fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons enrich-tokens apply-enrichment clean dev
+.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist icons clean dev
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -111,20 +111,6 @@ vendor-blocklist:
 icons:
 	@node script/lib/icons.js
 
-# Fetch a name and a website for every token in src/shared/tokenList.js into
-# script/lib/token-enrichment.json. Run deliberately, land the diff: the names
-# come from live data, so a later run can return different ones.
-enrich-tokens:
-	@node script/lib/enrich-tokens.js
-
-# Write the names and websites in script/lib/token-enrichment.json into
-# src/shared/tokenList.js. Commit the result with the data file:
-# tests/applyEnrichment.test.js fails while the list differs from what this
-# writes, or while an address in the data or in the script's table of websites
-# matches no entry in the list.
-apply-enrichment:
-	@node script/lib/apply-enrichment.js
-
 clean:
 	@rm -rf dist/ release/
 

README.md

@@ -239,24 +239,18 @@ provide:
   `make check` stays non-mutating. Linting runs only in the container, because
   an ESLint result that depends on whichever ESLint the host happens to have is
   not a result, so docker is required to lint.
-- `script/fmt` — format all files (writes), on the host, with the `prettier`
+- `script/fmt` — format all files (writes), on the host
-  that `script/bootstrap` installs in `node_modules/`; when that one is missing
+- `script/fmt-check` — check formatting (read-only), on the host
-  it fails and says to run `script/bootstrap`, instead of using a `prettier`
-  from the `PATH`
-- `script/fmt-check` — check formatting (read-only), on the host, with the same
-  `prettier` and the same refusal
 - `script/check` — run `script/test`, `script/lint` and `script/fmt-check`
 - `script/check-censored` — assert the competitor name RULES.md bars appears
   nowhere in the working tree or under `dist/` outside its documented
   exceptions: the pinned source reference in `script/vendor-blocklist`, the two
   provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
-  on-chain name in `src/shared/tokenList.js` and in
+  on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
-  `script/lib/token-enrichment.json`, the fetched data that file's names are
+  fails anywhere else. Run by the `lint` phase, so part of `make check`; it
-  written from. Each is scoped to the paths named and fails anywhere else. Run
+  inspects `dist/` when there is one and says loudly when there is not, and the
-  by the `lint` phase, so part of `make check`; it inspects `dist/` when there
+  build context of that phase never has one. `make build` re-runs it with
-  is one and says loudly when there is not, and the build context of that phase
+  `--require-dist`, so a build artifact is always covered
-  never has one. `make build` re-runs it with `--require-dist`, so a build
-  artifact is always covered
 - `script/package` — produce the release artifacts: `make build` first, so the
   archives can only ever be made from a `dist/` that has been verified against
   that build's own receipt as a RELEASE build, then one self-contained,
@@ -328,19 +322,6 @@ The Makefile shims to those. It also carries a few targets that have no
   that already holds the drawn image, the same IHDR and every pixel, is left
   untouched. Commit the files with the drawing: `make check` fails while their
   image differs from what it draws
-- `make enrich-tokens` — fetch the name of each token in
-  `src/shared/tokenList.js` from CoinGecko's coin list and its website from the
-  `ethereum-lists/tokens` repository, at a pinned commit, into
-  `script/lib/token-enrichment.json`, by running `script/lib/enrich-tokens.js`.
-  CoinGecko's list is live and has no fixed version, so a later run can return
-  different names
-- `make apply-enrichment` — write the names and URLs in
-  `script/lib/token-enrichment.json` into `src/shared/tokenList.js`, by running
-  `script/lib/apply-enrichment.js`, taking a URL from the table of project
-  websites in that script only where the fetched data has none. Commit the list
-  with the data file: `make check` fails while the list differs from what this
-  writes. Neither target changes which tokens are on the list, and no build runs
-  either
 - `make clean` — remove `dist/` and `release/`
 - `make dev` — run the build `make build` runs, without the checks that follow
   it, then run it again after every change to a file under `src/`, `manifest/`
@@ -441,12 +422,11 @@ captured at `eth_sendRawTransaction` rather than against anything the extension
 reported, rejecting each prompt is required to return a rejection to the page
 rather than hang or resolve, a network switch request is required to leave the
 stored network unchanged and send no `chainChanged` until it is approved, a
-network switch in Settings is required to send the page `chainChanged` with the
+prompt raised while another approval window has focus is required to open a
-new chain id, a prompt raised while another approval window has focus is
+window of its own, and the password is required to be absent from every message
-required to open a window of its own, and the password is required to be absent
+the approval window sends to the background — with the message that would carry
-from every message the approval window sends to the background — with the
+it required to be present, so that check cannot pass by observing nothing. That
-message that would carry it required to be present, so that check cannot pass by
+last one is the standing floor under
-observing nothing. That last one is the standing floor under
 [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
@@ -1125,18 +1105,14 @@ read:
 
 The swap's `Token In` and `Token Out` lines name a currency, not an amount; each
 reads `Unknown (not named in the calldata)` when the decoder found no token for
-that side, or `Unknown (could not be decoded)` instead when a V4 swap action in
+that side. An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side
-the transaction could not be read (see Transaction Decoding below). A V4 step
+is WETH, on mainnet or Sepolia, or when no step set the output side; a WETH
-whose swap action could not be read still sets each side as a swap step does,
+`Min. received` figure then reads in ETH. Otherwise `Token Out` and
-and a side its `SETTLE` or `TAKE` did not name is then unknown: no other step's
+`Min. received` keep the output side's own token and figure, whether the swap
-token or figure is shown for it. An `UNWRAP_WETH` step makes `Token Out` ETH
+was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
-only when the output side is WETH, on mainnet or Sepolia, or when no step set
+unwraps the WETH it did not spend shows USDC. The token permission warning on
-the output side; a WETH `Min. received` figure then reads in ETH. Otherwise
+the signature screen has its own amount wording, including `Unknown`; the
-`Token Out` and `Min. received` keep the output side's own token and figure,
+SignApproval section below describes it.
-whether the swap was paid in ETH or in a token: a V2 exact-out swap that buys
-USDC and then unwraps the WETH it did not spend shows USDC. The token permission
-warning on the signature screen has its own amount wording, including `Unknown`;
-the SignApproval section below describes it.
 
 The swap's `Deadline` line is the router's deadline as a UTC date and time, e.g.
 `2026-02-27 08:25:51`. A JavaScript date reaches only to 275760-09-13 00:00:00
@@ -1211,16 +1187,7 @@ The core hierarchy is **Wallets → Addresses**:
       of its stored `xpub` by `src/shared/walletDefects.js`, explained in the
       wallet list, and blocked from signing, sending and private-key export. It
       is never deleted or rewritten.
-- An **address** holds ETH and ERC-20 tokens. In an HD or xprv wallet each
+- An **address** holds ETH and ERC-20 tokens.
-  address record also stores `index`, the derivation index it was made at: 0 for
-  the first address, the index the import scan found it at, or `nextIndex` when
-  "+" added it. An address's `index` and its position in the wallet's list
-  differ once the scan has passed over an unused index or an address has been
-  removed. Sending, site transactions, site signatures and private-key export
-  derive the key at `index`, and refuse it unless it is that address's own key;
-  an HD or xprv address with no valid `index` is refused before anything is
-  derived (`getSignerForAddress()` in `src/shared/wallet.js`). Each refusal is a
-  full sentence naming the address.
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
@@ -1546,9 +1513,6 @@ view would leave a wallet one click from deletion.
       change)
     - "Reveal" (wrong password) → full-sentence error on the error line, nothing
       revealed (no screen change)
-    - "Reveal" (correct password, but this address's key is refused, see Data
-      Model) → full-sentence error saying why, nothing revealed (no screen
-      change)
     - "Back" → previous screen (AddressDetail)
     - Settings gear → **Settings**, whose "Back" goes to AddressDetail: leaving
       drops the address the screen was showing, so it also takes the screen off
@@ -1676,21 +1640,8 @@ view would leave a wallet one click from deletion.
       the contract's own answer is read at signing time only to be compared with
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
-    - "Sign & Send" after the active network was switched in Settings while this
-      screen was open → nothing is signed; "The active network changed after
-      this transaction was reviewed, so it was not sent. Please go back and
-      review it again." in the errors box, no screen change. The transaction
-      carries the chain id of the network the screen was shown for, so it cannot
-      be signed for another
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
-    - "Sign & Send" signs as the From address above, not as whichever address is
-      selected: the two are saved separately, so the popup can reopen onto this
-      screen with another address selected. When the selected wallet does not
-      hold the From address → full-sentence error on the password error line,
-      nothing sent (no screen change)
-    - "Sign & Send" (correct password, but the From address's key is refused,
-      see Data Model) → nothing is signed → **ErrorTx** saying why
     - "Back" → **Send**
 
 #### WaitTx (`wait-tx`)
@@ -1834,12 +1785,10 @@ view would leave a wallet one click from deletion.
       plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
       Timestamps" checkbox, and a Theme selector (System / Light / Dark)
-    - Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
+    - Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
+      resets the RPC and Blockscout endpoints to that network's defaults. The
       network changes only here, or when the user approves a site's request on
-      **NetworkApproval**; either way, switching restores the RPC and Blockscout
+      **NetworkApproval**
-      endpoints last used on that network, or that network's defaults if it has
-      none, and sends `chainChanged` with the new chain id to every open tab.
-      Choosing the network already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2119,11 +2068,7 @@ view would leave a wallet one click from deletion.
   artifact can be compared with it field for field. A nonce the site supplies is
   ignored: the nonce is always the account's next nonce from the node, so a site
   cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is the
+  behind a gap. A request that cannot be populated — unreachable node, reverting
-  one shown and signed in place of the node's estimate, but the node still
-  estimates the transaction with that limit, as the check that it neither
-  reverts nor runs out of gas; a request that gives both with different values
-  is refused. A request that cannot be populated — unreachable node, reverting
   gas estimate — opens no window and is failed back to the site. Only one
   transaction approval exists at a time: populating fixes the nonce, so a second
   `eth_sendTransaction` arriving while one is unanswered is refused with
@@ -2158,9 +2103,6 @@ view would leave a wallet one click from deletion.
       shown, exactly as shown, hands the signed transaction to the background to
       broadcast, then → **WaitTx** in the same popup window
     - "Confirm" (wrong password) → error line, no screen change
-    - "Confirm" (correct password, but the From address's key is refused, see
-      Data Model) → full-sentence error on the error line saying why, nothing
-      signed (no screen change)
     - "Reject" → closes popup (returns rejection to background)
     - Popup window closed without answering → the request is rejected with
       EIP-1193 code 4001
@@ -2179,12 +2121,7 @@ view would leave a wallet one click from deletion.
       blocklist)
     - Site origin (bold, scheme and port included) + "wants you to sign a
       message"
-    - Warning box, shown for `eth_sign`: "This site used the older eth_sign
+    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
-      method. The data will be signed as a personal message." An `eth_sign`
-      request names the address first and the data second. Its data is signed
-      exactly as a `personal_sign` message is, as an EIP-191 personal message,
-      which is what the Ethereum JSON-RPC specification defines `eth_sign` to
-      return.
     - Type: "Personal message" or "Typed data (EIP-712)"
     - From: color dot + full address + etherscan link
     - Message: for `personal_sign` and `eth_sign`, the text the message's bytes
@@ -2199,12 +2136,7 @@ view would leave a wallet one click from deletion.
       Bytes that are not UTF-8 are shown as "This message is not text." For
       typed data, formatted domain/type/message fields (EIP-712). The primary
       type shown is the one ethers signs, derived from the typed data's `types`,
-      not the type the site states. The message shows only the fields that type
+      not the type the site states.
-      declares, at every level of nesting and in the type's order: ethers signs
-      those and drops any other key. Typed data carrying other keys is not
-      refused; each such key is listed after the message under "Not part of the
-      signature", by its place in the message (`details.note`,
-      `details[1].note`) and its value.
     - Token permission warning, at the top of the message (typed data whose
       primary type is `Permit`, as in EIP-2612, or one of Permit2's signature
       types): "⚠️ TOKEN PERMISSION: Signing this lets the spender below take the
@@ -2225,13 +2157,6 @@ view would leave a wallet one click from deletion.
     - Typed data that states no primary type, or one other than the type it
       would be signed as, or that cannot be read → shown with the error line
       saying so and "Sign" disabled; only "Reject" remains
-    - Typed data whose domain `chainId` names a chain other than the active
-      network's → shown with the error line naming both chain ids and "Sign"
-      disabled; only "Reject" remains. EIP-712 asks for this, because the
-      signature is valid on the chain the domain names. Typed data with no
-      `chainId` is not refused. The background refuses such a signature too,
-      against the network active when the signature reaches it, and answers the
-      site with the same sentence
     - A `personal_sign` or `eth_sign` message that is not hex (`0x` or `0X` and
       an even number of hex digits, the form ethers' `getBytes` reads when
       signing) → shown as plain text, with the error line "This message is plain
@@ -2272,9 +2197,8 @@ view would leave a wallet one click from deletion.
     - "Switch" / "Reject" buttons
 - **Transitions**:
     - "Switch" → closes popup; the background switches the network as
-      **Settings** does, restoring the RPC and Blockscout endpoints last used on
+      **Settings** does, sends `chainChanged` to every open tab, and answers the
-      that network (or that network's defaults if it has none), sends
+      site with success
-      `chainChanged` to every open tab, and answers the site with success
     - "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
       nothing changes
     - Popup window closed without answering → the same as "Reject"
@@ -2724,8 +2648,7 @@ plaintext list of anyone's domain names.
 When a dApp on a blocklisted domain requests a wallet connection, transaction
 approval, or signature, the approval popup displays a prominent red warning
 banner alerting the user. The domain checker matches exact hostnames and all
-parent domains (subdomain matching), and checks a hostname written with a
+parent domains (subdomain matching).
-trailing dot (`name.`) as `name`.
 
 #### Transaction Decoding
 
@@ -2751,11 +2674,7 @@ Currently supported:
   or recipient, and amount.
 - **Uniswap Universal Router**: `execute()` calls — shows swap direction (e.g.
   "Swap USDT → ETH"), token addresses, amounts, execution steps, and deadline.
-  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap
+  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks.
-  action is read only in the parameter shape deployed on mainnet and Sepolia,
-  not in the newer one on `v4-periphery` `main`, which adds a `minHopPriceX36`
-  field. An action in any other shape is not read, and its step is listed as
-  `V4 Swap (could not be decoded)`.
 
 ### Non-Goals Forever
 
@@ -2772,7 +2691,7 @@ Currently supported:
 
 ### Non-Goals for 1.0
 
-- Chains other than Ethereum mainnet and the Sepolia testnet
+- Multi-chain support (Ethereum mainnet only)
 - Hardware wallet support
 
 ## TODO
@@ -2806,10 +2725,7 @@ Currently supported:
 ## Policies
 
 - We don't mention "the other wallet" by name in code or documentation. We're
-  our own thing. Written exception: the injected provider in
+  our own thing.
-  `src/content/inpage.js` sets the flag named after the other wallet to `true`.
-  It is an interface-compatibility flag many dApps check, and without it the
-  wallet stops working on their sites.
 - The README is the complete authoritative technical documentation. It's ok if
   it gets big.
 
@@ -2839,7 +2755,7 @@ exact URL, the commit it is pinned to and the sha256 of the bytes that commit
 serves, because a source reference nobody can verify is not a source reference.
 `script/check-censored` reads the name back out of that one file and fails the
 build wherever else it appears, save for three shipped-code literals it cannot
-avoid — each permitted only at the paths that carry it, and listed in that
+avoid — each permitted only at the one path that carries it, and listed in that
 script's header.
 
 ## Author

RULES.md

@@ -118,7 +118,4 @@ contradicts either, the originals govern.
 - [ ] "Address" not "account" or "derived key"
 - [ ] "Password" not "encryption key" or "vault passphrase"
 - [ ] Error messages are full sentences
-- [ ] No competitor mentioned by name in code or documentation. Written
+- [ ] No competitor mentioned by name in code or documentation
-      exception: the injected provider in `src/content/inpage.js` sets the flag
-      named after the other wallet to `true`, an interface-compatibility flag
-      many dApps check (README.md, Policies)

TODO.md

@@ -2,9 +2,10 @@
 
 - `git pull` `next` and cut a branch from it — one branch per issue, named
   `issue-<N>-<slug>`. Never branch from `main`.
-- Do the work as one commit whose title ends with ` (closes #N)`.
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
-- Add no entry to Completed Steps. What landed is recorded on the tracker and in
+  `TODO.md` update in that same commit.
-  `git log`, where each commit title names the issue it closes.
+- Move Next Step to the top of Completed Steps; move the top item of Future
+  Steps into Next Step.
 - Run `make fmt`, then `make check`. A feature branch may be red; `next` and
   `main` may not.
 - Rebase onto current `next` immediately before pushing — other branches land on
@@ -43,25 +44,6 @@ then continue tagging as milestones land.
 
 # Completed Steps
 
-- 2026-10-08: The browser suites no longer read a screen before the page has
-  shown it ([#502](https://git.eeqj.de/sneak/AutistMask/issues/502)). Their wait
-  for a screen used to pass as soon as the element laid out, which every view
-  does until the page's stylesheet has applied, so an approval test could read
-  the prompt's fields before the page's script had filled them. `visible()` in
-  `tests/e2e/harness.js` and `waitVisible()` in `tests/e2e/firefox/driver.js`
-  now also wait for the page to finish loading and for neither the element nor
-  anything around it to carry the `hidden` class that `showView()` puts on every
-  view but the current one. No caller changed.
-
-- 2026-10-08: Switching the network in Settings now tells open pages
-  ([#500](https://git.eeqj.de/sneak/AutistMask/issues/500)). Once the switch is
-  saved, Settings asks the background to send `chainChanged` with the new chain
-  id to every open tab, through the same function an approved site request uses.
-  Choosing the network already active changes nothing and sends nothing. Only
-  the extension's own pages can ask for this. `tests/chainSwitchGate.test.js`
-  drives the real Settings view against the background, and the Chrome suite
-  checks that the test page hears both switches.
-
 - 2026-10-07: A site can no longer switch the wallet's network by itself
   ([#408](https://git.eeqj.de/sneak/AutistMask/issues/408)). A connected site's
   `wallet_switchEthereumChain` request for the other supported network opens a
@@ -72,20 +54,9 @@ then continue tagging as milestones land.
   or closing the prompt answers 4001. One such prompt per site at a time. The
   approval window no longer shows the connection prompt while it waits for the
   background to describe the approval, because that prompt's "Allow" answers on
-  the same port as the new one; `tests/approvalWindow.test.js` checks that it
+  the same port as the new one. `tests/chainSwitchGate.test.js` and both browser
-  shows no screen until then. `tests/chainSwitchGate.test.js` and both browser
   suites drive the prompt.
 
-- 2026-10-07: Two contradictions between the documents and the code are resolved
-  as ruled on [#165](https://git.eeqj.de/sneak/AutistMask/issues/165). The
-  README's 1.0 non-goal now puts Ethereum mainnet and the Sepolia testnet in
-  scope and other chains out of it. The injected provider's flag named after the
-  other wallet stays, as an interface-compatibility flag many dApps check, and
-  is written down as an exception to the rule against naming competitors in the
-  README's Policies section, in `RULES.md` and in a comment beside it in
-  `src/content/inpage.js`. `script/check-censored` already allows that flag only
-  in that file and its built copies, so it is unchanged.
-
 - 2026-10-07: Two holes in what `tests/persistedFieldContract.test.js` checks
   are closed ([#379](https://git.eeqj.de/sneak/AutistMask/issues/379)). The
   check that every swept field is driven both truthy and falsy counts only

script/check-censored

@@ -18,8 +18,6 @@
 #     (src/shared/balances.js), and this contract's on-chain name is that
 #     string, so censoring the repo cannot stop the wallet displaying it.
 #     Dropping the entry instead would cost the user MUSD spoof detection.
-#     script/lib/token-enrichment.json, the fetched data tokenList.js's names
-#     are written from, carries the same name for the same reason.
 #
 # Everything else fails, in the working tree and under dist/. The last two are
 # literals rather than whole files, so they are enforced by counting, and each
@@ -104,8 +102,8 @@ allowed_literals_for() {
     src/content/inpage.js | dist/*/src/content/inpage.js)
         printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
         ;;
-    src/shared/tokenList.js | script/lib/token-enrichment.json | \
+    src/shared/tokenList.js | dist/*/src/background/index.js | \
-        dist/*/src/background/index.js | dist/*/src/popup/index.js)
+        dist/*/src/popup/index.js)
         printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
         ;;
     esac

script/fmt

@@ -25,13 +25,6 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
-    # Without the repo's own prettier, yarn runs whatever prettier is on
-    # the PATH, which may be a version that formats files differently.
-    if [ ! -x node_modules/.bin/prettier ]; then
-        echo "fmt: this repo's prettier is not installed in node_modules/," \
-            "so run script/bootstrap first." >&2
-        exit 1
-    fi
     echo "Formatting..."
     run_yarn run fmt
 }

script/fmt-check

@@ -26,13 +26,6 @@ run_yarn() {
 
 main() {
     cd "$ROOT"
-    # Without the repo's own prettier, yarn runs whatever prettier is on
-    # the PATH, which may be a version that formats files differently.
-    if [ ! -x node_modules/.bin/prettier ]; then
-        echo "fmt-check: this repo's prettier is not installed in" \
-            "node_modules/, so run script/bootstrap first." >&2
-        exit 1
-    fi
     echo "Checking formatting..."
     run_yarn run fmt-check
 }

script/lib/apply-enrichment.js

@@ -1,159 +0,0 @@
-// Writes the names and URLs in script/lib/token-enrichment.json, which
-// script/lib/enrich-tokens.js fetches, into the matching entries of
-// src/shared/tokenList.js: the name and url an entry already has are replaced,
-// and an entry without them gets them after its decimals. Where the fetched
-// data has no URL for a token, EXTRA_URLS below supplies one. An entry the data
-// does not mention is left as it is. An address in the data or in EXTRA_URLS
-// that matches no entry in tokenList.js, capitals included, is an error naming
-// that address. Run by
-// `make apply-enrichment`; no build runs it. tests/applyEnrichment.test.js
-// checks that the committed tokenList.js is exactly what this writes from the
-// committed data.
-
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const TOKEN_LIST = path.join(__dirname, "..", "..", "src/shared/tokenList.js");
-
-// Project websites by token address, each spelled as tokenList.js spells it. A
-// token gets its URL here only where the fetched data has none, so an address
-// the data has a URL for is never used.
-const EXTRA_URLS = {
-    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
-    "0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",
-    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": "https://www.bnbchain.org",
-    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": "https://www.circle.com/usdc",
-    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": "https://sky.money",
-    "0x2AF5D2aD76741191D15Dfe7bF6aC92d4Bd912Ca3": "https://www.bitfinex.com",
-    "0x514910771AF9Ca656af840dff83E8264EcF986CA": "https://chain.link",
-    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": "https://ethena.fi",
-    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d":
-        "https://www.worldlibertyfinancial.com",
-    "0x6B175474E89094C44Da98b954EedeAC495271d0F": "https://makerdao.com",
-    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8":
-        "https://www.paypal.com/us/digital-wallet/manage-money/crypto/pyusd",
-    "0x95aD61b0a150d79219dCF64E1E6Cc01f0B64C4cE": "https://shibatoken.com",
-    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6":
-        "https://www.worldlibertyfinancial.com",
-    "0xA0b73E1Ff0B80914AB6fe0444E65848C4C34450b": "https://crypto.com",
-    "0x582d872A1B094FC48F5DE31D3B73F2D9bE47def1": "https://ton.org",
-    "0x68749665FF8D2d112Fa859AA293F07A622782F38": "https://gold.tether.to",
-    "0x196C20DA81Fbc324EcdF55501e95Ce9f0bD84d14": "https://polkadot.network",
-    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": "https://uniswap.org",
-    "0x45804880De22913dAFE09f4980848ECE6EcbAf78":
-        "https://www.paxos.com/paxgold",
-    "0x3c3a81e81dc49A522A592e7622A7E711c06bf354": "https://www.mantle.xyz",
-    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": "https://aave.com",
-    "0x75231F58b43240C9718Dd58B4967c5114342a86c": "https://www.okx.com",
-    "0x6982508145454Ce325dDbE47a25d4ec3d2311933": "https://www.pepe.vip",
-    "0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32": "https://lido.fi",
-    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": "https://ens.domains",
-    "0xD533a949740bb3306d119CC777fa900bA034cd52": "https://curve.fi",
-    "0x111111111117dC0aa78b770fA6A738034120C302": "https://1inch.io",
-    "0x163f8C2467924be0ae7B5347228CABF260318753": "https://worldcoin.org",
-    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": "https://synthetix.io",
-    "0xBBbbCA6A901c926F240b89EacB641d8Aec7AEafD": "https://loopring.org",
-    "0xC669928185DbCE49d2230CC9B0979BE6DC797957": "https://bitstable.finance",
-    "0xfAbA6f8e4a5E8Ab82F62fe7C39859FA577269BE3": "https://ondo.finance",
-    "0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24": "https://www.render.com",
-    "0x4a220E6096B25EADb88358cb44068A3248254675": "https://www.quant.network",
-    "0xba5BDe662c17e2aDFF1075610382B9B691296350": "https://superrare.com",
-    "0xc00e94Cb662C3520282E6f5717214004A7f26888": "https://compound.finance",
-    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": "https://0x.org",
-    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": "https://yearn.fi",
-    "0x6fB3e0A217407EFFf7Ca062D46c26E5d60a14d69": "https://iotex.io",
-    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": "https://immutable.com",
-    "0x0F5D2fB29fb7d3CFeE444a200298f468908cC942": "https://decentraland.org",
-    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": "https://www.sandbox.game",
-    "0x6810e776880C02933D47DB1b9fc05908e5386b96": "https://gnosis.io",
-    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": "https://www.liquity.org",
-    "0x0D8775F648430679A709E98d2b0Cb6250d2887EF":
-        "https://basicattentiontoken.org",
-    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": "https://thegraph.com",
-    "0x853d955aCEf822Db058eb8505911ED77F175b99e": "https://frax.finance",
-    "0x0000000000085d4780B73119b644AE5ecd22b376": "https://www.trueusd.com",
-    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": "https://frax.finance",
-    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": "https://curve.fi",
-    "0x808507121B80c02388fAd14726482e061B8da827": "https://pendle.finance",
-    "0xCa14007Eff0dB1f8135f4C25B34De49AB0d42766": "https://starknet.io",
-    "0x8457CA5040ad67fdebbCC8EdCE889A335Bc0fbFB": "https://alt.layer",
-    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": "https://arbitrum.io",
-    "0x6985884C4392D348587B19cb9eAAf157F13271cd": "https://layerzero.network",
-    "0xFe0c30065B384F05761f15d0CC899D4F9F9Cc0eB": "https://ethfi.org",
-    "0x5283D291DBCF85356A21bA090E6db59121208b44": "https://blur.io",
-    "0x43Dfc4159D86F3A37A5A4B3D4580b888ad7d4DDd": "https://dydx.exchange",
-    "0xcf0C122c6b73ff809C693DB761e7BaeBe62b6a2E": "https://floki.com",
-    "0xe53EC727dbDEB9E2d5456c3be40cFF031AB40A55": "https://superfarm.com",
-    "0x32353A6C91143bfd6C7d363B546e62a9A2489A20": "https://www.agora.finance",
-    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": "https://www.euro-coin.com",
-    "0xA35923162C49cF95e6BF26623385eb431ad920D3": "https://www.turbo-eth.com",
-    "0x1151CB3d861920e07a38e03eEAd12C32178567F6": "https://bonk.com",
-    "0x090185f2135308BaD17527004364eBcC2D37e5F6": "https://spell.club",
-    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": "https://stargate.finance",
-};
-
-// Returns tokenList, the text of tokenList.js, with the name and url of each
-// token in enrichment, the parsed data file, written into its entry.
-function applyEnrichment(tokenList, enrichment) {
-    for (const addr of Object.keys(EXTRA_URLS)) {
-        if (!tokenList.includes(`address: "${addr}"`)) {
-            throw new Error(
-                `No entry in src/shared/tokenList.js has the address ${addr} from EXTRA_URLS.`,
-            );
-        }
-    }
-
-    let result = tokenList;
-
-    for (const [addr, data] of Object.entries(enrichment)) {
-        // Escape special regex characters in the address
-        const escaped = addr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
-        // Match the token block: { address: "...", symbol: "...", decimals: N, }
-        // and the name: "...", url: "..." after decimals when it has them.
-        // The closing }, may have trailing whitespace
-        const blockRe = new RegExp(
-            `(\\{\\s*address:\\s*"${escaped}",\\s*symbol:\\s*"[^"]+",\\s*decimals:\\s*\\d+)` +
-                `(?:,\\s*name:\\s*"(?:[^"\\\\]|\\\\.)*",\\s*url:\\s*"(?:[^"\\\\]|\\\\.)*")?` +
-                `,?(\\s*\\})`,
-        );
-
-        const match = result.match(blockRe);
-        if (!match) {
-            throw new Error(
-                `No entry in src/shared/tokenList.js matches the address ${addr} from script/lib/token-enrichment.json.`,
-            );
-        }
-
-        // A URL from EXTRA_URLS only where the fetched data has none.
-        const url = data.url || EXTRA_URLS[addr] || "";
-
-        // Build replacement: original fields + name + url
-        const nameEscaped = data.name
-            .replace(/\\/g, "\\\\")
-            .replace(/"/g, '\\"');
-        const urlEscaped = url.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-        const replacement =
-            match[1] +
-            `,\n        name: "${nameEscaped}",` +
-            `\n        url: "${urlEscaped}",` +
-            match[2];
-
-        // A function, so a "$" in a name is not read as a replacement pattern.
-        result = result.replace(blockRe, () => replacement);
-    }
-
-    return result;
-}
-
-if (require.main === module) {
-    const enrichment = JSON.parse(
-        fs.readFileSync(path.join(__dirname, "token-enrichment.json"), "utf8"),
-    );
-    const original = fs.readFileSync(TOKEN_LIST, "utf8");
-    fs.writeFileSync(TOKEN_LIST, applyEnrichment(original, enrichment));
-}
-
-module.exports = { applyEnrichment };

script/lib/enrich-tokens.js

@@ -1,115 +0,0 @@
-// Fetches a name and a website for every token in src/shared/tokenList.js and
-// writes them, keyed by address, to script/lib/token-enrichment.json, which
-// script/lib/apply-enrichment.js then writes into tokenList.js. Run by
-// `make enrich-tokens`; no build runs it and nothing here is shipped.
-//
-// Names come from CoinGecko's coin list, fetched whole in one request, matched
-// on the token's Ethereum contract address. A token CoinGecko does not list
-// gets its symbol as its name. The list is live data with no fixed version, so
-// a later run can return different names.
-//
-// Websites come from the ethereum-lists/tokens repository, one file per token,
-// read at a pinned commit. Most tokens have no file there and get an empty URL.
-// A file that is missing is not an error; any other failed request stops the
-// run, so a network fault cannot quietly empty a URL.
-
-"use strict";
-
-const fs = require("fs");
-const path = require("path");
-
-const TOKEN_LIST = path.join(__dirname, "..", "..", "src/shared/tokenList.js");
-const OUTPUT = path.join(__dirname, "token-enrichment.json");
-
-const COINGECKO_LIST =
-    "https://api.coingecko.com/api/v3/coins/list?include_platform=true";
-// ethereum-lists/tokens at its master of 2026-02-27, when the committed
-// token-enrichment.json was made.
-const ETHEREUM_LISTS =
-    "https://raw.githubusercontent.com/ethereum-lists/tokens/c3560d499a380a38e94caa7c4968d59aeffde59a/tokens/eth";
-
-const CONCURRENT = 10;
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-async function main() {
-    const src = fs.readFileSync(TOKEN_LIST, "utf8");
-
-    const tokens = [];
-    const re =
-        /\{\s*address:\s*"(0x[a-fA-F0-9]{40})",\s*symbol:\s*"([^"]+)",\s*decimals:\s*(\d+)/g;
-    let m;
-    while ((m = re.exec(src)) !== null) {
-        tokens.push({ address: m[1], symbol: m[2], decimals: parseInt(m[3]) });
-    }
-    console.error(`Parsed ${tokens.length} tokens`);
-
-    // --- Names from CoinGecko ---
-    console.error("Fetching CoinGecko coins list...");
-    const listResp = await fetch(COINGECKO_LIST);
-    if (!listResp.ok) throw new Error(`CoinGecko list HTTP ${listResp.status}`);
-    const coins = await listResp.json();
-
-    const addrMap = new Map();
-    for (const coin of coins) {
-        const eth = (coin.platforms?.ethereum || "").toLowerCase().trim();
-        if (eth && eth.startsWith("0x")) {
-            addrMap.set(eth, { name: coin.name, id: coin.id });
-        }
-    }
-    console.error(`CoinGecko map: ${addrMap.size} Ethereum tokens`);
-
-    const enriched = new Map();
-    let namesMatched = 0;
-    for (const t of tokens) {
-        const info = addrMap.get(t.address.toLowerCase());
-        if (info) namesMatched++;
-        enriched.set(t.address, { name: info?.name || t.symbol, url: "" });
-    }
-    console.error(`Matched ${namesMatched}/${tokens.length} names`);
-
-    // --- Websites from ethereum-lists ---
-    console.error("Fetching URLs from ethereum-lists GitHub...");
-    let urlsFound = 0;
-
-    for (let i = 0; i < tokens.length; i += CONCURRENT) {
-        const batch = tokens.slice(i, i + CONCURRENT);
-        await Promise.all(
-            batch.map(async (t) => {
-                const r = await fetch(`${ETHEREUM_LISTS}/${t.address}.json`);
-                if (r.status === 404) return;
-                if (!r.ok) {
-                    throw new Error(
-                        `ethereum-lists HTTP ${r.status} for ${t.address}`,
-                    );
-                }
-                const data = await r.json();
-                const website = (data.website || "").trim();
-                if (website && website !== "https://") {
-                    enriched.get(t.address).url = website;
-                    urlsFound++;
-                }
-            }),
-        );
-        if (i % 100 === 0) {
-            console.error(
-                `  GitHub: ${Math.min(i + CONCURRENT, tokens.length)}/${tokens.length}, ${urlsFound} URLs`,
-            );
-        }
-        await sleep(200);
-    }
-    console.error(`Found ${urlsFound} URLs in ethereum-lists`);
-
-    // --- Output, in the layout prettier gives it ---
-    const output = {};
-    for (const [addr, e] of enriched) {
-        output[addr] = { name: e.name, url: e.url };
-    }
-    fs.writeFileSync(OUTPUT, JSON.stringify(output, null, 4) + "\n");
-    console.error(`Done! ${tokens.length} names, ${urlsFound} URLs.`);
-}
-
-main().catch((err) => {
-    console.error(`enrich-tokens: ${err.message}`);
-    process.exit(1);
-});

src/background/index.js

@@ -22,7 +22,6 @@ const { debugFetch, log } = require("../shared/log");
 const {
     verifySignedTx,
     verifySignature,
-    typedDataChainRefusal,
     failureIsRetryable,
     describeTxFailure,
     sameAddress,
@@ -633,9 +632,8 @@ function isExtensionSender(sender) {
 // had refused.
 //
 // TX and sign approvals do not decide here. They stay pending across a
-// disconnect. When their window closes, the windows.onRemoved listener below
+// disconnect — the user can reopen the toolbar popup — and are rejected by the
-// rejects them, unless an approved attempt is still running, in which case
+// windows.onRemoved listener below.
-// that attempt answers the page.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
@@ -663,9 +661,7 @@ runtime.onConnect.addListener((port) => {
             const approval = pendingApprovals[id];
             if (approval) {
                 if (approval.type === "tx" || approval.type === "sign") {
-                    // When its window closes, windows.onRemoved rejects it,
+                    // Keep pending — user can reopen the toolbar popup
-                    // unless an approved attempt is still running, in which
-                    // case that attempt answers the page.
                     return;
                 }
                 settleApproval(id, { approved: false, remember: false });
@@ -988,8 +984,9 @@ async function handleRpc(method, params, origin) {
 
         if (method === "eth_sign") {
             signParams.dangerWarning =
-                "This site used the older eth_sign method. " +
+                "\u26a0\ufe0f DANGER: This site is requesting to sign a raw hash. " +
-                "The data will be signed as a personal message.";
+                "This can be used to sign transactions that drain your funds. " +
+                "Only proceed if you fully understand what you are signing.";
         }
 
         if (findPendingApproval(origin, "sign")) {
@@ -1474,7 +1471,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         "AUTISTMASK_ADDRESSES_REMOVED",
         "AUTISTMASK_GET_CONNECTED_SITES",
         "AUTISTMASK_REMOVE_SITE",
-        "AUTISTMASK_NETWORK_CHANGED",
     ];
     if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
         sendResponse({ error: "Unauthorized sender" });
@@ -1767,8 +1763,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
 
         (async () => {
             try {
-                const s = await getState();
+                const activeAddress = await getActiveAddress();
-                const activeAddress = activeAddressOf(s);
                 // Same as the transaction path: the address the approval named
                 // is the one that must have signed, and a switch since then is
                 // a refusal rather than a signature from another account.
@@ -1787,20 +1782,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     signature,
                     approval.approvedFrom,
                 );
-                // The sign screen refuses typed data whose domain names
-                // another chain. A signature for it that arrives anyway is
-                // refused here, against the network active now.
-                const sp = approval.signParams;
-                if (
-                    sp.method === "eth_signTypedData_v4" ||
-                    sp.method === "eth_signTypedData"
-                ) {
-                    const refusal = typedDataChainRefusal(
-                        JSON.parse(sp.typedData).domain,
-                        networkById(s.networkId),
-                    );
-                    if (refusal) throw new ApprovalMismatchError(refusal);
-                }
                 settleApproval(msg.id, { signature }, { holdsClaim: true });
                 sendResponse({ signature });
             } catch (e) {
@@ -1873,13 +1854,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         broadcastSiteRemoved(msg.origin);
         return false;
     }
-
-    // Settings switched the network and has saved it. Open tabs are told the
-    // new chain id the same way as after a site's approved switch request.
-    if (msg.type === "AUTISTMASK_NETWORK_CHANGED") {
-        broadcastChainChanged(msg.chainId);
-        return false;
-    }
 });
 
 module.exports = { PROXY_METHODS };

src/content/inpage.js

@@ -99,10 +99,7 @@
 
     const provider = {
         isAutistMask: true,
-        // An interface-compatibility flag many dApps check. Kept as a written
+        isMetaMask: true, // compatibility — many dApps check this
-        // exception to the rule that no competitor is named in code: see
-        // Policies in README.md, and RULES.md.
-        isMetaMask: true,
         chainId: currentChainId,
         networkVersion: currentNetworkVersion,
         selectedAddress: null,

src/popup/index.html

@@ -7,10 +7,9 @@
         <link rel="stylesheet" href="styles.css" />
     </head>
     <!-- Chrome gives extension pages a stylesheet of its own that sets the
-         font and its size on body, and a Tailwind class beats it only when
+         font on body, and a Tailwind class beats it only when marked
-         marked important: hence font-mono! and text-sm! rather than
+         important: hence font-mono! rather than font-mono. -->
-         font-mono and text-sm. -->
+    <body class="bg-bg text-fg font-mono! text-sm">
-    <body class="bg-bg text-fg font-mono! text-sm!">
         <div id="app" class="p-2 pr-5 overflow-x-hidden">
             <!-- ============ GLOBAL TITLE BAR ============ -->
             <div
@@ -88,14 +87,11 @@
 
                 <!-- Mnemonic form section -->
                 <div id="add-wallet-section-mnemonic">
-                    <!-- The die button shares the instruction's row: on a row
+                    <p class="mb-2">
-                         of its own it pushes Import below the fold at
+                        Enter your 12 or 24 word recovery phrase below, or click
-                         360x600. -->
+                        the button to roll the die for a new one.
-                    <div class="mb-2 flex justify-between items-start gap-2">
+                    </p>
-                        <p>
+                    <div class="mb-1 flex justify-end">
-                            Enter your 12 or 24 word recovery phrase below, or
-                            click the button to roll the die for a new one.
-                        </p>
                         <button
                             id="btn-generate-phrase"
                             class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
@@ -1716,7 +1712,10 @@
                     <div class="text-xs text-muted mb-1">
                         Address that will be shared:
                     </div>
-                    <div id="approve-address" class="text-xs mb-2"></div>
+                    <div
+                        id="approve-address"
+                        class="text-xs flex items-center mb-2"
+                    ></div>
                 </div>
                 <div class="mb-3">
                     <label

src/popup/views/addWallet.js

@@ -184,12 +184,7 @@ async function importMnemonic(ctx) {
         encryptedSecret: encrypted,
         nextIndex: 1,
         addresses: [
-            {
+            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
-                address: firstAddress,
-                index: 0,
-                balance: "0.0000",
-                tokenBalances: [],
-            },
         ],
     };
     state.wallets.push(wallet);
@@ -210,7 +205,6 @@ async function importMnemonic(ctx) {
     if (scan.addresses.length > 1) {
         wallet.addresses = scan.addresses.map((a) => ({
             address: a.address,
-            index: a.index,
             balance: "0.0000",
             tokenBalances: [],
         }));
@@ -305,12 +299,7 @@ async function importXprvKey(ctx) {
         encryptedSecret: encrypted,
         nextIndex: 1,
         addresses: [
-            {
+            { address: firstAddress, balance: "0.0000", tokenBalances: [] },
-                address: firstAddress,
-                index: 0,
-                balance: "0.0000",
-                tokenBalances: [],
-            },
         ],
     };
     state.wallets.push(wallet);
@@ -331,7 +320,6 @@ async function importXprvKey(ctx) {
     if (scan.addresses.length > 1) {
         wallet.addresses = scan.addresses.map((a) => ({
             address: a.address,
-            index: a.index,
             balance: "0.0000",
             tokenBalances: [],
         }));

src/popup/views/addressDetail.js

@@ -266,7 +266,7 @@ function init(_ctx) {
         // This address's private key can be derived from the stored key,
         // but export goes through getSignerForAddress, which refuses a key
         // that is not a master key. Without this the export screen would
-        // take a password and then refuse.
+        // take a password and then report that refusal as a wrong password.
         const defect = selectedWalletDefect();
         if (defect) {
             showFlash(defect.shortMessage);

src/popup/views/approval.js

@@ -12,7 +12,7 @@ const {
     formatFee,
     tokenLabel,
 } = require("./helpers");
-const { state, saveState, currentNetwork } = require("../../shared/state");
+const { state, saveState } = require("../../shared/state");
 const {
     networkById,
     networkByChainId,
@@ -46,10 +46,7 @@ const {
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
-const {
+const { describeSigningFailure } = require("../../shared/approvalVerify");
-    describeSigningFailure,
-    typedDataChainRefusal,
-} = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
 const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
@@ -332,9 +329,9 @@ function showTxApproval(details) {
     const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
     const usdStr = formatUsd(ethUsd);
     // In the native currency of the network the transaction is for, which the
-    // Network line names, not the active network's: the active network can
+    // Network line names, not the active network's: a site can switch the
-    // change, in Settings or when the user approves a site's request, after
+    // active network after this transaction is prepared and back before it is
-    // this transaction is prepared and change back before it is signed.
+    // signed.
     $("approve-tx-value").textContent =
         ethValueFormatted +
         " " +
@@ -446,8 +443,7 @@ function signedPrimaryType(types) {
 // Why a signature request cannot be signed, as a sentence for the error line,
 // or null when it can. Only typed data is refused: the `primaryType` the page
 // states has to be the type ethers will sign, or this screen would name one
-// message while another is signed. Its domain may name no chain but the active
+// message while another is signed.
-// network's.
 function typedDataRefusal(sp) {
     if (sp.method === "personal_sign" || sp.method === "eth_sign") return null;
     let data;
@@ -470,7 +466,7 @@ function typedDataRefusal(sp) {
             ", so it cannot be signed."
         );
     }
-    return typedDataChainRefusal(data.domain, currentNetwork());
+    return null;
 }
 
 // The largest amount a Permit2 allowance can hold, a uint160. Permit2 treats
@@ -626,38 +622,10 @@ function permitWarningHtml(types, primaryType, domain, message) {
     return html;
 }
 
-// What ethers signs of a message value of type `type`: a struct keeps only
-// the fields its type declares, in the type's order, and a list is read item
-// by item. ethers drops every other key, so each one is added to `notSigned`
-// with its place in the message and its value, for the screen to list apart.
-function signedValue(types, type, value, path, notSigned) {
-    const itemType = type.replace(/\[\d*\]$/, "");
-    if (itemType !== type) {
-        if (!Array.isArray(value)) return value;
-        return value.map((item, i) =>
-            signedValue(types, itemType, item, `${path}[${i}]`, notSigned),
-        );
-    }
-    const fields = types[type];
-    if (!fields || !value || typeof value !== "object") return value;
-    const at = (name) => (path ? `${path}.${name}` : name);
-    for (const [key, val] of Object.entries(value)) {
-        if (!fields.some((f) => f.name === key)) notSigned.push([at(key), val]);
-    }
-    return Object.fromEntries(
-        fields.map((f) => [
-            f.name,
-            signedValue(types, f.type, value[f.name], at(f.name), notSigned),
-        ]),
-    );
-}
-
 // The typed data as the screen shows it. The primary type shown is the one
 // ethers signs, never the page's word for it; typedDataRefusal() keeps the two
-// from differing on anything that can be signed. The Message section shows
+// from differing on anything that can be signed. Only typed data that cannot
-// only what is signed, and any other key the page sent is listed after it as
+// be read at all is shown as raw text, and typedDataRefusal() refuses it.
-// not part of the signature. Only typed data that cannot be read at all is
-// shown as raw text, and typedDataRefusal() refuses it.
 function formatTypedDataHtml(jsonStr) {
     let data;
     let primaryType;
@@ -691,30 +659,12 @@ function formatTypedDataHtml(jsonStr) {
     html += `<div class="mb-2"><div class="text-muted">Primary type</div>`;
     html += `<div class="font-bold">${escapeHtml(primaryType)}</div></div>`;
 
-    const lineHtml = (key, val) =>
-        `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
-
     if (data.message) {
-        const notSigned = [];
-        const message = signedValue(
-            data.types,
-            primaryType,
-            data.message,
-            "",
-            notSigned,
-        );
         html += `<div class="mb-2"><div class="text-muted">Message</div>`;
-        for (const [key, val] of Object.entries(message)) {
+        for (const [key, val] of Object.entries(data.message)) {
-            html += lineHtml(key, val);
+            html += `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
         }
         html += `</div>`;
-        if (notSigned.length > 0) {
-            html += `<div class="mb-2"><div class="text-muted">Not part of the signature</div>`;
-            for (const [key, val] of notSigned) {
-                html += lineHtml(key, val);
-            }
-            html += `</div>`;
-        }
     }
 
     return html;
@@ -771,7 +721,7 @@ function showSignApproval(details) {
             "This message is plain text, not hex, so it cannot be signed.";
     }
 
-    // The warning the background attaches to an eth_sign request.
+    // Display danger warning for eth_sign (raw hash signing)
     const warningEl = $("approve-sign-danger-warning");
     if (warningEl) {
         if (sp.dangerWarning) {
@@ -913,15 +863,15 @@ function gateOnWalletDefect(errorId, buttonId, address) {
     return true;
 }
 
-// Locate the wallet and the stored address record owning an address. Returns
+// Locate the wallet and the address index owning an address. Returns null when
-// null when no wallet holds it. Approvals look up the address they were raised
+// no wallet holds it. Approvals look up the address they were raised for, not
-// for, not whichever address is active now: the approval named one account,
+// whichever address is active now: the approval named one account, and signing
-// and signing with another is what verification refuses.
+// with another is what verification refuses.
 function findWalletFor(address) {
     for (const wallet of state.wallets) {
         for (let i = 0; i < wallet.addresses.length; i++) {
             if (wallet.addresses[i].address === address) {
-                return { wallet, addr: wallet.addresses[i] };
+                return { wallet, addrIndex: i };
             }
         }
     }
@@ -1048,7 +998,7 @@ function init(_ctx) {
         try {
             const signer = getSignerForAddress(
                 active.wallet,
-                active.addr,
+                active.addrIndex,
                 decryptedSecret,
             );
             // Sign the approved transaction exactly as it was displayed. The
@@ -1176,7 +1126,7 @@ function init(_ctx) {
         try {
             const signer = getSignerForAddress(
                 active.wallet,
-                active.addr,
+                active.addrIndex,
                 decryptedSecret,
             );
             const sp = pendingSignParams;

src/popup/views/confirmTx.js

@@ -101,10 +101,6 @@ function show(txInfo) {
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
-    // The network this screen is drawn for, and the only one it sends on:
-    // Settings can switch the active network while the screen is open. The
-    // wait, success and error screens label the amount by it too.
-    txInfo.chainId = currentNetwork().chainId;
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
@@ -494,12 +490,7 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
         );
         request = await contract.transfer.populateTransaction(tx.to, amount);
     }
-    // The chain id of the network the screen was drawn for: ethers refuses to
+    const populated = await connectedSigner.populateTransaction(request);
-    // populate it for a provider on any other network.
-    const populated = await connectedSigner.populateTransaction({
-        ...request,
-        chainId: tx.chainId,
-    });
     assertWithinCeilings(populated);
     return connectedSigner.sendTransaction(populated);
 }
@@ -556,30 +547,6 @@ function init(_ctx) {
             return;
         }
 
-        // Back from Settings only unhides this screen, still drawn for the
-        // network that was active when it was shown.
-        if (currentNetwork().chainId !== pendingTx.chainId) {
-            showSendError(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-            return;
-        }
-
-        // Sign as the From address this screen shows. The selection is saved
-        // apart from this screen, so the popup can reopen onto it with another
-        // address selected.
-        const addr = wallet.addresses.find((a) => a.address === pendingTx.from);
-        if (!addr) {
-            showError(
-                "confirm-tx-password-error",
-                "The selected wallet does not hold the From address above, " +
-                    "so nothing was sent. Please go back and send again.",
-            );
-            return;
-        }
-
         const password = $("confirm-tx-password").value;
         if (!password) {
             showError(
@@ -608,9 +575,17 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
+        // The network it is sent on. The wait, success and error screens
+        // label its amount by this, not by the network active when they draw.
+        pendingTx.chainId = currentNetwork().chainId;
+
         let tx;
         try {
-            const signer = getSignerForAddress(wallet, addr, decryptedSecret);
+            const signer = getSignerForAddress(
+                wallet,
+                state.selectedAddress,
+                decryptedSecret,
+            );
             const provider = getProvider(state.rpcUrl, state.networkId);
             const connectedSigner = signer.connect(provider);
 

src/popup/views/exportPrivkey.js

@@ -135,18 +135,7 @@ async function reveal() {
         // decrypt ran, the wipe has already happened, so the key is not
         // even derived, let alone written.
         if (!isCurrentReveal(generation)) return;
-        let signer;
+        const signer = getSignerForAddress(wallet, addressIndex, secret);
-        try {
-            signer = getSignerForAddress(
-                wallet,
-                wallet.addresses[addressIndex],
-                secret,
-            );
-        } catch (e) {
-            // The password was right; it is the key that was refused.
-            showError("export-privkey-password-error", e.message);
-            return;
-        }
         $("export-privkey-password").value = "";
         $("export-privkey-password-section").classList.add("hidden");
         $("export-privkey-value").textContent = signer.privateKey;

src/popup/views/home.js

@@ -354,7 +354,6 @@ function render(ctx) {
             );
             wallet.addresses.push({
                 address: newAddr,
-                index: wallet.nextIndex,
                 balance: "0.0000",
                 tokenBalances: [],
             });

src/popup/views/settings.js

@@ -316,11 +316,7 @@ function init(ctx) {
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
         const newId = networkSelect.value;
-        if (newId === state.networkId) return;
         const net = await onChainSwitch(newId);
-        // Open pages are told by the background, as after a site's approved
-        // switch request.
-        notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
         showFlash("Switched to " + net.name + ".");

src/popup/views/transactionDetail.js

@@ -84,9 +84,8 @@ function show(tx) {
             contractAddress: tx.contractAddress || null,
             // The network the history entry was read from. The type line and
             // the fee are in its native currency, not the active network's:
-            // the active network can change, in Settings or when the user
+            // a site can switch the active network before a later popup
-            // approves a site's request, before a later popup shows this
+            // shows this screen again.
-            // screen again.
             chainId: tx.chainId,
         },
     };
@@ -183,7 +182,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.chainId);
+    loadFullTxDetails(tx.hash, tx.to, tx.chainId);
 
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
@@ -291,7 +290,7 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
-async function loadFullTxDetails(txHash, chainId) {
+async function loadFullTxDetails(txHash, toAddress, chainId) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -313,10 +312,7 @@ async function loadFullTxDetails(txHash, chainId) {
         const inputData = txData.raw_input || txData.input || null;
         if (!inputData || inputData === "0x") return;
 
-        // Decoded against the address the transaction was sent to, as the
+        const decoded = decodeCalldata(inputData, toAddress || "");
-        // explorer reports it, not the history entry's `to`: for a token
-        // transfer that is the transfer's recipient, not the token contract.
-        const decoded = decodeCalldata(inputData, txData.to?.hash || "");
         if (decoded) {
             // Render decoded calldata matching approval view style
             actionEl.textContent = decoded.name;

src/popup/views/txStatus.js

@@ -89,9 +89,8 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
 
     // A native amount, here and on the success and error screens, is in the
     // native currency of txInfo.chainId, the network the transaction was sent
-    // on, not the active network's: the active network can change, in
+    // on, not the active network's: a site can switch the active network
-    // Settings or when the user approves a site's request, while this screen
+    // while this screen is open or before a later popup resumes it.
-    // is open or before a later popup resumes it.
     const symbol =
         txInfo.token === "ETH"
             ? nativeCurrencyByChainId(txInfo.chainId)

src/shared/approvalTx.js

@@ -1,14 +1,13 @@
 // Preparation of the transaction an approval screen displays.
 //
-// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
+// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
-// sometimes the gas limit. The nonce, the fees, and the gas limit when the
+// The nonce, the gas limit and the fees have to be filled in from the network
-// site gives none have to be filled in from the network before anything can
+// before anything can be signed, and whoever fills them in decides what the
-// be signed, and whoever fills them in decides what the user is shown. That
+// user is shown. That work used to happen in the popup, after the user had
-// work used to happen in the popup, after the user had already approved: the
+// already approved: the numbers on the approval screen came from the popup and
-// numbers on the approval screen came from the popup and were compared against
+// were compared against nothing, so a compromised popup could display one fee
-// nothing, so a compromised popup could display one fee and sign another, and
+// and sign another, and the ceilings in approvalVerify.js were all that stood
-// the ceilings in approvalVerify.js were all that stood between the user and a
+// between the user and a fee that hands the validator the balance.
-// fee that hands the validator the balance.
 //
 // So it happens here instead, in the background, before the approval window is
 // opened. The background populates the transaction, shows that object, and
@@ -32,7 +31,6 @@ const {
     VoidSigner,
     accessListify,
     getAddress,
-    getBigInt,
     getBytes,
     hexlify,
     toQuantity,
@@ -49,11 +47,10 @@ const {
 // minutes long, which is not a wait anyone will sit through.
 const POPULATE_TIMEOUT_MS = 20000;
 
-// The request fields taken from the page, plus `gas`, which requestFrom()
+// The request fields taken from the page. Anything else is dropped rather than
-// takes as the gas limit. Anything else is dropped rather than passed to
+// passed to ethers: the object is page-controlled, and a future ethers that
-// ethers: the object is page-controlled, and a future ethers that learns to
+// learns to carry a new transaction field must not start picking one up out of
-// carry a new transaction field must not start picking one up out of it
+// it without this module knowing.
-// without this module knowing.
 //
 // The nonce is not taken from the page; it is always the account's next nonce
 // from the network. A page that chose it could replace one of the user's
@@ -87,16 +84,6 @@ function present(v) {
     return v !== null && v !== undefined && v !== "";
 }
 
-// Whether two quantities from the page are the same number. One that is not a
-// number matches nothing.
-function sameQuantity(a, b) {
-    try {
-        return getBigInt(a) === getBigInt(b);
-    } catch {
-        return false;
-    }
-}
-
 // These strings reach the user through the requesting page, so they are full
 // sentences even when the tail of one came from ethers or from the node.
 function sentence(text) {
@@ -124,20 +111,6 @@ function requestFrom(txParams, from) {
     for (const key of REQUEST_FIELDS) {
         if (present(txParams[key])) request[key] = txParams[key];
     }
-    // JSON-RPC calls the gas limit `gas`, and that is the name sites send.
-    // ethers only reads `gasLimit`: left as `gas` it would be dropped and an
-    // estimate signed in its place.
-    if (present(txParams.gas)) {
-        if (
-            present(request.gasLimit) &&
-            !sameQuantity(request.gasLimit, txParams.gas)
-        ) {
-            throw fail(
-                "The site asked for two different gas limits for this transaction.",
-            );
-        }
-        request.gasLimit = txParams.gas;
-    }
     if (
         present(request.type) &&
         !ALLOWED_TX_TYPES.includes(Number(request.type))
@@ -201,7 +174,6 @@ async function prepareApprovalTx(provider, from, txParams) {
         throw fail("There is no active address to send this transaction from.");
     }
     const request = requestFrom(txParams || {}, from);
-    const signer = new VoidSigner(getAddress(from), provider);
 
     let populated;
     try {
@@ -209,20 +181,10 @@ async function prepareApprovalTx(provider, from, txParams) {
         // nonce, gas, fee and chain id are populated exactly as they were when
         // the popup did this. VoidSigner cannot sign, which is the point: the
         // background prepares, the popup signs.
-        //
-        // ethers asks the node for a gas estimate only when the request has
-        // no gas limit, and that estimate is the only check that the
-        // transaction does not revert. So a request carrying the site's gas
-        // limit is estimated first, with that limit: one that reverts, or
-        // needs more gas than the site gave it, fails here as well. The
-        // site's gas limit is still the one populated.
         populated = await withTimeout(
-            (async () => {
+            new VoidSigner(getAddress(from), provider).populateTransaction(
-                if (present(request.gasLimit)) {
+                request,
-                    await signer.estimateGas(request);
+            ),
-                }
-                return signer.populateTransaction(request);
-            })(),
             POPULATE_TIMEOUT_MS,
             "The transaction could not be prepared: the network did not answer in time.",
         );

src/shared/approvalVerify.js

@@ -53,7 +53,6 @@ const {
     accessListify,
     formatEther,
     getAddress,
-    getBigInt,
     getBytes,
     toQuantity,
     verifyMessage,
@@ -636,33 +635,6 @@ function verifySignature(signParams, signature, expectedFrom) {
     return recovered;
 }
 
-// Why typed data cannot be signed while `network` is the active network, as a
-// sentence, or null when it can. EIP-712 has a wallet refuse typed data whose
-// domain names another chain, because the signature is valid on that chain.
-// ethers signs no chain id when the domain's is null or absent, and reads any
-// other with getBigInt(), so 1, "1" and "0x1" are the same chain here too.
-function typedDataChainRefusal(domain, network) {
-    const chainId = domain?.chainId;
-    if (chainId === undefined || chainId === null) return null;
-    let named;
-    try {
-        named = getBigInt(chainId);
-    } catch {
-        return "This typed data cannot be read, so it cannot be signed.";
-    }
-    const active = getBigInt(network.chainId);
-    if (named === active) return null;
-    return (
-        "This typed data is for chain id " +
-        named +
-        ", but the active network is " +
-        network.name +
-        " (chain id " +
-        active +
-        "), so it cannot be signed."
-    );
-}
-
 // The stage a transaction approval failed at. Which stage it is decides
 // whether the approval survives the failure.
 const TX_STAGE_SIGN = "sign";
@@ -824,7 +796,6 @@ function describeSigningFailure(response, fallbackMessage) {
 module.exports = {
     verifySignedTx,
     verifySignature,
-    typedDataChainRefusal,
     assertNoForbiddenFields,
     assertNothingUnchecked,
     assertCanonicalBytes,

src/shared/phishingDomains.js

@@ -110,14 +110,11 @@ function hashListed(hash) {
  * Generate hostname variants for subdomain matching.
  * "sub.evil.com" yields ["sub.evil.com", "evil.com"].
  *
- * A trailing dot is dropped: "evil.com." is the fully qualified spelling of
- * "evil.com", and the browser loads the same site from either.
- *
  * @param {string} hostname
  * @returns {string[]}
  */
 function hostnameVariants(hostname) {
-    const h = hostname.toLowerCase().replace(/\.$/, "");
+    const h = hostname.toLowerCase();
     const variants = [h];
     const parts = h.split(".");
     // Parent domains: a.b.c.d -> b.c.d, c.d

src/shared/tokenList.js

@@ -576,7 +576,7 @@ const TOKENS = [
         symbol: "FLOKI",
         decimals: 9,
         name: "FLOKI",
-        url: "https://floki.com",
+        url: "",
     },
     {
         address: "0x7420B4b9a0110cdC71fB720908340C03F9Bc03EC",
@@ -1290,7 +1290,7 @@ const TOKENS = [
         symbol: "TURBO",
         decimals: 18,
         name: "Turbo",
-        url: "https://www.turbo-eth.com",
+        url: "",
     },
     {
         address: "0xA27EC0006e59f245217Ff08CD52A7E8b169E62D2",

src/shared/uniswap.js

@@ -53,11 +53,6 @@ function formatAmount(raw, decimals) {
 // on a scale — not as a token name, and not as a quantity.
 const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
 
-// The same refusal when a V4 swap action could not be read (see
-// decodeExactly()). That action names both of its currencies, so saying the
-// calldata did not name one would be false.
-const UNDECODED_CURRENCY = "Unknown (could not be decoded)";
-
 // Explicit presence, never truthiness. Every gate in this file that guards a
 // decoded value goes through here: an address is never falsy once set, but an
 // amount of 0n is, and a gate that cannot tell a genuine zero from an absent
@@ -300,24 +295,6 @@ function v4ExactInAmount(raw) {
     return raw === 0n ? OPEN_DELTA : raw;
 }
 
-// The V4 swap actions are read only in the parameter structs V4Router has
-// deployed on mainnet and Sepolia. v4-periphery `main` has since added a
-// `minHopPriceX36` field to all four (`src/interfaces/IV4Router.sol`), and
-// reading a shape nobody has deployed would be guessing. ethers alone would
-// read the newer structs anyway: it takes whatever word sits where a
-// deployed field would be, ignores bytes left over, and holds back an error
-// in a field until that field is used. The newer multi-hop exact-in struct
-// then yields the offset of its hop-price array as `amountIn`. So a decode
-// counts only when encoding the result again gives back the same bytes;
-// otherwise this throws, and decodeV4Swap() marks the step as not decoded.
-function decodeExactly(types, data) {
-    const decoded = coder.decode(types, data);
-    if (coder.encode(types, decoded) !== data) {
-        throw new Error("Not in the deployed V4 parameter shape.");
-    }
-    return decoded;
-}
-
 // Decode V4_SWAP (command 0x10) input bytes.
 // The input is ABI-encoded as (bytes actions, bytes[] params).
 // We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
@@ -332,10 +309,6 @@ function decodeV4Swap(input) {
         let takeToken = null;
         let amountIn = null;
         let amountOutMin = null;
-        // Set when a swap action's parameters are not in the deployed shape
-        // (see decodeExactly()), so nothing was read from that action. SETTLE
-        // and TAKE may still name both currencies.
-        let swapUndecoded = false;
 
         for (let i = 0; i < actions.length; i++) {
             const actionId = actions[i];
@@ -364,7 +337,7 @@ function decodeV4Swap(input) {
                         //   tuple(address,uint24,int24,address,bytes)[] path,
                         //   uint128 amountIn, uint128 amountOutMin)
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -382,13 +355,13 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through — SETTLE/TAKE will provide tokens
                         }
                     } else {
                         // ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
                         //   bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -411,7 +384,7 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     }
                 } else if (
@@ -420,7 +393,7 @@ function decodeV4Swap(input) {
                 ) {
                     if (actionId === V4_SWAP_EXACT_OUT) {
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -432,11 +405,11 @@ function decodeV4Swap(input) {
                                 settleToken = path[path.length - 1][0];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     } else {
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -453,7 +426,7 @@ function decodeV4Swap(input) {
                                     ? poolKey[1]
                                     : poolKey[0];
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     }
                 }
@@ -467,7 +440,6 @@ function decodeV4Swap(input) {
             tokenOut: takeToken,
             amountIn,
             amountOutMin,
-            swapUndecoded,
         };
     } catch {
         return null;
@@ -493,7 +465,6 @@ function decode(data, toAddress, sources) {
         let minOutput = null;
         let hasUnwrapWeth = false;
         let hasV2ExactOut = false;
-        let swapUndecoded = false;
         const commandNames = [];
 
         // THE INVARIANT: an amount and the token it is counted in always come
@@ -596,20 +567,7 @@ function decode(data, toAddress, sources) {
 
                 if (cmdId === 0x10) {
                     const v4 = decodeV4Swap(inputs[i]);
-                    if (v4 && v4.swapUndecoded) {
+                    if (v4) {
-                        // The unread swap action named this step's currencies
-                        // and amounts, so the step is marked and still sets
-                        // both sides as a swap step does. A side its SETTLE or
-                        // TAKE did not name is set undetermined, not left to
-                        // an earlier or later step's token and figure.
-                        swapUndecoded = true;
-                        commandNames[i] += " (could not be decoded)";
-                        if (!inputEstablished) {
-                            setInput(v4.tokenIn, v4.amountIn);
-                        }
-                        outputToken = v4.tokenOut;
-                        minOutput = v4.amountOutMin;
-                    } else if (v4) {
                         setInputOnce(v4.tokenIn, v4.amountIn);
                         // Always update output: last swap step wins. A step
                         // that carries the Min. received figure but decoded no
@@ -633,19 +591,16 @@ function decode(data, toAddress, sources) {
             }
         }
 
-        // Resolve token info. A null token on either side means no step named
+        // Resolve token info. A null token on either side means the calldata
-        // a currency for it, or a V4 step whose swap action went unread left
+        // named no currency for it; tokenInfo() refuses rather than calling it
-        // it undetermined; tokenInfo() refuses rather than calling it ETH.
+        // ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
-        // UNWRAP_WETH turns WETH into ETH, so it makes the output ETH when the
+        // when the output side is WETH, or when no step set the output side.
-        // output side is WETH, or when no step set the output side. A step
+        // Any other output keeps its own token and figure: a swap that buys
-        // whose swap action went unread did set it, to undetermined. Any other
+        // USDC and then unwraps the WETH it did not spend receives USDC.
-        // output keeps its own token and figure: a swap that buys USDC and
-        // then unwraps the WETH it did not spend receives USDC.
         const outputIsWeth =
             present(outputToken) &&
             WETH_ADDRESSES.includes(outputToken.toLowerCase());
-        const outputUnset =
+        const outputUnset = !present(outputToken) && !present(minOutput);
-            !present(outputToken) && !present(minOutput) && !swapUndecoded;
         const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
             hasUnwrapWeth && (outputIsWeth || outputUnset)
@@ -685,10 +640,7 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default. Same
             // wording as the Token Out refusal below: the two sides of this
             // screen must not describe the same condition in two ways.
-            details.push({
+            details.push({ label: "Token In", value: UNNAMED_CURRENCY });
-                label: "Token In",
-                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
-            });
         }
 
         if (present(inputAmount)) {
@@ -751,10 +703,7 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default, and a
             // Min. received figure below it is never attached to a token the
             // calldata did not state.
-            details.push({
+            details.push({ label: "Token Out", value: UNNAMED_CURRENCY });
-                label: "Token Out",
-                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
-            });
         }
 
         if (present(minOutput)) {

src/shared/wallet.js

@@ -110,33 +110,16 @@ function addressFromPrivateKey(key) {
     return w.address;
 }
 
-// The signer for `addr`, one of the wallet's stored address records. An HD or
+function getSignerForAddress(walletData, addrIndex, decryptedSecret) {
-// xprv address is derived at its own `index`, never at its position in the
-// wallet's list: the two differ once an import scan passes over an unused
-// index, or once an address that is not the last is removed. An HD or xprv
-// record without a valid `index` is refused before anything is derived.
-// Whatever the wallet type, the key is refused unless it is the key of
-// `addr.address`.
-function getSignerForAddress(walletData, addr, decryptedSecret) {
-    if (
-        (walletData.type === "hd" || walletData.type === "xprv") &&
-        !(Number.isInteger(addr.index) && addr.index >= 0)
-    ) {
-        throw new Error(
-            "No derivation index is stored for " +
-                addr.address +
-                ", so its key cannot be derived.",
-        );
-    }
-    let signer;
     if (walletData.type === "hd") {
         const node = HDNodeWallet.fromPhrase(
             decryptedSecret,
             "",
             BIP44_ETH_PATH,
         );
-        signer = node.deriveChild(addr.index);
+        return node.deriveChild(addrIndex);
-    } else if (walletData.type === "xprv") {
+    }
+    if (walletData.type === "xprv") {
         // Checked here rather than through masterXprvOrThrow so the message
         // fits the situation: nobody is importing anything at signing time,
         // and this wallet is already in storage. src/shared/walletDefects.js
@@ -154,18 +137,9 @@ function getSignerForAddress(walletData, addr, decryptedSecret) {
                     "is not a master key, so it cannot sign.",
             );
         }
-        signer = node.derivePath(BIP44_ETH_PATH).deriveChild(addr.index);
+        return node.derivePath(BIP44_ETH_PATH).deriveChild(addrIndex);
-    } else {
-        signer = new Wallet(decryptedSecret);
     }
-    if (signer.address.toLowerCase() !== addr.address.toLowerCase()) {
+    return new Wallet(decryptedSecret);
-        throw new Error(
-            "The key this wallet holds for " +
-                addr.address +
-                " belongs to a different address, so it was not used.",
-        );
-    }
-    return signer;
 }
 
 function isValidMnemonic(mnemonic) {

src/shared/walletDefects.js

@@ -36,13 +36,11 @@ const DEFECTS = {
                 "derivation path beneath that key instead of from a master " +
                 "key, so the addresses listed here are not the ones that key " +
                 "produces under the standard path.",
-            "Signing, sending and private key export are disabled for this " +
+            "Signing and sending are disabled for this wallet. The addresses " +
-                "wallet. Anything these addresses hold can be reached outside " +
+                "do descend from the extended private key you imported, so " +
-                "this wallet with the extended private key you imported, if " +
+                "anything they hold is still reachable by software that " +
-                "you kept a copy of it, or with the master extended private " +
+                "repeats the same non-standard derivation. Check them in a " +
-                "key or recovery phrase it came from, in software that " +
+                "block explorer before deciding what to do.",
-                "repeats the same non-standard derivation. Check the " +
-                "addresses in a block explorer before deciding what to do.",
             "To see the addresses this key produces under the standard path, " +
                 "import the master extended private key, or the recovery " +
                 "phrase it came from, as a new wallet. Nothing here has been " +

tests/addressKey.test.js

@@ -1,490 +0,0 @@
-// Sending, a site's transaction and signature requests and private key export
-// each use the key of the address they name: the key at the index that address
-// was derived at, not the one at its position in the wallet's list. The two
-// differ after an import whose scan passed over an unused index, and after an
-// address that is not the last is removed
-// (https://git.eeqj.de/sneak/AutistMask/issues/510). A send is signed by the
-// From address its confirmation screen shows, whichever address is selected.
-//
-// Driven through the real import, "+" button, address removal, confirmation
-// screen, transaction and signature approval screens and export screen, with
-// the node, the vault and the DOM stubbed.
-
-"use strict";
-
-// The addresses the stub node reports a balance for, and the signed
-// transactions it was handed.
-const mockNode = { funded: new Set(), broadcast: [] };
-
-jest.mock("ethers", () => {
-    const actual = jest.requireActual("ethers");
-    class StubProvider {
-        async getBalance(address) {
-            return mockNode.funded.has(address) ? 1n : 0n;
-        }
-        async getTransactionCount() {
-            return 0;
-        }
-        async estimateGas() {
-            return 21000n;
-        }
-        async getFeeData() {
-            return {
-                maxFeePerGas: 20000000000n,
-                maxPriorityFeePerGas: 1000000000n,
-                gasPrice: 10000000000n,
-            };
-        }
-        async getNetwork() {
-            return { chainId: 1n };
-        }
-        async getCode() {
-            return "0x";
-        }
-        async lookupAddress() {
-            return null;
-        }
-        async broadcastTransaction(signed) {
-            mockNode.broadcast.push(signed);
-            return { hash: "0x" + "ab".repeat(32) };
-        }
-    }
-    return { ...actual, JsonRpcProvider: StubProvider };
-});
-
-// No password is hashed: what the wallet stores is the phrase itself.
-jest.mock("../src/shared/vault", () => ({
-    encryptWithPassword: async (secret) => secret,
-    decryptWithPassword: async (secret) => secret,
-}));
-
-// The wait screen polls for a receipt; these tests stop at the broadcast.
-jest.mock("../src/popup/views/txStatus", () => ({
-    showWait: jest.fn(),
-    showError: jest.fn(),
-}));
-
-jest.mock("ethereum-blockies-base64", () => () => "data:image/png;base64,x");
-
-global.fetch = jest.fn(() => {
-    throw new Error("tests must not perform network requests");
-});
-
-const {
-    HDNodeWallet,
-    Mnemonic,
-    Transaction,
-    getBytes,
-    verifyMessage,
-} = require("ethers");
-
-// Publicly known development phrase; never fund it.
-const PHRASE = "test test test test test test test test test test test junk";
-// PHRASE's master extended private key, as the xprv import takes it.
-const XPRV = HDNodeWallet.fromSeed(
-    Mnemonic.fromPhrase(PHRASE).computeSeed(),
-).extendedKey;
-const PASSWORD = "correct horse battery staple";
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-// "Hello", as the hex a page sends.
-const MESSAGE = "0x48656c6c6f";
-
-// The address and key at derivation index `index` of PHRASE, worked out with
-// ethers directly rather than through the wallet's own code.
-function derived(index) {
-    return HDNodeWallet.fromPhrase(PHRASE, "", "m/44'/60'/0'/0/" + index);
-}
-
-// ------------------------------------------------------------ DOM stub
-
-function makeElement(id) {
-    const classes = new Set();
-    const el = {
-        id,
-        textContent: "",
-        title: "",
-        value: "",
-        innerHTML: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        listeners: {},
-        classList: {
-            add: (...names) => names.forEach((n) => classes.add(n)),
-            remove: (...names) => names.forEach((n) => classes.delete(n)),
-            contains: (n) => classes.has(n),
-            toggle: (n, force) => {
-                const on = force === undefined ? !classes.has(n) : force;
-                if (on) classes.add(n);
-                else classes.delete(n);
-                return on;
-            },
-        },
-        addEventListener: (name, fn) => {
-            el.listeners[name] = el.listeners[name] || [];
-            el.listeners[name].push(fn);
-        },
-        querySelectorAll: () => [],
-        appendChild: () => {},
-    };
-    // Views reach for .parentElement to hide whole sections.
-    Object.defineProperty(el, "parentElement", {
-        get: () => node(id + "-parent"),
-    });
-    return el;
-}
-
-function makeDocument() {
-    const els = new Map();
-    return {
-        getElementById(id) {
-            // The debug banner is created on demand by helpers.js; absent
-            // is the state a non-debug, non-testnet popup is in.
-            if (id === "debug-banner") return null;
-            if (!els.has(id)) els.set(id, makeElement(id));
-            return els.get(id);
-        },
-        createElement: () => makeElement("created"),
-        addEventListener: () => {},
-        body: { prepend: () => {} },
-    };
-}
-
-function node(id) {
-    return globalThis.document.getElementById(id);
-}
-
-function click(element) {
-    const event = { stopPropagation: () => {} };
-    return Promise.all((element.listeners.click || []).map((fn) => fn(event)));
-}
-
-// show() starts the fee estimate without awaiting it; this lets it settle.
-async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-}
-
-// ------------------------------------------------------------ harness
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { state } = require("../src/shared/state");
-const { removeAddressFromState } = require("../src/shared/walletDelete");
-const addWallet = require("../src/popup/views/addWallet");
-const home = require("../src/popup/views/home");
-const confirmTx = require("../src/popup/views/confirmTx");
-const approval = require("../src/popup/views/approval");
-const exportPrivkey = require("../src/popup/views/exportPrivkey");
-const txStatus = require("../src/popup/views/txStatus");
-
-// What the background answers when the approval window asks which approval it
-// was opened for, and every message the popup sent it.
-let approvalDetails;
-let sent;
-
-// The "+" button of the wallet list's last render. Each render attaches the
-// handler to the buttons it drew, as the browser's fresh list would have.
-let plusButton;
-
-beforeEach(() => {
-    approvalDetails = null;
-    sent = [];
-    mockNode.broadcast = [];
-    globalThis.document = makeDocument();
-    globalThis.window = { close: () => {} };
-    globalThis.chrome = {
-        storage: { local: { get: async () => ({}), set: async () => {} } },
-        runtime: {
-            connect: () => ({ postMessage: () => {} }),
-            sendMessage: (msg, reply) => {
-                sent.push(msg);
-                if (!reply) return;
-                reply(
-                    msg.type === "AUTISTMASK_GET_APPROVAL"
-                        ? approvalDetails
-                        : null,
-                );
-            },
-        },
-    };
-    node("wallet-list").querySelectorAll = (selector) => {
-        if (selector !== ".btn-add-address") return [];
-        plusButton = makeElement("btn-add-address");
-        plusButton.dataset.wallet = "0";
-        return [plusButton];
-    };
-    // The explorer and price lookups these screens start fail offline, and
-    // say so; that is not under test.
-    for (const method of ["log", "warn", "error"]) {
-        jest.spyOn(console, method).mockImplementation(() => {});
-    }
-    txStatus.showError.mockClear();
-
-    state.wallets = [];
-    state.rpcUrl = "https://rpc.example.invalid";
-    state.networkId = "mainnet";
-    state.viewStack = [];
-    state.currentView = "main";
-
-    addWallet.init({
-        renderWalletList: () => {},
-        doRefreshAndRender: () => {},
-        pageClosed: new AbortController().signal,
-    });
-    confirmTx.init({});
-    approval.init({});
-    exportPrivkey.init();
-});
-
-afterEach(() => {
-    jest.restoreAllMocks();
-});
-
-// Import PHRASE on the add-wallet screen, with the stub node reporting a
-// balance at each of `fundedIndices`, and wait for the address scan.
-async function importPhrase(fundedIndices) {
-    mockNode.funded = new Set(fundedIndices.map((i) => derived(i).address));
-    await click(node("tab-mnemonic"));
-    node("wallet-mnemonic").value = PHRASE;
-    node("add-wallet-password").value = PASSWORD;
-    node("add-wallet-password-confirm").value = PASSWORD;
-    await click(node("btn-add-wallet-confirm"));
-}
-
-// The same, importing XPRV on the add-wallet screen's xprv tab.
-async function importXprv(fundedIndices) {
-    mockNode.funded = new Set(fundedIndices.map((i) => derived(i).address));
-    await click(node("tab-xprv"));
-    node("import-xprv-key").value = XPRV;
-    node("add-wallet-password").value = PASSWORD;
-    node("add-wallet-password-confirm").value = PASSWORD;
-    await click(node("btn-add-wallet-confirm"));
-}
-
-// Press the wallet's "+" button on Home.
-async function addAddress() {
-    home.render({
-        doRefreshAndRender: () => {},
-        pageClosed: new AbortController().signal,
-    });
-    await click(plusButton);
-}
-
-// The key the export screen reveals for the address at `position`.
-async function exportedKey(position) {
-    exportPrivkey.show(0, position);
-    node("export-privkey-password").value = PASSWORD;
-    await click(node("btn-export-privkey-confirm"));
-    return node("export-privkey-value").textContent;
-}
-
-// Confirm a send whose From line shows `from`, with the address at position
-// `selected` selected; resolves to the signed transaction the node was handed,
-// or undefined when none was.
-async function confirmSend(from, selected) {
-    state.selectedWallet = 0;
-    state.selectedAddress = selected;
-    confirmTx.show({
-        from,
-        to: RECIPIENT,
-        amount: "0.5",
-        token: "ETH",
-        balance: "1.0",
-    });
-    await settle();
-    node("confirm-tx-password").value = PASSWORD;
-    await click(node("btn-confirm-send"));
-    return mockNode.broadcast.pop();
-}
-
-// Send from the address at `position`, with that address selected, as the Send
-// button leaves it.
-function sendFrom(position) {
-    return confirmSend(state.wallets[0].addresses[position].address, position);
-}
-
-// A site asks the address at `position` to sign MESSAGE; resolves to the
-// response the approval window sent the background.
-async function signFor(position) {
-    const address = state.wallets[0].addresses[position].address;
-    approvalDetails = {
-        type: "sign",
-        origin: "https://dapp.example",
-        isPhishingDomain: false,
-        approvedFrom: address,
-        signParams: {
-            method: "personal_sign",
-            message: MESSAGE,
-            from: address,
-        },
-    };
-    await approval.show(1);
-    node("approve-sign-password").value = PASSWORD;
-    await click(node("btn-approve-sign"));
-    return sent.find((msg) => msg.type === "AUTISTMASK_SIGN_RESPONSE");
-}
-
-// A site asks the address at `position` to send RECIPIENT a transaction of no
-// value; resolves to the response the approval window sent the background.
-async function transactFor(position) {
-    const address = state.wallets[0].addresses[position].address;
-    approvalDetails = {
-        type: "tx",
-        origin: "https://dapp.example",
-        isPhishingDomain: false,
-        approvedFrom: address,
-        approvedTx: {
-            type: 2,
-            from: address,
-            chainId: "0x1",
-            nonce: "0x0",
-            gasLimit: "0x5208",
-            maxPriorityFeePerGas: "0x3b9aca00",
-            maxFeePerGas: "0x77359400",
-            to: RECIPIENT,
-            value: "0x0",
-            data: "0x",
-            accessList: [],
-        },
-    };
-    await approval.show(1);
-    node("approve-tx-password").value = PASSWORD;
-    await click(node("btn-approve-tx"));
-    return sent.find((msg) => msg.type === "AUTISTMASK_TX_RESPONSE");
-}
-
-describe.each([
-    [
-        "a recovery phrase import whose scan found only the first address",
-        async () => {
-            await importPhrase([0]);
-        },
-        // The address the import stores before its scan.
-        { position: 0, index: 0 },
-    ],
-    [
-        "an xprv import whose scan found only the first address",
-        async () => {
-            await importXprv([0]);
-        },
-        { position: 0, index: 0 },
-    ],
-    [
-        "an import whose scan passed over index 3",
-        async () => {
-            await importPhrase([0, 1, 2, 4]);
-        },
-        // Address 4 on Home, derived at index 4.
-        { position: 3, index: 4 },
-    ],
-    [
-        "an xprv import whose scan passed over index 3",
-        async () => {
-            await importXprv([0, 1, 2, 4]);
-        },
-        { position: 3, index: 4 },
-    ],
-    [
-        "removing the middle one of three addresses",
-        async () => {
-            await importPhrase([0]);
-            await addAddress();
-            await addAddress();
-            removeAddressFromState(state, 0, 1);
-        },
-        // Address 2 on Home after the removal, derived at index 2.
-        { position: 1, index: 2 },
-    ],
-])("after %s", (_name, setUp, { position, index }) => {
-    beforeEach(setUp);
-
-    test("the wallet lists the address derived at that index there", () => {
-        expect(state.wallets[0].addresses[position].address).toBe(
-            derived(index).address,
-        );
-    });
-
-    test("export reveals that address's key", async () => {
-        expect(await exportedKey(position)).toBe(derived(index).privateKey);
-    });
-
-    test("a send is signed by that address", async () => {
-        const signed = await sendFrom(position);
-        expect(Transaction.from(signed).from).toBe(derived(index).address);
-    });
-
-    test("a site's signature is made by that address", async () => {
-        const response = await signFor(position);
-        expect(verifyMessage(getBytes(MESSAGE), response.signature)).toBe(
-            derived(index).address,
-        );
-    });
-
-    test("a site's transaction is signed by that address", async () => {
-        const response = await transactFor(position);
-        expect(Transaction.from(response.rawSignedTx).from).toBe(
-            derived(index).address,
-        );
-    });
-});
-
-// The selection and the confirmation screen are saved apart, so the popup can
-// reopen onto the screen with another address selected than its From line
-// shows.
-describe("a confirmation screen whose From is not the selected address", () => {
-    beforeEach(async () => {
-        await importPhrase([0, 1]);
-    });
-
-    test("the send is signed by the From address shown", async () => {
-        const signed = await confirmSend(derived(1).address, 0);
-        expect(Transaction.from(signed).from).toBe(derived(1).address);
-    });
-
-    test("nothing is sent when the selected wallet does not hold it", async () => {
-        expect(await confirmSend(derived(5).address, 0)).toBeUndefined();
-        expect(node("confirm-tx-password-error").textContent).toBe(
-            "The selected wallet does not hold the From address above, " +
-                "so nothing was sent. Please go back and send again.",
-        );
-    });
-});
-
-describe("an address whose stored index derives a different address", () => {
-    function refusal() {
-        return (
-            "The key this wallet holds for " +
-            derived(0).address +
-            " belongs to a different address, so it was not used."
-        );
-    }
-
-    beforeEach(async () => {
-        await importPhrase([0]);
-        state.wallets[0].addresses[0].index = 1;
-    });
-
-    test("export reveals nothing and says why", async () => {
-        expect(await exportedKey(0)).toBe("");
-        expect(node("export-privkey-password-error").textContent).toBe(
-            refusal(),
-        );
-    });
-
-    test("nothing is sent", async () => {
-        expect(await sendFrom(0)).toBeUndefined();
-        expect(txStatus.showError).toHaveBeenCalledWith(
-            expect.anything(),
-            null,
-            refusal(),
-        );
-    });
-
-    test("nothing is signed", async () => {
-        const response = await signFor(0);
-        expect(response.signature).toBeUndefined();
-        expect(response.error).toBe(refusal());
-    });
-});

tests/applyEnrichment.test.js

@@ -1,19 +0,0 @@
-// The token names and URLs in src/shared/tokenList.js are written from
-// script/lib/token-enrichment.json by script/lib/apply-enrichment.js
-// (`make apply-enrichment`). This fails when the committed list differs from
-// what the script writes from the committed data, and when the data or the
-// script's table of websites has an address that no entry in the list matches.
-
-const fs = require("fs");
-const path = require("path");
-
-const enrichment = require("../script/lib/token-enrichment.json");
-const { applyEnrichment } = require("../script/lib/apply-enrichment");
-
-test("src/shared/tokenList.js is what make apply-enrichment writes from the committed data", () => {
-    const committed = fs.readFileSync(
-        path.join(__dirname, "..", "src/shared/tokenList.js"),
-        "utf8",
-    );
-    expect(applyEnrichment(committed, enrichment)).toBe(committed);
-});

tests/approvalNonce.test.js

@@ -136,9 +136,7 @@ async function openTxApproval(approvedTx) {
             xpub: "xpub-wallet-1",
             encryptedSecret: "encrypted-secret-1",
             nextIndex: 1,
-            addresses: [
+            addresses: [{ address: FROM, balance: "0", tokenBalances: [] }],
-                { address: FROM, index: 0, balance: "0", tokenBalances: [] },
-            ],
         },
     ];
     approval.init({});

tests/approvalTx.test.js

@@ -9,7 +9,7 @@
 // requesting page or the RPC node can say turns it into an approval that
 // should never have been raised.
 
-const { Network, Transaction, Wallet, toQuantity } = require("ethers");
+const { Network, Wallet } = require("ethers");
 const {
     prepareApprovalTx,
     serializeApprovedTx,
@@ -138,49 +138,6 @@ describe("prepareApprovalTx", () => {
         expect(approved.maxFeePerGas).toBe("0x12a05f200");
     });
 
-    // `gas` is the JSON-RPC name for the gas limit and the one sites send.
-    // The node is still asked for its estimate, with the site's gas limit,
-    // because the estimate is the check that the transaction does not revert.
-    // It estimates 21000; the site's 200000 is what is shown and what is
-    // signed.
-    test("uses the gas limit a site sends as gas", async () => {
-        const estimateGas = jest.fn(async () => 21000n);
-        const approved = await prepareApprovalTx(
-            providerWith({ estimateGas }),
-            signer.address,
-            { ...TX_PARAMS, gas: "0x30d40" },
-        );
-        expect(estimateGas).toHaveBeenCalledWith(
-            expect.objectContaining({ gasLimit: 200000n }),
-        );
-        expect(approved.gasLimit).toBe("0x30d40");
-        const signed = Transaction.from(
-            await signer.signTransaction({ ...approved }),
-        );
-        expect(signed.gasLimit).toBe(200000n);
-    });
-
-    test("accepts gas and gasLimit that name the same number", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            { ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
-        );
-        expect(approved.gasLimit).toBe("0x30d40");
-    });
-
-    test("refuses gas and gasLimit that disagree", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), signer.address, {
-                ...TX_PARAMS,
-                gas: "0x30d40",
-                gasLimit: "0x5208",
-            }),
-        ).rejects.toThrow(
-            "The site asked for two different gas limits for this transaction.",
-        );
-    });
-
     test("carries an access list the request asked for", async () => {
         const approved = await prepareApprovalTx(
             providerWith(),
@@ -255,15 +212,6 @@ describe("prepareApprovalTx", () => {
         ).rejects.toThrow(/gas limit no network this wallet supports/);
     });
 
-    test("refuses a gas limit the site sent above the ceiling", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), signer.address, {
-                ...TX_PARAMS,
-                gas: toQuantity(MAX_GAS_LIMIT + 1n),
-            }),
-        ).rejects.toThrow(/gas limit no network this wallet supports/);
-    });
-
     // The combined bound at population: a gas limit and a fee that are each
     // under their own ceiling but multiply to thousands of ETH is refused
     // before the approval window opens, so the user is never shown a
@@ -303,22 +251,6 @@ describe("prepareApprovalTx", () => {
         expect(thrown.message).toMatch(/^[A-Z].*\.$/);
     });
 
-    test("fails back a reverting request that sends its own gas limit", async () => {
-        const reverting = providerWith({
-            estimateGas: async () => {
-                throw new Error("execution reverted: ERC20: transfer amount");
-            },
-        });
-        await expect(
-            prepareApprovalTx(reverting, signer.address, {
-                ...TX_PARAMS,
-                gas: "0x30d40",
-            }),
-        ).rejects.toThrow(
-            /^The transaction could not be prepared: execution reverted/,
-        );
-    });
-
     // Without a bound, an unreachable node leaves the page's promise pending
     // with nothing on screen to explain it.
     test("gives up on a node that never answers", async () => {
@@ -341,28 +273,6 @@ describe("prepareApprovalTx", () => {
             jest.useRealTimers();
         }
     });
-
-    // The estimate of a request carrying the site's gas limit is a call of its
-    // own, made before populating, and is bounded the same way.
-    test("gives up on a node that never answers the estimate of a request that sends its own gas limit", async () => {
-        jest.useFakeTimers();
-        try {
-            const hanging = providerWith({
-                estimateGas: () => new Promise(() => {}),
-            });
-            const pending = prepareApprovalTx(hanging, signer.address, {
-                ...TX_PARAMS,
-                gas: "0x30d40",
-            });
-            const settled = expect(pending).rejects.toThrow(
-                /did not answer in time/,
-            );
-            await jest.advanceTimersByTimeAsync(POPULATE_TIMEOUT_MS + 1);
-            await settled;
-        } finally {
-            jest.useRealTimers();
-        }
-    });
 });
 
 describe("serializeApprovedTx", () => {

tests/approvalVerify.test.js

@@ -58,6 +58,7 @@ const TX_PARAMS = {
     to: RECIPIENT,
     value: "0x2386f26fc10000",
     data: "0xdeadbeef",
+    gas: "0x5208",
 };
 
 // The values populateTransaction() fills in when the dApp fixed none of them.
@@ -1454,11 +1455,7 @@ describe("background population to popup signing to verification", () => {
 
     // What the popup does with it: signs it as given, populating nothing.
     async function popupSigns(approvedTx) {
-        const localSigner = getSignerForAddress(
+        const localSigner = getSignerForAddress(walletData, 0, SIGNER_KEY);
-            walletData,
-            { address: signer.address },
-            SIGNER_KEY,
-        );
         return localSigner.signTransaction({ ...approvedTx });
     }
 
@@ -1553,11 +1550,7 @@ describe("background population to popup signing to verification", () => {
     // address the user has switched to.
     test("the approved from stops the popup signing with another key", async () => {
         const approvedTx = await backgroundPrepares(TX_PARAMS);
-        const otherSigner = getSignerForAddress(
+        const otherSigner = getSignerForAddress(walletData, 0, OTHER_KEY);
-            walletData,
-            { address: other.address },
-            OTHER_KEY,
-        );
         await expect(
             otherSigner.signTransaction({ ...approvedTx }),
         ).rejects.toThrow(/from address mismatch/);

tests/approvalWindow.test.js

@@ -1,47 +0,0 @@
-// The approval window shows no screen until the background has described the
-// approval it answers (https://git.eeqj.de/sneak/AutistMask/issues/408). The
-// connection prompt's "Allow" and the network switch prompt's "Switch" answer
-// on the same port, so a window that showed the connection prompt while it
-// waited could approve a network switch.
-//
-// Booted through the real popup entry point, which is where the connection
-// prompt used to be put up before the background had answered.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    settle,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-afterEach(cleanupPopup);
-
-test("the approval window shows no screen until the background describes the approval", async () => {
-    // The background's answer, held until the test gives it.
-    let answer = null;
-    const env = await bootPopup(unversionedValidProfile(), {
-        search: "?approval=approval-1",
-        runtime: {
-            connect: () => ({ postMessage: () => {} }),
-            sendMessage: (msg, reply) => {
-                if (msg.type === "AUTISTMASK_GET_APPROVAL") answer = reply;
-            },
-        },
-    });
-
-    expect(answer).not.toBeNull();
-    // No screen at all, the connection prompt included.
-    expect(env.visibleViews()).toEqual([]);
-
-    answer({
-        type: "network",
-        origin: "https://dapp.example",
-        currentNetworkId: "mainnet",
-        requestedNetworkId: "sepolia",
-        isPhishingDomain: false,
-    });
-    await settle();
-
-    expect(env.visibleViews()).toEqual(["approve-network"]);
-    expect(env.pageErrors).toEqual([]);
-});

tests/backgroundApproval.test.js

@@ -397,13 +397,7 @@ function loadBackground(options) {
                 rpcResult = r;
             },
         );
-        return {
+        return { result: () => rpcResult };
-            id: () =>
-                new URL(created[created.length - 1].url).searchParams.get(
-                    "approval",
-                ),
-            result: () => rpcResult,
-        };
     }
 
     // A dApp asking to connect. The origin defaults to one the persisted
@@ -1490,55 +1484,6 @@ describe("what the approval is verified against", () => {
         });
     });
 
-    // Typed data whose domain names another chain is refused on the sign
-    // screen; a signature for it that reaches the background anyway is not
-    // handed to the page (https://git.eeqj.de/sneak/AutistMask/issues/519).
-    // TYPED_DATA names mainnet.
-    async function answerTypedData(bg, pending) {
-        const { domain, types, message } = JSON.parse(TYPED_DATA);
-        delete types.EIP712Domain;
-        const signature = await signer.signTypedData(domain, types, message);
-        const answer = bg.send(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                signature,
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        return { answer, signature };
-    }
-
-    test("typed data for the active chain is handed back signed", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTypedData();
-        await settle();
-
-        const { answer, signature } = await answerTypedData(bg, pending);
-
-        expect(answer.sendResponse).toHaveBeenCalledWith({ signature });
-        expect(pending.result()).toEqual({ result: signature });
-    });
-
-    test("typed data for another chain is refused, not handed back", async () => {
-        const bg = loadBackground();
-        bg.setNetwork(SEPOLIA);
-        const pending = bg.requestTypedData();
-        await settle();
-
-        const { answer } = await answerTypedData(bg, pending);
-
-        const refusal =
-            "This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
-        expect(answer.sendResponse).toHaveBeenCalledWith({
-            error: refusal,
-            retryable: false,
-        });
-        expect(pending.result()).toEqual({ error: { message: refusal } });
-    });
-
     test("a sign request from another address raises no approval at all", async () => {
         const bg = loadBackground();
         const pending = bg.requestSign(other.address);
@@ -1606,55 +1551,6 @@ describe("what the approval is verified against", () => {
     });
 });
 
-// eth_sign names the address first and the data second, the reverse of
-// personal_sign, and is answered as the JSON-RPC specification defines it:
-// with an EIP-191 personal message signature over the data, the same
-// signature personal_sign returns
-// (https://git.eeqj.de/sneak/AutistMask/issues/409). The signature below is
-// made by the test; that the sign screen makes the same one is tested in
-// tests/ethSign.test.js.
-describe("eth_sign", () => {
-    test("is read address first, and returns a personal message signature over the data", async () => {
-        const bg = loadBackground();
-        const page = bg.send(
-            {
-                type: "AUTISTMASK_RPC",
-                method: "eth_sign",
-                params: [signer.address, MESSAGE],
-            },
-            { origin: ORIGIN },
-        );
-        await settle();
-        const id = approvalIdIn(bg.created.map((c) => c.url));
-
-        const details = bg.send(
-            { type: "AUTISTMASK_GET_APPROVAL", id },
-            { url: bg.fromPopup.url },
-        );
-        const { signParams } = details.sendResponse.mock.calls[0][0];
-        expect(signParams).toMatchObject({
-            method: "eth_sign",
-            message: MESSAGE,
-            from: signer.address,
-        });
-        expect(signParams.dangerWarning).toBe(
-            "This site used the older eth_sign method. " +
-                "The data will be signed as a personal message.",
-        );
-
-        const signature = await signer.signMessage(
-            Buffer.from(MESSAGE.slice(2), "hex"),
-        );
-        bg.send(
-            { type: "AUTISTMASK_SIGN_RESPONSE", id, approved: true, signature },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-
-        expect(page.sendResponse).toHaveBeenCalledWith({ result: signature });
-    });
-});
-
 // The interlock must not cost the retry the approval exists to allow.
 describe("the interlock releases a failed attempt", () => {
     test("a retryable failure before the broadcast leaves the approval usable", async () => {

tests/chainSwitchGate.test.js

@@ -16,9 +16,7 @@
 //
 // The endpoint half of #308 lives in tests/networkEndpoints.test.js, which
 // covers the popup's chain switch; this file covers the background's, which
-// goes through storage rather than the shared state singleton. The last block
+// goes through storage rather than the shared state singleton.
-// covers what the background tells open tabs when the user switches the
-// network in Settings.
 
 const { networkById } = require("../src/shared/networks");
 const { makeStorageStub } = require("./support/storageStub");
@@ -227,14 +225,6 @@ function loadBackground() {
         answerPrompt,
         closePrompt,
         opened,
-        // A message to the background from `sender`, and its answer.
-        send: (msg, sender) => {
-            let reply = null;
-            messageListener(msg, sender, (r) => {
-                reply = r;
-            });
-            return reply;
-        },
         walletState: () => storage.read("autistmask"),
         chainChangedEvents: () =>
             toTabs.filter((m) => m.eventName === "chainChanged"),
@@ -400,109 +390,3 @@ describe("only the user switches the network", () => {
         expect(bg.walletState().rpcUrl).toBe(CUSTOM_RPC);
     });
 });
-
-// Switching the network in Settings tells open pages, as an approved site
-// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). These drive
-// the real Settings view over the background's storage, with what it sends
-// delivered to the background from the extension's own page.
-describe("switching the network in Settings tells every open tab", () => {
-    const POPUP = { url: EXT_URL + "src/popup/index.html" };
-
-    // A stand-in for one DOM node: enough of an element for init() to set
-    // properties on it and hang listeners off it.
-    function fakeElement() {
-        return {
-            value: "",
-            checked: false,
-            textContent: "",
-            style: {},
-            dataset: {},
-            classList: { add() {}, remove() {} },
-            listeners: {},
-            addEventListener(event, handler) {
-                this.listeners[event] = handler;
-            },
-            querySelectorAll: () => [],
-        };
-    }
-
-    // Settings, opened the way the popup opens it. Returns its network
-    // selector.
-    async function openSettings(bg) {
-        const elements = {};
-        const element = (id) => (elements[id] ||= fakeElement());
-        jest.doMock("../src/popup/views/helpers", () => ({
-            $: element,
-            showView: () => {},
-            updateDebugBanner: () => {},
-            showFlash: () => {},
-            escapeHtml: (s) => s,
-            flashCopyFeedback: () => {},
-            goBack: () => {},
-            pushCurrentView: () => {},
-            onViewLeave: () => {},
-            VIEWS: [],
-        }));
-        global.chrome.runtime.sendMessage = (msg) => {
-            bg.send(msg, POPUP);
-        };
-        await require("../src/shared/state").loadState();
-        require("../src/popup/views/settings").init({
-            pageClosed: new AbortController().signal,
-        });
-        const select = element("settings-network");
-        select.value = "mainnet";
-        return select;
-    }
-
-    // The user picks `networkId` in the selector.
-    async function choose(select, networkId) {
-        select.value = networkId;
-        await select.listeners.change();
-        await settle();
-    }
-
-    afterEach(() => {
-        jest.dontMock("../src/popup/views/helpers");
-    });
-
-    test("switching to the other network sends chainChanged once, with its chain id", async () => {
-        const bg = loadBackground();
-        const select = await openSettings(bg);
-
-        await choose(select, "sepolia");
-
-        expect(bg.walletState().networkId).toBe("sepolia");
-        expect(bg.chainChangedEvents()).toEqual([
-            {
-                type: "AUTISTMASK_EVENT",
-                eventName: "chainChanged",
-                data: SEPOLIA.chainId,
-            },
-        ]);
-    });
-
-    test("choosing the network already active changes nothing and sends nothing", async () => {
-        const bg = loadBackground();
-        const select = await openSettings(bg);
-        const before = bg.walletState();
-
-        await choose(select, "mainnet");
-
-        expect(bg.walletState()).toEqual(before);
-        expect(bg.chainChangedEvents()).toEqual([]);
-    });
-
-    test("a page cannot make the background send chainChanged", async () => {
-        const bg = loadBackground();
-
-        const reply = bg.send(
-            { type: "AUTISTMASK_NETWORK_CHANGED", chainId: SEPOLIA.chainId },
-            { url: CONNECTED_ORIGIN + "/" },
-        );
-        await settle();
-
-        expect(reply).toEqual({ error: "Unauthorized sender" });
-        expect(bg.chainChangedEvents()).toEqual([]);
-    });
-});

tests/confirmTxNetworkSwitch.test.js

@@ -1,259 +0,0 @@
-// A transfer is sent only on the network its confirmation screen was drawn for
-// (https://git.eeqj.de/sneak/AutistMask/issues/524).
-//
-// Settings is reachable from the confirmation screen, and Back from it only
-// unhides the screen, still labelled for the network it was drawn for. Sign &
-// Send used to take the network at the moment of the click, so 1 SepoliaETH
-// reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
-// Settings in between.
-//
-// Driven through the real confirmation screen, signer and chain switch, with
-// only the node and the DOM stubbed. The stub node is on the network its
-// provider was built for, so a broadcast records the network it went to.
-
-"use strict";
-
-// The signed transactions the stub node was handed, with its network's chain id.
-const mockNode = { broadcast: [] };
-
-jest.mock("ethers", () => {
-    const actual = jest.requireActual("ethers");
-    class StubProvider {
-        constructor(url, network) {
-            this.network = network;
-        }
-        async getNetwork() {
-            return this.network;
-        }
-        async getFeeData() {
-            return {
-                maxFeePerGas: 20000000000n,
-                maxPriorityFeePerGas: 1000000000n,
-                gasPrice: 10000000000n,
-            };
-        }
-        async estimateGas() {
-            return 21000n;
-        }
-        async getCode() {
-            return "0x";
-        }
-        async getTransactionCount() {
-            return 1;
-        }
-        async lookupAddress() {
-            return null;
-        }
-        async broadcastTransaction(signed) {
-            mockNode.broadcast.push({ chainId: this.network.chainId, signed });
-            return { hash: "0x" + "ab".repeat(32) };
-        }
-    }
-    return { ...actual, JsonRpcProvider: StubProvider };
-});
-
-jest.mock("../src/shared/log", () => ({
-    log: {
-        debugf: () => {},
-        infof: () => {},
-        warnf: () => {},
-        errorf: () => {},
-    },
-    debugFetch: jest.fn(async () => ({
-        ok: true,
-        status: 200,
-        json: async () => ({ items: [] }),
-    })),
-    urlOrigin: () => "",
-    setRuntimeDebug: () => {},
-    isDebug: () => false,
-}));
-
-// The wait screen polls for a receipt; these tests stop at the broadcast.
-jest.mock("../src/popup/views/txStatus", () => ({
-    showWait: jest.fn(),
-    showError: jest.fn(),
-}));
-
-global.fetch = jest.fn(() => {
-    throw new Error("tests must not perform network requests");
-});
-
-const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-
-// A stub DOM: every id resolves to a recording element.
-const elements = new Map();
-
-function makeEl(id) {
-    const handlers = new Map();
-    return {
-        id,
-        textContent: "",
-        innerHTML: "",
-        value: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        classList: {
-            add() {},
-            remove() {},
-            toggle() {},
-            contains: () => false,
-        },
-        handlers,
-        addEventListener(name, fn) {
-            handlers.set(name, fn);
-        },
-        querySelectorAll: () => [],
-        querySelector: () => null,
-        remove() {},
-        focus() {},
-    };
-}
-
-global.document = {
-    getElementById(id) {
-        if (!elements.has(id)) elements.set(id, makeEl(id));
-        return elements.get(id);
-    },
-    createElement: (tag) => makeEl(tag),
-    body: { prepend() {}, appendChild() {} },
-    addEventListener() {},
-};
-global.navigator = { clipboard: { writeText() {} } };
-
-const { BaseWallet, Transaction, Wallet } = require("ethers");
-const { encryptWithPassword } = require("../src/shared/vault");
-const { state, loadState } = require("../src/shared/state");
-const { onChainSwitch } = require("../src/shared/chainSwitch");
-const { NETWORKS } = require("../src/shared/networks");
-const txStatus = require("../src/popup/views/txStatus");
-const confirmTx = require("../src/popup/views/confirmTx");
-
-const PRIVATE_KEY = "0x" + "11".repeat(32);
-const HOLDER = new Wallet(PRIVATE_KEY).address;
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const PASSWORD = "correct horse battery staple";
-
-function el(id) {
-    return global.document.getElementById(id);
-}
-
-let encryptedSecret;
-let signTransaction;
-
-beforeAll(async () => {
-    await loadState();
-    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
-});
-
-beforeEach(() => {
-    elements.clear();
-    mockNode.broadcast = [];
-    txStatus.showWait.mockClear();
-    txStatus.showError.mockClear();
-    signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
-});
-
-afterEach(() => {
-    signTransaction.mockRestore();
-});
-
-// Show the confirmation screen for 1 of the native token on `networkId`, as
-// Review on the Send screen does, with its fee estimate settled.
-async function review(networkId) {
-    await onChainSwitch(networkId);
-    state.wallets = [
-        {
-            type: "key",
-            name: "Wallet 1",
-            encryptedSecret,
-            addresses: [{ address: HOLDER, balance: "5.0" }],
-        },
-    ];
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    confirmTx.init({});
-    confirmTx.show({
-        from: HOLDER,
-        to: RECIPIENT,
-        ensName: null,
-        amount: "1",
-        token: "ETH",
-        balance: "5.0",
-        tokenSymbol: null,
-        tokenBalance: null,
-        tokenDecimals: null,
-        max: false,
-    });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-}
-
-async function signAndSend() {
-    el("confirm-tx-password").value = PASSWORD;
-    await el("btn-confirm-send").handlers.get("click")();
-}
-
-test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () => {
-    await review("sepolia");
-    expect(el("confirm-type").textContent).toBe("Native SepoliaETH transfer");
-    expect(el("btn-confirm-send").disabled).toBe(false);
-    await signAndSend();
-    expect(mockNode.broadcast).toHaveLength(1);
-    expect(mockNode.broadcast[0].chainId).toBe(11155111n);
-    expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
-        11155111n,
-    );
-    expect(txStatus.showWait).toHaveBeenCalledTimes(1);
-});
-
-describe.each([
-    ["sepolia", "mainnet", "SepoliaETH"],
-    ["mainnet", "sepolia", "ETH"],
-])(
-    "a transfer reviewed on %s, with %s chosen in Settings before Sign & Send",
-    (reviewedOn, switchedTo, symbol) => {
-        test("is neither signed nor sent, and the screen says why", async () => {
-            await review(reviewedOn);
-            expect(el("confirm-type").textContent).toBe(
-                "Native " + symbol + " transfer",
-            );
-            // Settings' network select, then Back, which only unhides the
-            // screen as it was drawn.
-            await onChainSwitch(switchedTo);
-            await signAndSend();
-
-            expect(signTransaction).not.toHaveBeenCalled();
-            expect(mockNode.broadcast).toEqual([]);
-            expect(txStatus.showWait).not.toHaveBeenCalled();
-            expect(txStatus.showError).not.toHaveBeenCalled();
-            expect(el("confirm-errors").style.visibility).toBe("visible");
-            expect(el("confirm-errors").innerHTML).toContain(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-        });
-    },
-);
-
-// The check in the click handler tells the user; the send itself carries the
-// chain id the screen was drawn for, so a signer on another network's node
-// cannot sign it even if the network changes after that check.
-test("the send is refused by a signer on another network's node", async () => {
-    const { getProvider } = require("../src/shared/balances");
-    const signer = new Wallet(PRIVATE_KEY).connect(
-        getProvider("https://rpc.example.invalid", "mainnet"),
-    );
-    await expect(
-        confirmTx.populateVerifyAndSend(signer, {
-            token: "ETH",
-            to: RECIPIENT,
-            amount: "1",
-            chainId: NETWORKS.sepolia.chainId,
-        }),
-    ).rejects.toThrow("transaction chainId mismatch");
-    expect(signTransaction).not.toHaveBeenCalled();
-    expect(mockNode.broadcast).toEqual([]);
-});

tests/e2e/firefox/driver.js

@@ -279,18 +279,12 @@ class Driver {
 
     // Shown means shown: in the popup a view is switched by toggling a
     // "hidden" class, and an element that is present but collapsed is not
-    // the thing a test means by visible. Until the page's stylesheet has
+    // the thing a test means by visible.
-    // applied that class hides nothing and every view lays out, so the page
-    // must also have finished loading, which it does only after its
-    // stylesheet, and neither the element nor anything enclosing it may
-    // carry the class (https://git.eeqj.de/sneak/AutistMask/issues/502).
     async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
         return this.waitFor(
             "selector " + selector + " to be visible",
             `const el = document.querySelector(arguments[0]);
-             if (document.readyState !== "complete" || !el) return false;
+             if (!el) return false;
-             if (el.closest(".hidden")) return false;
-             if (getComputedStyle(el).visibility !== "visible") return false;
              const r = el.getBoundingClientRect();
              return r.width > 0 && r.height > 0;`,
             [selector],

tests/e2e/firefox/run.js

@@ -128,18 +128,6 @@ step("the popup is drawn in the monospace font it declares", async (env) => {
     );
 });
 
-// The same check as the Chrome suite's (#456), so both browsers are held to
-// the same size.
-step("the popup's text is drawn at the 14px text-sm declares", async (env) => {
-    const size = await env.driver.execute(
-        "return getComputedStyle(document.body).fontSize;",
-    );
-    assert(
-        size === "14px",
-        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
-    );
-});
-
 // The recovery screen (#361): the Chrome suite's four cases, run before any
 // wallet exists for the same reason. With no wallet nothing saves on a timer,
 // so no save can write a good record over the unreadable one. The last of them

tests/e2e/harness.js

@@ -333,33 +333,8 @@ async function launch(routeOpts) {
 
 const PASSWORD = "e2e-harness-password";
 
-// Waits until the page shows `selector`, not only until it lays out. Until the
-// page's stylesheet has applied, the `hidden` class that showView() keeps on
-// every view but the current one hides nothing and every view lays out, so a
-// test could read a screen before the page's script had filled it
-// (https://git.eeqj.de/sneak/AutistMask/issues/502). So the page must also
-// have finished loading, which it does only after its stylesheet, and neither
-// the element nor anything enclosing it may carry `hidden`. Polled on a timer:
-// animation frames are not guaranteed to a window that is not in front.
 async function visible(page, selector, timeout = 15000) {
-    await page
+    await page.waitForSelector(selector, { state: "visible", timeout });
-        .waitForFunction(
-            (sel) => {
-                const el = document.querySelector(sel);
-                if (document.readyState !== "complete" || !el) return false;
-                if (el.closest(".hidden")) return false;
-                if (getComputedStyle(el).visibility !== "visible") return false;
-                const r = el.getBoundingClientRect();
-                return r.width > 0 && r.height > 0;
-            },
-            selector,
-            { polling: 50, timeout },
-        )
-        .catch((e) => {
-            throw new Error(
-                "the page did not show " + selector + ": " + e.message,
-            );
-        });
 }
 
 // An empty WebAssembly module: magic number and version header, no

tests/e2e/run.js

@@ -113,18 +113,6 @@ test("the popup is drawn in the monospace font it declares (#418)", async (env)
     );
 });
 
-// The same stylesheet sets the size on body to 75%, which would draw the
-// popup at 12px.
-test("the popup's text is drawn at the 14px text-sm declares (#456)", async (env) => {
-    const size = await env.page.evaluate(
-        () => getComputedStyle(document.body).fontSize,
-    );
-    assert(
-        size === "14px",
-        "the popup's text is drawn at " + size + ", not at the 14px of text-sm",
-    );
-});
-
 // The empirical half of #182. The manifest change is only a claim about
 // what the CSP permits; this is the observation. Two things have to hold
 // together, and the run covers both: the popup realm compiles WASM (here),
@@ -3857,9 +3845,6 @@ test("eth_requestAccounts approved returns the selected address (#183)", async (
             shown.toLowerCase().includes(env.expectedAddress.toLowerCase()),
             "the site prompt shows the wrong address: " + JSON.stringify(shown),
         );
-        // The text above is there even when the row is too narrow to show it
-        // all; this measures that the whole address is visible (#517).
-        await assertAddressesFit(popup, "the connection prompt");
 
         // Remembered, so the connection survives a background worker that MV3
         // terminates after 30 seconds idle. The in-memory connectedSites map
@@ -4553,42 +4538,6 @@ test("a site's network switch changes nothing until the user approves it (#408)"
     );
 });
 
-// Switching the network in Settings tells the page too, as an approved site
-// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). The wallet
-// goes back to mainnet the same way at the end.
-test("a network switch in Settings tells the page (#500)", async (env) => {
-    const { mainnet, sepolia } = NETWORKS;
-    const before = await storedNetwork(env.page);
-    assert(
-        before.networkId === "mainnet",
-        "this test starts on mainnet, not on " + before.networkId,
-    );
-    const eventsBefore = (await chainChangedEvents(env.dapp)).length;
-    await openSettings(env.page);
-
-    await env.page.selectOption("#settings-network", "sepolia");
-    let events = await chainChangedEvents(env.dapp, eventsBefore + 1);
-    assert(
-        events.length === eventsBefore + 1 &&
-            events[events.length - 1].data === sepolia.chainId,
-        "the page was not told of the switch to Sepolia: " +
-            JSON.stringify(events),
-    );
-
-    await env.page.selectOption("#settings-network", "mainnet");
-    events = await chainChangedEvents(env.dapp, eventsBefore + 2);
-    assert(
-        events.length === eventsBefore + 2 &&
-            events[events.length - 1].data === mainnet.chainId,
-        "the page was not told of the switch back to mainnet: " +
-            JSON.stringify(events),
-    );
-    assert(
-        isDeepStrictEqual(await storedNetwork(env.page), before),
-        "switching back did not restore the mainnet network and endpoints",
-    );
-});
-
 // The closing pass over both boundaries at once. Every message the section
 // put on either channel is re-read here and required to be free of the
 // password — and required to be there at all, method by method, so the

tests/ethSign.test.js

@@ -1,102 +0,0 @@
-// The sign screen signs an eth_sign request the way it signs personal_sign: as
-// an EIP-191 personal message over the bytes of the data
-// (https://git.eeqj.de/sneak/AutistMask/issues/409). Booted through the real
-// popup entry point as the approval window. The background's half, which reads
-// the address first and the data second and checks the signature, is tested in
-// tests/backgroundApproval.test.js.
-
-// Mocked so that no password has to be hashed: the stored secret decrypts to
-// the test key below.
-jest.mock("../src/shared/vault", () => ({
-    decryptWithPassword: jest.fn(),
-    encryptWithPassword: jest.fn(),
-}));
-
-const { Wallet, getBytes } = require("ethers");
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-// A published test key, never used for real funds.
-const SIGNER_KEY =
-    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
-const signer = new Wallet(SIGNER_KEY);
-// "Hello AutistMask", as the hex a page sends.
-const MESSAGE = "0x48656c6c6f204175746973744d61736b";
-const ORIGIN = "https://dapp.example";
-
-afterEach(cleanupPopup);
-
-test("the sign screen answers eth_sign with a personal message signature over the data", async () => {
-    const sent = [];
-    const page = await bootPopup(
-        unversionedValidProfile({
-            wallets: [
-                {
-                    type: "key",
-                    name: "Wallet 1",
-                    encryptedSecret: "encrypted-key",
-                    addresses: [
-                        {
-                            address: signer.address,
-                            balance: "0.0000",
-                            tokenBalances: [],
-                        },
-                    ],
-                },
-            ],
-            activeAddress: signer.address,
-            allowedSites: { [signer.address]: [ORIGIN] },
-        }),
-        {
-            search: "?approval=approval-1",
-            runtime: {
-                connect: () => ({ postMessage: () => {} }),
-                // Answered as the background answers: with the eth_sign
-                // approval this window was opened for, and by handing back
-                // the signature the popup sends.
-                sendMessage: (msg, reply) => {
-                    sent.push(msg);
-                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                        reply({
-                            type: "sign",
-                            origin: ORIGIN,
-                            isPhishingDomain: false,
-                            approvedFrom: signer.address,
-                            signParams: {
-                                method: "eth_sign",
-                                message: MESSAGE,
-                                from: signer.address,
-                            },
-                        });
-                    } else if (msg.type === "AUTISTMASK_SIGN_RESPONSE") {
-                        reply({ signature: msg.signature });
-                    } else {
-                        reply(undefined);
-                    }
-                },
-            },
-        },
-    );
-    globalThis.window.close = jest.fn();
-    const { decryptWithPassword } = require("../src/shared/vault");
-    decryptWithPassword.mockResolvedValue(SIGNER_KEY);
-
-    expect(page.visibleViews()).toEqual(["approve-sign"]);
-    page.node("approve-sign-password").value = "any password";
-    await page.click("btn-approve-sign");
-
-    expect(
-        sent.filter((msg) => msg.type === "AUTISTMASK_SIGN_RESPONSE"),
-    ).toEqual([
-        {
-            type: "AUTISTMASK_SIGN_RESPONSE",
-            id: "approval-1",
-            approved: true,
-            signature: await signer.signMessage(getBytes(MESSAGE)),
-        },
-    ]);
-    expect(globalThis.window.close).toHaveBeenCalled();
-});

tests/nativeCurrency.test.js

@@ -345,10 +345,10 @@ describe.each([
 });
 
 // A transaction's value and fee are in the native currency of the network the
-// transaction is on, which need not be the active one. The active network can
+// transaction is on, which need not be the active one. A site can switch the
-// change, in Settings or when the user approves a site's request, after a
+// active network after its transaction is prepared and back before it is
-// transaction is prepared and change back before it is signed, and a popup
+// signed, and a popup opened after a switch shows a sent or listed transaction
-// opened after a switch shows a sent or listed transaction again. The wallet's balances follow the active network; these do not.
+// again. The wallet's balances follow the active network; these do not.
 describe.each([
     ["mainnet", "sepolia", "ETH"],
     ["sepolia", "mainnet", "SepoliaETH"],

tests/phishingDomains.test.js

@@ -89,12 +89,6 @@ describe("vendored blocklist", () => {
         expect(isPhishingDomain(LISTED[0].toUpperCase())).toBe(true);
     });
 
-    test("a hostname ending in a dot is the same host", () => {
-        expect(isPhishingDomain(LISTED[1] + ".")).toBe(true);
-        expect(isPhishingDomain("wallet." + LISTED[1] + ".")).toBe(true);
-        expect(isPhishingDomain(CLEAN[0] + ".")).toBe(false);
-    });
-
     test("returns false for an empty or missing hostname", () => {
         expect(isPhishingDomain("")).toBe(false);
         expect(isPhishingDomain(null)).toBe(false);
@@ -139,13 +133,6 @@ describe("hostnameVariants", () => {
     test("lowercases hostnames", () => {
         expect(hostnameVariants("Evil.COM")).toEqual(["evil.com"]);
     });
-
-    test("drops the trailing dot of a fully qualified hostname", () => {
-        expect(hostnameVariants("sub.evil.com.")).toEqual([
-            "sub.evil.com",
-            "evil.com",
-        ]);
-    });
 });
 
 describe("domain hashing", () => {

tests/support/popupBoot.js

@@ -238,10 +238,6 @@ async function settle() {
  * @param {object} [options]
  * @param {object} [options.storage] a storage stub from makeStorageStub(), for
  *     a test that needs to make writes fail or to watch the round trips.
- * @param {string} [options.search] the page URL's query string, such as
- *     "?approval=" and an id for the popup opened as an approval window.
- * @param {object} [options.runtime] members of chrome.runtime that replace the
- *     stub's own, for a test that has to answer the background's messages.
  * @returns {Promise<object>} handles onto the booted page.
  */
 async function bootPopup(stored, options) {
@@ -285,13 +281,12 @@ async function bootPopup(stored, options) {
             sendMessage: jest.fn(async () => ({})),
             getURL: (p) => "chrome-extension://autistmask/" + p,
             onMessage: { addListener: () => {} },
-            ...(options && options.runtime),
         },
     };
     globalThis.document = document;
     globalThis.window = {
         location: {
-            search: (options && options.search) || "",
+            search: "",
             href: "chrome-extension://autistmask/src/popup/index.html",
             reload: () => reloads.push(Date.now()),
         },

tests/tokenTransferDetail.test.js

@@ -1,176 +0,0 @@
-// The decoded details on the transaction detail screen of a token transfer
-// (https://git.eeqj.de/sneak/AutistMask/issues/515).
-//
-// A history row for a token transfer holds the transfer's recipient as its
-// `to`, not the contract the transaction was sent to. The screen used to decode
-// the transaction's data against that `to`, so its Token line named the
-// recipient, and the amount read "decimals unknown" for a token the wallet
-// tracks. It decodes against the address the explorer reports the transaction
-// was sent to.
-//
-// The row is the one the real history parser makes from the explorer's answer,
-// opened through transactionDetail.show(), which is what a click on the row
-// calls. Driven against a minimal DOM stub in the shape
-// tests/contractCreation.test.js uses.
-
-const { Interface } = require("ethers");
-
-jest.mock("../src/shared/log", () => ({
-    log: {
-        debugf: () => {},
-        infof: () => {},
-        warnf: () => {},
-        errorf: () => {},
-    },
-    debugFetch: async (url) => ({
-        ok: true,
-        json: async () => mockExplorerAnswer(url),
-    }),
-    setRuntimeDebug: () => {},
-    isDebug: () => false,
-}));
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { state } = require("../src/shared/state");
-const { fetchRecentTransactions } = require("../src/shared/transactions");
-const transactionDetail = require("../src/popup/views/transactionDetail");
-
-const EXPLORER = "https://explorer.example/api/v2";
-const HOLDER = "0x0000000000000000000000000000000000000a11";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-// A token the wallet tracks and the bundled token list does not name.
-const TOKEN = "0x74de5d4FCbf63E00296fd95d33236B9794016631";
-const TX_HASH =
-    "0x85215772ed26ea8b39c2b3b18779030487efbe0b5fd7e882592b2f62b837be84";
-
-// HOLDER sends 1234.5 of the 6-decimal token to RECIPIENT.
-const TRANSFER_DATA = new Interface([
-    "function transfer(address to, uint256 amount)",
-]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
-
-// The explorer's answers: the transfer in HOLDER's token transfers, and the
-// transaction itself, sent to the token contract.
-function mockExplorerAnswer(url) {
-    if (
-        url ===
-        EXPLORER + "/addresses/" + HOLDER + "/token-transfers?type=ERC-20"
-    ) {
-        return {
-            items: [
-                {
-                    transaction_hash: TX_HASH,
-                    block_number: 100,
-                    timestamp: "2026-10-01T00:00:00Z",
-                    from: { hash: HOLDER },
-                    to: { hash: RECIPIENT },
-                    total: { value: "1234500000", decimals: "6" },
-                    token: {
-                        address_hash: TOKEN,
-                        symbol: "TDOL",
-                        holders_count: "5000",
-                    },
-                },
-            ],
-        };
-    }
-    if (url === EXPLORER + "/transactions/" + TX_HASH) {
-        return { to: { hash: TOKEN }, raw_input: TRANSFER_DATA };
-    }
-    return { items: [] };
-}
-
-function makeElement(id) {
-    const classes = new Set();
-    const el = {
-        id,
-        textContent: "",
-        value: "",
-        innerHTML: "",
-        style: {},
-        dataset: {},
-        classList: {
-            add: (...names) => names.forEach((n) => classes.add(n)),
-            remove: (...names) => names.forEach((n) => classes.delete(n)),
-            contains: (n) => classes.has(n),
-            toggle: () => false,
-        },
-        addEventListener: () => {},
-        querySelectorAll: () => [],
-        appendChild: () => {},
-    };
-    // Views reach for .parentElement to hide whole sections.
-    Object.defineProperty(el, "parentElement", {
-        get: () => node(id + "-parent"),
-    });
-    return el;
-}
-
-function makeDocument() {
-    const els = new Map();
-    return {
-        getElementById(id) {
-            // The debug banner is created on demand by helpers.js; absent
-            // is the state a non-debug, non-testnet popup is in.
-            if (id === "debug-banner") return null;
-            if (!els.has(id)) els.set(id, makeElement(id));
-            return els.get(id);
-        },
-        createElement: () => makeElement("created"),
-        body: { prepend: () => {} },
-    };
-}
-
-function node(id) {
-    return globalThis.document.getElementById(id);
-}
-
-// One line of the decoded details: its label and what is drawn under it.
-function decodedLine(label) {
-    return node("tx-detail-calldata-details")
-        .innerHTML.split('<div class="mb-2">')
-        .find((line) =>
-            line.startsWith(`<div class="text-muted">${label}</div>`),
-        );
-}
-
-beforeEach(() => {
-    globalThis.document = makeDocument();
-    globalThis.window = { location: { search: "" } };
-    state.blockscoutUrl = EXPLORER;
-    state.wallets = [
-        {
-            name: "Main",
-            type: "key",
-            addresses: [{ address: HOLDER, balance: "0.0000" }],
-        },
-    ];
-    state.trackedTokens = [{ address: TOKEN, symbol: "TDOL", decimals: 6 }];
-    state.viewData = {};
-    state.viewStack = [];
-    state.currentView = null;
-});
-
-test("a token transfer's decoded details name the token contract and the amount at its scale", async () => {
-    const [row] = await fetchRecentTransactions(HOLDER, EXPLORER, 1);
-    expect(row.to).toBe(RECIPIENT);
-    expect(row.contractAddress).toBe(TOKEN.toLowerCase());
-
-    transactionDetail.show(row);
-    // The decoded details are drawn once the explorer has answered.
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-
-    expect(node("tx-detail-calldata-action").textContent).toBe(
-        "Token Transfer",
-    );
-    const token = decodedLine("Token");
-    expect(token).toContain('<div class="font-bold">TDOL</div>');
-    expect(token).toContain(TOKEN);
-    expect(token).not.toContain(RECIPIENT);
-    expect(decodedLine("Recipient")).toContain(RECIPIENT);
-    expect(decodedLine("Amount")).toContain(
-        '<div class="font-bold">1234.5000 TDOL</div>',
-    );
-});

tests/typedDataPermit.test.js

@@ -233,26 +233,6 @@ function warningOf(data) {
     return html.slice(0, html.indexOf(">Domain<"));
 }
 
-const NOT_SIGNED = ">Not part of the signature<";
-
-// The Message section alone, without the keys listed after it as not part of
-// the signature.
-function messageOf(data) {
-    const html = formatTypedDataHtml(JSON.stringify(data));
-    const end = html.indexOf(NOT_SIGNED);
-    return html.slice(
-        html.indexOf(">Message<"),
-        end === -1 ? html.length : end,
-    );
-}
-
-// The keys listed as not part of the signature, or "" when there are none.
-function notSignedOf(data) {
-    const html = formatTypedDataHtml(JSON.stringify(data));
-    const start = html.indexOf(NOT_SIGNED);
-    return start === -1 ? "" : html.slice(start);
-}
-
 function request(data) {
     return { method: "eth_signTypedData_v4", typedData: JSON.stringify(data) };
 }
@@ -260,7 +240,6 @@ function request(data) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
-    state.networkId = "mainnet";
 });
 
 describe("a token permission is warned about, naming spender and amount", () => {
@@ -332,8 +311,7 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 
     // A Permit whose type names its spender `operator`; the page adds a
-    // `spender` key the type does not declare. The Message section names
+    // `spender` key the type does not declare.
-    // only the operator, and the added key is listed apart as not signed.
     test("an added key is not named as the spender", () => {
         const data = {
             ...PERMIT,
@@ -352,10 +330,6 @@ describe("the warning reads only the fields the signed type declares", () => {
         const warning = warningOf(data);
         expect(warning).toContain(WARNING);
         expect(warning).not.toContain(DECOY);
-        expect(messageOf(data)).toContain(SPENDER);
-        expect(messageOf(data)).not.toContain(DECOY);
-        expect(notSignedOf(data)).toContain("spender:");
-        expect(notSignedOf(data)).toContain(DECOY);
     });
 
     // The permit for a Uniswap v3 position NFT: a `Permit` with no amount
@@ -396,47 +370,6 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 });
 
-// ethers signs only the declared fields at every level of nesting, so an
-// added key inside a struct is not signed either. Such typed data is not
-// refused; the added key is listed apart, with where it sits in the message.
-describe("the Message section shows only the fields that are signed", () => {
-    const NOTE = "This signature only signs you in";
-
-    test("an added key inside a nested struct is listed as not signed", () => {
-        const data = {
-            ...PERMIT_SINGLE,
-            message: {
-                ...PERMIT_SINGLE.message,
-                details: { ...PERMIT_SINGLE.message.details, note: NOTE },
-            },
-        };
-        expect(messageOf(data)).toContain("expiration");
-        expect(messageOf(data)).not.toContain(NOTE);
-        expect(notSignedOf(data)).toContain("details.note:");
-        expect(notSignedOf(data)).toContain(NOTE);
-        expect(typedDataRefusal(request(data))).toBeNull();
-    });
-
-    test("an added key inside a list item is listed with its index", () => {
-        const [first, second] = PERMIT_BATCH.message.details;
-        const data = {
-            ...PERMIT_BATCH,
-            message: {
-                ...PERMIT_BATCH.message,
-                details: [first, { ...second, note: NOTE }],
-            },
-        };
-        expect(messageOf(data)).not.toContain(NOTE);
-        expect(notSignedOf(data)).toContain("details[1].note:");
-        expect(notSignedOf(data)).toContain(NOTE);
-    });
-
-    test("nothing is listed apart when every key is declared", () => {
-        expect(notSignedOf(PERMIT_SINGLE)).toBe("");
-        expect(notSignedOf(LOGIN)).toBe("");
-    });
-});
-
 describe("the primary type shown is the one ethers signs", () => {
     // A drain stated as a sign-in: the page says Login, the types say
     // PermitSingle, and ethers would sign PermitSingle.
@@ -599,66 +532,3 @@ describe("the sign screen refuses a mismatched primary type", () => {
         expect(node("btn-approve-sign").disabled).toBe(true);
     });
 });
-
-// EIP-712: a wallet refuses typed data whose domain names a chain other than
-// the active one, because the signature is valid on the chain it names
-// (https://git.eeqj.de/sneak/AutistMask/issues/519). The wallet is on Sepolia
-// and the site asks for a mainnet USDC Permit.
-describe("the sign screen refuses typed data for another chain", () => {
-    const REFUSAL =
-        "This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
-
-    function withChainId(chainId) {
-        return { ...PERMIT, domain: { ...PERMIT.domain, chainId } };
-    }
-
-    beforeEach(() => {
-        decryptWithPassword.mockClear();
-        state.networkId = "sepolia";
-    });
-
-    test("another chain shows the error, with Sign disabled", async () => {
-        await openSignScreen(PERMIT);
-        expect(node("approve-sign-error").textContent).toBe(REFUSAL);
-        expect(node("btn-approve-sign").disabled).toBe(true);
-    });
-
-    test("Sign clicked anyway decrypts and signs nothing", async () => {
-        const sent = await openSignScreen(PERMIT);
-        node("approve-sign-password").value = "any password";
-        await click("btn-approve-sign");
-
-        expect(decryptWithPassword).not.toHaveBeenCalled();
-        expect(sent.map((msg) => msg.type)).not.toContain(
-            "AUTISTMASK_SIGN_RESPONSE",
-        );
-        expect(node("approve-sign-error").textContent).toBe(REFUSAL);
-    });
-
-    // ethers signs 1, "1" and "0x1" as the same chain id.
-    test("the chain id is refused in each form ethers signs", () => {
-        for (const chainId of [1, "1", "0x1"]) {
-            expect(typedDataRefusal(request(withChainId(chainId)))).toBe(
-                REFUSAL,
-            );
-        }
-    });
-
-    test("a chain id that is not a number is refused", () => {
-        expect(typedDataRefusal(request(withChainId("mainnet")))).toBe(
-            "This typed data cannot be read, so it cannot be signed.",
-        );
-    });
-
-    test("the active chain leaves Sign enabled", async () => {
-        await openSignScreen(withChainId("0xaa36a7"));
-        expect(node("approve-sign-error").textContent).toBe("");
-        expect(node("btn-approve-sign").disabled).toBe(false);
-    });
-
-    test("no chain id leaves Sign enabled", async () => {
-        await openSignScreen(withChainId(undefined));
-        expect(node("approve-sign-error").textContent).toBe("");
-        expect(node("btn-approve-sign").disabled).toBe(false);
-    });
-});

tests/uniswap.test.js

@@ -163,122 +163,6 @@ function encodeV4ExactInSingle(currency0, currency1, amountIn, amountOutMin) {
     );
 }
 
-// Each V4 swap action's parameters in two shapes: the struct V4Router has
-// deployed on mainnet and Sepolia, and the one v4-periphery `main` has since
-// moved to, which adds a `minHopPriceX36` field. Each swaps WETH for USDC.
-const POOL_KEY = "tuple(address,address,uint24,int24,address)";
-const PATH_KEY = "tuple(address,uint24,int24,address,bytes)";
-const WETH_USDC_POOL = [WETH_ADDR, USDC_ADDR, 100, 1, ZERO_ADDR];
-const ONE_WETH = 1000000000000000000n;
-const V4_SWAP_ACTION_SHAPES = [
-    {
-        action: "SWAP_EXACT_IN_SINGLE",
-        id: 0x06,
-        deployed: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
-            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, "0x"]],
-        ),
-        newer: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
-            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, 0n, "0x"]],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_IN",
-        id: 0x07,
-        deployed: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
-            [
-                [
-                    WETH_ADDR,
-                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    ONE_WETH,
-                    990000n,
-                ],
-            ],
-        ),
-        newer: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
-            [
-                [
-                    WETH_ADDR,
-                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    [],
-                    ONE_WETH,
-                    990000n,
-                ],
-            ],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_OUT_SINGLE",
-        id: 0x08,
-        deployed: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
-            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, "0x"]],
-        ),
-        newer: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
-            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, 0n, "0x"]],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_OUT",
-        id: 0x09,
-        deployed: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
-            [
-                [
-                    USDC_ADDR,
-                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    990000n,
-                    ONE_WETH,
-                ],
-            ],
-        ),
-        newer: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
-            [
-                [
-                    USDC_ADDR,
-                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    [],
-                    990000n,
-                    ONE_WETH,
-                ],
-            ],
-        ),
-    },
-];
-
-// Helper: execute() with one V4_SWAP step holding the swap action, then
-// SETTLE of WETH and TAKE of USDC.
-function v4SwapCalldata(actionId, swapParams) {
-    return buildExecute(
-        "0x10",
-        [
-            encodeV4Swap(new Uint8Array([actionId, V4_SETTLE_ID, V4_TAKE_ID]), [
-                swapParams,
-                encodeV4Settle(WETH_ADDR),
-                encodeV4Take(USDC_ADDR),
-            ]),
-        ],
-        9999999999n,
-    );
-}
-
-// V4 SETTLE_ALL (currency, maxAmount) and TAKE_ALL (currency, minAmount). The
-// decoder reads neither, so in a V4_SWAP of a swap action and these, only the
-// swap action names the currencies.
-const V4_SETTLE_ALL_ID = 0x0c;
-const V4_TAKE_ALL_ID = 0x0f;
-function encodeV4SettleAll(currency, maxAmount) {
-    return coder.encode(["address", "uint256"], [currency, maxAmount]);
-}
-function encodeV4TakeAll(currency, minAmount) {
-    return coder.encode(["address", "uint256"], [currency, minAmount]);
-}
-
 function detail(result, label) {
     return result.details.find((d) => d.label === label);
 }
@@ -319,157 +203,9 @@ describe("uniswap decoder", () => {
             result.details.find((d) => d.label === "Min. received").value,
         ).toBe("0.0002 ETH");
 
-        // Real mainnet calldata is in the deployed shape, so its V4 step is
-        // not said to be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
-        expect(steps.value).toBe("Permit2 Permit → V4 Swap");
+        expect(steps.value).toContain("Permit2 Permit");
-    });
+        expect(steps.value).toContain("V4 Swap");
-
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the deployed shape is read",
-        ({ id, deployed }) => {
-            const result = uniswap.decode(
-                v4SwapCalldata(id, deployed),
-                ROUTER_ADDR,
-            );
-            expect(detail(result, "Steps").value).toBe("V4 Swap");
-        },
-    );
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/358 — before it, all four
-    // newer structs decoded as the deployed ones without an error, and the
-    // newer SWAP_EXACT_IN showed the offset of its hop-price array as Amount
-    // ("0.0000000000000004 WETH") and its amountIn as Min. received.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the newer periphery shape is shown as not decoded",
-        ({ id, newer }) => {
-            const result = uniswap.decode(
-                v4SwapCalldata(id, newer),
-                ROUTER_ADDR,
-            );
-            expect(detail(result, "Amount")).toBeUndefined();
-            expect(detail(result, "Min. received")).toBeUndefined();
-            expect(detail(result, "Steps").value).toBe(
-                "V4 Swap (could not be decoded)",
-            );
-            // SETTLE and TAKE keep their own shape and still name both sides.
-            expect(detail(result, "Token In").address).toBe(WETH_ADDR);
-            expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
-        },
-    );
-
-    // Only the unread swap action names the currencies here. The token lines
-    // must not say the calldata did not name them.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the newer shape, then SETTLE_ALL and TAKE_ALL, says both tokens could not be decoded",
-        ({ id, newer }) => {
-            const data = buildExecute(
-                "0x10",
-                [
-                    encodeV4Swap(
-                        new Uint8Array([id, V4_SETTLE_ALL_ID, V4_TAKE_ALL_ID]),
-                        [
-                            newer,
-                            encodeV4SettleAll(WETH_ADDR, ONE_WETH),
-                            encodeV4TakeAll(USDC_ADDR, 990000n),
-                        ],
-                    ),
-                ],
-                9999999999n,
-            );
-            const result = uniswap.decode(data, ROUTER_ADDR);
-            expect(detail(result, "Steps").value).toBe(
-                "V4 Swap (could not be decoded)",
-            );
-            expect(detail(result, "Token In").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-            expect(detail(result, "Token Out").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-        },
-    );
-
-    // The user receives the V4 step's USDC, which only its unread swap
-    // action names. The V3 step's WETH and its Min. received figure were
-    // shown instead.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V3 step, then a V4 $action in the newer shape and TAKE_ALL, does not show the V3 step's output",
-        ({ id, newer }) => {
-            const data = buildExecute(
-                solidityPacked(["uint8", "uint8"], [0x00, 0x10]),
-                [
-                    encodeV3SwapExactIn(USER_ADDR, 2000000n, ONE_WETH, [
-                        USDT_ADDR,
-                        WETH_ADDR,
-                    ]),
-                    encodeV4Swap(new Uint8Array([id, V4_TAKE_ALL_ID]), [
-                        newer,
-                        encodeV4TakeAll(USDC_ADDR, 990000n),
-                    ]),
-                ],
-                9999999999n,
-            );
-            const result = uniswap.decode(data, ROUTER_ADDR);
-            expect(result.name).toBe("Uniswap Swap");
-            expect(detail(result, "Amount").value).toBe("2.0000 USDT");
-            expect(detail(result, "Token Out").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-            expect(detail(result, "Min. received")).toBeUndefined();
-        },
-    );
-
-    // The user pays the V4 step's WETH, which only its unread swap action
-    // names. The V3 step's USDC and its amount were shown instead.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the newer shape and SETTLE_ALL, then a V3 step, does not show the V3 step's input",
-        ({ id, newer }) => {
-            const data = buildExecute(
-                solidityPacked(["uint8", "uint8"], [0x10, 0x00]),
-                [
-                    encodeV4Swap(new Uint8Array([id, V4_SETTLE_ALL_ID]), [
-                        newer,
-                        encodeV4SettleAll(WETH_ADDR, ONE_WETH),
-                    ]),
-                    encodeV3SwapExactIn(
-                        USER_ADDR,
-                        990000n,
-                        980000000000000000n,
-                        [USDC_ADDR, DAI_ADDR],
-                    ),
-                ],
-                9999999999n,
-            );
-            const result = uniswap.decode(data, ROUTER_ADDR);
-            expect(result.name).toBe("Uniswap Swap");
-            expect(detail(result, "Token In").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-            expect(detail(result, "Amount")).toBeUndefined();
-            expect(detail(result, "Min. received").value).toBe("0.9800 DAI");
-        },
-    );
-
-    // UNWRAP_WETH makes Token Out ETH when no step set the output side. An
-    // unread swap action's step did set it, to undetermined.
-    test("an UNWRAP_WETH after an unread V4 swap action does not make Token Out ETH", () => {
-        const { id, newer } = V4_SWAP_ACTION_SHAPES[0];
-        const data = buildExecute(
-            solidityPacked(["uint8", "uint8"], [0x10, 0x0c]),
-            [
-                encodeV4Swap(new Uint8Array([id, V4_TAKE_ALL_ID]), [
-                    newer,
-                    encodeV4TakeAll(USDC_ADDR, 990000n),
-                ]),
-                encodeWrapEth(USER_ADDR, 0n), // UNWRAP_WETH, same encoding
-            ],
-            9999999999n,
-        );
-        const result = uniswap.decode(data, ROUTER_ADDR);
-        expect(detail(result, "Token Out").value).toBe(
-            "Unknown (could not be decoded)",
-        );
     });
 
     test("decodes V2_SWAP_EXACT_IN with known tokens", () => {
@@ -812,11 +548,9 @@ describe("uniswap decoder", () => {
         const result = uniswap.decode(data, ROUTER_ADDR);
         expect(result).not.toBeNull();
 
-        // The V4 swap action's parameters are empty, so that step is said to
-        // be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
         expect(steps.value).toBe(
-            "Permit2 Permit \u2192 V4 Swap (could not be decoded) \u2192 Unwrap WETH",
+            "Permit2 Permit \u2192 V4 Swap \u2192 Unwrap WETH",
         );
     });
 

tests/uniswapUndeterminedTokenIn.test.js

@@ -97,11 +97,7 @@ describe("an execute() whose input currency never decoded", () => {
         ]);
 
     test("says the input token is unknown instead of naming ETH", () => {
-        // The swap action that would name it could not be read, so the line
+        expect(detail(data(), "Token In").value).toBe(REFUSAL);
-        // says that rather than REFUSAL's "not named in the calldata".
-        expect(detail(data(), "Token In").value).toBe(
-            "Unknown (could not be decoded)",
-        );
     });
 
     test("keeps a Token In line, so the screen never omits what is paid", () => {

tests/wallet.test.js

@@ -416,7 +416,7 @@ describe("extended key depth", () => {
         expect(() =>
             wallet.getSignerForAddress(
                 { type: "xprv" },
-                { address: VECTOR_ADDRESSES[0], index: 0 },
+                0,
                 accountXprv(VECTOR_PHRASE),
             ),
         ).toThrow(/master/i);
@@ -504,7 +504,7 @@ describe("getSignerForAddress", () => {
     test.each([0, 1, 2])("hd wallet, address index %i", (index) => {
         const signer = wallet.getSignerForAddress(
             { type: "hd" },
-            { address: VECTOR_ADDRESSES[index], index },
+            index,
             VECTOR_PHRASE,
         );
 
@@ -515,7 +515,7 @@ describe("getSignerForAddress", () => {
     test.each([0, 1, 2])("xprv wallet, address index %i", (index) => {
         const signer = wallet.getSignerForAddress(
             { type: "xprv" },
-            { address: VECTOR_ADDRESSES[index], index },
+            index,
             masterXprv(VECTOR_PHRASE),
         );
 
@@ -527,7 +527,7 @@ describe("getSignerForAddress", () => {
         for (const index of [0, 1, 2]) {
             const signer = wallet.getSignerForAddress(
                 { type: "privkey" },
-                { address: VECTOR_ADDRESSES[1], index },
+                index,
                 VECTOR_PRIVATE_KEYS[1],
             );
 
@@ -535,54 +535,10 @@ describe("getSignerForAddress", () => {
         }
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/510: an address whose stored
-    // index does not derive it, or a private key that is not its key.
-    test.each([
-        ["hd", { address: VECTOR_ADDRESSES[2], index: 1 }, VECTOR_PHRASE],
-        [
-            "xprv",
-            { address: VECTOR_ADDRESSES[2], index: 1 },
-            masterXprv(VECTOR_PHRASE),
-        ],
-        ["privkey", { address: VECTOR_ADDRESSES[2] }, VECTOR_PRIVATE_KEYS[1]],
-    ])(
-        "%s wallet refuses a key that is not the address's own",
-        (type, addr, secret) => {
-            expect(() =>
-                wallet.getSignerForAddress({ type }, addr, secret),
-            ).toThrow(
-                "The key this wallet holds for " +
-                    VECTOR_ADDRESSES[2] +
-                    " belongs to a different address, so it was not used.",
-            );
-        },
-    );
-
-    // An HD or xprv address record without a usable `index` is refused in a
-    // sentence, not with what ethers says about the value it was handed.
-    test.each([
-        ["hd", VECTOR_PHRASE],
-        ["xprv", masterXprv(VECTOR_PHRASE)],
-    ])("%s wallet refuses an address with no valid index", (type, secret) => {
-        for (const index of [undefined, null, -1, 1.5, "1"]) {
-            expect(() =>
-                wallet.getSignerForAddress(
-                    { type },
-                    { address: VECTOR_ADDRESSES[1], index },
-                    secret,
-                ),
-            ).toThrow(
-                "No derivation index is stored for " +
-                    VECTOR_ADDRESSES[1] +
-                    ", so its key cannot be derived.",
-            );
-        }
-    });
-
     test("the returned signer signs recoverably as the expected address", async () => {
         const signer = wallet.getSignerForAddress(
             { type: "hd" },
-            { address: VECTOR_ADDRESSES[1], index: 1 },
+            1,
             VECTOR_PHRASE,
         );
         const message = "AutistMask derivation test";

tests/walletDefects.test.js

@@ -55,7 +55,7 @@ function healthyXprvWallet(name = "Master") {
         xpub,
         nextIndex: 1,
         encryptedSecret: "irrelevant-to-these-tests",
-        addresses: [{ address: firstAddress, index: 0, balance: "0.0000" }],
+        addresses: [{ address: firstAddress, balance: "0.0000" }],
     };
 }
 
@@ -74,11 +74,7 @@ function brokenXprvWallet(name = "Imported xprv") {
         nextIndex: 1,
         encryptedSecret: "irrelevant-to-these-tests",
         addresses: [
-            {
+            { address: node.deriveChild(0).address, balance: "0.0000" },
-                address: node.deriveChild(0).address,
-                index: 0,
-                balance: "0.0000",
-            },
         ],
     };
 }
@@ -157,18 +153,6 @@ describe("the explanatory copy", () => {
         expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
     });
 
-    // The wallet holds the imported key but will not export it, so the copy
-    // must name every key the user may hold that reaches the addresses
-    // outside it.
-    test("it names the keys that reach the addresses outside this wallet", () => {
-        const body = defect.paragraphs.join(" ");
-
-        expect(body).toMatch(/private key export are disabled/);
-        expect(body).toMatch(
-            /with the extended private key you imported, if you kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation/,
-        );
-    });
-
     test("it says the wallet is not deleted and what the user can do", () => {
         const body = defect.paragraphs.join(" ");
 
@@ -574,7 +558,7 @@ describe("no path throws an unhandled error for a defective wallet", () => {
         try {
             wallet.getSignerForAddress(
                 { type: "xprv" },
-                brokenXprvWallet().addresses[0],
+                0,
                 accountXprv(VECTOR_PHRASE),
             );
         } catch (e) {
@@ -589,7 +573,7 @@ describe("no path throws an unhandled error for a defective wallet", () => {
     test("a healthy xprv wallet signs as it always did", () => {
         const signer = wallet.getSignerForAddress(
             { type: "xprv" },
-            healthyXprvWallet().addresses[0],
+            0,
             masterXprv(VECTOR_PHRASE),
         );