fix: never render a nonzero approval amount as zero (closes #322)

Amounts are truncated to four decimal places per README.md's Display
Consistency rule. With the token's true scale resolved, an amount below 0.0001
still printed as 0.0000 — 1 base unit of an 18-decimal token, 500 base units of
an 8-decimal one. On the dApp approval screen, and on the wait/success/error
screens that carry the same string forward as txInfo.amount, a real transfer,
allowance or swap was therefore stated as nothing. A swap's "Min. received" is
the sharper case: a slippage floor shown as 0.0000 states that the swap may
return nothing.

That truncation existed in three separate copies — src/popup/views/approval.js
(the ERC-20 amount, the ETH value, the max fee), src/shared/uniswap.js (the
swap's Amount and Min. received lines, on that same screen) and
src/shared/transactions.js (history and balance lists). They now share
src/shared/amountDisplay.js, which holds the rule and its one exception side by
side: truncateAmount() truncates, truncateAmountNeverZero() truncates with the
nonzero floor.

approval.js and uniswap.js take the floored function, so every amount those
screens display or hand to the confirmation screens obeys the invariant. When
the truncated string would carry no digit from 1 to 9 and the value does, the
amount is extended to its first significant digit: 0.000000000000000001 DAI,
not 0.0000 DAI. It stays in token units, the same unit as the symbol beside it;
the base-unit rendering already on this screen means "the scale is unknown", and
reusing it for a known scale would blur the two. A genuine zero still renders
0.0000, an amount at or above the floor is untouched, and truncation stays
truncation — 0.99999 shows as 0.9999, never rounded up.

transactions.js takes the unfloored function, keeping its current behaviour
exactly: balance lists and history are out of scope by the issue's definition of
done, and the transaction detail view already shows exact precision there. The
code path is shared; the policy is not.

tests/approvalDisplayFloor.test.js drives decodeCalldata() and uniswap.decode()
and asserts both the displayed line and the rawValue the confirmation screens
carry. Against this tree with src/shared/uniswap.js reverted to its previous
formatAmount(), its two new swap cases fail: a 50-base-unit USDT input gives
"0.0000 USDT" where "0.00005 USDT" is expected, and a 1-wei amountOutMin gives
"0.0000 WETH" where "0.000000000000000001 WETH" is expected. A case pinning the
list rule as unfloored is included so the shared module cannot drift into one
policy.

make check green: 42 suites, 848 tests; verify-build 39 cases; check-censored
153 files; eslint and prettier clean in the pinned container.

README.md

@@ -689,6 +689,32 @@ Both are click-copyable. Truncating to 4 decimals in summary views is acceptable
 for scannability, but the detail view must never discard precision — it is the
 one place the user can always use to verify exact details.
 
+**Specific Exception — nonzero floor on the approval screens:** A nonzero amount
+must never render as zero. Truncating to 4 decimals does exactly that to an
+amount below 0.0001 — 1 base unit of an 18-decimal token, 500 base units of an
+8-decimal one — and on the dApp approval screen and the wait/success/error
+screens that carry its amount forward, a real transfer or allowance then reads
+as "nothing is being moved". A swap's `Min. received` is the sharper case: a
+slippage floor shown as `0.0000` states that the swap may return nothing.
+
+On those screens, when the truncated string would contain no digit from 1 to 9
+and the value does, the amount is extended to its first significant digit
+instead: `0.000000000000000001 DAI`, not `0.0000 DAI`. The test is on the whole
+truncated string, integer part included, so `1.00005` still shows as `1.0000` —
+the exception only fires where the entire displayed figure would read as zero. A
+genuine zero still renders `0.0000`, and truncation stays truncation: `0.99999`
+shows as `0.9999`, never rounded up.
+
+The rule and its exception live in `src/shared/amountDisplay.js` as
+`truncateAmount()` and `truncateAmountNeverZero()`. Everything the approval and
+confirmation screens display goes through the floored one — the ERC-20 amount,
+the ETH value and max fee (`src/popup/views/approval.js`), and the swap's
+`Amount` and `Min. received` lines (`src/shared/uniswap.js`). The history and
+balance lists (`src/shared/transactions.js`) use the unfloored one: the
+transaction detail view is the authoritative record and already shows exact
+precision. The 4-decimal rule is unchanged everywhere else, including for
+amounts at or above the floor on the approval screens.
+
 #### Partial USD totals
 
 Prices are fetched for the top 25 tokens only, so an address can hold assets the

TODO.md

@@ -44,6 +44,49 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-23: An amount below the 4-decimal display floor no longer reads as
+  zero on the approval screens
+  ([#322](https://git.eeqj.de/sneak/AutistMask/issues/322)). With the token's
+  true scale resolved, the 4-decimal truncation still printed a small amount as
+  `0.0000` — 1 base unit of an 18-decimal token, 500 of an 8-decimal one — so a
+  real transfer, allowance or swap was stated as nothing on the one screen whose
+  job is to say what is being authorized, and a swap's `Min. received` claimed
+  the user might receive nothing. Three copies of that truncation existed; they
+  now share `src/shared/amountDisplay.js`. Everything the approval and
+  confirmation screens render (`src/popup/views/approval.js`,
+  `src/shared/uniswap.js`) extends to the first significant digit when the
+  truncated figure would otherwise read as zero, keeping the amount in token
+  units rather than switching to base units mid-line. The history and balance
+  lists (`src/shared/transactions.js`) keep the unfloored rule, which is out of
+  scope by the issue's definition of done. `README.md`'s Display Consistency
+  section records the exception.
+
+- 2026-08-20: A second extension page can no longer silently delete a wallet
+  ([#304](https://git.eeqj.de/sneak/AutistMask/issues/304)). `saveState()` wrote
+  the entire state blob, and every extension page — the toolbar popup, a dApp
+  approval window, `backgroundRefresh()` — holds its own in-memory `state`,
+  loaded once, with `showView()` saving on every navigation; a second page that
+  saved after a first had written something new overwrote it, no attacker or
+  unusual input required. `saveState()` is now a read-modify-write: it re-reads
+  storage, diffs the persisted fields against a deep-cloned `baseline` snapshot
+  taken at the last `loadState()`/`saveState()` on that page, and writes only
+  the fields that actually changed — everything else is carried forward from
+  storage in its loaded-and-normalized shape (`normalizePersisted()`, shared
+  with `loadState()`), so a legacy or malformed record a load has always
+  self-healed in memory keeps getting written back even on a save that touched
+  something else entirely. `showView()` fires `saveState()` on every navigation
+  without awaiting it, so two saves from the same page can be in flight at once;
+  a FIFO queue serializes them rather than letting a slow one finish after a
+  later one and re-derive a stale answer. Deliberately not done: the live
+  `state` of a field this page does not own is not rehydrated from what another
+  page wrote, only the persisted record is — adopting a concurrently-written
+  value into `state` reintroduced the same clobber one page later, caught by
+  `tests/txStatus.test.js` red. Two writers of the same field still resolve
+  last-writer-wins, documented at the merge point. `tests/stateMerge.test.js`
+  covers the two-page save and the approval-window reproduction from the issue —
+  add a wallet in one page, force a save from a second page loaded before it,
+  both wallets survive — each demonstrated failing against the unfixed full-blob
+  write.
 - 2026-08-20: A forgotten password no longer wedges the wallet
   ([#312](https://git.eeqj.de/sneak/AutistMask/issues/312)). Deleting a wallet
   was password-gated and importing its recovery phrase again was refused as a

src/popup/views/approval.js

@@ -25,6 +25,12 @@ const {
     resolveTokenDecimals,
     unknownDecimalsAmount,
 } = require("../../shared/approvalAmount");
+// Four decimals, with the nonzero floor these screens hold: every amount this
+// view renders — the ERC-20 line, the ETH value, the max fee — and every one
+// it carries forward to the wait/success/error screens goes through it.
+const {
+    truncateAmountNeverZero: formatTxValue,
+} = require("../../shared/amountDisplay");
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
@@ -40,13 +46,6 @@ function approvalAddressHtml(address) {
     return renderAddressHtml(address, { title });
 }
 
-function formatTxValue(val) {
-    const parts = val.split(".");
-    if (parts.length === 1) return val + ".0000";
-    const dec = (parts[1] + "0000").slice(0, 4);
-    return parts[0] + "." + dec;
-}
-
 // The amount line for a decoded ERC-20 call. With a known scale it is the
 // token quantity; with `decimals` null it is the base-unit integer with the
 // unknown scale stated, because formatting it with an assumed scale is what

src/shared/amountDisplay.js

@@ -0,0 +1,46 @@
+// The 4-decimal amount rule from README.md's Display Consistency section, and
+// the one exception to it, in one place. Three call sites had grown their own
+// copy of the truncation — the history and balance lists
+// (`src/shared/transactions.js`), the approval screen's ERC-20 amount line
+// (`src/popup/views/approval.js`) and its Uniswap swap detail lines
+// (`src/shared/uniswap.js`) — and a fix applied to one of them left the other
+// two showing a different number for the same value.
+//
+// The two functions below are the two policies, not two implementations of
+// one: summary lists truncate, and the screens that state what is being
+// authorized truncate with a floor. Keeping them adjacent is the point, so a
+// change to the rule cannot reach one screen and miss another.
+
+// Truncate to exactly four decimal places. Truncation, never rounding: an
+// amount must never be displayed as larger than it is, so 0.99999 stays
+// 0.9999.
+function truncateAmount(val) {
+    const parts = val.split(".");
+    if (parts.length === 1) return val + ".0000";
+    return parts[0] + "." + (parts[1] + "0000").slice(0, 4);
+}
+
+// The same rule, plus the invariant the approval and confirmation screens
+// hold: a nonzero amount never renders as zero. Truncating to four decimals
+// does exactly that to an amount below 0.0001 — one base unit of an 18-decimal
+// token, 500 of an 8-decimal one — and a real transfer or allowance then reads
+// as "nothing is being moved" on the screen whose whole job is to say what is
+// being authorized.
+//
+// When the truncated string carries no significant digit and the value does,
+// the amount is extended to its first significant digit instead. It stays in
+// token units, the same unit as the symbol printed beside it. A genuine zero
+// still renders 0.0000, and anything at or above the floor is untouched.
+function truncateAmountNeverZero(val) {
+    const truncated = truncateAmount(val);
+    // Tests the whole truncated string, integer part included: 1.00005 has a
+    // significant digit already and stays 1.0000.
+    if (/[1-9]/.test(truncated)) return truncated;
+    const parts = val.split(".");
+    if (parts.length === 1) return truncated;
+    const sig = parts[1].search(/[1-9]/);
+    if (sig === -1) return truncated;
+    return parts[0] + "." + parts[1].slice(0, sig + 1);
+}
+
+module.exports = { truncateAmount, truncateAmountNeverZero };

src/shared/state.js

@@ -6,6 +6,7 @@ const { networkById } = require("./networks");
 const { RESTORABLE_VIEWS } = require("../popup/restorableViews");
 
 const { storageGet, storageSet } = require("./browserApi");
+const { log } = require("./log");
 
 const DEFAULT_STATE = {
     hasWallet: false,
@@ -88,135 +89,529 @@ function currentNetwork() {
     return networkById(state.networkId);
 }
 
-async function saveState() {
-    const persisted = {
-        hasWallet: state.hasWallet,
-        wallets: state.wallets,
-        trackedTokens: state.trackedTokens,
-        networkId: state.networkId,
-        rpcUrl: state.rpcUrl,
-        blockscoutUrl: state.blockscoutUrl,
-        networkEndpoints: state.networkEndpoints,
-        lastBalanceRefresh: state.lastBalanceRefresh,
-        activeAddress: state.activeAddress,
-        allowedSites: state.allowedSites,
-        deniedSites: state.deniedSites,
-        rememberSiteChoice: state.rememberSiteChoice,
-        showZeroBalanceTokens: state.showZeroBalanceTokens,
-        hideSpoofedSymbols: state.hideSpoofedSymbols,
-        hideLowHolderTokens: state.hideLowHolderTokens,
-        hideFraudContracts: state.hideFraudContracts,
-        hideDustTransactions: state.hideDustTransactions,
-        dustThresholdGwei: state.dustThresholdGwei,
-        utcTimestamps: state.utcTimestamps,
-        fraudContracts: state.fraudContracts,
-        tokenHolderCache: state.tokenHolderCache,
-        theme: state.theme,
-        debugMode: state.debugMode,
-        currentView: state.currentView,
-        selectedWallet: state.selectedWallet,
-        selectedAddress: state.selectedAddress,
-        selectedToken: state.selectedToken,
-        viewData: state.viewData,
-        viewStack: state.viewStack,
-    };
-    await storageSet({ autistmask: persisted });
+// Every field written to and read from the single "autistmask" storage key.
+// hasWallet is deliberately excluded from the diffing/merge logic below —
+// like loadState() does, it is always derived from `wallets`, never carried
+// as an independent value.
+const PERSISTED_FIELDS = Object.keys(DEFAULT_STATE)
+    .filter((key) => key !== "hasWallet")
+    .concat([
+        "currentView",
+        "selectedWallet",
+        "selectedAddress",
+        "selectedToken",
+        "viewData",
+        "viewStack",
+    ]);
+
+// Turn a raw stored (or missing) record into the full, defaulted shape
+// loadState() used to assign directly onto `state`. Pulled out as a pure
+// function so saveState() can apply it too: the fields THIS page did not
+// change still have to come from storage in their loaded-and-normalized
+// form, not as the raw bytes another page (or an old release) left there —
+// otherwise a legacy shape a load has always self-healed in memory (a
+// missing networkEndpoints map, an out-of-range flag) is dropped right back
+// into storage unfixed every time the page that DID normalize it saves
+// something unrelated, because that field's value never "changed" for that
+// page to notice.
+function normalizePersisted(saved) {
+    saved = saved || {};
+    const out = {};
+    out.wallets = saved.wallets || [];
+    // Derived, never trusted verbatim off storage — see loadState().
+    out.hasWallet = out.wallets.length > 0;
+    out.trackedTokens = saved.trackedTokens || [];
+    out.networkId = saved.networkId || DEFAULT_STATE.networkId;
+    out.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
+    out.blockscoutUrl = saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
+    // An actual object is required, not merely a truthy non-array: the code
+    // below and onChainSwitch() index and ASSIGN INTO this value, and
+    // assigning a property to a string or a number is a silent no-op in
+    // sloppy mode. Copied rather than referenced, nested pairs included, so
+    // normalizing never mutates the object a caller handed in.
+    const rawEndpoints =
+        typeof saved.networkEndpoints === "object" &&
+        saved.networkEndpoints !== null &&
+        !Array.isArray(saved.networkEndpoints)
+            ? saved.networkEndpoints
+            : {};
+    out.networkEndpoints = {};
+    for (const netId of Object.keys(rawEndpoints)) {
+        out.networkEndpoints[netId] = { ...rawEndpoints[netId] };
+    }
+    // A profile written before this map existed carries exactly one pair of
+    // endpoints, belonging to whatever network it was last on. Adopt it as
+    // that network's remembered pair, so a custom endpoint set on the old
+    // build is not lost by the first switch away and back.
+    if (!out.networkEndpoints[out.networkId]) {
+        out.networkEndpoints[out.networkId] = {
+            rpcUrl: out.rpcUrl,
+            blockscoutUrl: out.blockscoutUrl,
+        };
+    }
+    out.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
+    out.activeAddress = saved.activeAddress || null;
+    out.allowedSites =
+        saved.allowedSites && !Array.isArray(saved.allowedSites)
+            ? saved.allowedSites
+            : {};
+    out.deniedSites =
+        saved.deniedSites && !Array.isArray(saved.deniedSites)
+            ? saved.deniedSites
+            : {};
+    out.rememberSiteChoice =
+        saved.rememberSiteChoice !== undefined
+            ? saved.rememberSiteChoice
+            : true;
+    out.showZeroBalanceTokens =
+        saved.showZeroBalanceTokens !== undefined
+            ? saved.showZeroBalanceTokens
+            : true;
+    // A profile written before this setting existed has no key for it. It
+    // is a safety filter, so absent must load as on, not as undefined.
+    out.hideSpoofedSymbols =
+        saved.hideSpoofedSymbols !== undefined
+            ? saved.hideSpoofedSymbols
+            : true;
+    out.hideLowHolderTokens =
+        saved.hideLowHolderTokens !== undefined
+            ? saved.hideLowHolderTokens
+            : true;
+    out.hideFraudContracts =
+        saved.hideFraudContracts !== undefined
+            ? saved.hideFraudContracts
+            : true;
+    out.hideDustTransactions =
+        saved.hideDustTransactions !== undefined
+            ? saved.hideDustTransactions
+            : true;
+    out.dustThresholdGwei =
+        saved.dustThresholdGwei !== undefined
+            ? saved.dustThresholdGwei
+            : 100000;
+    out.utcTimestamps =
+        saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+    out.fraudContracts = saved.fraudContracts || [];
+    out.tokenHolderCache = saved.tokenHolderCache || {};
+    out.theme = saved.theme || "system";
+    out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;
+    out.currentView = saved.currentView || null;
+    out.selectedWallet =
+        saved.selectedWallet !== undefined ? saved.selectedWallet : null;
+    out.selectedAddress =
+        saved.selectedAddress !== undefined ? saved.selectedAddress : null;
+    out.selectedToken = saved.selectedToken || null;
+    out.viewData = saved.viewData || {};
+    out.viewStack = restorableStack(saved.viewStack, out.currentView);
+    return out;
+}
+
+// The persisted fields as they stood at the end of this page's last
+// loadState() or saveState(). saveState() diffs the live state against this
+// to find only the fields THIS page actually changed.
+//
+// Deep-cloned, not a reference: callers mutate persisted objects and arrays
+// in place (state.wallets.push(...)), and a reference baseline would mutate
+// right along with `state`, so the diff would always come out empty.
+let baseline = null;
+
+function snapshotPersisted() {
+    const out = {};
+    for (const key of PERSISTED_FIELDS) out[key] = state[key];
+    return out;
+}
+
+function deepEqual(a, b) {
+    if (a === b) return true;
+    if (typeof a !== "object" || typeof b !== "object") return false;
+    if (a === null || b === null) return false;
+    if (Array.isArray(a) !== Array.isArray(b)) return false;
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length) return false;
+    for (const key of aKeys) {
+        if (!Object.prototype.hasOwnProperty.call(b, key)) return false;
+        if (!deepEqual(a[key], b[key])) return false;
+    }
+    return true;
+}
+
+// Stable identity for a wallet, independent of its position in the array
+// (which shifts under a concurrent add/delete elsewhere) and independent of
+// its mutable fields (name is user-editable; addresses gains/loses entries
+// via scanning and deleteAddress.js). An "hd"/"xprv" wallet's xpub never
+// changes for its lifetime and is already enforced unique
+// (findWalletByXpub() in addWallet.js). A "key" wallet has no xpub, exactly
+// one address for its whole lifetime (nothing ever adds to or removes from
+// a key wallet's address list), and that address is already enforced
+// unique (findWalletByAddress()) — so it stands in for identity there.
+// Neither invariant is enforced by this function or by
+// mergeListByIdentity() below — they hold only because every wallet-
+// creation path in addWallet.js happens to populate one or the other before
+// the wallet ever reaches state.wallets, and because canRemoveAddress() in
+// walletDelete.js never lets a wallet's address list go to zero. A wallet
+// with neither (an empty/legacy/corrupt record) falls back to the same
+// "addr:" identity as every other such record, which is a genuine
+// collision, not a proxy for one — see the collision handling in
+// mergeListByIdentity().
+function walletIdentity(wallet) {
+    if (wallet.xpub) return "xpub:" + wallet.xpub;
+    const first = wallet.addresses && wallet.addresses[0];
+    return "addr:" + (first ? String(first.address).toLowerCase() : "");
+}
+
+// Stable identity for an address within one wallet's address list. An
+// address is unique within its wallet and, once derived or imported, never
+// changes — only whether it is present.
+function addressIdentity(addr) {
+    return String(addr.address).toLowerCase();
+}
+
+// Merge one array of identity-bearing objects (wallets, or the addresses
+// inside one wallet) by identity rather than by array index — an index
+// shifts under a concurrent insert/delete elsewhere, which would merge the
+// wrong pair of objects entirely.
+//
+// `theirs` (fresh storage) sets the membership baseline and the order:
+//   - An item this page never had baseline knowledge of, but that is in
+//     `theirs`, was added by someone else — kept as-is.
+//   - An item `base` had and `ours` no longer has was deleted by THIS page
+//     — dropped even though `theirs` still has it (this page's own delete
+//     must win over a background save that only touched leaf fields).
+//   - An item present in both `ours` and `theirs` is merged leaf-by-leaf via
+//     `mergeItem`, so a leaf this page changed (e.g. a renamed wallet) lands
+//     on top of `theirs`' otherwise-current copy (e.g. a refreshed balance).
+// Anything left in `ours` that `base` never had and `theirs` does not have
+// yet is this page's own new addition — appended.
+//
+// `identityOf` is not guaranteed collision-free (walletIdentity() falls
+// back to one shared "addr:" value for any wallet with neither an xpub nor
+// a populated first address). Two records that collide under it must never
+// silently collapse into one — that is exactly how this function used to
+// drop a wallet, encryptedSecret included, with no error and no log. Two
+// defenses:
+//   - `ours` is indexed into GROUPS, not a single item per identity, so two
+//     colliding live items on this page can't overwrite each other in the
+//     index before the merge below even runs.
+//   - A matched pair with no shared `base` entry (neither page ever agreed
+//     on this identity) is only merged leaf-by-leaf when the two sides are
+//     already equal. If they differ, that is not "the same record edited
+//     twice", it is two different records that happen to share an identity
+//     — both are kept, unmerged, rather than guessing which one is real.
+function mergeListByIdentity(base, ours, theirs, identityOf, mergeItem) {
+    base = base || [];
+    ours = ours || [];
+    theirs = theirs || [];
+    const baseIndex = new Map(base.map((item) => [identityOf(item), item]));
+    const oursIndex = new Map();
+    for (const item of ours) {
+        const id = identityOf(item);
+        if (!oursIndex.has(id)) oursIndex.set(id, []);
+        oursIndex.get(id).push(item);
+    }
+
+    const result = [];
+    const seen = new Set();
+
+    for (const theirItem of theirs) {
+        const id = identityOf(theirItem);
+        seen.add(id);
+        const oursGroup = oursIndex.get(id);
+        if (baseIndex.has(id) && !oursGroup) continue;
+        if (oursGroup) {
+            const baseItem = baseIndex.get(id);
+            if (!baseItem && !deepEqual(oursGroup[0], theirItem)) {
+                log.errorf(
+                    "state: identity collision merging",
+                    JSON.stringify(id),
+                    "- keeping both records instead of dropping one",
+                );
+                result.push(theirItem, ...oursGroup);
+            } else {
+                result.push(mergeItem(baseItem, oursGroup[0], theirItem));
+                for (let i = 1; i < oursGroup.length; i++) {
+                    result.push(oursGroup[i]);
+                }
+            }
+        } else {
+            result.push(theirItem);
+        }
+    }
+
+    for (const item of ours) {
+        const id = identityOf(item);
+        if (seen.has(id)) continue;
+        if (!baseIndex.has(id)) result.push(item);
+    }
+
+    return result;
+}
+
+// Merge one wallet's scalar/leaf fields (name, encryptedSecret, nextIndex,
+// ...) against base, then recurse into its address list by identity. `base`
+// is null when this page created the wallet itself and no other page has
+// (yet) produced a same-identity record — nothing to merge in that case,
+// this page's own copy wins outright. mergeListByIdentity() only ever calls
+// this with `!base` when `ours` and `theirs` are already equal (a genuine
+// collision between two DIFFERENT same-identity records is caught and kept
+// as two separate entries before this function is reached), so returning
+// `ours` here can't discard a different wallet's data.
+function mergeWallet(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (key === "addresses") continue;
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    merged.addresses = mergeListByIdentity(
+        base.addresses,
+        ours.addresses,
+        theirs.addresses,
+        addressIdentity,
+        mergeAddress,
+    );
+    return merged;
+}
+
+// Merge one address's leaf fields (balance, ensName, tokenBalances, ...).
+// tokenBalances is itself an array, but only backgroundRefresh() ever
+// writes it and always wholesale (refreshBalances() in
+// src/shared/balances.js), so there is no membership to reconcile within
+// it — it is a leaf like balance or ensName, not a list with its own
+// identity.
+function mergeAddress(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    return merged;
+}
+
+// Merge a plain object keyed by string (allowedSites/deniedSites: address ->
+// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
+// same way mergeListByIdentity() merges an array — by key, not by whole-
+// object diff — so a key one page added or removed applies independently of
+// a key another page edited. Unlike an array's identity function, an object
+// key can't collide with a different logical entry (Object.keys() is
+// already deduplicated), so this needs no collision floor of its own.
+function mergeMapByKey(base, ours, theirs, mergeLeaf) {
+    base = base || {};
+    ours = ours || {};
+    theirs = theirs || {};
+    const result = {};
+    const seen = new Set();
+
+    for (const key of Object.keys(theirs)) {
+        seen.add(key);
+        const inBase = Object.prototype.hasOwnProperty.call(base, key);
+        const inOurs = Object.prototype.hasOwnProperty.call(ours, key);
+        if (inBase && !inOurs) continue; // this page deleted the whole entry
+        if (inOurs) {
+            result[key] = mergeLeaf(base[key], ours[key], theirs[key]);
+        } else {
+            result[key] = theirs[key];
+        }
+    }
+
+    for (const key of Object.keys(ours)) {
+        if (seen.has(key)) continue;
+        if (!Object.prototype.hasOwnProperty.call(base, key)) {
+            result[key] = ours[key];
+        }
+    }
+
+    return result;
+}
+
+// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
+// list is itself membership, not a leaf — src/background/index.js pushes a
+// newly approved/denied hostname onto it in place, and the Settings "revoke"
+// button (src/popup/views/settings.js) filters a hostname out of it in
+// place, from a different page. Merge it the same way wallets are merged:
+// identity is the hostname itself, so a merged pair is always equal and
+// mergeItem is a no-op pick.
+function mergeHostnameList(base, ours, theirs) {
+    return mergeListByIdentity(
+        base,
+        ours,
+        theirs,
+        (hostname) => hostname,
+        (b, o, t) => t,
+    );
+}
+
+function mergeSiteMap(base, ours, theirs) {
+    return mergeMapByKey(base, ours, theirs, mergeHostnameList);
+}
+
+// networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }. onChainSwitch()
+// (src/shared/chainSwitch.js) writes state.networkEndpoints[networkId] in
+// place before saving. No code path ever removes a key from this map, so the
+// membership collision that matters for allowedSites/wallets (an add on one
+// page racing a delete on another) can't happen here — but two pages
+// switching to two different networks concurrently still race a whole-field
+// diff the same way, so it gets the same per-key merge for the leaf edit
+// case (e.g. Settings saving a custom RPC URL for the active network).
+function mergeEndpointEntry(base, ours, theirs) {
+    if (!base) return ours;
+    const merged = { ...theirs };
+    for (const key of Object.keys(ours)) {
+        if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
+    }
+    return merged;
+}
+
+function mergeNetworkEndpoints(base, ours, theirs) {
+    return mergeMapByKey(base, ours, theirs, mergeEndpointEntry);
+}
+
+// Read-modify-write, merged per field, rather than one full-blob write.
+//
+// Every extension page (the toolbar popup, a dApp approval window, the
+// background's backgroundRefresh()) holds its own in-memory `state`, loaded
+// once, and showView() saves on every navigation. A full-blob write here
+// clobbers whatever a second page had written since — including, in the
+// worst case, an entire wallet and its encrypted secret with no attacker
+// and no unusual input (see the issue this fixes).
+//
+// Only the fields this page actually changed — those that differ from
+// `baseline`, captured at the last loadState()/saveState() on this page —
+// are written; every other field is carried forward from whatever is in
+// storage right now, which may already be a value another page wrote.
+//
+// `wallets` is merged structurally (mergeListByIdentity(), by wallet
+// identity and then by address identity within each wallet), not as one
+// whole field: backgroundRefresh() mutates wallets IN PLACE (addr.balance /
+// ensName / tokenBalances, via refreshBalances()), so a whole-field diff
+// would mark all of `wallets` "changed" the moment any balance moved and
+// write back background's own copy — loaded before its multi-second network
+// round trip — clobbering a wallet another page added, or resurrecting one
+// another page deleted, in that window. Merging by identity lets
+// background's leaf changes and another page's membership changes
+// (add/delete a wallet or an address) apply independently instead of
+// colliding as the same field.
+//
+// `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
+// by address key and then by hostname within each address's list), for the
+// identical reason: src/background/index.js pushes a newly
+// approved/denied hostname onto them in place, and the Settings "revoke"
+// button (src/popup/views/settings.js) filters one out in place, from a
+// different page. A whole-field diff here doesn't just lose data, it is a
+// security defect — a stale page's save can resurrect a just-revoked site
+// permission, or silently wipe a permission just granted elsewhere.
+//
+// `networkEndpoints` gets the same treatment too (mergeNetworkEndpoints(),
+// by network id), since onChainSwitch() writes into it in place; the value
+// per key is a small leaf object with no membership of its own; see the
+// comment at mergeEndpointEntry() for why the collision this closes is
+// milder than the other two.
+//
+// Every other persisted field stays a whole-field diff:
+// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
+// per-element identity to merge by; `tokenHolderCache` is a map shaped like
+// the ones above, but nothing in src/ ever writes an entry into it — it is
+// only ever reset wholesale to `{}` (onChainSwitch()) — so there is no
+// in-place mutation for a whole-field diff to collide with; `viewData` is
+// this page's own UI scratch space, not data another page has any reason to
+// share membership of.
+//
+// This does not make two pages that both change the SAME leaf concurrently
+// safe: last write wins on that one leaf, same as before. What it removes
+// is the cross-field (and now cross-membership-vs-leaf) clobber — a page
+// that only navigated, or only refreshed a balance, overwriting a wallet or
+// address list it never touched the membership of.
+//
+// This page's own live `state` is deliberately NOT rehydrated from a field
+// another page changed — only the record written to storage is merged.
+// showView() fires saveState() on every navigation without awaiting it,
+// which is what makes the queue above necessary in the first place, and a
+// save that is slow to come back has no way to tell whether the field it
+// is about to hand back is still the current answer or has since been
+// overtaken by something this very page did in the meantime; writing it
+// into `state` regardless reintroduced exactly the clobber this function
+// exists to remove, just delayed and confined to one page instead of two
+// (caught by tests/txStatus.test.js). A page's live picture of a field it
+// does not own goes on being whatever its last loadState() saw, same as
+// before this fix; only the persisted record is guaranteed current.
+async function saveStateOnce() {
+    const current = snapshotPersisted();
+    const result = await storageGet("autistmask");
+    // Normalized, not raw: a field this page did not change still has to
+    // come from storage in its loaded (self-healed) shape. See
+    // normalizePersisted() above.
+    const fresh = normalizePersisted(result.autistmask);
+
+    const merged = { ...fresh };
+    for (const key of PERSISTED_FIELDS) {
+        if (key === "wallets") {
+            merged.wallets = mergeListByIdentity(
+                baseline ? baseline.wallets : [],
+                current.wallets,
+                fresh.wallets,
+                walletIdentity,
+                mergeWallet,
+            );
+        } else if (key === "allowedSites" || key === "deniedSites") {
+            merged[key] = mergeSiteMap(
+                baseline ? baseline[key] : {},
+                current[key],
+                fresh[key],
+            );
+        } else if (key === "networkEndpoints") {
+            merged.networkEndpoints = mergeNetworkEndpoints(
+                baseline ? baseline.networkEndpoints : {},
+                current.networkEndpoints,
+                fresh.networkEndpoints,
+            );
+        } else if (
+            baseline === null ||
+            !deepEqual(current[key], baseline[key])
+        ) {
+            merged[key] = current[key];
+        }
+    }
+    merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
+
+    await storageSet({ autistmask: merged });
+
+    // Derived from this page's own wallets, never adopted off the wire —
+    // see loadState(). Everything else this page did not change is left
+    // exactly as it stood; see the note above.
+    state.hasWallet = state.wallets.length > 0;
+
+    baseline = structuredClone(snapshotPersisted());
+}
+
+// showView() calls saveState() on every navigation without awaiting it, so
+// two saves from the SAME page can be in flight at once — e.g. a screen
+// shown, then immediately replaced before the first save's storageGet()
+// round trip has come back. Left concurrent, the first save's turn would
+// finish after the second's live-state mutation and then re-hydrate `state`
+// from what IT read, stomping the second, later change back to a stale
+// value — the same clobber this function exists to prevent, just between
+// two saves on one page instead of two pages. Queuing makes every save's
+// snapshot-diff-write-rehydrate run start to finish before the next one
+// begins, so each one only ever sees the true live state at its turn.
+let saveQueue = Promise.resolve();
+
+function saveState() {
+    const turn = saveQueue.then(saveStateOnce);
+    // The queue must advance even when a save rejects, or every save after
+    // it queues behind a promise that never settles.
+    saveQueue = turn.catch(() => {});
+    return turn;
 }
 
 async function loadState() {
     const result = await storageGet("autistmask");
     if (result.autistmask) {
-        const saved = result.autistmask;
-        state.wallets = saved.wallets || [];
-        // Derived, never read from storage: a profile persisted with the flag
-        // out of step with the wallet list would otherwise stay broken on
-        // every load. Nothing depends on the two disagreeing.
-        state.hasWallet = state.wallets.length > 0;
-        state.trackedTokens = saved.trackedTokens || [];
-        state.networkId = saved.networkId || DEFAULT_STATE.networkId;
-        state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
-        state.blockscoutUrl =
-            saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
-        // An actual object is required, not merely a truthy non-array: the
-        // code below and onChainSwitch() index and ASSIGN INTO this value,
-        // and assigning a property to a string or a number is a silent no-op
-        // in sloppy mode. A stored primitive would therefore be re-persisted
-        // unchanged forever, and every switch would fall back to the network
-        // default — the endpoint loss this map exists to prevent, with no
-        // self-healing. The allowedSites/deniedSites guards below are only
-        // read from, which is why they can be looser.
-        state.networkEndpoints =
-            typeof saved.networkEndpoints === "object" &&
-            saved.networkEndpoints !== null &&
-            !Array.isArray(saved.networkEndpoints)
-                ? saved.networkEndpoints
-                : {};
-        // A profile written before this map existed carries exactly one pair
-        // of endpoints, belonging to whatever network it was last on. Adopt
-        // it as that network's remembered pair, so a custom endpoint set on
-        // the old build is not lost by the first switch away and back.
-        if (!state.networkEndpoints[state.networkId]) {
-            state.networkEndpoints[state.networkId] = {
-                rpcUrl: state.rpcUrl,
-                blockscoutUrl: state.blockscoutUrl,
-            };
-        }
-        state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
-        state.activeAddress = saved.activeAddress || null;
-        state.allowedSites =
-            saved.allowedSites && !Array.isArray(saved.allowedSites)
-                ? saved.allowedSites
-                : {};
-        state.deniedSites =
-            saved.deniedSites && !Array.isArray(saved.deniedSites)
-                ? saved.deniedSites
-                : {};
-        state.rememberSiteChoice =
-            saved.rememberSiteChoice !== undefined
-                ? saved.rememberSiteChoice
-                : true;
-        state.showZeroBalanceTokens =
-            saved.showZeroBalanceTokens !== undefined
-                ? saved.showZeroBalanceTokens
-                : true;
-        // A profile written before this setting existed has no key for it.
-        // It is a safety filter, so absent must load as on, not as undefined.
-        state.hideSpoofedSymbols =
-            saved.hideSpoofedSymbols !== undefined
-                ? saved.hideSpoofedSymbols
-                : true;
-        state.hideLowHolderTokens =
-            saved.hideLowHolderTokens !== undefined
-                ? saved.hideLowHolderTokens
-                : true;
-        state.hideFraudContracts =
-            saved.hideFraudContracts !== undefined
-                ? saved.hideFraudContracts
-                : true;
-        state.hideDustTransactions =
-            saved.hideDustTransactions !== undefined
-                ? saved.hideDustTransactions
-                : true;
-        state.dustThresholdGwei =
-            saved.dustThresholdGwei !== undefined
-                ? saved.dustThresholdGwei
-                : 100000;
-        state.utcTimestamps =
-            saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
-        state.fraudContracts = saved.fraudContracts || [];
-        state.tokenHolderCache = saved.tokenHolderCache || {};
-        state.theme = saved.theme || "system";
-        state.debugMode =
-            saved.debugMode !== undefined ? saved.debugMode : false;
-        state.currentView = saved.currentView || null;
-        state.selectedWallet =
-            saved.selectedWallet !== undefined ? saved.selectedWallet : null;
-        state.selectedAddress =
-            saved.selectedAddress !== undefined ? saved.selectedAddress : null;
-        state.selectedToken = saved.selectedToken || null;
-        state.viewData = saved.viewData || {};
-        state.viewStack = restorableStack(saved.viewStack, state.currentView);
+        Object.assign(state, normalizePersisted(result.autistmask));
     }
+    // The point of comparison every saveState() on this page diffs against,
+    // whether storage had a profile or was empty. See PERSISTED_FIELDS above
+    // saveState() for why a reference here would be wrong.
+    baseline = structuredClone(snapshotPersisted());
 }
 
 function currentAddress() {

src/shared/transactions.js

@@ -11,6 +11,10 @@ const { log, debugFetch } = require("./log");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { parseHoldersCount, isLowHolderCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
+// The plain 4-decimal rule. The history and balance lists deliberately keep
+// truncation without the approval screens' nonzero floor: the transaction
+// detail view is the authoritative record and already shows exact precision.
+const { truncateAmount: formatTxValue } = require("./amountDisplay");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -20,13 +24,6 @@ function normalizeAddress(addr) {
     return (addr || "").toLowerCase();
 }
 
-function formatTxValue(val) {
-    const parts = val.split(".");
-    if (parts.length === 1) return val + ".0000";
-    const dec = (parts[1] + "0000").slice(0, 4);
-    return parts[0] + "." + dec;
-}
-
 function parseTx(tx, addrLower) {
     const from = tx.from?.hash || "";
     const to = tx.to?.hash || "";

src/shared/uniswap.js

@@ -3,6 +3,7 @@
 
 const { Interface, AbiCoder, getBytes, formatUnits } = require("ethers");
 const { TOKEN_BY_ADDRESS } = require("./tokenList");
+const { truncateAmountNeverZero } = require("./amountDisplay");
 
 const coder = AbiCoder.defaultAbiCoder();
 
@@ -34,11 +35,13 @@ const COMMAND_NAMES = {
     0x21: "Execute Sub-Plan",
 };
 
+// The swap's Amount and Min. received lines land on the same approval screen,
+// and Amount is carried to the wait/success/error screens as the ERC-20 line
+// is, so they take the same nonzero floor: a swap of an amount below 0.0001 is
+// not "0.0000", and a slippage floor of one base unit does not read as "you may
+// receive nothing".
 function formatAmount(raw, decimals) {
-    const parts = formatUnits(raw, decimals).split(".");
-    if (parts.length === 1) return parts[0] + ".0000";
-    const dec = (parts[1] + "0000").slice(0, 4);
-    return parts[0] + "." + dec;
+    return truncateAmountNeverZero(formatUnits(raw, decimals));
 }
 
 function tokenInfo(address) {

tests/approvalDisplayFloor.test.js

@@ -0,0 +1,190 @@
+// The floor of the approval screen's amount line.
+//
+// Amounts are truncated to four decimal places for scannability (README.md,
+// Display Consistency). With the token's true scale resolved, that truncation
+// can still take a real amount below the floor and print it as `0.0000`: one
+// base unit of an 18-decimal token, or a few hundred of an 8-decimal one. On
+// the one screen whose job is to state what is being authorized, a nonzero
+// transfer or allowance then reads as nothing.
+//
+// The invariant asserted here is narrow: a nonzero amount never renders as
+// zero. The four-decimal rule itself is unchanged, and the string the
+// confirmation screens carry as `txInfo.amount` is the same one, so it is
+// asserted on `rawValue` alongside the displayed line.
+//
+// Both amount paths of that screen are covered: the ERC-20 line decoded by
+// `src/popup/views/approval.js`, and the swap's `Amount` and `Min. received`
+// lines decoded by `src/shared/uniswap.js`.
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { AbiCoder, Interface } = require("ethers");
+const { ERC20_ABI } = require("../src/shared/constants");
+const { state } = require("../src/shared/state");
+const { decodeCalldata } = require("../src/popup/views/approval");
+const uniswap = require("../src/shared/uniswap");
+const {
+    truncateAmount,
+    truncateAmountNeverZero,
+} = require("../src/shared/amountDisplay");
+
+const iface = new Interface(ERC20_ABI);
+
+// Bundled tokens, so the scale and the symbol both come from the list.
+const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"; // 6 decimals
+const WBT = "0x925206b8a707096Ed26ae47C84747fE0bb734F59"; // 8 decimals
+const DAI = "0x6B175474E89094C44Da98b954EedeAC495271d0F"; // 18 decimals
+// Outside the list, so the scale comes from what the user tracks and the line
+// carries no symbol.
+const NOVEL = "0xE2E0000000000000000000000000000000000E2e";
+
+const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const SPENDER = "0x1111111111111111111111111111111111111111";
+
+// The Uniswap swap lines land on this same approval screen.
+const ROUTER = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
+const USDT = "0xdAC17F958D2ee523a2206206994597C13D831ec7"; // 6 decimals
+const WETH = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"; // 18 decimals
+
+const coder = AbiCoder.defaultAbiCoder();
+const routerIface = new Interface([
+    "function execute(bytes commands, bytes[] inputs, uint256 deadline)",
+]);
+
+// A V2_SWAP_EXACT_IN (command 0x08) execute() call: `amountIn` of USDT for at
+// least `amountOutMin` of WETH.
+function swapData(amountIn, amountOutMin) {
+    const input = coder.encode(
+        ["address", "uint256", "uint256", "address[]", "bool"],
+        [RECIPIENT, amountIn, amountOutMin, [USDT, WETH], true],
+    );
+    return routerIface.encodeFunctionData("execute", [
+        "0x08",
+        [input],
+        9999999999n,
+    ]);
+}
+
+function swapDetail(amountIn, amountOutMin, label) {
+    const decoded = uniswap.decode(swapData(amountIn, amountOutMin), ROUTER);
+    return decoded.details.find((d) => d.label === label);
+}
+
+function transferData(amount) {
+    return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
+}
+
+function approveData(amount) {
+    return iface.encodeFunctionData("approve", [SPENDER, amount]);
+}
+
+// The Amount detail as the approval screen renders it: `value` is the line on
+// the screen, `rawValue` is what is carried to the wait/success/error screens.
+function amount(data, token) {
+    const decoded = decodeCalldata(data, token);
+    return decoded.details.find((d) => d.label === "Amount");
+}
+
+beforeEach(() => {
+    state.trackedTokens = [];
+    state.wallets = [];
+});
+
+describe("a nonzero amount never renders as zero", () => {
+    test("500 base units of a 6-decimal token", () => {
+        const detail = amount(transferData(500n), USDC);
+        expect(detail.value).toBe("0.0005 USDC");
+        expect(detail.rawValue).toBe("0.0005");
+    });
+
+    test("1 base unit of an 18-decimal token", () => {
+        const detail = amount(transferData(1n), DAI);
+        expect(detail.value).toBe("0.000000000000000001 DAI");
+        expect(detail.rawValue).toBe("0.000000000000000001");
+    });
+
+    test("500 base units of an 8-decimal token", () => {
+        expect(amount(transferData(500n), WBT).rawValue).toBe("0.000005");
+    });
+
+    test("an allowance below the floor is not rendered as zero either", () => {
+        expect(amount(approveData(1n), DAI).value).toBe(
+            "0.000000000000000001 DAI",
+        );
+    });
+
+    // The floor holds at any scale, not only the three above: for every
+    // decimals a token can declare, one base unit has to show a digit.
+    test("one base unit shows a significant digit at every scale", () => {
+        for (let decimals = 0; decimals <= 30; decimals++) {
+            state.trackedTokens = [{ address: NOVEL, decimals }];
+            expect(amount(transferData(1n), NOVEL).rawValue).toMatch(/[1-9]/);
+        }
+    });
+});
+
+// The swap decoder formats its own amounts, so the same floor has to hold on
+// the swap lines of the same screen. `Min. received` is the sharper of the
+// two: the slippage floor rendered as `0.0000` states that the swap may return
+// nothing.
+describe("a swap's amounts never render as zero either", () => {
+    test("a swap input below the floor keeps a significant digit", () => {
+        // 50 base units of a 6-decimal token is 0.00005.
+        const detail = swapDetail(50n, 10n ** 15n, "Amount");
+        expect(detail.value).toBe("0.00005 USDT");
+        expect(detail.rawValue).toBe("0.00005");
+    });
+
+    test("a min-received below the floor keeps a significant digit", () => {
+        // 1 wei of an 18-decimal token.
+        expect(swapDetail(10n ** 6n, 1n, "Min. received").value).toBe(
+            "0.000000000000000001 WETH",
+        );
+    });
+
+    test("swap amounts at or above the floor are still truncated", () => {
+        expect(swapDetail(1000000n, 10n ** 15n, "Amount").rawValue).toBe(
+            "1.0000",
+        );
+        expect(
+            swapDetail(1000000n, 999999999999999999n, "Min. received").value,
+        ).toBe("0.9999 WETH");
+    });
+});
+
+describe("the four-decimal rule is otherwise unchanged", () => {
+    test("a whole amount keeps exactly four decimals", () => {
+        expect(amount(transferData(5000000000n), USDC).rawValue).toBe(
+            "5000.0000",
+        );
+    });
+
+    test("precision beyond four decimals is still truncated", () => {
+        expect(amount(transferData(1234567890123456789n), DAI).rawValue).toBe(
+            "1.2345",
+        );
+    });
+
+    test("an amount at the floor is not extended", () => {
+        expect(amount(transferData(100000000000000n), DAI).rawValue).toBe(
+            "0.0001",
+        );
+    });
+
+    test("a genuine zero still renders as zero", () => {
+        expect(amount(transferData(0n), DAI).rawValue).toBe("0.0000");
+    });
+
+    // The three truncators now share one module. The floor is a policy of the
+    // approval and confirmation screens only: the history and balance lists
+    // keep plain truncation, because the transaction detail view is the
+    // authoritative record and already shows exact precision.
+    test("the list rule stays unfloored", () => {
+        expect(truncateAmount("0.000000000000000001")).toBe("0.0000");
+        expect(truncateAmountNeverZero("0.000000000000000001")).toBe(
+            "0.000000000000000001",
+        );
+    });
+});

tests/stateMerge.test.js

@@ -0,0 +1,443 @@
+// saveState() used to write the entire state blob every time
+// (src/shared/state.js). Every extension page — the toolbar popup, a dApp
+// approval window opened by the background, backgroundRefresh() in
+// src/background/index.js — holds its own in-memory `state`, loaded once,
+// and src/popup/views/helpers.js showView() saves on EVERY navigation. So
+// any second page that saved after a first page had written something new
+// overwrote it, with no attacker and no unusual input: a whole wallet, name,
+// addresses and encrypted secret included, silently gone
+// (https://git.eeqj.de/sneak/AutistMask/issues/304).
+//
+// Both cases below drive the real state.js module through two independent
+// module registries sharing one storage backend, the way two real extension
+// pages share one chrome.storage.local. The storage stub structured-clones
+// on both get and set — a stub that hands back the object it was given
+// aliases the caller's own mutation and would make this entire defect class
+// invisible (see https://git.eeqj.de/sneak/AutistMask/issues/324).
+
+function makeStorage() {
+    let store = {};
+    return {
+        get: async (keys) => {
+            const wanted =
+                keys === undefined || keys === null
+                    ? Object.keys(store)
+                    : [].concat(keys);
+            const out = {};
+            for (const key of wanted) {
+                if (key in store) out[key] = structuredClone(store[key]);
+            }
+            return out;
+        },
+        set: async (items) => {
+            for (const [key, value] of Object.entries(items)) {
+                store[key] = structuredClone(value);
+            }
+        },
+    };
+}
+
+// One extension page: a fresh module registry over the shared storage.
+// state.js resolves the storage API at require time, so the stub has to be
+// installed before the module is loaded, and `state` is a module-level
+// singleton, so each page needs its own registry to hold its own copy.
+function loadPage(storage) {
+    jest.resetModules();
+    globalThis.chrome = { storage: { local: storage } };
+    return {
+        state: require("../src/shared/state"),
+        helpers: require("../src/popup/views/helpers"),
+    };
+}
+
+function wallet(name, secret, address) {
+    return {
+        type: "hd",
+        name,
+        xpub: "xpub-" + name,
+        encryptedSecret: secret,
+        nextIndex: 1,
+        addresses: [{ address, balance: "0", tokenBalances: [] }],
+    };
+}
+
+const W1 = wallet(
+    "Wallet 1",
+    "secret-one",
+    "0x66133E8ea0f5D1d612D2502a968757D1048c214a",
+);
+const W2 = wallet(
+    "Wallet 2",
+    "secret-two",
+    "0xdAC17F958D2ee523a2206206994597C13D831ec7",
+);
+
+// Minimal DOM: showView() toggles view elements, clears the flash line and
+// creates/removes the debug banner. Nothing here is asserted; it only has to
+// answer without throwing, the way the popup's own index.html would.
+function makeElement(id) {
+    const classes = new Set();
+    return {
+        id,
+        textContent: "",
+        style: {},
+        classList: {
+            add: (...n) => n.forEach((c) => classes.add(c)),
+            remove: (...n) => n.forEach((c) => classes.delete(c)),
+            toggle: (c, force) => {
+                const on = force === undefined ? !classes.has(c) : force;
+                if (on) classes.add(c);
+                else classes.delete(c);
+                return on;
+            },
+        },
+        remove: () => {},
+    };
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+afterEach(() => {
+    delete globalThis.chrome;
+    delete globalThis.document;
+});
+
+describe("a save from a page that never saw a wallet another page added", () => {
+    // The first DoD case on the issue: add a wallet in one page, then force
+    // a save from a second page loaded before that wallet existed. Both
+    // wallets must survive.
+    test("both wallets are in storage afterwards", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // Loaded while storage held only Wallet 1, and never reloads —
+        // the approval window in the reproduction, or a second popup that
+        // has been open for a while.
+        const stale = loadPage(storage);
+        await stale.state.loadState();
+        expect(stale.state.state.wallets).toHaveLength(1);
+
+        // A second page, loaded after, adds a wallet — the exact sequence
+        // src/popup/views/addWallet.js uses.
+        const fresh = loadPage(storage);
+        await fresh.state.loadState();
+        fresh.state.state.wallets.push(W2);
+        fresh.state.state.hasWallet = true;
+        await fresh.state.saveState();
+
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // The stale page saves something that has nothing to do with
+        // wallets — exactly what showView() does on every navigation, and
+        // what backgroundRefresh() does after a balance poll.
+        stale.state.state.currentView = "settings";
+        await stale.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+    });
+});
+
+describe("the approval-window reproduction", () => {
+    // approval window open, add a wallet in the popup, confirm the approval
+    // — the exact sequence from the issue. The approval window and the
+    // popup are the same popup code with a different starting view, so
+    // showView() is the real save path in both: src/popup/views/approval.js
+    // showTxApproval() calls showView("approve-tx") when the window opens,
+    // and a successful confirm calls
+    // src/popup/views/txStatus.js showWait() -> startWait(), which calls
+    // showView("wait-tx") — the save that clobbered the second wallet in
+    // the reproduction on the issue.
+    test("the wallet added in the popup survives confirming the approval", async () => {
+        globalThis.document = makeDocument();
+
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // The background opens the approval window on the approve-tx
+        // screen; nothing else has happened yet.
+        const approvalWindow = loadPage(storage);
+        await approvalWindow.state.loadState();
+        approvalWindow.helpers.showView("approve-tx");
+        // showView() does not await its own saveState(); an extra save
+        // joins the same queue and only resolves once that one has too,
+        // which is the black-box way to know it landed.
+        await approvalWindow.state.saveState();
+
+        // The user adds a wallet in the popup — a separate page, loaded
+        // after the approval window.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.push(W2);
+        popup.state.state.hasWallet = true;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // The user confirms the approval. The approval window navigates
+        // approve-tx -> wait-tx, saving again from state it loaded before
+        // Wallet 2 ever existed.
+        approvalWindow.helpers.showView("wait-tx");
+        await approvalWindow.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+    });
+});
+
+// backgroundRefresh() (src/background/index.js) loads state, spends seconds
+// on network I/O in refreshBalances() (src/shared/balances.js) mutating
+// addr.balance/ensName/tokenBalances IN PLACE on the wallets it already
+// knew about, then saves. Precondition 2 on the issue: that refresh window
+// overlapping a membership change (add or delete) on another page must not
+// clobber or resurrect a wallet — a whole-field diff on `wallets` failed
+// this, because "background changed a balance" and "another page changed
+// membership" collided as the same field.
+describe("background refresh racing a wallet added on another page", () => {
+    test("the wallet added elsewhere survives background's stale balance save", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // "background": loads first, and its save is the one that lands
+        // last, modeling the multi-second network round trip in between.
+        const background = loadPage(storage);
+        await background.state.loadState();
+        background.state.state.wallets[0].addresses[0].balance = "1.2345";
+
+        // A second page, loaded after, adds a wallet while background's
+        // refresh is still in flight.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.push(W2);
+        popup.state.state.hasWallet = true;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        // background's save lands last, carrying only its balance update.
+        await background.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual([
+            "Wallet 1",
+            "Wallet 2",
+        ]);
+        expect(persisted.wallets.map((w) => w.encryptedSecret)).toEqual([
+            "secret-one",
+            "secret-two",
+        ]);
+        // The balance update itself must not be lost either — this is a
+        // merge, not deletion-always-wins.
+        expect(persisted.wallets[0].addresses[0].balance).toBe("1.2345");
+    });
+});
+
+describe("background refresh racing a wallet deleted on another page", () => {
+    test("the wallet deleted elsewhere stays deleted after background's stale balance save", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1, W2] } });
+
+        const background = loadPage(storage);
+        await background.state.loadState();
+        background.state.state.wallets[0].addresses[0].balance = "1.2345";
+
+        // A second page deletes Wallet 2 while background's refresh is in
+        // flight — the same splice deleteWallet.js's removeWalletFromState()
+        // does.
+        const popup = loadPage(storage);
+        await popup.state.loadState();
+        popup.state.state.wallets.splice(1, 1);
+        popup.state.state.hasWallet = popup.state.state.wallets.length > 0;
+        await popup.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(1);
+
+        await background.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.wallets.map((w) => w.name)).toEqual(["Wallet 1"]);
+        expect(persisted.wallets[0].addresses[0].balance).toBe("1.2345");
+    });
+});
+
+// allowedSites/deniedSites: { [address]: [hostname, ...] }. Mutated in place
+// from two different contexts — src/background/index.js:592-599 pushes a
+// newly approved hostname onto state.allowedSites[activeAddress], and the
+// Settings "revoke" button (src/popup/views/settings.js:55-68) filters a
+// hostname out of state[key][addr] in place, deleting the address key
+// entirely once its list is empty — the exact membership-vs-whole-field
+// pattern that made the whole-field `wallets` diff unsafe, on a
+// security-relevant field: a stale whole-field save here can resurrect a
+// revoked permission or wipe a freshly granted one.
+const ADDR1 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
+const ADDR2 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+
+function approveSite(pageState, address, hostname) {
+    if (!pageState.allowedSites[address]) {
+        pageState.allowedSites[address] = [];
+    }
+    if (!pageState.allowedSites[address].includes(hostname)) {
+        pageState.allowedSites[address].push(hostname);
+    }
+}
+
+function revokeSite(pageState, hostname) {
+    for (const addr of Object.keys(pageState.allowedSites)) {
+        pageState.allowedSites[addr] = pageState.allowedSites[addr].filter(
+            (h) => h !== hostname,
+        );
+        if (pageState.allowedSites[addr].length === 0) {
+            delete pageState.allowedSites[addr];
+        }
+    }
+}
+
+describe("a dApp approval racing a stale Settings page's later save", () => {
+    test("the fresh approval survives Settings revoking an unrelated site", async () => {
+        const storage = makeStorage();
+        await storage.set({
+            autistmask: {
+                wallets: [W1],
+                allowedSites: { [ADDR2]: ["other.example"] },
+            },
+        });
+
+        // Settings loads first, and its save lands last — before either has
+        // any idea a dApp approval happened elsewhere in between.
+        const settings = loadPage(storage);
+        await settings.state.loadState();
+
+        // A dApp approval window, opened later, approves a new site for a
+        // different address and saves — the real sequence at
+        // src/background/index.js:592-599.
+        const approval = loadPage(storage);
+        await approval.state.loadState();
+        approveSite(approval.state.state, ADDR1, "dapp.example");
+        await approval.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
+        ).toEqual(["dapp.example"]);
+
+        // Settings revokes its own, unrelated site — the real sequence at
+        // src/popup/views/settings.js:55-68 — and saves from state loaded
+        // before the dApp approval ever happened.
+        revokeSite(settings.state.state, "other.example");
+        await settings.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.allowedSites[ADDR1]).toEqual(["dapp.example"]);
+        expect(persisted.allowedSites[ADDR2]).toBeUndefined();
+    });
+});
+
+describe("a revoked site permission against a stale page's later save", () => {
+    test("the revocation holds even when the stale page approves something else", async () => {
+        const storage = makeStorage();
+        await storage.set({
+            autistmask: {
+                wallets: [W1],
+                allowedSites: { [ADDR1]: ["evil.example"] },
+            },
+        });
+
+        // A stale page loads while the permission still stands.
+        const stale = loadPage(storage);
+        await stale.state.loadState();
+
+        // Settings revokes it — src/popup/views/settings.js:55-68 — from a
+        // second page.
+        const settings = loadPage(storage);
+        await settings.state.loadState();
+        revokeSite(settings.state.state, "evil.example");
+        await settings.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.allowedSites[ADDR1],
+        ).toBeUndefined();
+
+        // The stale page, unaware of the revoke, approves an unrelated site
+        // for a different address and saves — src/background/index.js:592-599.
+        approveSite(stale.state.state, ADDR2, "good.example");
+        await stale.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        expect(persisted.allowedSites[ADDR2]).toEqual(["good.example"]);
+        expect(persisted.allowedSites[ADDR1]).toBeUndefined();
+    });
+});
+
+// mergeListByIdentity()'s identity function is not guaranteed collision-free
+// — walletIdentity() falls back to one shared "addr:" value for any wallet
+// with neither an xpub nor a populated first address (a legacy or corrupt
+// record). Two such records created independently on two different pages
+// must not silently collapse into one, dropping the loser's
+// encryptedSecret with no error and no log.
+function legacyWallet(name, secret) {
+    return {
+        type: "legacy",
+        name,
+        encryptedSecret: secret,
+        nextIndex: 0,
+        addresses: [],
+    };
+}
+
+describe("two wallets independently created with a colliding identity", () => {
+    test("both survive, encryptedSecret included, instead of one silently replacing the other", async () => {
+        const storage = makeStorage();
+        await storage.set({ autistmask: { wallets: [W1] } });
+
+        // Both pages load before either has created their malformed wallet,
+        // so neither has baseline knowledge of the other's.
+        const pageA = loadPage(storage);
+        await pageA.state.loadState();
+        const pageB = loadPage(storage);
+        await pageB.state.loadState();
+
+        pageA.state.state.wallets.push(legacyWallet("Legacy A", "secret-a"));
+        pageA.state.state.hasWallet = true;
+        await pageA.state.saveState();
+        expect(
+            (await storage.get("autistmask")).autistmask.wallets,
+        ).toHaveLength(2);
+
+        pageB.state.state.wallets.push(legacyWallet("Legacy B", "secret-b"));
+        pageB.state.state.hasWallet = true;
+        await pageB.state.saveState();
+
+        const persisted = (await storage.get("autistmask")).autistmask;
+        const secrets = persisted.wallets.map((w) => w.encryptedSecret);
+        expect(secrets).toContain("secret-one");
+        expect(secrets).toContain("secret-a");
+        expect(secrets).toContain("secret-b");
+    });
+});