fix: the first wallet's first address is active as soon as it is added (closes #512)

The popup picked an active address only when it opened, so after the first
wallet was created nothing was active until a reopen: Home had no headline,
and Send and Receive refused. Each of the three import paths on AddWallet now
makes the new wallet's first address active when no address is. The
background already answered sites with that address through its own
fallback, so nothing is broadcast. The address scan stand-in in the popup
test boot now answers in the real scan's shape, which the phrase and xprv
imports read.

Model: opus-5-5

README.md

@@ -1110,16 +1110,14 @@ read:
 
 The swap's `Token In` and `Token Out` lines name a currency, not an amount; each
 reads `Unknown (not named in the calldata)` when the decoder found no token for
-that side, or `Unknown (could not be decoded)` instead when a V4 swap action in
-the transaction could not be read (see Transaction Decoding below). An
-`UNWRAP_WETH` step makes `Token Out` ETH only when the output side is WETH, on
-mainnet or Sepolia, or when no step set the output side; a WETH `Min. received`
-figure then reads in ETH. Otherwise `Token Out` and `Min. received` keep the
-output side's own token and figure, whether the swap was paid in ETH or in a
-token: a V2 exact-out swap that buys USDC and then unwraps the WETH it did not
-spend shows USDC. The token permission warning on the signature screen has its
-own amount wording, including `Unknown`; the SignApproval section below
-describes it.
+that side. An `UNWRAP_WETH` step makes `Token Out` ETH only when the output side
+is WETH, on mainnet or Sepolia, or when no step set the output side; a WETH
+`Min. received` figure then reads in ETH. Otherwise `Token Out` and
+`Min. received` keep the output side's own token and figure, whether the swap
+was paid in ETH or in a token: a V2 exact-out swap that buys USDC and then
+unwraps the WETH it did not spend shows USDC. The token permission warning on
+the signature screen has its own amount wording, including `Unknown`; the
+SignApproval section below describes it.
 
 The swap's `Deadline` line is the router's deadline as a UTC date and time, e.g.
 `2026-02-27 08:25:51`. A JavaScript date reaches only to 275760-09-13 00:00:00
@@ -1466,8 +1464,10 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
     - "Import" with a valid entry and a matching password of at least 12
       characters → creates the wallet, clears the navigation stack, and →
-      **Home**. The phrase and xprv modes then scan for further used addresses
-      and report the count as a flash message.
+      **Home**. When no address is active yet, as on the first wallet, the new
+      wallet's first address becomes the active one. The phrase and xprv modes
+      then scan for further used addresses and report the count as a flash
+      message.
     - "Import" with a missing, short or mismatched password → full-sentence
       error on the error line, no screen change
     - "Import" with an invalid entry or a duplicate wallet or address → flash
@@ -1647,6 +1647,12 @@ view would leave a wallet one click from deletion.
       the contract's own answer is read at signing time only to be compared with
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
+    - "Sign & Send" after the active network was switched in Settings while this
+      screen was open → nothing is signed; "The active network changed after
+      this transaction was reviewed, so it was not sent. Please go back and
+      review it again." in the errors box, no screen change. The transaction
+      carries the chain id of the network the screen was shown for, so it cannot
+      be signed for another
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Back" → **Send**
@@ -2077,7 +2083,9 @@ view would leave a wallet one click from deletion.
   artifact can be compared with it field for field. A nonce the site supplies is
   ignored: the nonce is always the account's next nonce from the node, so a site
   cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A request that cannot be populated — unreachable node, reverting
+  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is used
+  in place of the node's estimate; a request giving both with different values
+  is refused. A request that cannot be populated — unreachable node, reverting
   gas estimate — opens no window and is failed back to the site. Only one
   transaction approval exists at a time: populating fixes the nonce, so a second
   `eth_sendTransaction` arriving while one is unanswered is refused with
@@ -2130,7 +2138,12 @@ view would leave a wallet one click from deletion.
       blocklist)
     - Site origin (bold, scheme and port included) + "wants you to sign a
       message"
-    - Danger warning box (shown for `eth_sign`, which signs a raw hash)
+    - Warning box, shown for `eth_sign`: "This site used the older eth_sign
+      method. The data will be signed as a personal message." An `eth_sign`
+      request names the address first and the data second. Its data is signed
+      exactly as a `personal_sign` message is, as an EIP-191 personal message,
+      which is what the Ethereum JSON-RPC specification defines `eth_sign` to
+      return.
     - Type: "Personal message" or "Typed data (EIP-712)"
     - From: color dot + full address + etherscan link
     - Message: for `personal_sign` and `eth_sign`, the text the message's bytes
@@ -2145,7 +2158,12 @@ view would leave a wallet one click from deletion.
       Bytes that are not UTF-8 are shown as "This message is not text." For
       typed data, formatted domain/type/message fields (EIP-712). The primary
       type shown is the one ethers signs, derived from the typed data's `types`,
-      not the type the site states.
+      not the type the site states. The message shows only the fields that type
+      declares, at every level of nesting and in the type's order: ethers signs
+      those and drops any other key. Typed data carrying other keys is not
+      refused; each such key is listed after the message under "Not part of the
+      signature", by its place in the message (`details.note`,
+      `details[1].note`) and its value.
     - Token permission warning, at the top of the message (typed data whose
       primary type is `Permit`, as in EIP-2612, or one of Permit2's signature
       types): "⚠️ TOKEN PERMISSION: Signing this lets the spender below take the
@@ -2692,11 +2710,7 @@ Currently supported:
   or recipient, and amount.
 - **Uniswap Universal Router**: `execute()` calls — shows swap direction (e.g.
   "Swap USDT → ETH"), token addresses, amounts, execution steps, and deadline.
-  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks. A V4 swap
-  action is read only in the parameter shape deployed on mainnet and Sepolia,
-  not in the newer one on `v4-periphery` `main`, which adds a `minHopPriceX36`
-  field. An action in any other shape is not read, and its step is listed as
-  `V4 Swap (could not be decoded)`.
+  Decodes Permit2, V2/V3/V4 swaps, wrap/unwrap, and balance checks.
 
 ### Non-Goals Forever
 

src/background/index.js

@@ -988,9 +988,8 @@ async function handleRpc(method, params, origin) {
 
         if (method === "eth_sign") {
             signParams.dangerWarning =
-                "\u26a0\ufe0f DANGER: This site is requesting to sign a raw hash. " +
-                "This can be used to sign transactions that drain your funds. " +
-                "Only proceed if you fully understand what you are signing.";
+                "This site used the older eth_sign method. " +
+                "The data will be signed as a personal message.";
         }
 
         if (findPendingApproval(origin, "sign")) {

src/popup/index.html

@@ -1716,10 +1716,7 @@
                     <div class="text-xs text-muted mb-1">
                         Address that will be shared:
                     </div>
-                    <div
-                        id="approve-address"
-                        class="text-xs flex items-center mb-2"
-                    ></div>
+                    <div id="approve-address" class="text-xs mb-2"></div>
                 </div>
                 <div class="mb-3">
                     <label

src/popup/views/addWallet.js

@@ -189,6 +189,9 @@ async function importMnemonic(ctx) {
     };
     state.wallets.push(wallet);
     state.hasWallet = true;
+    if (state.activeAddress === null) {
+        state.activeAddress = firstAddress;
+    }
     await saveState();
     clearViewStack();
     ctx.renderWalletList();
@@ -248,6 +251,9 @@ async function importPrivateKey(ctx) {
         addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
     });
     state.hasWallet = true;
+    if (state.activeAddress === null) {
+        state.activeAddress = addr;
+    }
     await saveState();
     clearViewStack();
     ctx.renderWalletList();
@@ -304,6 +310,9 @@ async function importXprvKey(ctx) {
     };
     state.wallets.push(wallet);
     state.hasWallet = true;
+    if (state.activeAddress === null) {
+        state.activeAddress = firstAddress;
+    }
     await saveState();
     clearViewStack();
     ctx.renderWalletList();

src/popup/views/approval.js

@@ -626,10 +626,38 @@ function permitWarningHtml(types, primaryType, domain, message) {
     return html;
 }
 
+// What ethers signs of a message value of type `type`: a struct keeps only
+// the fields its type declares, in the type's order, and a list is read item
+// by item. ethers drops every other key, so each one is added to `notSigned`
+// with its place in the message and its value, for the screen to list apart.
+function signedValue(types, type, value, path, notSigned) {
+    const itemType = type.replace(/\[\d*\]$/, "");
+    if (itemType !== type) {
+        if (!Array.isArray(value)) return value;
+        return value.map((item, i) =>
+            signedValue(types, itemType, item, `${path}[${i}]`, notSigned),
+        );
+    }
+    const fields = types[type];
+    if (!fields || !value || typeof value !== "object") return value;
+    const at = (name) => (path ? `${path}.${name}` : name);
+    for (const [key, val] of Object.entries(value)) {
+        if (!fields.some((f) => f.name === key)) notSigned.push([at(key), val]);
+    }
+    return Object.fromEntries(
+        fields.map((f) => [
+            f.name,
+            signedValue(types, f.type, value[f.name], at(f.name), notSigned),
+        ]),
+    );
+}
+
 // The typed data as the screen shows it. The primary type shown is the one
 // ethers signs, never the page's word for it; typedDataRefusal() keeps the two
-// from differing on anything that can be signed. Only typed data that cannot
-// be read at all is shown as raw text, and typedDataRefusal() refuses it.
+// from differing on anything that can be signed. The Message section shows
+// only what is signed, and any other key the page sent is listed after it as
+// not part of the signature. Only typed data that cannot be read at all is
+// shown as raw text, and typedDataRefusal() refuses it.
 function formatTypedDataHtml(jsonStr) {
     let data;
     let primaryType;
@@ -663,12 +691,30 @@ function formatTypedDataHtml(jsonStr) {
     html += `<div class="mb-2"><div class="text-muted">Primary type</div>`;
     html += `<div class="font-bold">${escapeHtml(primaryType)}</div></div>`;
 
+    const lineHtml = (key, val) =>
+        `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+
     if (data.message) {
+        const notSigned = [];
+        const message = signedValue(
+            data.types,
+            primaryType,
+            data.message,
+            "",
+            notSigned,
+        );
         html += `<div class="mb-2"><div class="text-muted">Message</div>`;
-        for (const [key, val] of Object.entries(data.message)) {
-            html += `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+        for (const [key, val] of Object.entries(message)) {
+            html += lineHtml(key, val);
         }
         html += `</div>`;
+        if (notSigned.length > 0) {
+            html += `<div class="mb-2"><div class="text-muted">Not part of the signature</div>`;
+            for (const [key, val] of notSigned) {
+                html += lineHtml(key, val);
+            }
+            html += `</div>`;
+        }
     }
 
     return html;
@@ -725,7 +771,7 @@ function showSignApproval(details) {
             "This message is plain text, not hex, so it cannot be signed.";
     }
 
-    // Display danger warning for eth_sign (raw hash signing)
+    // The warning the background attaches to an eth_sign request.
     const warningEl = $("approve-sign-danger-warning");
     if (warningEl) {
         if (sp.dangerWarning) {

src/popup/views/confirmTx.js

@@ -101,6 +101,10 @@ function show(txInfo) {
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
+    // The network this screen is drawn for, and the only one it sends on:
+    // Settings can switch the active network while the screen is open. The
+    // wait, success and error screens label the amount by it too.
+    txInfo.chainId = currentNetwork().chainId;
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
@@ -490,7 +494,12 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
         );
         request = await contract.transfer.populateTransaction(tx.to, amount);
     }
-    const populated = await connectedSigner.populateTransaction(request);
+    // The chain id of the network the screen was drawn for: ethers refuses to
+    // populate it for a provider on any other network.
+    const populated = await connectedSigner.populateTransaction({
+        ...request,
+        chainId: tx.chainId,
+    });
     assertWithinCeilings(populated);
     return connectedSigner.sendTransaction(populated);
 }
@@ -547,6 +556,17 @@ function init(_ctx) {
             return;
         }
 
+        // Back from Settings only unhides this screen, still drawn for the
+        // network that was active when it was shown.
+        if (currentNetwork().chainId !== pendingTx.chainId) {
+            showSendError(
+                "The active network changed after this transaction was" +
+                    " reviewed, so it was not sent. Please go back and review" +
+                    " it again.",
+            );
+            return;
+        }
+
         const password = $("confirm-tx-password").value;
         if (!password) {
             showError(
@@ -575,10 +595,6 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
-        // The network it is sent on. The wait, success and error screens
-        // label its amount by this, not by the network active when they draw.
-        pendingTx.chainId = currentNetwork().chainId;
-
         let tx;
         try {
             const signer = getSignerForAddress(

src/popup/views/transactionDetail.js

@@ -183,7 +183,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    loadFullTxDetails(tx.hash, tx.to, tx.chainId);
+    loadFullTxDetails(tx.hash, tx.chainId);
 
     const isoStr = isoDate(tx.timestamp);
     $("tx-detail-time").innerHTML =
@@ -291,7 +291,7 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
-async function loadFullTxDetails(txHash, toAddress, chainId) {
+async function loadFullTxDetails(txHash, chainId) {
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -313,7 +313,10 @@ async function loadFullTxDetails(txHash, toAddress, chainId) {
         const inputData = txData.raw_input || txData.input || null;
         if (!inputData || inputData === "0x") return;
 
-        const decoded = decodeCalldata(inputData, toAddress || "");
+        // Decoded against the address the transaction was sent to, as the
+        // explorer reports it, not the history entry's `to`: for a token
+        // transfer that is the transfer's recipient, not the token contract.
+        const decoded = decodeCalldata(inputData, txData.to?.hash || "");
         if (decoded) {
             // Render decoded calldata matching approval view style
             actionEl.textContent = decoded.name;

src/shared/approvalTx.js

@@ -1,13 +1,14 @@
 // Preparation of the transaction an approval screen displays.
 //
-// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
-// The nonce, the gas limit and the fees have to be filled in from the network
-// before anything can be signed, and whoever fills them in decides what the
-// user is shown. That work used to happen in the popup, after the user had
-// already approved: the numbers on the approval screen came from the popup and
-// were compared against nothing, so a compromised popup could display one fee
-// and sign another, and the ceilings in approvalVerify.js were all that stood
-// between the user and a fee that hands the validator the balance.
+// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
+// sometimes the gas limit. The nonce, the fees, and the gas limit when the
+// site gives none have to be filled in from the network before anything can
+// be signed, and whoever fills them in decides what the user is shown. That
+// work used to happen in the popup, after the user had already approved: the
+// numbers on the approval screen came from the popup and were compared against
+// nothing, so a compromised popup could display one fee and sign another, and
+// the ceilings in approvalVerify.js were all that stood between the user and a
+// fee that hands the validator the balance.
 //
 // So it happens here instead, in the background, before the approval window is
 // opened. The background populates the transaction, shows that object, and
@@ -31,6 +32,7 @@ const {
     VoidSigner,
     accessListify,
     getAddress,
+    getBigInt,
     getBytes,
     hexlify,
     toQuantity,
@@ -47,10 +49,11 @@ const {
 // minutes long, which is not a wait anyone will sit through.
 const POPULATE_TIMEOUT_MS = 20000;
 
-// The request fields taken from the page. Anything else is dropped rather than
-// passed to ethers: the object is page-controlled, and a future ethers that
-// learns to carry a new transaction field must not start picking one up out of
-// it without this module knowing.
+// The request fields taken from the page, plus `gas`, which requestFrom()
+// takes as the gas limit. Anything else is dropped rather than passed to
+// ethers: the object is page-controlled, and a future ethers that learns to
+// carry a new transaction field must not start picking one up out of it
+// without this module knowing.
 //
 // The nonce is not taken from the page; it is always the account's next nonce
 // from the network. A page that chose it could replace one of the user's
@@ -84,6 +87,16 @@ function present(v) {
     return v !== null && v !== undefined && v !== "";
 }
 
+// Whether two quantities from the page are the same number. One that is not a
+// number matches nothing.
+function sameQuantity(a, b) {
+    try {
+        return getBigInt(a) === getBigInt(b);
+    } catch {
+        return false;
+    }
+}
+
 // These strings reach the user through the requesting page, so they are full
 // sentences even when the tail of one came from ethers or from the node.
 function sentence(text) {
@@ -111,6 +124,20 @@ function requestFrom(txParams, from) {
     for (const key of REQUEST_FIELDS) {
         if (present(txParams[key])) request[key] = txParams[key];
     }
+    // JSON-RPC calls the gas limit `gas`, and that is the name sites send.
+    // ethers only reads `gasLimit`: left as `gas` it would be dropped and an
+    // estimate signed in its place.
+    if (present(txParams.gas)) {
+        if (
+            present(request.gasLimit) &&
+            !sameQuantity(request.gasLimit, txParams.gas)
+        ) {
+            throw fail(
+                "The site asked for two different gas limits for this transaction.",
+            );
+        }
+        request.gasLimit = txParams.gas;
+    }
     if (
         present(request.type) &&
         !ALLOWED_TX_TYPES.includes(Number(request.type))

src/shared/uniswap.js

@@ -53,11 +53,6 @@ function formatAmount(raw, decimals) {
 // on a scale — not as a token name, and not as a quantity.
 const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
 
-// The same refusal when a V4 swap action could not be read (see
-// decodeExactly()). That action names both of its currencies, so saying the
-// calldata did not name one would be false.
-const UNDECODED_CURRENCY = "Unknown (could not be decoded)";
-
 // Explicit presence, never truthiness. Every gate in this file that guards a
 // decoded value goes through here: an address is never falsy once set, but an
 // amount of 0n is, and a gate that cannot tell a genuine zero from an absent
@@ -300,24 +295,6 @@ function v4ExactInAmount(raw) {
     return raw === 0n ? OPEN_DELTA : raw;
 }
 
-// The V4 swap actions are read only in the parameter structs V4Router has
-// deployed on mainnet and Sepolia. v4-periphery `main` has since added a
-// `minHopPriceX36` field to all four (`src/interfaces/IV4Router.sol`), and
-// reading a shape nobody has deployed would be guessing. ethers alone would
-// read the newer structs anyway: it takes whatever word sits where a
-// deployed field would be, ignores bytes left over, and holds back an error
-// in a field until that field is used. The newer multi-hop exact-in struct
-// then yields the offset of its hop-price array as `amountIn`. So a decode
-// counts only when encoding the result again gives back the same bytes;
-// otherwise this throws, and decodeV4Swap() marks the step as not decoded.
-function decodeExactly(types, data) {
-    const decoded = coder.decode(types, data);
-    if (coder.encode(types, decoded) !== data) {
-        throw new Error("Not in the deployed V4 parameter shape.");
-    }
-    return decoded;
-}
-
 // Decode V4_SWAP (command 0x10) input bytes.
 // The input is ABI-encoded as (bytes actions, bytes[] params).
 // We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
@@ -332,10 +309,6 @@ function decodeV4Swap(input) {
         let takeToken = null;
         let amountIn = null;
         let amountOutMin = null;
-        // Set when a swap action's parameters are not in the deployed shape
-        // (see decodeExactly()), so nothing was read from that action. SETTLE
-        // and TAKE may still name both currencies.
-        let swapUndecoded = false;
 
         for (let i = 0; i < actions.length; i++) {
             const actionId = actions[i];
@@ -364,7 +337,7 @@ function decodeV4Swap(input) {
                         //   tuple(address,uint24,int24,address,bytes)[] path,
                         //   uint128 amountIn, uint128 amountOutMin)
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -382,13 +355,13 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through — SETTLE/TAKE will provide tokens
                         }
                     } else {
                         // ExactInputSingleParams: (tuple(address,address,uint24,int24,address) poolKey,
                         //   bool zeroForOne, uint128 amountIn, uint128 amountOutMin, bytes hookData)
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -411,7 +384,7 @@ function decodeV4Swap(input) {
                                 amountOutMin = s[0][3];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     }
                 } else if (
@@ -420,7 +393,7 @@ function decodeV4Swap(input) {
                 ) {
                     if (actionId === V4_SWAP_EXACT_OUT) {
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(address,tuple(address,uint24,int24,address,bytes)[],uint128,uint128)",
                                 ],
@@ -432,11 +405,11 @@ function decodeV4Swap(input) {
                                 settleToken = path[path.length - 1][0];
                             }
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     } else {
                         try {
-                            const s = decodeExactly(
+                            const s = coder.decode(
                                 [
                                     "tuple(tuple(address,address,uint24,int24,address),bool,uint128,uint128,bytes)",
                                 ],
@@ -453,7 +426,7 @@ function decodeV4Swap(input) {
                                     ? poolKey[1]
                                     : poolKey[0];
                         } catch {
-                            swapUndecoded = true;
+                            // Fall through
                         }
                     }
                 }
@@ -467,7 +440,6 @@ function decodeV4Swap(input) {
             tokenOut: takeToken,
             amountIn,
             amountOutMin,
-            swapUndecoded,
         };
     } catch {
         return null;
@@ -493,7 +465,6 @@ function decode(data, toAddress, sources) {
         let minOutput = null;
         let hasUnwrapWeth = false;
         let hasV2ExactOut = false;
-        let swapUndecoded = false;
         const commandNames = [];
 
         // THE INVARIANT: an amount and the token it is counted in always come
@@ -597,12 +568,6 @@ function decode(data, toAddress, sources) {
                 if (cmdId === 0x10) {
                     const v4 = decodeV4Swap(inputs[i]);
                     if (v4) {
-                        // Without this, a swap action that went unread would
-                        // look like one that had nothing to show.
-                        if (v4.swapUndecoded) {
-                            swapUndecoded = true;
-                            commandNames[i] += " (could not be decoded)";
-                        }
                         setInputOnce(v4.tokenIn, v4.amountIn);
                         // Always update output: last swap step wins. A step
                         // that carries the Min. received figure but decoded no
@@ -626,13 +591,12 @@ function decode(data, toAddress, sources) {
             }
         }
 
-        // Resolve token info. A null token on either side means no step that
-        // was read named a currency for it; tokenInfo() refuses rather than
-        // calling it ETH. UNWRAP_WETH turns WETH into ETH, so it makes the
-        // output ETH when the output side is WETH, or when no step set the
-        // output side. Any other output keeps its own token and figure: a swap
-        // that buys USDC and then unwraps the WETH it did not spend receives
-        // USDC.
+        // Resolve token info. A null token on either side means the calldata
+        // named no currency for it; tokenInfo() refuses rather than calling it
+        // ETH. UNWRAP_WETH turns WETH into ETH, so it makes the output ETH
+        // when the output side is WETH, or when no step set the output side.
+        // Any other output keeps its own token and figure: a swap that buys
+        // USDC and then unwraps the WETH it did not spend receives USDC.
         const outputIsWeth =
             present(outputToken) &&
             WETH_ADDRESSES.includes(outputToken.toLowerCase());
@@ -676,10 +640,7 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default. Same
             // wording as the Token Out refusal below: the two sides of this
             // screen must not describe the same condition in two ways.
-            details.push({
-                label: "Token In",
-                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
-            });
+            details.push({ label: "Token In", value: UNNAMED_CURRENCY });
         }
 
         if (present(inputAmount)) {
@@ -742,10 +703,7 @@ function decode(data, toAddress, sources) {
             // rather than going missing or naming a token by default, and a
             // Min. received figure below it is never attached to a token the
             // calldata did not state.
-            details.push({
-                label: "Token Out",
-                value: swapUndecoded ? UNDECODED_CURRENCY : UNNAMED_CURRENCY,
-            });
+            details.push({ label: "Token Out", value: UNNAMED_CURRENCY });
         }
 
         if (present(minOutput)) {

src/shared/walletDefects.js

@@ -36,11 +36,13 @@ const DEFECTS = {
                 "derivation path beneath that key instead of from a master " +
                 "key, so the addresses listed here are not the ones that key " +
                 "produces under the standard path.",
-            "Signing and sending are disabled for this wallet. The addresses " +
-                "do descend from the extended private key you imported, so " +
-                "anything they hold is still reachable by software that " +
-                "repeats the same non-standard derivation. Check them in a " +
-                "block explorer before deciding what to do.",
+            "Signing, sending and private key export are disabled for this " +
+                "wallet. Anything these addresses hold can be reached outside " +
+                "this wallet with the extended private key you imported, if " +
+                "you kept a copy of it, or with the master extended private " +
+                "key or recovery phrase it came from, in software that " +
+                "repeats the same non-standard derivation. Check the " +
+                "addresses in a block explorer before deciding what to do.",
             "To see the addresses this key produces under the standard path, " +
                 "import the master extended private key, or the recovery " +
                 "phrase it came from, as a new wallet. Nothing here has been " +

tests/approvalTx.test.js

@@ -9,7 +9,7 @@
 // requesting page or the RPC node can say turns it into an approval that
 // should never have been raised.
 
-const { Network, Wallet } = require("ethers");
+const { Network, Transaction, Wallet, toQuantity } = require("ethers");
 const {
     prepareApprovalTx,
     serializeApprovedTx,
@@ -138,6 +138,43 @@ describe("prepareApprovalTx", () => {
         expect(approved.maxFeePerGas).toBe("0x12a05f200");
     });
 
+    // `gas` is the JSON-RPC name for the gas limit and the one sites send.
+    // The node would estimate 21000; the site's 200000 is what is shown and
+    // what is signed.
+    test("uses the gas limit a site sends as gas", async () => {
+        const approved = await prepareApprovalTx(
+            providerWith(),
+            signer.address,
+            { ...TX_PARAMS, gas: "0x30d40" },
+        );
+        expect(approved.gasLimit).toBe("0x30d40");
+        const signed = Transaction.from(
+            await signer.signTransaction({ ...approved }),
+        );
+        expect(signed.gasLimit).toBe(200000n);
+    });
+
+    test("accepts gas and gasLimit that name the same number", async () => {
+        const approved = await prepareApprovalTx(
+            providerWith(),
+            signer.address,
+            { ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
+        );
+        expect(approved.gasLimit).toBe("0x30d40");
+    });
+
+    test("refuses gas and gasLimit that disagree", async () => {
+        await expect(
+            prepareApprovalTx(providerWith(), signer.address, {
+                ...TX_PARAMS,
+                gas: "0x30d40",
+                gasLimit: "0x5208",
+            }),
+        ).rejects.toThrow(
+            "The site asked for two different gas limits for this transaction.",
+        );
+    });
+
     test("carries an access list the request asked for", async () => {
         const approved = await prepareApprovalTx(
             providerWith(),
@@ -212,6 +249,15 @@ describe("prepareApprovalTx", () => {
         ).rejects.toThrow(/gas limit no network this wallet supports/);
     });
 
+    test("refuses a gas limit the site sent above the ceiling", async () => {
+        await expect(
+            prepareApprovalTx(providerWith(), signer.address, {
+                ...TX_PARAMS,
+                gas: toQuantity(MAX_GAS_LIMIT + 1n),
+            }),
+        ).rejects.toThrow(/gas limit no network this wallet supports/);
+    });
+
     // The combined bound at population: a gas limit and a fee that are each
     // under their own ceiling but multiply to thousands of ETH is refused
     // before the approval window opens, so the user is never shown a

tests/approvalVerify.test.js

@@ -58,7 +58,6 @@ const TX_PARAMS = {
     to: RECIPIENT,
     value: "0x2386f26fc10000",
     data: "0xdeadbeef",
-    gas: "0x5208",
 };
 
 // The values populateTransaction() fills in when the dApp fixed none of them.

tests/backgroundApproval.test.js

@@ -1606,6 +1606,55 @@ describe("what the approval is verified against", () => {
     });
 });
 
+// eth_sign names the address first and the data second, the reverse of
+// personal_sign, and is answered as the JSON-RPC specification defines it:
+// with an EIP-191 personal message signature over the data, the same
+// signature personal_sign returns
+// (https://git.eeqj.de/sneak/AutistMask/issues/409). The signature below is
+// made by the test; that the sign screen makes the same one is tested in
+// tests/ethSign.test.js.
+describe("eth_sign", () => {
+    test("is read address first, and returns a personal message signature over the data", async () => {
+        const bg = loadBackground();
+        const page = bg.send(
+            {
+                type: "AUTISTMASK_RPC",
+                method: "eth_sign",
+                params: [signer.address, MESSAGE],
+            },
+            { origin: ORIGIN },
+        );
+        await settle();
+        const id = approvalIdIn(bg.created.map((c) => c.url));
+
+        const details = bg.send(
+            { type: "AUTISTMASK_GET_APPROVAL", id },
+            { url: bg.fromPopup.url },
+        );
+        const { signParams } = details.sendResponse.mock.calls[0][0];
+        expect(signParams).toMatchObject({
+            method: "eth_sign",
+            message: MESSAGE,
+            from: signer.address,
+        });
+        expect(signParams.dangerWarning).toBe(
+            "This site used the older eth_sign method. " +
+                "The data will be signed as a personal message.",
+        );
+
+        const signature = await signer.signMessage(
+            Buffer.from(MESSAGE.slice(2), "hex"),
+        );
+        bg.send(
+            { type: "AUTISTMASK_SIGN_RESPONSE", id, approved: true, signature },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+
+        expect(page.sendResponse).toHaveBeenCalledWith({ result: signature });
+    });
+});
+
 // The interlock must not cost the retry the approval exists to allow.
 describe("the interlock releases a failed attempt", () => {
     test("a retryable failure before the broadcast leaves the approval usable", async () => {

tests/confirmTxNetworkSwitch.test.js

@@ -0,0 +1,259 @@
+// A transfer is sent only on the network its confirmation screen was drawn for
+// (https://git.eeqj.de/sneak/AutistMask/issues/524).
+//
+// Settings is reachable from the confirmation screen, and Back from it only
+// unhides the screen, still labelled for the network it was drawn for. Sign &
+// Send used to take the network at the moment of the click, so 1 SepoliaETH
+// reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
+// Settings in between.
+//
+// Driven through the real confirmation screen, signer and chain switch, with
+// only the node and the DOM stubbed. The stub node is on the network its
+// provider was built for, so a broadcast records the network it went to.
+
+"use strict";
+
+// The signed transactions the stub node was handed, with its network's chain id.
+const mockNode = { broadcast: [] };
+
+jest.mock("ethers", () => {
+    const actual = jest.requireActual("ethers");
+    class StubProvider {
+        constructor(url, network) {
+            this.network = network;
+        }
+        async getNetwork() {
+            return this.network;
+        }
+        async getFeeData() {
+            return {
+                maxFeePerGas: 20000000000n,
+                maxPriorityFeePerGas: 1000000000n,
+                gasPrice: 10000000000n,
+            };
+        }
+        async estimateGas() {
+            return 21000n;
+        }
+        async getCode() {
+            return "0x";
+        }
+        async getTransactionCount() {
+            return 1;
+        }
+        async lookupAddress() {
+            return null;
+        }
+        async broadcastTransaction(signed) {
+            mockNode.broadcast.push({ chainId: this.network.chainId, signed });
+            return { hash: "0x" + "ab".repeat(32) };
+        }
+    }
+    return { ...actual, JsonRpcProvider: StubProvider };
+});
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: jest.fn(async () => ({
+        ok: true,
+        status: 200,
+        json: async () => ({ items: [] }),
+    })),
+    urlOrigin: () => "",
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+// The wait screen polls for a receipt; these tests stop at the broadcast.
+jest.mock("../src/popup/views/txStatus", () => ({
+    showWait: jest.fn(),
+    showError: jest.fn(),
+}));
+
+global.fetch = jest.fn(() => {
+    throw new Error("tests must not perform network requests");
+});
+
+const { makeStorageStub } = require("./support/storageStub");
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+
+// A stub DOM: every id resolves to a recording element.
+const elements = new Map();
+
+function makeEl(id) {
+    const handlers = new Map();
+    return {
+        id,
+        textContent: "",
+        innerHTML: "",
+        value: "",
+        disabled: false,
+        style: {},
+        dataset: {},
+        classList: {
+            add() {},
+            remove() {},
+            toggle() {},
+            contains: () => false,
+        },
+        handlers,
+        addEventListener(name, fn) {
+            handlers.set(name, fn);
+        },
+        querySelectorAll: () => [],
+        querySelector: () => null,
+        remove() {},
+        focus() {},
+    };
+}
+
+global.document = {
+    getElementById(id) {
+        if (!elements.has(id)) elements.set(id, makeEl(id));
+        return elements.get(id);
+    },
+    createElement: (tag) => makeEl(tag),
+    body: { prepend() {}, appendChild() {} },
+    addEventListener() {},
+};
+global.navigator = { clipboard: { writeText() {} } };
+
+const { BaseWallet, Transaction, Wallet } = require("ethers");
+const { encryptWithPassword } = require("../src/shared/vault");
+const { state, loadState } = require("../src/shared/state");
+const { onChainSwitch } = require("../src/shared/chainSwitch");
+const { NETWORKS } = require("../src/shared/networks");
+const txStatus = require("../src/popup/views/txStatus");
+const confirmTx = require("../src/popup/views/confirmTx");
+
+const PRIVATE_KEY = "0x" + "11".repeat(32);
+const HOLDER = new Wallet(PRIVATE_KEY).address;
+const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
+const PASSWORD = "correct horse battery staple";
+
+function el(id) {
+    return global.document.getElementById(id);
+}
+
+let encryptedSecret;
+let signTransaction;
+
+beforeAll(async () => {
+    await loadState();
+    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
+});
+
+beforeEach(() => {
+    elements.clear();
+    mockNode.broadcast = [];
+    txStatus.showWait.mockClear();
+    txStatus.showError.mockClear();
+    signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
+});
+
+afterEach(() => {
+    signTransaction.mockRestore();
+});
+
+// Show the confirmation screen for 1 of the native token on `networkId`, as
+// Review on the Send screen does, with its fee estimate settled.
+async function review(networkId) {
+    await onChainSwitch(networkId);
+    state.wallets = [
+        {
+            type: "key",
+            name: "Wallet 1",
+            encryptedSecret,
+            addresses: [{ address: HOLDER, balance: "5.0" }],
+        },
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    confirmTx.init({});
+    confirmTx.show({
+        from: HOLDER,
+        to: RECIPIENT,
+        ensName: null,
+        amount: "1",
+        token: "ETH",
+        balance: "5.0",
+        tokenSymbol: null,
+        tokenBalance: null,
+        tokenDecimals: null,
+        max: false,
+    });
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+async function signAndSend() {
+    el("confirm-tx-password").value = PASSWORD;
+    await el("btn-confirm-send").handlers.get("click")();
+}
+
+test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () => {
+    await review("sepolia");
+    expect(el("confirm-type").textContent).toBe("Native SepoliaETH transfer");
+    expect(el("btn-confirm-send").disabled).toBe(false);
+    await signAndSend();
+    expect(mockNode.broadcast).toHaveLength(1);
+    expect(mockNode.broadcast[0].chainId).toBe(11155111n);
+    expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
+        11155111n,
+    );
+    expect(txStatus.showWait).toHaveBeenCalledTimes(1);
+});
+
+describe.each([
+    ["sepolia", "mainnet", "SepoliaETH"],
+    ["mainnet", "sepolia", "ETH"],
+])(
+    "a transfer reviewed on %s, with %s chosen in Settings before Sign & Send",
+    (reviewedOn, switchedTo, symbol) => {
+        test("is neither signed nor sent, and the screen says why", async () => {
+            await review(reviewedOn);
+            expect(el("confirm-type").textContent).toBe(
+                "Native " + symbol + " transfer",
+            );
+            // Settings' network select, then Back, which only unhides the
+            // screen as it was drawn.
+            await onChainSwitch(switchedTo);
+            await signAndSend();
+
+            expect(signTransaction).not.toHaveBeenCalled();
+            expect(mockNode.broadcast).toEqual([]);
+            expect(txStatus.showWait).not.toHaveBeenCalled();
+            expect(txStatus.showError).not.toHaveBeenCalled();
+            expect(el("confirm-errors").style.visibility).toBe("visible");
+            expect(el("confirm-errors").innerHTML).toContain(
+                "The active network changed after this transaction was" +
+                    " reviewed, so it was not sent. Please go back and review" +
+                    " it again.",
+            );
+        });
+    },
+);
+
+// The check in the click handler tells the user; the send itself carries the
+// chain id the screen was drawn for, so a signer on another network's node
+// cannot sign it even if the network changes after that check.
+test("the send is refused by a signer on another network's node", async () => {
+    const { getProvider } = require("../src/shared/balances");
+    const signer = new Wallet(PRIVATE_KEY).connect(
+        getProvider("https://rpc.example.invalid", "mainnet"),
+    );
+    await expect(
+        confirmTx.populateVerifyAndSend(signer, {
+            token: "ETH",
+            to: RECIPIENT,
+            amount: "1",
+            chainId: NETWORKS.sepolia.chainId,
+        }),
+    ).rejects.toThrow("transaction chainId mismatch");
+    expect(signTransaction).not.toHaveBeenCalled();
+    expect(mockNode.broadcast).toEqual([]);
+});

tests/e2e/run.js

@@ -3857,6 +3857,9 @@ test("eth_requestAccounts approved returns the selected address (#183)", async (
             shown.toLowerCase().includes(env.expectedAddress.toLowerCase()),
             "the site prompt shows the wrong address: " + JSON.stringify(shown),
         );
+        // The text above is there even when the row is too narrow to show it
+        // all; this measures that the whole address is visible (#517).
+        await assertAddressesFit(popup, "the connection prompt");
 
         // Remembered, so the connection survives a background worker that MV3
         // terminates after 30 seconds idle. The in-memory connectedSites map

tests/ethSign.test.js

@@ -0,0 +1,102 @@
+// The sign screen signs an eth_sign request the way it signs personal_sign: as
+// an EIP-191 personal message over the bytes of the data
+// (https://git.eeqj.de/sneak/AutistMask/issues/409). Booted through the real
+// popup entry point as the approval window. The background's half, which reads
+// the address first and the data second and checks the signature, is tested in
+// tests/backgroundApproval.test.js.
+
+// Mocked so that no password has to be hashed: the stored secret decrypts to
+// the test key below.
+jest.mock("../src/shared/vault", () => ({
+    decryptWithPassword: jest.fn(),
+    encryptWithPassword: jest.fn(),
+}));
+
+const { Wallet, getBytes } = require("ethers");
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+} = require("./support/popupBoot");
+
+// A published test key, never used for real funds.
+const SIGNER_KEY =
+    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
+const signer = new Wallet(SIGNER_KEY);
+// "Hello AutistMask", as the hex a page sends.
+const MESSAGE = "0x48656c6c6f204175746973744d61736b";
+const ORIGIN = "https://dapp.example";
+
+afterEach(cleanupPopup);
+
+test("the sign screen answers eth_sign with a personal message signature over the data", async () => {
+    const sent = [];
+    const page = await bootPopup(
+        unversionedValidProfile({
+            wallets: [
+                {
+                    type: "key",
+                    name: "Wallet 1",
+                    encryptedSecret: "encrypted-key",
+                    addresses: [
+                        {
+                            address: signer.address,
+                            balance: "0.0000",
+                            tokenBalances: [],
+                        },
+                    ],
+                },
+            ],
+            activeAddress: signer.address,
+            allowedSites: { [signer.address]: [ORIGIN] },
+        }),
+        {
+            search: "?approval=approval-1",
+            runtime: {
+                connect: () => ({ postMessage: () => {} }),
+                // Answered as the background answers: with the eth_sign
+                // approval this window was opened for, and by handing back
+                // the signature the popup sends.
+                sendMessage: (msg, reply) => {
+                    sent.push(msg);
+                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
+                        reply({
+                            type: "sign",
+                            origin: ORIGIN,
+                            isPhishingDomain: false,
+                            approvedFrom: signer.address,
+                            signParams: {
+                                method: "eth_sign",
+                                message: MESSAGE,
+                                from: signer.address,
+                            },
+                        });
+                    } else if (msg.type === "AUTISTMASK_SIGN_RESPONSE") {
+                        reply({ signature: msg.signature });
+                    } else {
+                        reply(undefined);
+                    }
+                },
+            },
+        },
+    );
+    globalThis.window.close = jest.fn();
+    const { decryptWithPassword } = require("../src/shared/vault");
+    decryptWithPassword.mockResolvedValue(SIGNER_KEY);
+
+    expect(page.visibleViews()).toEqual(["approve-sign"]);
+    page.node("approve-sign-password").value = "any password";
+    await page.click("btn-approve-sign");
+
+    expect(
+        sent.filter((msg) => msg.type === "AUTISTMASK_SIGN_RESPONSE"),
+    ).toEqual([
+        {
+            type: "AUTISTMASK_SIGN_RESPONSE",
+            id: "approval-1",
+            approved: true,
+            signature: await signer.signMessage(getBytes(MESSAGE)),
+        },
+    ]);
+    expect(globalThis.window.close).toHaveBeenCalled();
+});

tests/firstWalletActiveAddress.test.js

@@ -0,0 +1,69 @@
+// Adding the first wallet left no address active until the popup was reopened,
+// so Send and Receive on Home only said "No active address selected."
+// (https://git.eeqj.de/sneak/AutistMask/issues/512). Each test boots a fresh
+// install, adds the first wallet through one of the three import tabs, and
+// opens Receive from Home in the same popup.
+
+const { HDNodeWallet, Mnemonic, Wallet } = require("ethers");
+
+const { bootPopup, cleanupPopup } = require("./support/popupBoot");
+
+const PHRASE =
+    "abandon abandon abandon abandon abandon abandon " +
+    "abandon abandon abandon abandon abandon about";
+const PRIVATE_KEY = "0x" + "11".repeat(32);
+// The master key of PHRASE, so its first address is the phrase's.
+const XPRV = HDNodeWallet.fromSeed(
+    Mnemonic.fromPhrase(PHRASE).computeSeed(),
+).extendedKey;
+const PASSWORD = "correct horse battery staple";
+
+const PHRASE_ADDRESS = HDNodeWallet.fromPhrase(PHRASE).address;
+
+const TABS = [
+    {
+        tab: "tab-mnemonic",
+        field: "wallet-mnemonic",
+        secret: PHRASE,
+        address: PHRASE_ADDRESS,
+    },
+    {
+        tab: "tab-privkey",
+        field: "import-private-key",
+        secret: PRIVATE_KEY,
+        address: new Wallet(PRIVATE_KEY).address,
+    },
+    {
+        tab: "tab-xprv",
+        field: "import-xprv-key",
+        secret: XPRV,
+        address: PHRASE_ADDRESS,
+    },
+];
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+describe("the first wallet's first address is active right away", () => {
+    test.each(TABS)(
+        "added from $tab, Receive opens on it",
+        async ({ tab, field, secret, address }) => {
+            const page = await bootPopup(undefined);
+            expect(page.pageErrors).toEqual([]);
+            await page.click("btn-welcome-add");
+            await page.click(tab);
+            page.node(field).value = secret;
+            page.node("add-wallet-password").value = PASSWORD;
+            page.node("add-wallet-password-confirm").value = PASSWORD;
+            await page.click("btn-add-wallet-confirm");
+            expect(page.visibleViews()).toEqual(["main"]);
+
+            await page.click("btn-main-receive");
+            expect(page.visibleViews()).toEqual(["receive"]);
+            expect(page.node("receive-address-block").dataset.full).toBe(
+                address,
+            );
+        },
+    );
+});

tests/support/popupBoot.js

@@ -258,12 +258,17 @@ async function bootPopup(stored, options) {
         formatAddressTotal: () => "",
         getAddressValue: () => ({ usd: null, partial: false }),
     }));
+    // scanForAddresses() answers in the real one's shape, a scan that found
+    // no used address: AddWallet reads `addresses` from it.
     jest.doMock("../../src/shared/balances", () => ({
         fetchTokenBalances: jest.fn(async () => []),
         refreshBalances: jest.fn(async () => {}),
         lookupTokenInfo: jest.fn(async () => null),
         getProvider: () => ({}),
-        scanForAddresses: jest.fn(async () => []),
+        scanForAddresses: jest.fn(async () => ({
+            addresses: [],
+            nextIndex: 1,
+        })),
     }));
     // filterTransactions() answers in the real one's shape: Home,
     // AddressDetail and AddressToken read both fields, and a bare list makes

tests/tokenTransferDetail.test.js

@@ -0,0 +1,176 @@
+// The decoded details on the transaction detail screen of a token transfer
+// (https://git.eeqj.de/sneak/AutistMask/issues/515).
+//
+// A history row for a token transfer holds the transfer's recipient as its
+// `to`, not the contract the transaction was sent to. The screen used to decode
+// the transaction's data against that `to`, so its Token line named the
+// recipient, and the amount read "decimals unknown" for a token the wallet
+// tracks. It decodes against the address the explorer reports the transaction
+// was sent to.
+//
+// The row is the one the real history parser makes from the explorer's answer,
+// opened through transactionDetail.show(), which is what a click on the row
+// calls. Driven against a minimal DOM stub in the shape
+// tests/contractCreation.test.js uses.
+
+const { Interface } = require("ethers");
+
+jest.mock("../src/shared/log", () => ({
+    log: {
+        debugf: () => {},
+        infof: () => {},
+        warnf: () => {},
+        errorf: () => {},
+    },
+    debugFetch: async (url) => ({
+        ok: true,
+        json: async () => mockExplorerAnswer(url),
+    }),
+    setRuntimeDebug: () => {},
+    isDebug: () => false,
+}));
+
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const { state } = require("../src/shared/state");
+const { fetchRecentTransactions } = require("../src/shared/transactions");
+const transactionDetail = require("../src/popup/views/transactionDetail");
+
+const EXPLORER = "https://explorer.example/api/v2";
+const HOLDER = "0x0000000000000000000000000000000000000a11";
+const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
+// A token the wallet tracks and the bundled token list does not name.
+const TOKEN = "0x74de5d4FCbf63E00296fd95d33236B9794016631";
+const TX_HASH =
+    "0x85215772ed26ea8b39c2b3b18779030487efbe0b5fd7e882592b2f62b837be84";
+
+// HOLDER sends 1234.5 of the 6-decimal token to RECIPIENT.
+const TRANSFER_DATA = new Interface([
+    "function transfer(address to, uint256 amount)",
+]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
+
+// The explorer's answers: the transfer in HOLDER's token transfers, and the
+// transaction itself, sent to the token contract.
+function mockExplorerAnswer(url) {
+    if (
+        url ===
+        EXPLORER + "/addresses/" + HOLDER + "/token-transfers?type=ERC-20"
+    ) {
+        return {
+            items: [
+                {
+                    transaction_hash: TX_HASH,
+                    block_number: 100,
+                    timestamp: "2026-10-01T00:00:00Z",
+                    from: { hash: HOLDER },
+                    to: { hash: RECIPIENT },
+                    total: { value: "1234500000", decimals: "6" },
+                    token: {
+                        address_hash: TOKEN,
+                        symbol: "TDOL",
+                        holders_count: "5000",
+                    },
+                },
+            ],
+        };
+    }
+    if (url === EXPLORER + "/transactions/" + TX_HASH) {
+        return { to: { hash: TOKEN }, raw_input: TRANSFER_DATA };
+    }
+    return { items: [] };
+}
+
+function makeElement(id) {
+    const classes = new Set();
+    const el = {
+        id,
+        textContent: "",
+        value: "",
+        innerHTML: "",
+        style: {},
+        dataset: {},
+        classList: {
+            add: (...names) => names.forEach((n) => classes.add(n)),
+            remove: (...names) => names.forEach((n) => classes.delete(n)),
+            contains: (n) => classes.has(n),
+            toggle: () => false,
+        },
+        addEventListener: () => {},
+        querySelectorAll: () => [],
+        appendChild: () => {},
+    };
+    // Views reach for .parentElement to hide whole sections.
+    Object.defineProperty(el, "parentElement", {
+        get: () => node(id + "-parent"),
+    });
+    return el;
+}
+
+function makeDocument() {
+    const els = new Map();
+    return {
+        getElementById(id) {
+            // The debug banner is created on demand by helpers.js; absent
+            // is the state a non-debug, non-testnet popup is in.
+            if (id === "debug-banner") return null;
+            if (!els.has(id)) els.set(id, makeElement(id));
+            return els.get(id);
+        },
+        createElement: () => makeElement("created"),
+        body: { prepend: () => {} },
+    };
+}
+
+function node(id) {
+    return globalThis.document.getElementById(id);
+}
+
+// One line of the decoded details: its label and what is drawn under it.
+function decodedLine(label) {
+    return node("tx-detail-calldata-details")
+        .innerHTML.split('<div class="mb-2">')
+        .find((line) =>
+            line.startsWith(`<div class="text-muted">${label}</div>`),
+        );
+}
+
+beforeEach(() => {
+    globalThis.document = makeDocument();
+    globalThis.window = { location: { search: "" } };
+    state.blockscoutUrl = EXPLORER;
+    state.wallets = [
+        {
+            name: "Main",
+            type: "key",
+            addresses: [{ address: HOLDER, balance: "0.0000" }],
+        },
+    ];
+    state.trackedTokens = [{ address: TOKEN, symbol: "TDOL", decimals: 6 }];
+    state.viewData = {};
+    state.viewStack = [];
+    state.currentView = null;
+});
+
+test("a token transfer's decoded details name the token contract and the amount at its scale", async () => {
+    const [row] = await fetchRecentTransactions(HOLDER, EXPLORER, 1);
+    expect(row.to).toBe(RECIPIENT);
+    expect(row.contractAddress).toBe(TOKEN.toLowerCase());
+
+    transactionDetail.show(row);
+    // The decoded details are drawn once the explorer has answered.
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+
+    expect(node("tx-detail-calldata-action").textContent).toBe(
+        "Token Transfer",
+    );
+    const token = decodedLine("Token");
+    expect(token).toContain('<div class="font-bold">TDOL</div>');
+    expect(token).toContain(TOKEN);
+    expect(token).not.toContain(RECIPIENT);
+    expect(decodedLine("Recipient")).toContain(RECIPIENT);
+    expect(decodedLine("Amount")).toContain(
+        '<div class="font-bold">1234.5000 TDOL</div>',
+    );
+});

tests/typedDataPermit.test.js

@@ -233,6 +233,26 @@ function warningOf(data) {
     return html.slice(0, html.indexOf(">Domain<"));
 }
 
+const NOT_SIGNED = ">Not part of the signature<";
+
+// The Message section alone, without the keys listed after it as not part of
+// the signature.
+function messageOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const end = html.indexOf(NOT_SIGNED);
+    return html.slice(
+        html.indexOf(">Message<"),
+        end === -1 ? html.length : end,
+    );
+}
+
+// The keys listed as not part of the signature, or "" when there are none.
+function notSignedOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const start = html.indexOf(NOT_SIGNED);
+    return start === -1 ? "" : html.slice(start);
+}
+
 function request(data) {
     return { method: "eth_signTypedData_v4", typedData: JSON.stringify(data) };
 }
@@ -312,7 +332,8 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 
     // A Permit whose type names its spender `operator`; the page adds a
-    // `spender` key the type does not declare.
+    // `spender` key the type does not declare. The Message section names
+    // only the operator, and the added key is listed apart as not signed.
     test("an added key is not named as the spender", () => {
         const data = {
             ...PERMIT,
@@ -331,6 +352,10 @@ describe("the warning reads only the fields the signed type declares", () => {
         const warning = warningOf(data);
         expect(warning).toContain(WARNING);
         expect(warning).not.toContain(DECOY);
+        expect(messageOf(data)).toContain(SPENDER);
+        expect(messageOf(data)).not.toContain(DECOY);
+        expect(notSignedOf(data)).toContain("spender:");
+        expect(notSignedOf(data)).toContain(DECOY);
     });
 
     // The permit for a Uniswap v3 position NFT: a `Permit` with no amount
@@ -371,6 +396,47 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 });
 
+// ethers signs only the declared fields at every level of nesting, so an
+// added key inside a struct is not signed either. Such typed data is not
+// refused; the added key is listed apart, with where it sits in the message.
+describe("the Message section shows only the fields that are signed", () => {
+    const NOTE = "This signature only signs you in";
+
+    test("an added key inside a nested struct is listed as not signed", () => {
+        const data = {
+            ...PERMIT_SINGLE,
+            message: {
+                ...PERMIT_SINGLE.message,
+                details: { ...PERMIT_SINGLE.message.details, note: NOTE },
+            },
+        };
+        expect(messageOf(data)).toContain("expiration");
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details.note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+        expect(typedDataRefusal(request(data))).toBeNull();
+    });
+
+    test("an added key inside a list item is listed with its index", () => {
+        const [first, second] = PERMIT_BATCH.message.details;
+        const data = {
+            ...PERMIT_BATCH,
+            message: {
+                ...PERMIT_BATCH.message,
+                details: [first, { ...second, note: NOTE }],
+            },
+        };
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details[1].note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+    });
+
+    test("nothing is listed apart when every key is declared", () => {
+        expect(notSignedOf(PERMIT_SINGLE)).toBe("");
+        expect(notSignedOf(LOGIN)).toBe("");
+    });
+});
+
 describe("the primary type shown is the one ethers signs", () => {
     // A drain stated as a sign-in: the page says Login, the types say
     // PermitSingle, and ethers would sign PermitSingle.

tests/uniswap.test.js

@@ -163,110 +163,6 @@ function encodeV4ExactInSingle(currency0, currency1, amountIn, amountOutMin) {
     );
 }
 
-// Each V4 swap action's parameters in two shapes: the struct V4Router has
-// deployed on mainnet and Sepolia, and the one v4-periphery `main` has since
-// moved to, which adds a `minHopPriceX36` field. Each swaps WETH for USDC.
-const POOL_KEY = "tuple(address,address,uint24,int24,address)";
-const PATH_KEY = "tuple(address,uint24,int24,address,bytes)";
-const WETH_USDC_POOL = [WETH_ADDR, USDC_ADDR, 100, 1, ZERO_ADDR];
-const ONE_WETH = 1000000000000000000n;
-const V4_SWAP_ACTION_SHAPES = [
-    {
-        action: "SWAP_EXACT_IN_SINGLE",
-        id: 0x06,
-        deployed: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
-            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, "0x"]],
-        ),
-        newer: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
-            [[WETH_USDC_POOL, true, ONE_WETH, 990000n, 0n, "0x"]],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_IN",
-        id: 0x07,
-        deployed: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
-            [
-                [
-                    WETH_ADDR,
-                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    ONE_WETH,
-                    990000n,
-                ],
-            ],
-        ),
-        newer: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
-            [
-                [
-                    WETH_ADDR,
-                    [[USDC_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    [],
-                    ONE_WETH,
-                    990000n,
-                ],
-            ],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_OUT_SINGLE",
-        id: 0x08,
-        deployed: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,bytes)`],
-            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, "0x"]],
-        ),
-        newer: coder.encode(
-            [`tuple(${POOL_KEY},bool,uint128,uint128,uint256,bytes)`],
-            [[WETH_USDC_POOL, true, 990000n, ONE_WETH, 0n, "0x"]],
-        ),
-    },
-    {
-        action: "SWAP_EXACT_OUT",
-        id: 0x09,
-        deployed: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint128,uint128)`],
-            [
-                [
-                    USDC_ADDR,
-                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    990000n,
-                    ONE_WETH,
-                ],
-            ],
-        ),
-        newer: coder.encode(
-            [`tuple(address,${PATH_KEY}[],uint256[],uint128,uint128)`],
-            [
-                [
-                    USDC_ADDR,
-                    [[WETH_ADDR, 100, 1, ZERO_ADDR, "0x"]],
-                    [],
-                    990000n,
-                    ONE_WETH,
-                ],
-            ],
-        ),
-    },
-];
-
-// Helper: execute() with one V4_SWAP step holding the swap action, then
-// SETTLE of WETH and TAKE of USDC.
-function v4SwapCalldata(actionId, swapParams) {
-    return buildExecute(
-        "0x10",
-        [
-            encodeV4Swap(new Uint8Array([actionId, V4_SETTLE_ID, V4_TAKE_ID]), [
-                swapParams,
-                encodeV4Settle(WETH_ADDR),
-                encodeV4Take(USDC_ADDR),
-            ]),
-        ],
-        9999999999n,
-    );
-}
-
 function detail(result, label) {
     return result.details.find((d) => d.label === label);
 }
@@ -307,83 +203,11 @@ describe("uniswap decoder", () => {
             result.details.find((d) => d.label === "Min. received").value,
         ).toBe("0.0002 ETH");
 
-        // Real mainnet calldata is in the deployed shape, so its V4 step is
-        // not said to be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
-        expect(steps.value).toBe("Permit2 Permit → V4 Swap");
+        expect(steps.value).toContain("Permit2 Permit");
+        expect(steps.value).toContain("V4 Swap");
     });
 
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the deployed shape is read",
-        ({ id, deployed }) => {
-            const result = uniswap.decode(
-                v4SwapCalldata(id, deployed),
-                ROUTER_ADDR,
-            );
-            expect(detail(result, "Steps").value).toBe("V4 Swap");
-        },
-    );
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/358 — before it, all four
-    // newer structs decoded as the deployed ones without an error, and the
-    // newer SWAP_EXACT_IN showed the offset of its hop-price array as Amount
-    // ("0.0000000000000004 WETH") and its amountIn as Min. received.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the newer periphery shape is shown as not decoded",
-        ({ id, newer }) => {
-            const result = uniswap.decode(
-                v4SwapCalldata(id, newer),
-                ROUTER_ADDR,
-            );
-            expect(detail(result, "Amount")).toBeUndefined();
-            expect(detail(result, "Min. received")).toBeUndefined();
-            expect(detail(result, "Steps").value).toBe(
-                "V4 Swap (could not be decoded)",
-            );
-            // SETTLE and TAKE keep their own shape and still name both sides.
-            expect(detail(result, "Token In").address).toBe(WETH_ADDR);
-            expect(detail(result, "Token Out").address).toBe(USDC_ADDR);
-        },
-    );
-
-    // The decoder does not read SETTLE_ALL or TAKE_ALL, so here only the
-    // unread swap action names the currencies. The token lines must not say
-    // the calldata did not name them.
-    test.each(V4_SWAP_ACTION_SHAPES)(
-        "a V4 $action in the newer shape, then SETTLE_ALL and TAKE_ALL, says both tokens could not be decoded",
-        ({ id, newer }) => {
-            const data = buildExecute(
-                "0x10",
-                [
-                    // 0x0c is SETTLE_ALL (currency, maxAmount), 0x0f is
-                    // TAKE_ALL (currency, minAmount).
-                    encodeV4Swap(new Uint8Array([id, 0x0c, 0x0f]), [
-                        newer,
-                        coder.encode(
-                            ["address", "uint256"],
-                            [WETH_ADDR, ONE_WETH],
-                        ),
-                        coder.encode(
-                            ["address", "uint256"],
-                            [USDC_ADDR, 990000n],
-                        ),
-                    ]),
-                ],
-                9999999999n,
-            );
-            const result = uniswap.decode(data, ROUTER_ADDR);
-            expect(detail(result, "Steps").value).toBe(
-                "V4 Swap (could not be decoded)",
-            );
-            expect(detail(result, "Token In").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-            expect(detail(result, "Token Out").value).toBe(
-                "Unknown (could not be decoded)",
-            );
-        },
-    );
-
     test("decodes V2_SWAP_EXACT_IN with known tokens", () => {
         const data = buildExecute(
             "0x08", // V2_SWAP_EXACT_IN
@@ -724,11 +548,9 @@ describe("uniswap decoder", () => {
         const result = uniswap.decode(data, ROUTER_ADDR);
         expect(result).not.toBeNull();
 
-        // The V4 swap action's parameters are empty, so that step is said to
-        // be undecoded.
         const steps = result.details.find((d) => d.label === "Steps");
         expect(steps.value).toBe(
-            "Permit2 Permit \u2192 V4 Swap (could not be decoded) \u2192 Unwrap WETH",
+            "Permit2 Permit \u2192 V4 Swap \u2192 Unwrap WETH",
         );
     });
 

tests/uniswapUndeterminedTokenIn.test.js

@@ -97,11 +97,7 @@ describe("an execute() whose input currency never decoded", () => {
         ]);
 
     test("says the input token is unknown instead of naming ETH", () => {
-        // The swap action that would name it could not be read, so the line
-        // says that rather than REFUSAL's "not named in the calldata".
-        expect(detail(data(), "Token In").value).toBe(
-            "Unknown (could not be decoded)",
-        );
+        expect(detail(data(), "Token In").value).toBe(REFUSAL);
     });
 
     test("keeps a Token In line, so the screen never omits what is paid", () => {

tests/walletDefects.test.js

@@ -153,6 +153,18 @@ describe("the explanatory copy", () => {
         expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
     });
 
+    // The wallet holds the imported key but will not export it, so the copy
+    // must name every key the user may hold that reaches the addresses
+    // outside it.
+    test("it names the keys that reach the addresses outside this wallet", () => {
+        const body = defect.paragraphs.join(" ");
+
+        expect(body).toMatch(/private key export are disabled/);
+        expect(body).toMatch(
+            /with the extended private key you imported, if you kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation/,
+        );
+    });
+
     test("it says the wallet is not deleted and what the user can do", () => {
         const body = defect.paragraphs.join(" ");