,
+exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
-so dropping `'wasm-unsafe-eval'` (a silent 20x regression on the key
+20x regression on the key derivation) and adding anything beyond it both fail
-derivation), dropping `default-src`, and adding anything anywhere all fail
 `make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
 backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
 under the real manifest.

TODO.md

@@ -44,60 +44,6 @@ but the review is broader than any of them.
 
 # Completed Steps
 
-- 2026-08-20: A hostile ERC-20 symbol no longer renders as live HTML in the
-  popup ([#307](https://git.eeqj.de/sneak/AutistMask/issues/307)). A token
-  symbol is whatever the contract's `symbol()` returns, the block explorer
-  passes it through unfiltered, and `balanceLine()` interpolated it into an
-  `innerHTML` string — so a token with the 1,000 holders the spam filter asks
-  for, airdropped to the victim, could paint a full-viewport cross-origin iframe
-  over the wallet's own UI, on the screens where the user types their password.
-  `escapeHtml` moved to `src/shared/html.js` as a pure string replace over `&`,
-  `<`, `>`, `"` and `'`: the old implementation round-tripped through a detached
-  element's `textContent`, which does not escape quotes, and it was already
-  being used inside `data-copy="..."`. Every interpolation into an `innerHTML`
-  string across `src/popup/views/` was audited, not just the reported one — the
-  transaction lists' direction label, the wallet name and ENS name in the Home
-  list, the `href` in the explorer link, and the confirmation screen's warning
-  line were all unescaped as well. Both manifests now declare
-  `default-src 'self'` with `frame-src 'none'`; the four directives that had to
-  stay looser than `'self'` are named and justified in the Content Security
-  Policy section of README.md, and `tests/manifest.test.js` pins the whole set
-  exactly. A display cap of 12 characters bounds the symbol, matching the bound
-  `lookupTokenInfo()` already applied on the contract-read path. Not repurposed
-  for any of this: `isSpoofedSymbol()`, which answers a different question and
-  would have been the wrong control.
-- 2026-08-20: A page asking which chain the wallet is on is told the chain the
-  user is actually on ([#317](https://git.eeqj.de/sneak/AutistMask/issues/317)).
-  `eth_chainId` and `net_version` answered from `currentNetwork()`, which reads
-  the module-level `state` singleton that nothing populates at module scope, so
-  a service worker revived by the page's own message answered out of
-  `DEFAULT_STATE` and reported mainnet `0x1`/`1` to a user on Sepolia — a dApp
-  building its interaction for the wrong chain. Both now answer from
-  `getState()`, the per-call detached storage read the other read handlers use,
-  rather than from the singleton: these two are reachable by any page on every
-  provider init, and mutating the shared singleton on that path would detach the
-  wallet objects an in-flight `backgroundRefresh()` is mutating. The read side
-  of the background was audited with it: the remaining singleton reads are the
-  chain switch, the transaction verification path and `backgroundRefresh`, which
-  each already load, and everything else answers from storage per call through
-  `getState()`. One stale read is left named but unfixed, outside this issue's
-  scope: `handleSendTransaction` builds its provider with no network name, so
-  `getProvider()` falls back to the same unloaded singleton for ethers' static
-  network hint.
-- 2026-08-20: The dApp approval screen no longer shows a token transfer it
-  cannot scale as `0.0000`
-  ([#306](https://git.eeqj.de/sneak/AutistMask/issues/306)). `decodeCalldata`
-  read decimals from the 512-entry bundled token list alone and fell back to 18,
-  so every token outside it — most of them, including anything the user added by
-  contract address — was displayed at the wrong scale: a `transfer` of 5,000
-  units of a 6-decimal token read as `0.0000`, and a user who reads zero
-  confirms the drain. The new `src/shared/approvalAmount.js` resolves the scale
-  from the bundled list, then `state.trackedTokens`, then the decimals the block
-  explorer already reported in `addr.tokenBalances`, and refuses one the
-  explorer's own entries disagree about. Where no source knows it, the amount
-  line is not formatted at all: it shows the base-unit integer and states that
-  the scale is unknown, for `approve` as well as `transfer`. An unbounded
-  allowance still reads `Unlimited`, which needs no scale.
 - 2026-08-20: A web page can no longer switch the wallet's chain, and switching
   no longer destroys the user's endpoints
   ([#308](https://git.eeqj.de/sneak/AutistMask/issues/308)).
@@ -114,33 +60,7 @@ but the review is broader than any of them.
   for the network being entered; `state.rpcUrl` stays the live value for the
   active network, so no reader changed. A profile written before the map existed
   has its stored pair adopted for the network it was stored under, and loses
-  nothing. The handler now loads state before it switches
+  nothing.
-  ([#316](https://git.eeqj.de/sneak/AutistMask/issues/316)): the service worker
-  populates nothing at module scope, so a worker revived by the page's own
-  message held `DEFAULT_STATE`, and the switch persisted every field of it —
-  wiping every wallet, every site approval and every tracked token from storage
-  along with the endpoint.
-- 2026-08-20: The wallet's own ERC-20 send signs the amount it displayed
-  ([#305](https://git.eeqj.de/sneak/AutistMask/issues/305)). The confirmation
-  screen renders from the block explorer's cached decimals; the transfer was
-  encoded from `decimals()` read off the contract at signing time, and nothing
-  compared the two, so a token whose on-chain scale disagreed — an upgradeable
-  or proxy token, a stale explorer entry, a compromised Blockscout — signed an
-  amount that was never on screen, off by a power of ten per decimal place of
-  disagreement. The scale is now carried forward on the pending transaction from
-  the same balance entry the screen's amount, balance and symbol come from, and
-  the contract's answer is read at signing time only to be compared with it: a
-  disagreement is a refusal naming both numbers, never a preference for either
-  (`src/shared/transferAmount.js`, the `confirmTx` counterpart to
-  `approvalVerify.js`). The gas estimate encodes from the same carried value and
-  no longer reads `decimals()` at all. Nothing in the e2e suite had ever clicked
-  `#btn-confirm-send`, which is how this shipped: the popup's own Send →
-  ConfirmTx → Sign & Send → WaitTx path now runs end to end to a broadcast, with
-  the `transfer()` amount decoded out of the raw signed bytes and asserted
-  against what the screen displayed, and a companion case where the contract
-  starts answering a different scale after the screen was built and nothing
-  reaches the RPC. Reverting only the signing-side comparison turns that second
-  case red and leaves the other 53 green.
 - 2026-08-17: The Settings screen is driven in a browser, and every element id
   the popup looks up is checked statically. Nothing exercised Settings in the
   e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups

manifest/chrome.json

@@ -6,7 +6,7 @@
     "permissions": ["storage", "activeTab", "alarms"],
     "host_permissions": ["<all_urls>"],
     "content_security_policy": {
-        "extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
+        "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
     },
     "action": {
         "default_popup": "src/popup/index.html"

manifest/firefox.json

@@ -4,7 +4,7 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
+    "content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
     "browser_action": {
         "default_popup": "src/popup/index.html"
     },

src/background/index.js

@@ -3,11 +3,7 @@
 // non-sensitive calls to the configured Ethereum JSON-RPC endpoint.
 
 const { DEFAULT_RPC_URL } = require("../shared/constants");
-const {
+const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
-    SUPPORTED_CHAIN_IDS,
-    networkById,
-    networkByChainId,
-} = require("../shared/networks");
 const { onChainSwitch } = require("../shared/chainSwitch");
 const {
     state,
@@ -667,28 +663,12 @@ async function handleRpc(method, params, origin) {
         return { result: [] };
     }
 
-    // Both answered from currentNetwork(), which reads the module-level state
+    if (method === "eth_chainId") {
-    // singleton, and nothing populates that at module scope. A worker revived
+        return { result: currentNetwork().chainId };
-    // by the page's own message therefore held DEFAULT_STATE and told a page
+    }
-    // it was on mainnet while the user was on Sepolia
+
-    // (https://git.eeqj.de/sneak/AutistMask/issues/317).
+    if (method === "net_version") {
-    //
+        return { result: currentNetwork().networkVersion };
-    // Answered from getState() rather than by loading the singleton. Any page
-    // reaches these two — neither is gated on a connection, and the injected
-    // provider sends eth_chainId on every page load — and loadState() replaces
-    // state.wallets wholesale, which would detach the address objects an
-    // in-flight backgroundRefresh() is mutating across its network round trip,
-    // so its saveState() would persist the pre-refresh balances while still
-    // stamping lastBalanceRefresh. getState() is the detached per-call storage
-    // read the other read handlers here already use.
-    // networkById(undefined) falls back to mainnet, matching the default for a
-    // profile with no stored networkId.
-    if (method === "eth_chainId" || method === "net_version") {
-        const s = await getState();
-        const net = networkById(s.networkId);
-        return {
-            result: method === "eth_chainId" ? net.chainId : net.networkVersion,
-        };
     }
 
     if (method === "wallet_switchEthereumChain") {
@@ -709,17 +689,6 @@ async function handleRpc(method, params, origin) {
             return { error: { code: 4100, message: "Unauthorized" } };
         }
 
-        // onChainSwitch() mutates the module-level state singleton and then
-        // saves every field of it, and currentNetwork() reads the same
-        // singleton. This worker may have been started by this very message:
-        // nothing loads state at module scope, so without this the singleton
-        // is DEFAULT_STATE, the same-chain check compares against the wrong
-        // network, and the save writes empty wallets, empty allowedSites and
-        // the default endpoints over the user's stored profile
-        // (https://git.eeqj.de/sneak/AutistMask/issues/316). Same precedent
-        // as the transaction path below.
-        await loadState();
-
         const chainId = params?.[0]?.chainId;
         if (chainId === currentNetwork().chainId) {
             return { result: null };

src/popup/views/addToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -13,7 +13,7 @@ function show() {
     list.innerHTML = getTopTokens(25)
         .map(
             (t) =>
-                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${escapeHtml(t.address)}" data-symbol="${escapeHtml(t.symbol)}" data-decimals="${escapeHtml(t.decimals)}">${escapeHtml(t.symbol)}</button>`,
+                `<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${t.address}" data-symbol="${t.symbol}" data-decimals="${t.decimals}">${t.symbol}</button>`,
         )
         .join("");
     list.querySelectorAll(".common-token").forEach((btn) => {

src/popup/views/addressDetail.js

@@ -6,7 +6,6 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
@@ -222,12 +221,10 @@ function renderTransactions(txs) {
                   : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
+        const dirLabel = tx.directionLabel;
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
+            ? escapeHtml(tx.value + " " + tx.symbol)
-            : escapeHtml(sym);
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);

src/popup/views/addressToken.js

@@ -9,7 +9,6 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     balanceLine,
     renderAddressHtml,
@@ -125,11 +124,7 @@ function show() {
     currentSymbol = symbol;
 
     $("address-token-title").textContent =
-        wallet.name +
+        wallet.name + " \u2014 Address " + (ai + 1) + " \u2014 " + symbol;
-        " \u2014 Address " +
-        (ai + 1) +
-        " \u2014 " +
-        displaySymbol(symbol);
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -179,9 +174,7 @@ function show() {
             (knownToken && knownToken.symbol) ||
             null;
         const tokenName = rawName ? escapeHtml(rawName) : null;
-        const tokenSymbol = rawSymbol
+        const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
-            ? escapeHtml(displaySymbol(rawSymbol))
-            : null;
         const tokenDecimals =
             tb && tb.decimals != null
                 ? tb.decimals
@@ -295,12 +288,10 @@ function renderTransactions(txs) {
         const counterparty = tx.direction === "sent" ? tx.to : tx.from;
         const ensName = ensNameMap.get(counterparty) || null;
         const title = addressTitle(counterparty, state.wallets);
-        // The explorer's method name for a contract call, title-cased.
+        const dirLabel = tx.directionLabel;
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
+            ? escapeHtml(tx.value + " " + tx.symbol)
-            : escapeHtml(sym);
+            : escapeHtml(tx.symbol);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr =
             title || ensName || truncateMiddle(counterparty, maxAddr);
@@ -370,7 +361,7 @@ function init(_ctx) {
         }
         // Hide dropdown, show static token display
         $("send-token").classList.add("hidden");
-        let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
+        let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
         if (tokenId !== "ETH") {
             staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
         }

src/popup/views/approval.js

@@ -21,10 +21,6 @@ const {
 const { getPrice, formatUsd } = require("../../shared/prices");
 const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../../shared/approvalAmount");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
@@ -47,23 +43,6 @@ function formatTxValue(val) {
     return parts[0] + "." + dec;
 }
 
-// The amount line for a decoded ERC-20 call. With a known scale it is the
-// token quantity; with `decimals` null it is the base-unit integer with the
-// unknown scale stated, because formatting it with an assumed scale is what
-// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
-// carry, `display` is what the approval screen shows.
-function tokenAmountText(rawAmount, decimals, symbol) {
-    if (decimals === null) {
-        const unknown = unknownDecimalsAmount(rawAmount);
-        return { raw: unknown, display: unknown };
-    }
-    const formatted = formatTxValue(formatUnits(rawAmount, decimals));
-    return {
-        raw: formatted,
-        display: formatted + (symbol ? " " + symbol : ""),
-    };
-}
-
 function tokenLabel(address) {
     const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
     return t ? t.symbol : null;
@@ -80,15 +59,7 @@ function decodeCalldata(data, toAddress) {
         if (parsed) {
             const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
             const tokenSymbol = token ? token.symbol : null;
-            // null when no source knows this token's scale. It is not
+            const tokenDecimals = token ? token.decimals : 18;
-            // defaulted to 18: an amount formatted with a guessed scale is
-            // the wrong number, and for a token with fewer decimals than the
-            // guess it is the wrong number in the direction that reads as
-            // zero. See tokenAmountText().
-            const tokenDecimals = resolveTokenDecimals(toAddress, {
-                trackedTokens: state.trackedTokens,
-                wallets: state.wallets,
-            });
             const contractLabel = tokenSymbol
                 ? tokenSymbol + " (" + toAddress + ")"
                 : toAddress;
@@ -100,11 +71,12 @@ function decodeCalldata(data, toAddress) {
                     "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                 );
                 const isUnlimited = rawAmount === maxUint;
-                // An unbounded allowance needs no scale to describe, so it is
+                const amountRaw = isUnlimited
-                // still named rather than refused.
+                    ? "Unlimited"
-                const amount = isUnlimited
+                    : formatTxValue(formatUnits(rawAmount, tokenDecimals));
-                    ? { raw: "Unlimited", display: "Unlimited" }
+                const amountStr = isUnlimited
-                    : tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
+                    ? "Unlimited"
+                    : amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Approval",
@@ -125,8 +97,8 @@ function decodeCalldata(data, toAddress) {
                         },
                         {
                             label: "Amount",
-                            value: amount.display,
+                            value: amountStr,
-                            rawValue: amount.raw,
+                            rawValue: amountRaw,
                         },
                     ],
                 };
@@ -135,11 +107,11 @@ function decodeCalldata(data, toAddress) {
             if (parsed.name === "transfer") {
                 const to = parsed.args[0];
                 const rawAmount = parsed.args[1];
-                const amount = tokenAmountText(
+                const amountRaw = formatTxValue(
-                    rawAmount,
+                    formatUnits(rawAmount, tokenDecimals),
-                    tokenDecimals,
-                    tokenSymbol,
                 );
+                const amountStr =
+                    amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
 
                 return {
                     name: "Token Transfer",
@@ -156,8 +128,8 @@ function decodeCalldata(data, toAddress) {
                         { label: "Recipient", value: to, address: to },
                         {
                             label: "Amount",
-                            value: amount.display,
+                            value: amountStr,
-                            rawValue: amount.raw,
+                            rawValue: amountRaw,
                         },
                     ],
                 };

src/popup/views/confirmTx.js

@@ -10,7 +10,6 @@ const {
     showView,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
@@ -26,10 +25,6 @@ const {
     getFullWarnings,
 } = require("../../shared/addressWarnings");
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
-const {
-    displayedDecimals,
-    transferAmountUnits,
-} = require("../../shared/transferAmount");
 const {
     CODES,
     FEE_PENDING,
@@ -58,7 +53,7 @@ function restore() {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function confirmAddressHtml(address, ensName, title) {
@@ -82,11 +77,7 @@ function show(txInfo) {
     feeWei = null;
 
     const isErc20 = txInfo.token !== "ETH";
-    // The raw symbol is the price-table key; the capped one is what the
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
-    // screen says. Truncating before the lookup would silently drop the
-    // price of any token whose symbol is long enough to be capped.
-    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
-    const symbol = displaySymbol(rawSymbol);
 
     // Transaction type
     if (isErc20) {
@@ -128,7 +119,7 @@ function show(txInfo) {
 
     // Amount (with inline USD)
     const ethPrice = getPrice("ETH");
-    const tokenPrice = getPrice(rawSymbol);
+    const tokenPrice = getPrice(symbol);
     const amountNum = parseFloat(txInfo.amount);
     const price = isErc20 ? tokenPrice : ethPrice;
     const amountUsd = price ? amountNum * price : null;
@@ -161,12 +152,7 @@ function show(txInfo) {
         warningsEl.innerHTML = localWarnings
             .map(
                 (w) =>
-                    // Only the three hardcoded strings in
+                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
-                    // src/shared/addressWarnings.js reach this today, but
-                    // src/shared/etherscanLabels.js already builds a
-                    // `warning` out of scraped explorer markup, so this is
-                    // one wiring change away from carrying remote text.
-                    `<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
             )
             .join("");
         warningsEl.style.visibility = "visible";
@@ -216,7 +202,7 @@ function show(txInfo) {
 // touches already occupies its space, so re-running it never moves anything.
 function renderValidation(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-    const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
+    const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
 
     const { canSend, codes } = validateTransfer({
         isErc20,
@@ -316,17 +302,8 @@ async function estimateGas(txInfo) {
             });
         } else {
             const contract = new Contract(txInfo.token, ERC20_ABI, provider);
-            // The scale the screen is rendering with, not the contract's own
+            const decimals = await contract.decimals();
-            // answer: the estimate has to be for the transfer that would be
+            const amount = parseUnits(txInfo.amount, decimals);
-            // signed, and that one is encoded from what was displayed. See
-            // transferAmount.js. A pending transaction that carries no usable
-            // scale throws here, which reports the fee as unknown and leaves
-            // Send blocked — an amount that cannot be checked against the
-            // screen is never estimated for, let alone sent.
-            const amount = parseUnits(
-                txInfo.amount,
-                displayedDecimals(txInfo.tokenDecimals),
-            );
             gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
                 from: txInfo.from,
             });
@@ -468,16 +445,8 @@ function init(_ctx) {
                     ERC20_ABI,
                     connectedSigner,
                 );
-                // The contract's decimals() is read to be COMPARED with the
+                const decimals = await contract.decimals();
-                // scale the screen rendered this amount at, not to encode with:
+                const amount = parseUnits(pendingTx.amount, decimals);
-                // encoding from it signs whatever the contract answers now,
-                // which is not what the user read. A disagreement throws and is
-                // reported on the error screen. See transferAmount.js.
-                const amount = transferAmountUnits(
-                    pendingTx.amount,
-                    pendingTx.tokenDecimals,
-                    await contract.decimals(),
-                );
                 tx = await contract.transfer(pendingTx.to, amount);
             }
 

src/popup/views/deleteAddress.js

@@ -11,7 +11,6 @@ const {
     $,
     showView,
     showFlash,
-    escapeHtml,
     goBack,
     renderAddressHtml,
     attachCopyHandlers,
@@ -93,7 +92,7 @@ function balanceWarningHtml(addr) {
     if (!addressHoldsFunds(addr)) return " ";
     const line = formatAddressTotal(getAddressValue(addr));
     const total = line
-        ? `<div class="text-xs text-muted mt-1">${escapeHtml(line)}</div>`
+        ? `<div class="text-xs text-muted mt-1">${line}</div>`
         : "";
     return (
         `<p class="mb-1">This address holds a balance. Removing it does not ` +

src/popup/views/helpers.js

@@ -1,22 +1,8 @@
 // Shared DOM helpers used by all views.
-//
-// Escaping rule for every view in this directory, since they all build
-// markup by concatenation: any VALUE interpolated into an innerHTML string
-// goes through escapeHtml(), whatever its provenance looks like today. The
-// only interpolations left bare are markup FRAGMENTS this code just built
-// (a rendered dot, an icon, a composed row), which escaping would turn into
-// visible angle brackets, and locally computed numbers and loop indices.
-// The distinction is meant to be greppable: an unescaped `${` next to a
-// name that reads like data is a defect.
 
-// escapeHtml lives in src/shared/html.js, where the escape and the
-// reasoning behind it are; it is re-exported below so views keep importing
-// it from here.
-const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { displaySymbol } = require("../../shared/symbolDisplay");
 const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
@@ -191,26 +177,17 @@ function showFlash(msg, duration = 2000) {
     }, duration);
 }
 
-// One row of the balance list: symbol, quantity, fiat value.
-//
-// `symbol` is the ERC-20's own symbol() as the block explorer reported it,
-// so it is attacker-chosen markup until it has been through escapeHtml, and
-// attacker-chosen length until it has been through displaySymbol. This is
-// the row that issue #307 was reported against: every screen that lists a
-// holding renders through here.
 function balanceLine(symbol, amount, price, tokenId) {
     const qty = amount.toFixed(4);
     const usd = price ? formatUsd(amount * price) || " " : " ";
-    // tokenId is a contract address out of the same explorer JSON, and it
+    const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
-    // lands inside a quoted attribute.
-    const tokenAttr = tokenId ? ` data-token="${escapeHtml(tokenId)}"` : "";
     const clickClass = tokenId
         ? " cursor-pointer hover:bg-hover balance-row"
         : "";
     return (
         `<div class="flex text-xs${clickClass}"${tokenAttr}>` +
         `<span class="flex justify-between" style="width:42ch;max-width:100%">` +
-        `<span>${escapeHtml(displaySymbol(symbol))}</span>` +
+        `<span>${symbol}</span>` +
         `<span>${qty}</span>` +
         `</span>` +
         `<span class="text-right text-muted flex-1">${usd}</span>` +
@@ -312,6 +289,12 @@ function addressDotHtml(address) {
     return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
 }
 
+function escapeHtml(s) {
+    const div = document.createElement("div");
+    div.textContent = s;
+    return div.innerHTML;
+}
+
 // Look up an address across all wallets and return its title
 // (e.g. "Address 1.2") or null if it's not one of ours.
 function addressTitle(address, wallets) {
@@ -399,26 +382,13 @@ const EXT_ICON =
     `<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
     `</svg></span>`;
 
-// Block-explorer URLs. The origin is a per-network constant from
-// src/shared/networks.js; only the path segment is data, and it comes out
-// of explorer JSON (a transaction's from/to, a token's address_hash), which
-// nothing upstream validates as hex. percent-encoding it keeps a segment
-// that contains a slash, a query or a fragment from re-pointing the link
-// somewhere else in the explorer.
-function explorerUrl(kind, value) {
-    return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
-}
-
 function etherscanAddressUrl(address) {
-    return explorerUrl("address", address);
+    return `${currentNetwork().explorerUrl}/address/${address}`;
 }
 
-// The URL still has to be escaped on the way into href="...": encoding
-// governs what the URL means, escaping governs whether it stays inside the
-// attribute.
 function etherscanLinkHtml(url) {
     return (
-        `<a href="${escapeHtml(url)}" target="_blank" rel="noopener" ` +
+        `<a href="${url}" target="_blank" rel="noopener" ` +
         `class="inline-flex items-center">${EXT_ICON}</a>`
     );
 }
@@ -522,7 +492,6 @@ module.exports = {
     addressColor,
     addressDotHtml,
     escapeHtml,
-    displaySymbol,
     addressTitle,
     formatAddressHtml,
     renderAddressHtml,
@@ -530,7 +499,6 @@ module.exports = {
     attachCopyHandlers,
     etherscanAddressUrl,
     etherscanLinkHtml,
-    explorerUrl,
     EXT_ICON,
     truncateMiddle,
     isoDate,

src/popup/views/home.js

@@ -8,7 +8,6 @@ const {
     addressDotHtml,
     addressTitle,
     escapeHtml,
-    displaySymbol,
     truncateMiddle,
     renderAddressHtml,
     attachCopyHandlers,
@@ -110,13 +109,10 @@ function renderHomeTxList(ctx) {
                 : tx.direction === "sent" || tx.direction === "contract"
                   ? tx.to
                   : tx.from;
-        // directionLabel is the explorer's own method name for a contract
+        const dirLabel = tx.directionLabel;
-        // call, title-cased — attacker-chosen for an attacker's contract.
-        const dirLabel = escapeHtml(tx.directionLabel);
-        const sym = displaySymbol(tx.symbol);
         const amountStr = tx.value
-            ? escapeHtml(tx.value + " " + sym)
+            ? escapeHtml(tx.value + " " + tx.symbol)
-            : escapeHtml(sym);
+            : escapeHtml(tx.symbol);
         const title = addressTitle(counterparty, state.wallets);
         const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
         const displayAddr = title || truncateMiddle(counterparty, maxAddr);
@@ -230,7 +226,7 @@ function walletListHtml() {
         const defect = walletDefect(wallet);
         html += `<div>`;
         html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
-        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
+        html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
         // No "+" on a defective wallet: deriving another address from that
         // xpub would only add one more address the key does not produce
         // under the standard path.
@@ -254,13 +250,10 @@ function walletListHtml() {
             const titleBold = isActive ? "font-bold" : "";
             html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
             if (addr.ensName) {
-                // An ENS reverse record is whatever the name owner set it
+                html += `<div class="text-xs font-bold flex items-center">${dot}${addr.ensName}</div>`;
-                // to; renderAddressHtml() escapes its own copy of this and
-                // this list was the one that did not.
-                html += `<div class="text-xs font-bold flex items-center">${dot}${escapeHtml(addr.ensName)}</div>`;
             }
             html += `<div class="flex text-xs items-center justify-between">`;
-            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${escapeHtml(addr.address)}</span>`;
+            html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
             html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
             html += `</div>`;
             const addrTotal = formatAddressTotal(getAddressValue(addr));

src/popup/views/receive.js

@@ -5,7 +5,6 @@ const {
     flashCopyFeedback,
     formatAddressHtml,
     addressTitle,
-    displaySymbol,
     attachCopyHandlers,
     goBack,
 } = require("./helpers");
@@ -45,7 +44,7 @@ function show() {
         }
         warningEl.textContent =
             "This is an ERC-20 token. Only send " +
-            displaySymbol(symbol) +
+            symbol +
             " on " +
             currentNetwork().name +
             " to this address. Sending tokens on other networks will result in permanent loss.";

src/popup/views/send.js

@@ -4,7 +4,6 @@ const {
     $,
     showFlash,
     addressTitle,
-    displaySymbol,
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
@@ -132,7 +131,7 @@ function renderSendTokenSelect(addr) {
         if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
         const opt = document.createElement("option");
         opt.value = t.address;
-        opt.textContent = displaySymbol(t.symbol);
+        opt.textContent = t.symbol;
         sel.appendChild(opt);
     }
 }
@@ -221,11 +220,6 @@ function init(_ctx) {
 
         let tokenSymbol = null;
         let tokenBalance = null;
-        // The scale the amount and the balance below are rendered at, carried
-        // forward so the transfer is encoded with the number the user read
-        // rather than with whatever the contract answers at signing time. See
-        // src/shared/transferAmount.js.
-        let tokenDecimals = null;
         if (token !== "ETH") {
             const tb = (addr.tokenBalances || []).find(
                 (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -236,7 +230,6 @@ function init(_ctx) {
                 state.trackedTokens,
             );
             tokenBalance = tb ? tb.balance || "0" : "0";
-            tokenDecimals = tb ? tb.decimals : null;
         }
 
         ctx.showConfirmTx({
@@ -248,7 +241,6 @@ function init(_ctx) {
             balance: addr.balance,
             tokenSymbol: tokenSymbol,
             tokenBalance: tokenBalance,
-            tokenDecimals: tokenDecimals,
         });
     });
 

src/popup/views/settings.js

@@ -4,7 +4,6 @@ const {
     updateDebugBanner,
     showFlash,
     escapeHtml,
-    displaySymbol,
     flashCopyFeedback,
     goBack,
     pushCurrentView,
@@ -44,11 +43,8 @@ function renderSiteList(containerId, siteMap, stateKey) {
     let html = "";
     hostnames.forEach((hostname) => {
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
-        // A hostname the URL parser produced cannot carry a delimiter, so
+        html += `<span>${hostname}</span>`;
-        // this is escaped for the rule rather than for a known hole — the
+        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
-        // rule being that nothing reaches innerHTML unescaped.
-        html += `<span>${escapeHtml(hostname)}</span>`;
-        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -77,10 +73,9 @@ function renderTrackedTokens() {
     }
     let html = "";
     state.trackedTokens.forEach((token, idx) => {
-        const sym = escapeHtml(displaySymbol(token.symbol));
         const label = token.name
-            ? escapeHtml(token.name) + " (" + sym + ")"
+            ? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
-            : sym;
+            : escapeHtml(token.symbol);
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span>${label}</span>`;
         html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;

src/popup/views/settingsAddToken.js

@@ -1,4 +1,4 @@
-const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
+const { $, showView, showFlash, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -26,11 +26,11 @@ function renderTop10() {
                 : "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
             return (
                 `<button class="settings-addtoken-quick ${cls}"` +
-                ` data-address="${escapeHtml(t.address)}"` +
+                ` data-address="${t.address}"` +
-                ` data-symbol="${escapeHtml(t.symbol)}"` +
+                ` data-symbol="${t.symbol}"` +
-                ` data-decimals="${escapeHtml(t.decimals)}"` +
+                ` data-decimals="${t.decimals}"` +
-                ` data-name="${escapeHtml(t.name || "")}"` +
+                ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
-                `${tracked ? " disabled" : ""}>${escapeHtml(t.symbol)}</button>`
+                `${tracked ? " disabled" : ""}>${t.symbol}</button>`
             );
         })
         .join("");
@@ -62,11 +62,11 @@ function renderDropdown() {
         const tracked = isTracked(t.address);
         const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
         html +=
-            `<option value="${escapeHtml(t.address)}"` +
+            `<option value="${t.address}"` +
-            ` data-symbol="${escapeHtml(t.symbol)}"` +
+            ` data-symbol="${t.symbol}"` +
-            ` data-decimals="${escapeHtml(t.decimals)}"` +
+            ` data-decimals="${t.decimals}"` +
-            ` data-name="${escapeHtml(t.name || "")}"` +
+            ` data-name="${(t.name || "").replace(/"/g, "&quot;")}"` +
-            `${tracked ? " disabled" : ""}>${escapeHtml(label)}</option>`;
+            `${tracked ? " disabled" : ""}>${label}</option>`;
     }
     sel.innerHTML = html;
 }

src/popup/views/transactionDetail.js

@@ -15,11 +15,9 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     goBack,
 } = require("./helpers");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { formatEther, formatUnits } = require("ethers");
 const makeBlockie = require("ethereum-blockies-base64");
 const { log, debugFetch } = require("../../shared/log");
@@ -46,7 +44,7 @@ function getTransactionType(tx) {
 
 function blockieHtml(address) {
     const src = makeBlockie(address);
-    return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
+    return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
 }
 
 function txAddressHtml(address, ensName, title) {
@@ -58,7 +56,7 @@ function txAddressHtml(address, ensName, title) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     const extLink = etherscanLinkHtml(link);
     return copyableHtml(hash, "break-all") + extLink;
 }
@@ -103,10 +101,9 @@ function render() {
     $("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
 
     // Exact amount (full precision, copyable)
-    const detailSym = displaySymbol(tx.symbol);
     const exactStr = tx.exactValue
-        ? tx.exactValue + " " + detailSym
+        ? tx.exactValue + " " + tx.symbol
-        : tx.directionLabel + " " + detailSym;
+        : tx.directionLabel + " " + tx.symbol;
     $("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
 
     // Native quantity (raw integer, copyable)
@@ -136,7 +133,7 @@ function render() {
     if (tokenContractSection && tokenContractEl) {
         if (tx.contractAddress) {
             const dot = addressDotHtml(tx.contractAddress);
-            const link = explorerUrl("token", tx.contractAddress);
+            const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
             tokenContractEl.innerHTML =
                 `<div class="flex items-center">${dot}` +
                 copyableHtml(tx.contractAddress, "break-all") +
@@ -188,7 +185,7 @@ function showDetailField(sectionId, contentId, value) {
 function populateOnChainDetails(txData) {
     // Block number
     if (txData.block_number != null) {
-        const blockLink = explorerUrl("block", String(txData.block_number));
+        const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
         const blockSection = $("tx-detail-block-section");
         const blockEl = $("tx-detail-block");
         if (blockSection && blockEl) {
@@ -312,7 +309,7 @@ async function loadFullTxDetails(txHash, toAddress) {
                     // Token entry: show symbol on its own line, then address via shared renderer
                     const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
                     if (tokenSymbol) {
-                        detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
+                        detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
                     }
                     detailsHtml += renderAddressHtml(d.address);
                 } else if (d.address) {

src/popup/views/txStatus.js

@@ -9,12 +9,10 @@ const {
     attachCopyHandlers,
     copyableHtml,
     etherscanLinkHtml,
-    explorerUrl,
-    displaySymbol,
     clearViewStack,
 } = require("./helpers");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
-const { state } = require("../../shared/state");
+const { state, currentNetwork } = require("../../shared/state");
 const { getProvider } = require("../../shared/balances");
 const { log } = require("../../shared/log");
 
@@ -64,13 +62,13 @@ function toAddressHtml(address) {
 }
 
 function txHashHtml(hash) {
-    const link = explorerUrl("tx", hash);
+    const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
     return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
 }
 
 function blockNumberHtml(blockNumber) {
     const num = String(blockNumber);
-    const link = explorerUrl("block", num);
+    const link = `${currentNetwork().explorerUrl}/block/${num}`;
     return copyableHtml(num) + etherscanLinkHtml(link);
 }
 
@@ -82,10 +80,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     endWait();
     const id = waitId;
 
-    const symbol =
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
     $("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
     $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
     $("wait-tx-hash").innerHTML = txHashHtml(txHash);
@@ -216,10 +211,7 @@ function restoreWait() {
 function showSuccess(txInfo, txHash, blockNumber) {
     endWait();
 
-    const symbol =
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
@@ -307,10 +299,7 @@ function renderSuccess() {
 function showError(txInfo, txHash, message) {
     endWait();
 
-    const symbol =
+    const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
-        txInfo.token === "ETH"
-            ? "ETH"
-            : displaySymbol(txInfo.tokenSymbol || "?");
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,

src/shared/approvalAmount.js

@@ -1,103 +0,0 @@
-// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
-// to display when there is no such scale.
-//
-// The approval screen decodes `transfer` and `approve` calldata into a
-// quantity the user confirms against. That quantity is a base-unit integer,
-// and turning it into a number a person can read needs the token's decimals.
-// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
-// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
-// default of 18 it reads `0.0000`, and a user who reads zero signs.
-//
-// So a scale is either found or the amount is not formatted. Decimals are
-// looked for in the bundled token list, then in the tokens the user tracks,
-// then in what the block explorer reported for the contract; where none of
-// them answers, unknownDecimalsAmount() renders the base-unit integer with the
-// unknown scale stated, and no formatUnits() call is reached at all.
-//
-// This is the display counterpart to transferAmount.js, which takes the same
-// stance on the wallet's own send path: an amount whose scale is unknown or
-// disputed is refused rather than guessed at.
-
-// Solidity's decimals() is a uint8, and every source here is ultimately
-// reporting that call's result.
-const { MAX_DECIMALS } = require("./transferAmount");
-const { TOKEN_BY_ADDRESS } = require("./tokenList");
-
-// A decimals value as a number, or null if it is not one. The bundled list
-// stores numbers, the explorer's copy arrives as a string, and a token the
-// user added by hand can carry whatever lookupTokenInfo() got back, so the
-// accepted types are enumerated rather than coerced: Number([]) is 0 and
-// Number(true) is 1, so a coercing check would read an empty array as a scale
-// of zero and format the amount as whole tokens.
-function toDecimals(value) {
-    let n;
-    if (typeof value === "number") {
-        n = value;
-    } else if (typeof value === "bigint") {
-        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
-        n = Number(value);
-    } else if (typeof value === "string") {
-        if (!/^[0-9]+$/.test(value)) return null;
-        n = Number(value);
-    } else {
-        return null;
-    }
-    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
-    return n;
-}
-
-// Every decimals the explorer reported for this contract, across all the
-// addresses whose balances have been fetched. They describe one contract, so
-// they should agree; a set that does not agree is a scale in dispute, and this
-// screen has no way to tell which member is the true one.
-function explorerDecimals(lower, wallets) {
-    let found = null;
-    for (const wallet of wallets || []) {
-        for (const addr of wallet.addresses || []) {
-            for (const tb of addr.tokenBalances || []) {
-                if ((tb.address || "").toLowerCase() !== lower) continue;
-                const d = toDecimals(tb.decimals);
-                if (d === null) continue;
-                if (found !== null && found !== d) return null;
-                found = d;
-            }
-        }
-    }
-    return found;
-}
-
-// The decimals to render a token amount with, or null when nothing knows.
-// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
-function resolveTokenDecimals(tokenAddress, sources) {
-    const lower = (tokenAddress || "").toLowerCase();
-    if (!lower) return null;
-
-    const bundled = TOKEN_BY_ADDRESS.get(lower);
-    if (bundled) {
-        const d = toDecimals(bundled.decimals);
-        if (d !== null) return d;
-    }
-
-    const tracked = ((sources && sources.trackedTokens) || []).find(
-        (t) => (t.address || "").toLowerCase() === lower,
-    );
-    if (tracked) {
-        const d = toDecimals(tracked.decimals);
-        if (d !== null) return d;
-    }
-
-    return explorerDecimals(lower, sources && sources.wallets);
-}
-
-// What the amount line reads when the scale is unknown. The base units are
-// exact and the caveat is part of the same string, so the number on the screen
-// cannot be mistaken for a token quantity, and it can never read as zero for a
-// transfer that is not zero.
-function unknownDecimalsAmount(rawAmount) {
-    return String(rawAmount) + " base units (decimals unknown)";
-}
-
-module.exports = {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-};

src/shared/html.js

@@ -1,41 +0,0 @@
-// HTML escaping for values interpolated into an innerHTML string.
-//
-// Every view in src/popup/views/ builds markup by string concatenation, so
-// this is the only thing standing between a value the wallet did not author
-// and the extension's own DOM. The values that reach it are attacker
-// controlled by design: an ERC-20's symbol() and name() are whatever the
-// contract chooses to return, an ENS name is whatever the resolver returns,
-// and both arrive through the block explorer with no schema.
-//
-// It escapes both quote characters as well as the tag delimiters, because
-// the popup interpolates into attribute values as well as into element
-// text — copyableHtml() writes data-copy="..." and etherscanLinkHtml()
-// writes href="...". A `<`/`>`-only escape leaves an unquoted-attribute
-// break-out intact, and the round trip through a detached element's
-// textContent that used to implement this was exactly that escape: the
-// HTML serializer only escapes `&`, `<`, `>` and U+00A0 in a text node,
-// since a text node has no idea it is about to be pasted inside quotes.
-//
-// Deliberately a pure string function with no DOM dependency: it is called
-// on every rendered row, it is unit-testable without a document, and it
-// cannot be affected by the state of a document that an attacker-supplied
-// string has already been written into.
-
-const HTML_ESCAPES = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;",
-};
-
-// `&` is escaped first by virtue of being in the same pass: a sequential
-// replace would re-escape the ampersands it had just introduced.
-function escapeHtml(s) {
-    if (s === null || s === undefined) return "";
-    return String(s).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
-}
-
-module.exports = {
-    escapeHtml,
-};

src/shared/state.js

@@ -137,18 +137,8 @@ async function loadState() {
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
         state.blockscoutUrl =
             saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
-        // An actual object is required, not merely a truthy non-array: the
-        // code below and onChainSwitch() index and ASSIGN INTO this value,
-        // and assigning a property to a string or a number is a silent no-op
-        // in sloppy mode. A stored primitive would therefore be re-persisted
-        // unchanged forever, and every switch would fall back to the network
-        // default — the endpoint loss this map exists to prevent, with no
-        // self-healing. The allowedSites/deniedSites guards below are only
-        // read from, which is why they can be looser.
         state.networkEndpoints =
-            typeof saved.networkEndpoints === "object" &&
+            saved.networkEndpoints && !Array.isArray(saved.networkEndpoints)
-            saved.networkEndpoints !== null &&
-            !Array.isArray(saved.networkEndpoints)
                 ? saved.networkEndpoints
                 : {};
         // A profile written before this map existed carries exactly one pair

src/shared/symbolDisplay.js

@@ -1,43 +0,0 @@
-// The length bound on a token symbol as displayed.
-//
-// A symbol is whatever an ERC-20's symbol() returns and the wallet fetches
-// it from the block explorer, which imposes no length: src/shared/balances.js
-// takes `item.token.symbol` as given. A kilobyte-long symbol is a real
-// return value, and rendering it pushes every amount off the row, scrolls
-// the balance list past the screen, and hides the figures the user is there
-// to read.
-//
-// This is a layout bound, not a security control. Escaping is what makes a
-// hostile symbol inert (see src/shared/html.js), and isSpoofedSymbol() is
-// what catches one impersonating a known ticker; neither job belongs here
-// and neither is done here. Truncating an unescaped symbol would still be
-// an injection, just a shorter one.
-//
-// 12 characters, which is the bound lookupTokenInfo() in
-// src/shared/balances.js already applies when it stores a symbol read
-// straight off a contract; the explorer path was the one with no bound at
-// all. The longest symbol across the 512 entries of the bundled list is 10
-// (MSYRUPUSDP), so nothing the wallet ships as a real token is ever
-// truncated. The ellipsis is what tells the user the name they are looking
-// at is not the whole name — worth knowing before they send to it.
-
-const MAX_SYMBOL_LENGTH = 12;
-
-// The placeholder for a token whose symbol the explorer did not report.
-// balances.js already substitutes this; repeated here so a symbol that
-// arrives empty from anywhere else displays the same way rather than as a
-// blank gap in the row.
-const UNKNOWN_SYMBOL = "???";
-
-function displaySymbol(symbol) {
-    const s = symbol === null || symbol === undefined ? "" : String(symbol);
-    if (s.length === 0) return UNKNOWN_SYMBOL;
-    if (s.length <= MAX_SYMBOL_LENGTH) return s;
-    return s.slice(0, MAX_SYMBOL_LENGTH - 1) + "…";
-}
-
-module.exports = {
-    displaySymbol,
-    MAX_SYMBOL_LENGTH,
-    UNKNOWN_SYMBOL,
-};

src/shared/transferAmount.js

@@ -1,116 +0,0 @@
-// The base-unit amount an ERC-20 transfer from the wallet's own Send screen is
-// encoded with.
-//
-// A token amount is a decimal string plus a scale, and the two come from
-// different places. The confirmation screen renders the amount, the balance and
-// the symbol from the block explorer's cached metadata (see
-// fetchTokenBalances() in balances.js); the transfer used to be encoded from
-// decimals() read off the contract at signing time, and nothing compared the
-// two. A token whose on-chain scale differs from the cached one — an
-// upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
-// entry — therefore signed an amount that was never displayed, off by a power
-// of ten for every decimal place of disagreement.
-//
-// So the scale used to encode is the scale the screen rendered with, carried
-// forward on the pending transaction, and the contract's own answer is read
-// only to be compared with it. A disagreement is a refusal, never a preference
-// for either number: the wallet cannot tell which of the two the user meant,
-// and both candidate transfers move an amount nobody approved.
-//
-// This is the confirmTx counterpart to approvalVerify.js, which does the same
-// job for the dApp approval path, and it takes the same stance: a quantity that
-// cannot be compared with what was displayed has not been checked, so an absent
-// or unusable value is refused rather than filled in.
-//
-// Every message here is shown to the user on the transaction error screen, so
-// each is a full sentence and names the numbers it is refusing over.
-
-const { parseUnits } = require("ethers");
-
-// Solidity's decimals() returns a uint8, so anything outside that range is not
-// an answer this wallet can use.
-const MAX_DECIMALS = 255;
-
-const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the number of decimal places this" +
-    " amount was shown with is unknown, so the amount that would be signed" +
-    " cannot be shown to be the amount that was displayed.";
-
-const UNREADABLE_CONTRACT_DECIMALS_MESSAGE =
-    "The transfer was not sent, because the token contract did not report a" +
-    " usable number of decimal places, so the amount that would be signed" +
-    " cannot be checked against the amount that was displayed.";
-
-function mismatchMessage(displayed, onChain) {
-    return (
-        "The transfer was not sent. The token contract reports " +
-        onChain +
-        " decimal places, but the amount was displayed using " +
-        displayed +
-        ", so signing it would move a different amount than the one shown." +
-        " Reopen the wallet to reload this token's details and try again."
-    );
-}
-
-// A decimals value from either source as a number, or null if it is not one.
-// decimals() comes back from ethers as a bigint and the explorer's copy arrives
-// as a string, so both of those are accepted alongside a plain number; anything
-// fractional, negative, out of uint8 range, or of any other type at all is not.
-//
-// The types are enumerated rather than coerced because Number() is far too
-// willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
-// admit an empty array as a scale of zero and encode a whole-token transfer
-// against it.
-function toDecimals(value) {
-    let n;
-    if (typeof value === "number") {
-        n = value;
-    } else if (typeof value === "bigint") {
-        if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
-        n = Number(value);
-    } else if (typeof value === "string") {
-        if (!/^[0-9]+$/.test(value)) return null;
-        n = Number(value);
-    } else {
-        return null;
-    }
-    if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
-    return n;
-}
-
-// The decimals the confirmation screen rendered an amount with, as a number.
-// Throws when the pending transaction does not carry a usable one — which is
-// also what keeps the gas estimate from quietly estimating a different transfer
-// than the one that would be signed.
-function displayedDecimals(value) {
-    const displayed = toDecimals(value);
-    if (displayed === null) {
-        throw new Error(UNKNOWN_DISPLAYED_DECIMALS_MESSAGE);
-    }
-    return displayed;
-}
-
-// The transfer amount in the token's base units, or a throw. `amount` is the
-// decimal string the user typed and the screen displayed, `displayed` is the
-// scale it was displayed at, and `onChain` is what the contract's decimals()
-// answered at signing time. The two scales must agree.
-function transferAmountUnits(amount, displayed, onChain) {
-    const shown = displayedDecimals(displayed);
-    const reported = toDecimals(onChain);
-    if (reported === null) {
-        throw new Error(UNREADABLE_CONTRACT_DECIMALS_MESSAGE);
-    }
-    if (reported !== shown) {
-        throw new Error(mismatchMessage(shown, reported));
-    }
-    return parseUnits(String(amount), shown);
-}
-
-module.exports = {
-    displayedDecimals,
-    transferAmountUnits,
-    mismatchMessage,
-    MAX_DECIMALS,
-    UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-    UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-};

tests/approvalAmount.test.js

@@ -1,208 +0,0 @@
-// The quantity the dApp approval screen shows for a decoded ERC-20 call.
-//
-// The screen's amount line is the only place a user sees how much a page is
-// asking for, and it is decoded from calldata, which carries base units and
-// no scale. Issue #306: decodeCalldata read decimals from the bundled token
-// list alone and fell back to 18, so a `transfer` of 5000000000 units of a
-// 6-decimal token — 5,000 tokens — was displayed as `0.0000` and confirmed.
-//
-// What is asserted here is that the scale is found wherever the wallet
-// already has it, and that where it is nowhere at all no formatted number is
-// produced: the amount line has to say base units and say the scale is
-// unknown, because a wrong quantity that reads as zero is worse than an
-// unwieldy correct one.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { Interface } = require("ethers");
-const { ERC20_ABI } = require("../src/shared/constants");
-const { state } = require("../src/shared/state");
-const {
-    resolveTokenDecimals,
-    unknownDecimalsAmount,
-} = require("../src/shared/approvalAmount");
-const { decodeCalldata } = require("../src/popup/views/approval");
-
-const iface = new Interface(ERC20_ABI);
-
-// Outside the bundled list, as the great majority of ERC-20s are.
-const NOVEL_TOKEN = "0xE2E0000000000000000000000000000000000E2e";
-// In the bundled list, at 6 decimals.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const SPENDER = "0x1111111111111111111111111111111111111111";
-
-// 5,000 units of a 6-decimal token, the amount from the issue.
-const FIVE_THOUSAND_AT_SIX = 5000000000n;
-const MAX_UINT256 = (1n << 256n) - 1n;
-
-function transferData(amount) {
-    return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
-}
-
-function approveData(amount) {
-    return iface.encodeFunctionData("approve", [SPENDER, amount]);
-}
-
-// The Amount line as the approval screen renders it.
-function amountLine(data, tokenAddress) {
-    const decoded = decodeCalldata(data, tokenAddress);
-    const detail = decoded.details.find((d) => d.label === "Amount");
-    return detail.value;
-}
-
-// A wallet holding `token` with the decimals the block explorer reported,
-// shaped as balances.js writes it onto state.
-function walletsHolding(token, decimals) {
-    return [
-        {
-            name: "Wallet 1",
-            addresses: [
-                {
-                    address: "0x" + "a".repeat(40),
-                    balance: "1.0",
-                    tokenBalances: [
-                        {
-                            address: token,
-                            symbol: "NOVEL",
-                            decimals,
-                            balance: "5000.0",
-                        },
-                    ],
-                },
-            ],
-        },
-    ];
-}
-
-beforeEach(() => {
-    state.trackedTokens = [];
-    state.wallets = [];
-});
-
-describe("resolveTokenDecimals", () => {
-    test("prefers the bundled list", () => {
-        state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
-        expect(resolveTokenDecimals(USDC, state)).toBe(6);
-    });
-
-    test("reads a token the user tracks", () => {
-        state.trackedTokens = [
-            {
-                address: NOVEL_TOKEN.toLowerCase(),
-                symbol: "NOVEL",
-                decimals: 6,
-            },
-        ];
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("reads the decimals the explorer reported", () => {
-        // Blockscout's copy arrives as a string.
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("falls past a tracked entry whose decimals are unusable", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: NaN },
-        ];
-        state.wallets = walletsHolding(NOVEL_TOKEN, 6);
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
-    });
-
-    test("refuses a scale the explorer's own entries disagree about", () => {
-        const wallets = walletsHolding(NOVEL_TOKEN, 6);
-        wallets[0].addresses.push({
-            address: "0x" + "b".repeat(40),
-            balance: "0.0",
-            tokenBalances: [
-                { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 18 },
-            ],
-        });
-        state.wallets = wallets;
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-
-    test("rejects values that are not a uint8", () => {
-        for (const decimals of [-1, 256, 1.5, true, [], {}, null, "6.0", ""]) {
-            state.trackedTokens = [{ address: NOVEL_TOKEN, decimals }];
-            expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-        }
-    });
-
-    test("is null when nothing knows the token", () => {
-        expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
-    });
-});
-
-describe("decodeCalldata amount", () => {
-    test("transfer of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer priced off the explorer's decimals shows the true quantity", () => {
-        state.wallets = walletsHolding(NOVEL_TOKEN, "6");
-        expect(
-            amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
-        ).toBe("5000.0000");
-    });
-
-    test("transfer of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).toBe(unknownDecimalsAmount(FIVE_THOUSAND_AT_SIX));
-        // The defect: any rendering that reads as a token quantity, and above
-        // all one that reads as zero.
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("approve of a tracked 6-decimal token shows the true quantity", () => {
-        state.trackedTokens = [
-            { address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
-        ];
-        expect(amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN)).toBe(
-            "5000.0000",
-        );
-    });
-
-    test("approve of an unknown-decimals token shows base units, not a number", () => {
-        const line = amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN);
-        expect(line).toBe("5000000000 base units (decimals unknown)");
-        expect(line).not.toMatch(/0\.0000/);
-    });
-
-    test("an unbounded allowance is still named, with or without a scale", () => {
-        expect(amountLine(approveData(MAX_UINT256), NOVEL_TOKEN)).toBe(
-            "Unlimited",
-        );
-        expect(amountLine(approveData(MAX_UINT256), USDC)).toBe("Unlimited");
-    });
-
-    test("a bundled token keeps its symbol and its scale", () => {
-        expect(amountLine(transferData(FIVE_THOUSAND_AT_SIX), USDC)).toBe(
-            "5000.0000 USDC",
-        );
-    });
-
-    test("the amount carried to the status screens is the same string", () => {
-        const decoded = decodeCalldata(
-            transferData(FIVE_THOUSAND_AT_SIX),
-            NOVEL_TOKEN,
-        );
-        const detail = decoded.details.find((d) => d.label === "Amount");
-        expect(detail.rawValue).toBe(
-            "5000000000 base units (decimals unknown)",
-        );
-    });
-});

tests/balanceLineEscaping.test.js

@@ -1,69 +0,0 @@
-// balanceLine() is the row that issue #307 was reported against: every
-// screen that lists a holding renders through it, and the symbol it renders
-// is whatever an ERC-20's symbol() returned. This asserts against the
-// string it emits, which is what gets assigned to innerHTML.
-//
-// The browser half of the same claim — that a real Chrome renders that
-// string as text and puts no iframe in the popup DOM — is in
-// tests/e2e/run.js. This half runs inside the 20-second make test cap.
-
-"use strict";
-
-// helpers.js reaches for both at module scope through the modules it pulls
-// in. Neither is exercised by anything asserted here.
-global.chrome = {
-    storage: {
-        local: {
-            get: () => Promise.resolve({}),
-            set: () => Promise.resolve(),
-        },
-    },
-    runtime: { sendMessage: () => {} },
-};
-global.document = {
-    getElementById: () => null,
-    createElement: () => ({ style: {}, classList: { toggle() {} } }),
-    body: { prepend: () => {} },
-    addEventListener: () => {},
-};
-
-const { balanceLine } = require("../src/popup/views/helpers");
-const { MAX_SYMBOL_LENGTH } = require("../src/shared/symbolDisplay");
-
-// The payload from the issue's reproduction, verbatim.
-const HOSTILE_SYMBOL =
-    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
-
-describe("balanceLine", () => {
-    test("emits a hostile symbol as text, not as an element", () => {
-        // Deliberately asserted on the escaping alone. The cap truncates
-        // this payload before its id attribute, so an assertion about the
-        // rest of the payload would pass on the cap and say nothing about
-        // the escape.
-        const html = balanceLine(HOSTILE_SYMBOL, 1, null, null);
-        expect(html).not.toContain("<iframe");
-        expect(html).toContain("&lt;iframe");
-    });
-
-    test("caps the symbol before rendering it", () => {
-        const html = balanceLine("A".repeat(4096), 1, null, null);
-        expect(html).toContain("A".repeat(MAX_SYMBOL_LENGTH - 1) + "…");
-        expect(html).not.toContain("A".repeat(MAX_SYMBOL_LENGTH + 1));
-    });
-
-    // The token id lands inside data-token="...", so a quote in it is a
-    // way out of the attribute and into a new one.
-    test("keeps a quote-bearing token id inside its attribute", () => {
-        const html = balanceLine("TKN", 1, null, '" onclick="alert(1)');
-        expect(html).not.toContain('onclick="');
-        expect(html).toContain('data-token="&quot; onclick=&quot;alert(1)"');
-    });
-
-    test("renders an ordinary holding unchanged", () => {
-        const html = balanceLine("USDC", 1.5, null, "0xabc");
-        expect(html).toContain("<span>USDC</span>");
-        expect(html).toContain("<span>1.5000</span>");
-        expect(html).toContain('data-token="0xabc"');
-    });
-});

tests/coldWorkerChainId.test.js

@@ -1,258 +0,0 @@
-// What eth_chainId and net_version answer on a worker that has not loaded
-// state yet.
-//
-// The MV3 service worker is terminated when idle and revived by the next
-// message, and nothing loads state at module scope. Both methods answered from
-// currentNetwork(), which reads the module-level `state` singleton, so a
-// worker revived by the page's own message answered out of DEFAULT_STATE and
-// told a page it was on mainnet while the user was on Sepolia
-// (https://git.eeqj.de/sneak/AutistMask/issues/317).
-//
-// This file therefore uses the REAL state module and never calls loadState()
-// itself: the handler has to answer from storage on its own. Same shape as
-// tests/coldWorkerChainSwitch.test.js, which covers the write side.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
-const UNKNOWN_ORIGIN = "https://stranger.example";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-const REFRESHED_BALANCE = "1.5";
-
-function storedProfile(networkId) {
-    return {
-        hasWallet: true,
-        wallets: [
-            {
-                name: "Wallet 1",
-                type: "hd",
-                addresses: [
-                    { address: ADDRESS, balance: "0", tokenBalances: [] },
-                ],
-            },
-        ],
-        activeAddress: ADDRESS,
-        networkId,
-        rpcUrl: networkById(networkId).defaultRpcUrl,
-        blockscoutUrl: networkById(networkId).defaultBlockscoutUrl,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
-        deniedSites: {},
-        trackedTokens: [],
-    };
-}
-
-async function settle() {
-    for (let i = 0; i < 50; i++) await Promise.resolve();
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-// Load the background worker with the real state module behind it, over a
-// storage stub that keeps what is written.
-//
-// The stub structured-clones in both directions, as the real
-// chrome.storage.local does. A stub that handed back the live stored object
-// would alias it into whatever read it, so an in-place mutation of a detached
-// copy would appear to have reached storage and this whole class of defect
-// would be invisible here.
-//
-// opts.refreshBalances replaces the balances stub, so a test can hold a
-// refresh open across a message.
-function loadColdWorker(networkId, opts) {
-    jest.resetModules();
-
-    const options = opts || {};
-
-    jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => ({}),
-        refreshBalances: options.refreshBalances || jest.fn(async () => {}),
-    }));
-    jest.doMock("../src/shared/phishingDomains", () => ({
-        isPhishingDomain: () => false,
-    }));
-
-    let alarmHandlers = {};
-    jest.doMock("../src/shared/alarms", () => ({
-        BALANCE_REFRESH_ALARM: "balance",
-        BALANCE_REFRESH_PERIOD_MINUTES: 1,
-        ensureRecurringAlarms: jest.fn(async () => {}),
-        registerAlarmHandlers: jest.fn((handlers) => {
-            alarmHandlers = handlers;
-        }),
-    }));
-
-    const store = { autistmask: storedProfile(networkId) };
-
-    let messageListener = null;
-    const set = jest.fn(async (items) => {
-        store.autistmask = structuredClone(items.autistmask);
-    });
-
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () => structuredClone(store)),
-                set,
-            },
-        },
-        runtime: {
-            getURL: (path) => "chrome-extension://autistmask/" + path,
-            onMessage: {
-                addListener: (fn) => {
-                    messageListener = fn;
-                },
-            },
-            onConnect: { addListener: () => {} },
-            lastError: null,
-        },
-        windows: {
-            getLastFocused: (cb) => cb(null),
-            create: (options, cb) => cb({ id: 1 }),
-            remove: (id, cb) => {
-                if (cb) cb();
-            },
-            onRemoved: { addListener: () => {} },
-        },
-        tabs: {
-            query: (queryInfo, cb) => cb([{ id: 1 }]),
-            sendMessage: (tabId, message, cb) => {
-                if (cb) cb();
-            },
-        },
-        action: { setPopup: () => {} },
-    };
-
-    require("../src/background/index");
-
-    async function rpc(method, origin) {
-        let result = null;
-        messageListener(
-            { type: "AUTISTMASK_RPC", method, params: [] },
-            { origin: origin || CONNECTED_ORIGIN },
-            (r) => {
-                result = r;
-            },
-        );
-        await settle();
-        return result;
-    }
-
-    return {
-        rpc,
-        persisted: () => store.autistmask,
-        storageSet: set,
-        fireBalanceAlarm: () => alarmHandlers.balance(),
-    };
-}
-
-describe("chain identity read by a worker that never loaded state", () => {
-    test("eth_chainId answers the stored chain, not the default", async () => {
-        // The first message this worker ever sees. Reading the unloaded
-        // singleton answers mainnet's 0x1 to a user who is on Sepolia.
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("eth_chainId")).toEqual({
-            result: SEPOLIA.chainId,
-        });
-    });
-
-    test("net_version answers the stored chain, not the default", async () => {
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("net_version")).toEqual({
-            result: SEPOLIA.networkVersion,
-        });
-    });
-
-    test("answers the stored chain to an origin that never connected", async () => {
-        // Neither method is gated on a connection, so the stale answer reached
-        // any page at all; the fixed answer has to as well.
-        const bg = loadColdWorker("sepolia");
-
-        expect(await bg.rpc("eth_chainId", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.chainId,
-        });
-        expect(await bg.rpc("net_version", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.networkVersion,
-        });
-    });
-
-    test("answers mainnet for a profile stored on mainnet", async () => {
-        // The default and the stored value agree here, so this case cannot
-        // catch the defect; it is what keeps the fix from being a swap.
-        const bg = loadColdWorker("mainnet");
-
-        expect(await bg.rpc("eth_chainId")).toEqual({
-            result: MAINNET.chainId,
-        });
-        expect(await bg.rpc("net_version")).toEqual({
-            result: MAINNET.networkVersion,
-        });
-    });
-
-    test("persists nothing: these are reads", async () => {
-        // The load must not turn a read into a write. saveState() persists
-        // every field of the singleton, and a read path that reached it would
-        // be the wipe https://git.eeqj.de/sneak/AutistMask/issues/316 fixed.
-        const bg = loadColdWorker("sepolia");
-
-        await bg.rpc("eth_chainId");
-        await bg.rpc("net_version");
-
-        expect(bg.storageSet).not.toHaveBeenCalled();
-        expect(bg.persisted()).toEqual(storedProfile("sepolia"));
-    });
-
-    test("a chain read arriving mid-refresh does not discard the refresh", async () => {
-        // Any page reaches these two methods, and the injected provider sends
-        // eth_chainId on every page load, so this overlap is ordinary traffic
-        // rather than a contrived race.
-        //
-        // backgroundRefresh() hands the singleton's wallets to
-        // refreshBalances(), which mutates those address objects in place once
-        // the network round trip resolves, and only then saves. Answering the
-        // page by calling loadState() would replace state.wallets mid-flight,
-        // so the refreshed balances would land on detached objects and the
-        // save that follows would persist the pre-refresh values — while still
-        // stamping lastBalanceRefresh, suppressing the redo.
-        let releaseRoundTrip;
-        const roundTrip = new Promise((resolve) => {
-            releaseRoundTrip = resolve;
-        });
-        let refreshReachedNetwork;
-        const inFlight = new Promise((resolve) => {
-            refreshReachedNetwork = resolve;
-        });
-
-        const bg = loadColdWorker("sepolia", {
-            refreshBalances: async (wallets) => {
-                refreshReachedNetwork();
-                await roundTrip;
-                // In place, on the objects handed in — as balances.js does.
-                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
-            },
-        });
-
-        const refresh = bg.fireBalanceAlarm();
-        await inFlight;
-
-        expect(await bg.rpc("eth_chainId", UNKNOWN_ORIGIN)).toEqual({
-            result: SEPOLIA.chainId,
-        });
-
-        releaseRoundTrip();
-        await refresh;
-
-        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
-            REFRESHED_BALANCE,
-        );
-    });
-});

tests/coldWorkerChainSwitch.test.js

@@ -1,212 +0,0 @@
-// What a chain switch does to a worker that has not loaded state yet.
-//
-// The MV3 service worker is terminated when idle and revived by the next
-// message, and nothing loads state at module scope. The chain-switch handler
-// reaches onChainSwitch(), which mutates the module-level `state` singleton
-// and then persists EVERY field of it, so a handler that runs before a load
-// writes DEFAULT_STATE over the user's stored profile — every wallet, every
-// site approval, every tracked token and the custom endpoint
-// (https://git.eeqj.de/sneak/AutistMask/issues/316). The same singleton is
-// what currentNetwork() answers from, so the same-chain early return also
-// compares against the wrong network.
-//
-// This file therefore uses the REAL state module and never calls loadState()
-// itself: the handler has to do it. tests/chainSwitchGate.test.js mocks the
-// state module wholesale and tests/networkEndpoints.test.js always loads
-// first, so neither can see this.
-
-const { networkById } = require("../src/shared/networks");
-
-const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
-
-const CONNECTED_ORIGIN = "https://dapp.example";
-const CONNECTED_HOSTNAME = "dapp.example";
-
-const MAINNET = networkById("mainnet");
-const SEPOLIA = networkById("sepolia");
-
-// The user's own node, and a wallet whose loss is the whole point.
-const CUSTOM_RPC = "http://127.0.0.1:8545";
-const CUSTOM_BLOCKSCOUT = "http://127.0.0.1:4000/api/v2";
-const TOKEN = "0x6B175474E89094C44Da98b954EedeAC495271d0F";
-
-function walletFixture() {
-    return [
-        {
-            name: "Wallet 1",
-            type: "hd",
-            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
-        },
-    ];
-}
-
-// A profile as an installed extension holds it, on `networkId`.
-function storedProfile(networkId) {
-    return {
-        hasWallet: true,
-        wallets: walletFixture(),
-        activeAddress: ADDRESS,
-        networkId,
-        rpcUrl: CUSTOM_RPC,
-        blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
-        deniedSites: {},
-        trackedTokens: [{ address: TOKEN, symbol: "DAI", decimals: 18 }],
-        theme: "dark",
-    };
-}
-
-async function settle() {
-    for (let i = 0; i < 50; i++) await Promise.resolve();
-}
-
-afterEach(() => {
-    delete global.chrome;
-});
-
-// Load the background worker with the real state and chain-switch modules
-// behind it, over a storage stub that actually keeps what is written — a
-// wipe is only observable against storage that remembers.
-function loadColdWorker(networkId) {
-    jest.resetModules();
-
-    jest.doMock("../src/shared/balances", () => ({
-        getProvider: () => ({}),
-        refreshBalances: jest.fn(async () => {}),
-    }));
-    jest.doMock("../src/shared/phishingDomains", () => ({
-        isPhishingDomain: () => false,
-    }));
-    jest.doMock("../src/shared/alarms", () => ({
-        BALANCE_REFRESH_ALARM: "balance",
-        BALANCE_REFRESH_PERIOD_MINUTES: 1,
-        ensureRecurringAlarms: jest.fn(async () => {}),
-        registerAlarmHandlers: jest.fn(),
-    }));
-
-    const store = { autistmask: storedProfile(networkId) };
-
-    let messageListener = null;
-    const toTabs = [];
-
-    global.chrome = {
-        storage: {
-            local: {
-                get: jest.fn(async () => ({ autistmask: store.autistmask })),
-                set: jest.fn(async (items) => {
-                    store.autistmask = items.autistmask;
-                }),
-            },
-        },
-        runtime: {
-            getURL: (path) => "chrome-extension://autistmask/" + path,
-            onMessage: {
-                addListener: (fn) => {
-                    messageListener = fn;
-                },
-            },
-            onConnect: { addListener: () => {} },
-            lastError: null,
-        },
-        windows: {
-            getLastFocused: (cb) => cb(null),
-            create: (options, cb) => cb({ id: 1 }),
-            remove: (id, cb) => {
-                if (cb) cb();
-            },
-            onRemoved: { addListener: () => {} },
-        },
-        tabs: {
-            query: (queryInfo, cb) => cb([{ id: 1 }]),
-            sendMessage: (tabId, message, cb) => {
-                toTabs.push(message);
-                if (cb) cb();
-            },
-        },
-        action: { setPopup: () => {} },
-    };
-
-    require("../src/background/index");
-
-    async function switchChain(chainId) {
-        let result = null;
-        messageListener(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "wallet_switchEthereumChain",
-                params: [{ chainId }],
-            },
-            { origin: CONNECTED_ORIGIN },
-            (r) => {
-                result = r;
-            },
-        );
-        await settle();
-        return result;
-    }
-
-    return {
-        switchChain,
-        persisted: () => store.autistmask,
-        chainChangedEvents: () =>
-            toTabs.filter((m) => m.eventName === "chainChanged"),
-    };
-}
-
-describe("a chain switch on a worker that never loaded state", () => {
-    test("keeps the wallets, approvals, tokens and custom endpoint", async () => {
-        const bg = loadColdWorker("mainnet");
-
-        const result = await bg.switchChain(SEPOLIA.chainId);
-        expect(result).toEqual({ result: null });
-
-        const after = bg.persisted();
-        // The switch itself happened.
-        expect(after.networkId).toBe("sepolia");
-        expect(after.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
-
-        // And it took nothing else with it. Without the load these come back
-        // as [], {}, [] and "system" from DEFAULT_STATE — every wallet in the
-        // extension gone, encrypted secrets included.
-        expect(after.wallets).toEqual(walletFixture());
-        expect(after.hasWallet).toBe(true);
-        expect(after.activeAddress).toBe(ADDRESS);
-        expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_HOSTNAME] });
-        expect(after.trackedTokens).toEqual([
-            { address: TOKEN, symbol: "DAI", decimals: 18 },
-        ]);
-        expect(after.theme).toBe("dark");
-
-        // The user's mainnet endpoint is remembered rather than replaced by
-        // the public default, so switching back returns it.
-        expect(after.networkEndpoints.mainnet).toEqual({
-            rpcUrl: CUSTOM_RPC,
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-        });
-
-        await bg.switchChain(MAINNET.chainId);
-        expect(bg.persisted().rpcUrl).toBe(CUSTOM_RPC);
-        expect(bg.persisted().blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
-        expect(bg.persisted().wallets).toEqual(walletFixture());
-    });
-
-    test("compares the requested chain against the stored one, not the default", async () => {
-        // Stored on Sepolia, asked for mainnet. Reading the unloaded
-        // singleton makes this look like the chain already active, so the
-        // page is told the switch succeeded while the wallet stays on the
-        // testnet it was on.
-        const bg = loadColdWorker("sepolia");
-
-        const result = await bg.switchChain(MAINNET.chainId);
-        expect(result).toEqual({ result: null });
-
-        expect(bg.persisted().networkId).toBe("mainnet");
-        expect(bg.chainChangedEvents()).toEqual([
-            {
-                type: "AUTISTMASK_EVENT",
-                eventName: "chainChanged",
-                data: MAINNET.chainId,
-            },
-        ]);
-    });
-});

tests/e2e/network.js

@@ -221,6 +221,11 @@ const RPC_RESULTS = {
     eth_estimateGas: hex(GAS_LIMIT),
     eth_getTransactionCount: "0x0",
     eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
+    // "not mined yet", which is what a node answers for a transaction it has
+    // only just accepted. The wait screen the dApp transaction approval hands
+    // off to polls this every 10 seconds; leaving it unstubbed would report
+    // the poll as escaping traffic the moment a test outlived one tick.
+    eth_getTransactionReceipt: null,
 };
 
 // The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
@@ -248,35 +253,26 @@ function latestBlock() {
 const SELECTOR_DECIMALS = "0x313ce567";
 
 // Every eth_call still answers with a zero word except decimals() on the
-// stub token, which the wallet reads back at signing time to compare with
+// stub token. ethers reads that before it can encode an ERC-20 transfer,
-// the scale the confirmation screen rendered (issue #305).
+// and a zero there makes parseUnits() reject any fractional amount — so the
-//
+// ERC-20 confirmation path would fail its gas estimate for a reason that
-// opts.tokenDecimalsOverride is the lying contract: set it and decimals()
+// has nothing to do with what is being tested.
-// answers something other than the value this same fixture reports through
+function ethCallResult(req) {
-// Blockscout, which is exactly the disagreement the wallet must refuse to
-// sign over. It is read at request time, so a test flips it on the options
-// object the route was registered with — after the confirmation screen has
-// been built — without re-registering anything.
-function ethCallResult(req, opts) {
     const call = Array.isArray(req.params) ? req.params[0] : null;
     if (!call || typeof call !== "object") return ZERO_WORD;
     const data = String(call.data || call.input || "").toLowerCase();
     const to = String(call.to || "").toLowerCase();
     if (data.startsWith(SELECTOR_DECIMALS) && to === STUB_TOKEN.address) {
-        return word(opts.tokenDecimalsOverride || STUB_TOKEN.decimals);
+        return word(STUB_TOKEN.decimals);
     }
     return ZERO_WORD;
 }
 
-// opts.tokenSymbolOverride is the hostile contract: set it and the explorer
+function tokenObject() {
-// reports that string as the token's symbol, exactly as it would for a token
-// whose symbol() returns markup. Read at request time, like every other
-// fixture switch, so a test can flip it and reopen the popup.
-function tokenObject(opts) {
     return {
         address_hash: STUB_TOKEN.address,
         address: STUB_TOKEN.address,
-        symbol: (opts && opts.tokenSymbolOverride) || STUB_TOKEN.symbol,
+        symbol: STUB_TOKEN.symbol,
         name: STUB_TOKEN.name,
         decimals: STUB_TOKEN.decimals,
         holders_count: STUB_TOKEN.holders,
@@ -285,7 +281,7 @@ function tokenObject(opts) {
 }
 
 // One received ERC-20 transfer of 1.5 E2E to the address under test.
-function tokenTransferItems(address, opts) {
+function tokenTransferItems(address) {
     return [
         {
             transaction_hash: STUB_TX_HASH,
@@ -294,7 +290,7 @@ function tokenTransferItems(address, opts) {
             from: { hash: STUB_COUNTERPARTY },
             to: { hash: address },
             total: { decimals: STUB_TOKEN.decimals, value: "1500000" },
-            token: tokenObject(opts),
+            token: tokenObject(),
         },
     ];
 }
@@ -321,11 +317,11 @@ function nativeTransactionItems(address) {
 // A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
 // this is what puts an ERC-20 in the send screen's token dropdown, which is
 // the only way the confirmation screen's ERC-20 path can be reached.
-function tokenBalanceItems(opts) {
+function tokenBalanceItems() {
     return [
         {
             value: "1500000",
-            token: tokenObject(opts),
+            token: tokenObject(),
         },
     ];
 }
@@ -350,38 +346,6 @@ function transactionDetails(hash) {
     };
 }
 
-// The receipt for a transaction this run broadcast.
-//
-// eth_getTransactionReceipt otherwise answers null — "not mined yet", which is
-// what a node says about a transaction it has only just accepted, and what the
-// wait screen has to keep polling through. opts.seedReceipt confirms it
-// instead, which is how a test that drives the popup's own send to a broadcast
-// gets off the wait screen: the wait resolves to the success view, which has a
-// Done button, rather than polling for a receipt for the rest of the suite.
-//
-// Every field ethers' receipt formatter requires is present. A receipt it
-// cannot parse throws inside the poll, which the wallet reports through
-// log.errorf — i.e. console.error — and the harness fails the run on, so a
-// half-populated fixture here would surface as an unrelated-looking failure.
-function transactionReceipt(hash) {
-    return {
-        transactionHash: hash,
-        transactionIndex: "0x0",
-        blockHash: "0x" + "33".repeat(32),
-        blockNumber: hex(STUB_BLOCK_NUMBER),
-        from: STUB_COUNTERPARTY,
-        to: STUB_TOKEN.address,
-        cumulativeGasUsed: hex(GAS_LIMIT),
-        gasUsed: hex(GAS_LIMIT),
-        effectiveGasPrice: hex(GAS_PRICE_WEI),
-        contractAddress: null,
-        logs: [],
-        logsBloom: "0x" + "00".repeat(256),
-        status: "0x1",
-        type: "0x2",
-    };
-}
-
 function jsonResponse(route, body) {
     return route.fulfill({
         status: 200,
@@ -444,13 +408,7 @@ function rpcReply(req, opts, report) {
         });
     }
     if (req.method === "eth_call") {
-        return Object.assign(envelope, { result: ethCallResult(req, opts) });
+        return Object.assign(envelope, { result: ethCallResult(req) });
-    }
-    if (req.method === "eth_getTransactionReceipt") {
-        const hash = Array.isArray(req.params) ? req.params[0] : null;
-        return Object.assign(envelope, {
-            result: opts.seedReceipt && hash ? transactionReceipt(hash) : null,
-        });
     }
     if (req.method === "eth_getBlockByNumber") {
         return Object.assign(envelope, { result: latestBlock() });
@@ -597,14 +555,6 @@ function traceEnabled(raw) {
  *   eth_estimateGas until this is cleared again.
  * @param {string[]} [opts.broadcastTransactions]  every raw signed
  *   transaction handed to eth_sendRawTransaction, appended in order.
- * @param {string} [opts.tokenDecimalsOverride]  what decimals() answers for
- *   the stub token, in place of the value Blockscout reports for it. This is
- *   the token that lies about its scale; read at request time.
- * @param {string} [opts.tokenSymbolOverride]  what the explorer reports as
- *   the stub token's symbol, in place of "E2E". This is the token whose
- *   symbol is markup; read at request time.
- * @param {boolean} [opts.seedReceipt]  answer eth_getTransactionReceipt with a
- *   confirmed receipt instead of null, so a wait screen resolves.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -681,14 +631,14 @@ async function installNetworkStubs(ctx, opts) {
                 return jsonResponse(route, {
                     items:
                         opts.seedTokenTransfer && addr
-                            ? tokenTransferItems(addr, opts)
+                            ? tokenTransferItems(addr)
                             : [],
                 });
             }
             if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
                 return jsonResponse(
                     route,
-                    opts.seedTokenBalance ? tokenBalanceItems(opts) : [],
+                    opts.seedTokenBalance ? tokenBalanceItems() : [],
                 );
             }
             for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {

tests/e2e/run.js

@@ -12,12 +12,10 @@
 const {
     Transaction,
     formatEther,
-    formatUnits,
     getAddress,
     getBytes,
     hexlify,
     parseEther,
-    parseUnits,
     toQuantity,
     toUtf8Bytes,
     verifyMessage,
@@ -1967,358 +1965,6 @@ test("ConfirmTx reports a failed ERC-20 estimate as unknown, not as a fee proble
     );
 });
 
-// ------------------------- the popup's own send, end to end (#305)
-//
-// Everything above this point stops at the confirmation screen. Nothing in
-// the suite had ever clicked #btn-confirm-send, so the wallet's own Send ->
-// ConfirmTx -> Sign & Send -> WaitTx path had no coverage at all, and issue
-// #305 shipped through the gap: the screen was rendered from the explorer's
-// decimals while the transfer was encoded from decimals() read off the
-// contract at signing time, with nothing comparing the two.
-//
-// These two tests drive that path to a broadcast and read the amount out of
-// the bytes the node was handed. The first asserts those bytes against what
-// the screen displayed; the second makes the contract answer a different
-// scale after the screen was built, and requires that nothing is broadcast.
-
-// keccak("transfer(address,uint256)")[0:4].
-const SELECTOR_TRANSFER = "0xa9059cbb";
-
-// What decimals() starts answering once the confirmation screen has been
-// built. The explorer reports 6 for the same token, so a wallet that encodes
-// from the contract signs 10^12 times the amount it displayed.
-const LYING_DECIMALS = "18";
-
-const TOKEN_DECIMALS = Number(STUB_TOKEN.decimals);
-
-// The transfer() call inside a raw signed transaction, hand-decoded.
-//
-// Deliberately not run through an ethers Interface built from the
-// extension's own ABI: what is under assertion is the bytes that reached the
-// node, and the fewer assumptions the wallet and the assertion share, the
-// less room there is for both to be wrong in the same direction.
-function decodeTransfer(rawSignedTx) {
-    const signed = Transaction.from(rawSignedTx);
-    const data = signed.data.toLowerCase();
-    assert(
-        data.startsWith(SELECTOR_TRANSFER) && data.length === 10 + 128,
-        "the broadcast transaction is not an ERC-20 transfer() call: " + data,
-    );
-    return {
-        signed,
-        recipient: getAddress("0x" + data.slice(34, 74)),
-        rawAmount: BigInt("0x" + data.slice(74)),
-    };
-}
-
-// The amount the confirmation screen is showing, verbatim.
-async function shownAmount(page) {
-    return (await page.locator("#confirm-amount").innerText()).trim();
-}
-
-async function fillPasswordAndSend(page) {
-    await page.fill("#confirm-tx-password", PASSWORD);
-    await page.click("#btn-confirm-send");
-}
-
-async function goToTokenConfirm(env) {
-    await goToConfirm(env.page, {
-        token: STUB_TOKEN.address,
-        balance: TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
-        amount: TOKEN_AMOUNT,
-    });
-    await waitForEstimate(env.page);
-    const shown = await shownAmount(env.page);
-    assert(
-        shown === TOKEN_AMOUNT + " " + STUB_TOKEN.symbol,
-        "the confirmation screen is not showing the amount that was entered: " +
-            JSON.stringify(shown),
-    );
-    return shown;
-}
-
-test("the popup's own ERC-20 send broadcasts the amount it displayed (#305)", async (env) => {
-    // The previous test left the ETH balance at the fee-only fixture, which
-    // blocks sending outright; this one has to be able to press Send.
-    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
-    await settleOnMain(env, { ethWei: FUNDED_ETH_WEI, expectToken: true });
-    const shown = await goToTokenConfirm(env);
-
-    const before = env.routeOpts.broadcastTransactions.length;
-    // Confirm the transaction once it is broadcast, so the wait screen
-    // resolves to the success view instead of polling for the rest of the run.
-    env.routeOpts.seedReceipt = true;
-    await fillPasswordAndSend(env.page);
-    await visible(env.page, "#view-wait-tx", 60000);
-
-    const broadcast = env.routeOpts.broadcastTransactions;
-    assert(
-        broadcast.length === before + 1,
-        "expected exactly one raw transaction to reach the RPC, got " +
-            (broadcast.length - before),
-    );
-    const { signed, recipient, rawAmount } = decodeTransfer(
-        broadcast[broadcast.length - 1],
-    );
-
-    // The measurement, printed on every run: the amount the user read, and
-    // what the signed bytes mean at each of the two candidate scales. Under
-    // the defect these three lines disagree.
-    console.log(
-        "# erc-20 send artifact: displayed=" +
-            JSON.stringify(shown) +
-            " rawAmount=" +
-            rawAmount +
-            " asIf" +
-            TOKEN_DECIMALS +
-            "Decimals=" +
-            formatUnits(rawAmount, TOKEN_DECIMALS) +
-            " asIf" +
-            LYING_DECIMALS +
-            "Decimals=" +
-            formatUnits(rawAmount, Number(LYING_DECIMALS)),
-    );
-
-    assert(
-        getAddress(signed.to) === getAddress(STUB_TOKEN.address),
-        "the broadcast transaction does not call the token contract: " +
-            signed.to,
-    );
-    assert(
-        recipient === getAddress(STUB_COUNTERPARTY),
-        "the broadcast transfer goes to " + recipient,
-    );
-    // What the whole issue turns on: the signed amount, read back at the
-    // scale the SCREEN rendered with, is the number the screen rendered.
-    const wanted = parseUnits(shown.split(" ")[0], TOKEN_DECIMALS);
-    assert(
-        rawAmount === wanted,
-        "the broadcast transfer moves " +
-            rawAmount +
-            " base units, which is " +
-            formatUnits(rawAmount, TOKEN_DECIMALS) +
-            " " +
-            STUB_TOKEN.symbol +
-            " at the scale the confirmation screen displayed — but the screen" +
-            " displayed " +
-            JSON.stringify(shown) +
-            ", i.e. " +
-            wanted +
-            " base units (#305)",
-    );
-
-    const summary = (
-        await env.page.locator("#wait-tx-summary").innerText()
-    ).trim();
-    assert(
-        summary === shown,
-        "the wait screen summarises the send as " +
-            JSON.stringify(summary) +
-            ", not as the approved " +
-            JSON.stringify(shown),
-    );
-
-    await visible(env.page, "#view-success-tx", 60000);
-    await env.page.click("#btn-success-tx-done");
-    await visible(env.page, "#view-address");
-    env.routeOpts.seedReceipt = false;
-});
-
-test("a token that lies about decimals() at signing time broadcasts nothing (#305)", async (env) => {
-    const shown = await goToTokenConfirm(env);
-
-    // Only now, with the screen already built and its estimate already taken
-    // at the explorer's scale, does the contract start answering differently.
-    // This is the whole shape of the defect: a value read at signing time that
-    // nothing on screen was ever derived from.
-    env.routeOpts.tokenDecimalsOverride = LYING_DECIMALS;
-    const before = env.routeOpts.broadcastTransactions.length;
-    await fillPasswordAndSend(env.page);
-    await visible(env.page, "#view-error-tx", 60000);
-    env.routeOpts.tokenDecimalsOverride = null;
-
-    assert(
-        env.routeOpts.broadcastTransactions.length === before,
-        "a transfer encoded against a contract that contradicts the " +
-            "confirmation screen still reached the RPC (#305)",
-    );
-
-    const message = (
-        await env.page.locator("#error-tx-message").innerText()
-    ).trim();
-    console.log(
-        "# erc-20 decimals refusal: displayed=" +
-            JSON.stringify(shown) +
-            " contract=" +
-            LYING_DECIMALS +
-            " message=" +
-            JSON.stringify(message),
-    );
-    assert(
-        message.includes("reports " + LYING_DECIMALS + " decimal places") &&
-            message.includes("displayed using " + STUB_TOKEN.decimals),
-        "the refusal does not name both scales it is refusing over: " +
-            JSON.stringify(message),
-    );
-    assert(
-        /^[A-Z].*\.$/s.test(message),
-        "the refusal is not a full sentence: " + JSON.stringify(message),
-    );
-
-    await env.page.click("#btn-error-tx-done");
-    await visible(env.page, "#view-address");
-});
-
-// ------------------------------------------- hostile token symbol (#307)
-//
-// The reproduction from the issue, in the real browser against the real
-// shipped manifest. A token symbol is whatever the contract's symbol()
-// returns, the explorer passes it through, and the popup interpolated it
-// into an innerHTML string — so a token with 1,000 holders airdropped to
-// the victim could paint a full-viewport cross-origin iframe over the
-// wallet's own UI, on the screens where the user types their password.
-//
-// The iframe count and the rendered text are asserted separately on
-// purpose, and neither substitutes for the other. `frame-src 'none'` stops
-// an injected frame LOADING; it does not stop the element existing, so a
-// zero iframe count is a claim about the escaping and about nothing else.
-// The literal capped text is the claim that the symbol was treated as a
-// string all the way down.
-//
-// The iframe count is taken on the address screen before anything is
-// clicked. That is where the injected frame lands first, and it covers the
-// viewport: with the escaping removed, every later step fails as a click
-// timeout ("<iframe id=\"pwn\"> intercepts pointer events") rather than as
-// anything that names the defect.
-
-// Verbatim from the issue's reproduction.
-const HOSTILE_SYMBOL =
-    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
-
-// What a correctly escaped and capped render of it reads as: the first
-// MAX_SYMBOL_LENGTH-1 characters and an ellipsis. Spelled out rather than
-// imported, so a change to the cap has to be restated here deliberately
-// instead of being absorbed by a shared constant.
-const HOSTILE_SYMBOL_DISPLAYED = "<iframe id=" + "…";
-
-// Everything the popup can say about an injected symbol, read out of the
-// live DOM in one pass.
-function hostileSymbolState(page, tokenAddress) {
-    return page.evaluate((addr) => {
-        const row = document.querySelector(
-            '#wallet-list [data-token="' + addr + '"]',
-        );
-        // balanceLine() emits <div data-token><span><span>SYMBOL</span>…
-        // so this is the span the symbol itself was written into.
-        const symbolEl = row && row.firstElementChild.firstElementChild;
-        return {
-            rowFound: !!row,
-            rowText: row ? row.innerText.trim() : "",
-            symbolText: symbolEl ? symbolEl.textContent : "",
-            // The symbol's own span must hold text and nothing else. An
-            // element child here is the injection, whether or not it
-            // happens to be an iframe.
-            symbolElementChildren: symbolEl
-                ? symbolEl.querySelectorAll("*").length
-                : -1,
-            // The whole popup document, not just the row: an injected
-            // element positioned fixed can be anywhere in the tree.
-            iframes: document.querySelectorAll("iframe").length,
-            pwnPresent: !!document.getElementById("pwn"),
-        };
-    }, tokenAddress);
-}
-
-test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
-    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
-    env.routeOpts.seedTokenBalance = true;
-    env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;
-    console.log(
-        "# stub token symbol() now returns: " + JSON.stringify(HOSTILE_SYMBOL),
-    );
-
-    // Close and reopen so the refresh that runs on open fetches balances
-    // with the hostile symbol in them.
-    await reopenPopup(env, "#view-address");
-    await env.page.waitForFunction(
-        (addr) =>
-            !!document.querySelector(
-                '#address-balances [data-token="' + addr + '"]',
-            ),
-        STUB_TOKEN.address,
-        { timeout: 60000 },
-    );
-    const onAddress = await env.page.evaluate(() => ({
-        iframes: document.querySelectorAll("iframe").length,
-        pwnPresent: !!document.getElementById("pwn"),
-    }));
-    console.log("# address-detail iframes = " + onAddress.iframes);
-    assert(
-        onAddress.iframes === 0 && !onAddress.pwnPresent,
-        "the address screen contains " +
-            onAddress.iframes +
-            " iframe(s) after a hostile symbol rendered (#307)",
-    );
-
-    await env.page.click("#btn-address-back");
-    await visible(env.page, "#view-main");
-    await visible(
-        env.page,
-        '#wallet-list [data-token="' + STUB_TOKEN.address + '"]',
-        60000,
-    );
-
-    const st = await hostileSymbolState(env.page, STUB_TOKEN.address);
-    console.log(
-        "# iframes in the popup DOM = " +
-            st.iframes +
-            " | #pwn present = " +
-            st.pwnPresent +
-            " | symbol = " +
-            JSON.stringify(st.symbolText),
-    );
-
-    assert(st.rowFound, "the hostile token never rendered a row at all");
-    assert(
-        st.iframes === 0,
-        "the popup DOM contains " + st.iframes + " iframe(s) (#307)",
-    );
-    assert(!st.pwnPresent, "the injected #pwn element is in the popup DOM");
-    assert(
-        st.symbolElementChildren === 0,
-        "the symbol span grew " +
-            st.symbolElementChildren +
-            " element children out of a token symbol (#307)",
-    );
-    assert(
-        st.symbolText === HOSTILE_SYMBOL_DISPLAYED,
-        "the symbol did not render as the literal capped text " +
-            JSON.stringify(HOSTILE_SYMBOL_DISPLAYED) +
-            ": " +
-            JSON.stringify(st.symbolText),
-    );
-    assert(
-        !st.rowText.includes("z-index"),
-        "the uncapped symbol reached the screen: " + JSON.stringify(st.rowText),
-    );
-
-    // Put the fixture back before the next test reads it, and let the
-    // stored balances be rewritten with the honest symbol.
-    env.routeOpts.tokenSymbolOverride = null;
-    await reopenPopup(env, "#view-main");
-    await env.page.waitForFunction(
-        (addr) => {
-            const row = document.querySelector(
-                '#wallet-list [data-token="' + addr + '"]',
-            );
-            return !!row && row.innerText.includes("E2E");
-        },
-        STUB_TOKEN.address,
-        { timeout: 60000 },
-    );
-});
-
 // ------------------------------------------- dApp round trips (#183)
 //
 // The seam. Everything above drives the popup on its own; this section is
@@ -3449,16 +3095,6 @@ async function main() {
         ethBalanceWei: null,
         failGasEstimate: false,
         holdGasEstimate: false,
-        // What decimals() answers for the stub token, when it is to answer
-        // something other than the value the same fixture reports through
-        // Blockscout. The token that lies about its scale (#305).
-        tokenDecimalsOverride: null,
-        // What the explorer reports as the stub token's symbol. The token
-        // whose symbol() returns markup (#307).
-        tokenSymbolOverride: null,
-        // Whether eth_getTransactionReceipt confirms a transaction rather than
-        // answering "not mined yet".
-        seedReceipt: false,
         // Every raw signed transaction handed to eth_sendRawTransaction, in
         // order. The dApp transaction round trip asserts against these bytes
         // rather than against anything the extension reported about them.

tests/htmlEscape.test.js

@@ -1,110 +0,0 @@
-// The escape every view depends on, and the length bound on a displayed
-// token symbol. Both were added for #307, where a token whose symbol()
-// returned an <iframe> tag rendered that iframe inside the popup.
-
-const { escapeHtml } = require("../src/shared/html");
-const {
-    displaySymbol,
-    MAX_SYMBOL_LENGTH,
-    UNKNOWN_SYMBOL,
-} = require("../src/shared/symbolDisplay");
-
-// The payload from the issue's reproduction, verbatim.
-const HOSTILE_SYMBOL =
-    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
-    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
-
-describe("escapeHtml", () => {
-    test("escapes all five characters, quotes included", () => {
-        expect(escapeHtml("&<>\"'")).toBe("&amp;&lt;&gt;&quot;&#39;");
-    });
-
-    // The regression this function was rewritten for. The previous
-    // implementation round-tripped through a detached div's textContent,
-    // and an HTML text node serializes a quote as itself — so a value with
-    // a quote in it broke straight out of data-copy="..." and href="...".
-    test("escapes quotes, which the textContent round trip did not", () => {
-        expect(escapeHtml('a"b')).toBe("a&quot;b");
-        expect(escapeHtml("a'b")).toBe("a&#39;b");
-    });
-
-    test("does not double-escape an ampersand it just introduced", () => {
-        expect(escapeHtml("&lt;")).toBe("&amp;lt;");
-        expect(escapeHtml("&amp;")).toBe("&amp;amp;");
-    });
-
-    test("leaves a string with nothing to escape untouched", () => {
-        expect(escapeHtml("USDC")).toBe("USDC");
-        expect(escapeHtml("")).toBe("");
-    });
-
-    test("renders the hostile symbol inert", () => {
-        const out = escapeHtml(HOSTILE_SYMBOL);
-        expect(out).not.toContain("<");
-        expect(out).not.toContain(">");
-        expect(out).not.toContain('"');
-        expect(out).toContain("&lt;iframe");
-    });
-
-    // A quoted attribute is broken out of by a quote, a bare one by a
-    // space; both are closed here. Asserted as a whole attribute rather
-    // than character by character, because it is the attribute that has to
-    // survive, not the escape table.
-    test("a value carrying a quote stays inside its attribute", () => {
-        const evil = '" onload="alert(1)';
-        const attr = `data-copy="${escapeHtml(evil)}"`;
-        expect(attr).toBe('data-copy="&quot; onload=&quot;alert(1)"');
-        expect(attr.split('"').length - 1).toBe(2);
-    });
-
-    test("null and undefined render as nothing rather than as words", () => {
-        expect(escapeHtml(null)).toBe("");
-        expect(escapeHtml(undefined)).toBe("");
-    });
-
-    test("coerces a non-string without losing the escape", () => {
-        expect(escapeHtml(42)).toBe("42");
-        expect(escapeHtml({ toString: () => "<b>" })).toBe("&lt;b&gt;");
-    });
-});
-
-describe("displaySymbol", () => {
-    test("passes every symbol in the bundled list through unchanged", () => {
-        const { TOKENS } = require("../src/shared/tokenList");
-        for (const t of TOKENS) {
-            expect([t.address, displaySymbol(t.symbol)]).toEqual([
-                t.address,
-                t.symbol,
-            ]);
-        }
-    });
-
-    test("caps an over-long symbol and marks it as truncated", () => {
-        const long = "A".repeat(4096);
-        const out = displaySymbol(long);
-        expect(out.length).toBe(MAX_SYMBOL_LENGTH);
-        expect(out.endsWith("…")).toBe(true);
-    });
-
-    test("keeps a symbol of exactly the cap intact", () => {
-        const exact = "A".repeat(MAX_SYMBOL_LENGTH);
-        expect(displaySymbol(exact)).toBe(exact);
-    });
-
-    test("substitutes a placeholder for an absent symbol", () => {
-        expect(displaySymbol("")).toBe(UNKNOWN_SYMBOL);
-        expect(displaySymbol(null)).toBe(UNKNOWN_SYMBOL);
-        expect(displaySymbol(undefined)).toBe(UNKNOWN_SYMBOL);
-    });
-
-    // The cap is a layout bound and nothing more: it must not be mistaken
-    // for the thing that makes a symbol safe to render. A short hostile
-    // symbol passes through it untouched, and is inert only because the
-    // caller escapes it afterwards.
-    test("does not sanitize — a short markup symbol survives it verbatim", () => {
-        expect(displaySymbol("<img src=x>")).toBe("<img src=x>");
-        expect(escapeHtml(displaySymbol("<img src=x>"))).toBe(
-            "&lt;img src=x&gt;",
-        );
-    });
-});

tests/manifest.test.js

@@ -13,33 +13,6 @@
 // an exact match on the token set is what keeps the next edit from
 // smuggling one in alongside.
 //
-// It is also the anti-regression check for #307. The policy used to declare
-// script-src and object-src and nothing else, which left every directive
-// that does not fall back to them — and, absent default-src, every one that
-// does — wide open: a hostile ERC-20 symbol that reached innerHTML could
-// load a full-viewport cross-origin iframe over the wallet's own UI. The
-// escaping in src/shared/html.js is the primary fix; default-src is what
-// stops the next escape that slips from reaching the network.
-//
-// Every directive below is pinned exactly, because each of the four
-// loosenings is load-bearing and none of them may grow:
-//
-//   style-src 'unsafe-inline'  src/popup/index.html and the view helpers
-//                              use style="..." attributes throughout, which
-//                              CSP blocks without it. Chrome enforces this
-//                              on attributes, not just <style> blocks, and
-//                              Firefox has never implemented style-src-attr,
-//                              so there is no narrower spelling available.
-//   img-src data:              blockies are data: PNGs assigned to img.src.
-//   connect-src https: http:   the RPC endpoint is user-configurable, and a
-//                              local node over http://127.0.0.1 is a
-//                              supported configuration — the Firefox e2e
-//                              suite runs on exactly that.
-//   frame-src/form-action/base-uri  named rather than inherited: form-action
-//                              and base-uri do not fall back to default-src
-//                              at all, and frame-src 'none' is what kills
-//                              the reported attack outright.
-//
 // build.js copies these files to dist/<target>/manifest.json verbatim, so
 // what is asserted here is what ships.
 
@@ -48,22 +21,8 @@ const path = require("path");
 
 const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
 
-const EXPECTED_DIRECTIVES = {
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
-    "default-src": ["'self'"],
+const EXPECTED_OBJECT_SRC = ["'self'"];
-    "script-src": ["'self'", "'wasm-unsafe-eval'"],
-    "object-src": ["'self'"],
-    "style-src": ["'self'", "'unsafe-inline'"],
-    "img-src": ["'self'", "data:"],
-    "connect-src": ["'self'", "http:", "https:"],
-    "frame-src": ["'none'"],
-    "form-action": ["'none'"],
-    "base-uri": ["'none'"],
-};
-
-// Directives that fetch script. Nothing that can execute code may name a
-// remote source, an eval form, or an inline form; 'wasm-unsafe-eval' is the
-// single deliberate exception and it is pinned above.
-const SCRIPT_DIRECTIVES = ["default-src", "script-src", "object-src"];
 
 const FORBIDDEN_SOURCES = [
     "'unsafe-eval'",
@@ -94,31 +53,26 @@ function parseCsp(policy) {
 
 function assertPolicy(policy) {
     const directives = parseCsp(policy);
-    // Exact, in both directions: a directive that appears here and not in
+    expect(Object.keys(directives).sort()).toEqual([
-    // EXPECTED_DIRECTIVES is an unreviewed addition, and one that
+        "object-src",
-    // disappears silently reopens whatever it was closing.
+        "script-src",
-    expect(Object.keys(directives).sort()).toEqual(
+    ]);
-        Object.keys(EXPECTED_DIRECTIVES).sort(),
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
     );
-    for (const [name, sources] of Object.entries(EXPECTED_DIRECTIVES)) {
+    expect(directives["object-src"].slice().sort()).toEqual(
-        expect([name, directives[name].slice().sort()]).toEqual([
+        EXPECTED_OBJECT_SRC,
-            name,
+    );
-            sources.slice().sort(),
+    for (const source of FORBIDDEN_SOURCES) {
-        ]);
+        expect(directives["script-src"]).not.toContain(source);
-    }
+        expect(directives["object-src"]).not.toContain(source);
-    for (const name of SCRIPT_DIRECTIVES) {
-        for (const source of FORBIDDEN_SOURCES) {
-            expect(name + " " + directives[name].join(" ")).not.toContain(
-                " " + source,
-            );
-        }
     }
 }
 
 describe("shipped Content Security Policy", () => {
     // MV3 takes an object and applies extension_pages to the popup and the
     // background service worker, which is where libsodium runs.
-    test("chrome MV3 ships the pinned policy, default-src included", () => {
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
         const csp = readManifest("chrome").content_security_policy;
         expect(typeof csp).toBe("object");
         expect(Object.keys(csp)).toEqual(["extension_pages"]);
@@ -133,7 +87,7 @@ describe("shipped Content Security Policy", () => {
     // Firefox before 106 rejects an MV2 policy string that omits
     // object-src and falls back to its own default, discarding everything
     // declared here. Same policy as Chrome, different manifest shape.
-    test("firefox MV2 ships the pinned policy, default-src included", () => {
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
         const csp = readManifest("firefox").content_security_policy;
         expect(typeof csp).toBe("string");
         assertPolicy(csp);

tests/networkEndpoints.test.js

@@ -154,22 +154,11 @@ describe("a custom endpoint survives a chain switch", () => {
         expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
     });
 
-    // A primitive is the dangerous case, not the array: assigning a property
+    test("a stored networkEndpoints of the wrong type is discarded", async () => {
-    // to a string throws nothing and stores nothing, so a stored string would
+        const { mod } = loadModuleWith({
-    // be carried through loadState() and re-persisted by every save, and each
-    // switch would fall back to the public default in place of the user's
-    // endpoint, permanently.
-    test.each([
-        ["an array", ["not", "a", "map"]],
-        ["a string", "junk"],
-        ["a number", 7],
-    ])("a stored networkEndpoints that is %s is discarded", async (_, bad) => {
-        const { mod, chainSwitch } = loadModuleWith({
             wallets: walletFixture(),
             networkId: "mainnet",
-            rpcUrl: CUSTOM_RPC,
+            networkEndpoints: ["not", "a", "map"],
-            blockscoutUrl: CUSTOM_BLOCKSCOUT,
-            networkEndpoints: bad,
         });
         await mod.loadState();
 
@@ -177,16 +166,9 @@ describe("a custom endpoint survives a chain switch", () => {
         // profile is — never left as something onChainSwitch() would index.
         expect(mod.state.networkEndpoints).toEqual({
             mainnet: {
-                rpcUrl: CUSTOM_RPC,
+                rpcUrl: MAINNET.defaultRpcUrl,
-                blockscoutUrl: CUSTOM_BLOCKSCOUT,
+                blockscoutUrl: MAINNET.defaultBlockscoutUrl,
             },
         });
-
-        // And the endpoint really survives the round trip, which is the point
-        // of discarding it rather than only of the shape being right.
-        await chainSwitch.onChainSwitch("sepolia");
-        await chainSwitch.onChainSwitch("mainnet");
-        expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
-        expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
     });
 });

tests/transferAmount.test.js

@@ -1,128 +0,0 @@
-// The scale an ERC-20 transfer from the wallet's own Send screen is encoded
-// with (issue #305). The screen renders from the block explorer's cached
-// decimals; the transfer used to be encoded from decimals() read off the
-// contract at signing time, with nothing comparing the two, so a token whose
-// on-chain scale differed signed an amount that was never displayed.
-
-const { parseUnits } = require("ethers");
-const {
-    displayedDecimals,
-    transferAmountUnits,
-    MAX_DECIMALS,
-    UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-    UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-} = require("../src/shared/transferAmount");
-
-describe("displayedDecimals", () => {
-    test("accepts what the explorer and the contract each answer with", () => {
-        // A string is what fetchTokenBalances() parses out of Blockscout, a
-        // number is what it stores, and a bigint is what ethers hands back
-        // from a uint8 return.
-        expect(displayedDecimals("6")).toBe(6);
-        expect(displayedDecimals(6)).toBe(6);
-        expect(displayedDecimals(6n)).toBe(6);
-        expect(displayedDecimals(0)).toBe(0);
-        expect(displayedDecimals(MAX_DECIMALS)).toBe(MAX_DECIMALS);
-    });
-
-    test("refuses anything that is not a uint8", () => {
-        for (const bad of [
-            null,
-            undefined,
-            "",
-            "eighteen",
-            NaN,
-            6.5,
-            -1,
-            MAX_DECIMALS + 1,
-            true,
-            {},
-            [],
-        ]) {
-            expect(() => displayedDecimals(bad)).toThrow(
-                UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-            );
-        }
-    });
-});
-
-describe("transferAmountUnits", () => {
-    test("encodes with the displayed scale when the contract agrees", () => {
-        expect(transferAmountUnits("0.25", 6, 6n)).toBe(parseUnits("0.25", 6));
-        expect(transferAmountUnits("0.25", "6", 6n)).toBe(
-            parseUnits("0.25", 6),
-        );
-        expect(transferAmountUnits("1.5", 18, 18n)).toBe(parseUnits("1.5", 18));
-    });
-
-    // The reproduction on the issue: 0.25 of a token displayed at 6 decimals,
-    // signed against a contract answering 18, moves 10^12 times the amount
-    // that was approved.
-    test("refuses the reproduction rather than signing either amount", () => {
-        expect(() => transferAmountUnits("0.25", 6, 18n)).toThrow(
-            /contract reports 18 decimal places, but the amount was displayed using 6/,
-        );
-    });
-
-    test("refuses a disagreement in the other direction too", () => {
-        expect(() => transferAmountUnits("0.25", 18, 6n)).toThrow(
-            /contract reports 6 decimal places, but the amount was displayed using 18/,
-        );
-    });
-
-    test("never returns the amount at either scale on a disagreement", () => {
-        // The point of the refusal: both candidate encodings exist, and the
-        // wallet must produce neither.
-        let thrown = null;
-        try {
-            transferAmountUnits("0.25", 6, 18n);
-        } catch (e) {
-            thrown = e;
-        }
-        expect(thrown).toBeInstanceOf(Error);
-        expect(thrown.message).toMatch(/was not sent/);
-    });
-
-    test("refuses when the screen's scale is unknown", () => {
-        expect(() => transferAmountUnits("0.25", null, 6n)).toThrow(
-            UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-        );
-        expect(() => transferAmountUnits("0.25", undefined, 6n)).toThrow(
-            UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
-        );
-    });
-
-    test("refuses when the contract's answer is not a uint8", () => {
-        for (const bad of [null, undefined, "", "eighteen", 6.5, -1, 256]) {
-            expect(() => transferAmountUnits("0.25", 6, bad)).toThrow(
-                UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
-            );
-        }
-    });
-
-    test("rejects an amount finer than the token's scale", () => {
-        // parseUnits' own refusal, reached only once the scales agree: a
-        // fractional base unit cannot be sent and must not be truncated.
-        expect(() => transferAmountUnits("0.0000001", 6, 6n)).toThrow();
-    });
-
-    test("every refusal is a full sentence", () => {
-        const messages = [];
-        for (const args of [
-            ["0.25", 6, 18n],
-            ["0.25", null, 6n],
-            ["0.25", 6, "eighteen"],
-        ]) {
-            try {
-                transferAmountUnits(...args);
-            } catch (e) {
-                messages.push(e.message);
-            }
-        }
-        expect(messages).toHaveLength(3);
-        for (const m of messages) {
-            expect(m).toMatch(/^[A-Z]/);
-            expect(m).toMatch(/\.$/);
-        }
-    });
-});