fix: tracked tokens' balances are read through the RPC endpoint (closes #669)

refreshBalances() now reads the balance of every token tracked on the
active network, at every address, with balanceOf through the same
provider as the ETH balance. The entry takes its holder count and
decimals from Blockscout's entry for the token in the same refresh, or
keeps them from before while Blockscout fails. A failed balanceOf keeps
the token's previous entry, or takes Blockscout's entry when there is
none, and is logged. Blockscout's answer still adds the tokens the user
has not tracked, as before.

The browser test for a hostile symbol now untracks the stub token
first, because a tracked token is listed under the symbol it was added
with.

Model: opus-5-5

README.md

@@ -845,7 +845,7 @@ src/
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
     alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
+    balances.js       — ETH and tracked token balances via RPC, others via Blockscout
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
@@ -1243,7 +1243,11 @@ only when no earlier step set it. It finds each side by three rules:
    is their sum; in any other case the step gives no `Amount`. The decoder reads
    no amount from an exact-out action, and an open delta is not a stated amount.
    Its `Min. received` is found the same way, from the `amountOutMin` of the
-   actions that buy the output currency.
+   actions that buy the output currency, except that the step gives none when a
+   swap action in it also spends the output currency, because the step then does
+   not pay out all that those actions buy. A step that buys at least 0.5 WETH
+   with USDT and swaps 0.3 WETH of it for USDC, with WETH as its output side,
+   gives no `Min. received`.
 3. If any swap action in the step could not be read, only `SETTLE`,
    `SETTLE_ALL`, `TAKE` and `TAKE_ALL` name its sides, and the step gives no
    `Amount` or `Min. received`. A side they did not name is unknown, and the
@@ -1375,23 +1379,30 @@ The core hierarchy is **Wallets → Addresses**:
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
-Which tokens an address shows is decided by `fetchTokenBalances()` in
-`src/shared/balances.js`, from the Blockscout `token-balances` response, so
-tokens do appear without the user adding them. An ERC-20 is shown when its
-balance is nonzero and it is in the bundled known-token list, is tracked by the
-user, or has 1,000 or more holders; a token claiming a symbol from the bundled
-list from any other contract address is always dropped, and so is any token
-claiming a symbol that belongs to the native asset and therefore has no
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
-tokens with fewer than 1,000 holders" setting governs the transaction history
-and the send-screen token selector, not this list. A token's holder count is
-unknown when the explorer reports none, or reports anything other than a whole
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
-or more, so such a token is shown only when it is on the bundled list or
-tracked. `fetchTokenBalances()` stores every nonzero holding of a token it
-admits, however small, but a holding below 0.000001 is left out of the balance
+Which tokens an address shows is decided on every refresh by `refreshBalances()`
+in `src/shared/balances.js`. The balance of each token tracked on the active
+network is read with `balanceOf` through the RPC endpoint, for every address.
+Its holder count and `decimals` are those of Blockscout's entry for it in the
+same refresh, kept from before while Blockscout fails. A read that fails keeps
+that token's previous entry, as a failed ETH balance keeps its figure, or takes
+Blockscout's entry from the same refresh when there is none. Every other token
+comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
+tokens do appear without the user adding them, and they keep their previous
+figures while Blockscout fails. A tracked token is shown when its balance is
+nonzero, and any other ERC-20 when its balance is nonzero and it is in the
+bundled known-token list or has 1,000 or more holders. A token claiming a symbol
+from the bundled list from any other contract address is always dropped, tracked
+or not, and so is any token claiming a symbol that belongs to the native asset
+and therefore has no legitimate contract at all (`"ETH"`, and every network's
+`nativeCurrency`, such as `"SepoliaETH"`, on every network). That filter is
+unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
+the transaction history and the send-screen token selector, not this list. A
+token's holder count is unknown when the explorer reports none, or reports
+anything other than a whole number written in digits alone, such as `1,000` or
+`1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list does not
+take an unknown count as 1,000 or more, so such a token is shown only when it is
+on the bundled list or tracked. Every nonzero holding of a token shown is stored
+exactly, however small, but a holding below 0.000001 is left out of the balance
 lists, the send-screen token selector, the address total and the remove-address
 warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
@@ -2658,7 +2669,8 @@ AutistMask is not a fully self-contained offline tool. It necessarily
 communicates with three external services to function as a wallet:
 
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
-  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
+  them the balance of every tracked token at every address (`balanceOf`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
   receipts. The default endpoint is a public RPC (configurable by the user to

src/shared/balances.js

@@ -1,4 +1,5 @@
-// Balance fetching: ETH balances via RPC, ERC-20 token balances via
+// Balance fetching: ETH balances and the balances of the tokens the user
+// tracks via RPC, the other ERC-20 token balances and the holder counts via
 // Blockscout, ENS reverse lookup via RPC.
 
 const {
@@ -81,7 +82,9 @@ function rawUnits(value) {
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders.
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
+// balance is read through the RPC endpoint instead, and its row here gives that
+// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -205,8 +208,96 @@ async function fetchTokenBalances(
     }
 }
 
-// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// The entries at `address` of the tokens the user tracks, shaped as
+// fetchTokenBalances() returns them, for the tokens the address holds.
+//
+// The balance is read with balanceOf through the RPC endpoint. The name and
+// symbol are the tracked token's. `decimals` and `holders` are those of
+// Blockscout's entry for the token in `explorerRequest`, this refresh's
+// fetchTokenBalances() for the address; while Blockscout fails they are kept
+// from the token's entry in `previous`, the address's entries before this
+// refresh. The balance is stated at the scale the screens read the token at
+// (resolveTokenDecimals()): the bundled list's, then the one the tracked token
+// records, then Blockscout's, as in fetchTokenBalances().
+//
+// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
+// balance keeps its figure, or takes Blockscout's entry from this refresh when
+// it has none. The failure is logged. A balance of zero gets no entry, as a
+// zero Blockscout reports gets none: the balance lists take a tracked token's
+// zero from the tracked list. A token whose symbol the spoof rule refuses gets
+// no entry either, as in fetchTokenBalances().
+//
 // `signal` is as for fetchTokenBalances().
+async function fetchTrackedTokenBalances(
+    provider,
+    address,
+    trackedTokens,
+    previous,
+    explorerRequest,
+    signal,
+) {
+    const listed = trackedTokens.filter(
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
+    );
+    // Each token's balanceOf answer, or null where it failed.
+    const balances = await Promise.all(
+        listed.map(async (token) => {
+            try {
+                const contract = new Contract(
+                    token.address,
+                    ERC20_ABI,
+                    provider,
+                );
+                return await contract.balanceOf(address);
+            } catch (e) {
+                if (!signal?.aborted) {
+                    log.errorf(
+                        "token balance failed",
+                        address,
+                        token.address,
+                        e.shortMessage || e.message,
+                    );
+                }
+                return null;
+            }
+        }),
+    );
+    const explorerRows = await explorerRequest;
+    const reported = explorerRows ?? previous;
+
+    const rows = [];
+    listed.forEach((token, i) => {
+        const lower = token.address.toLowerCase();
+        const entryIn = (list) =>
+            list.find((row) => String(row.address).toLowerCase() === lower);
+        const raw = balances[i];
+        if (raw === null) {
+            const kept = entryIn(previous) || entryIn(explorerRows || []);
+            if (kept) rows.push(kept);
+            return;
+        }
+        if (raw === 0n) return;
+        const entry = entryIn(reported);
+        const decimals = entry ? entry.decimals : null;
+        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const scale = known !== null ? known : decimals;
+        rows.push({
+            address: token.address,
+            name: token.name || "",
+            symbol: token.symbol || "???",
+            decimals: decimals,
+            // null when nothing knows the scale: a holding whose amount
+            // cannot be stated, never a zero.
+            balance: scale === null ? null : formatTokenBalance(raw, scale),
+            holders: entry ? entry.holders : null,
+        });
+    });
+    return rows;
+}
+
+// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// `trackedTokens` are the tokens tracked on the active network. `signal` is as
+// for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
@@ -217,6 +308,8 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
+    const tracked = trackedTokens || [];
+    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
 
     for (const wallet of wallets) {
@@ -266,23 +359,42 @@ async function refreshBalances(
                     }),
             );
 
-            // ERC-20 token balances via Blockscout
+            // ERC-20 token balances: the tracked tokens' through the RPC
+            // endpoint, and from Blockscout the tokens the user has not
+            // tracked. When Blockscout fails, the untracked rows from before
+            // this refresh stay. The Blockscout request is started first and
+            // handed to fetchTrackedTokenBalances() too, which waits for it
+            // after sending its balanceOf reads, so the two run side by side.
+            const previous = addr.tokenBalances || [];
+            const explorerRequest = fetchTokenBalances(
+                addr.address,
+                blockscoutUrl,
+                tracked,
+                signal,
+            );
             updates.push(
-                fetchTokenBalances(
-                    addr.address,
-                    blockscoutUrl,
-                    trackedTokens,
-                    signal,
-                ).then((balances) => {
-                    if (balances !== null) {
-                        addr.tokenBalances = balances;
-                        log.debugf(
-                            "Token balances",
-                            addr.address,
-                            balances.length,
-                            "tokens",
-                        );
-                    }
+                Promise.all([
+                    fetchTrackedTokenBalances(
+                        provider,
+                        addr.address,
+                        tracked,
+                        previous,
+                        explorerRequest,
+                        signal,
+                    ),
+                    explorerRequest,
+                ]).then(([trackedRows, explorerRows]) => {
+                    const untrackedRows = (explorerRows ?? previous).filter(
+                        (row) =>
+                            !trackedSet.has(String(row.address).toLowerCase()),
+                    );
+                    addr.tokenBalances = trackedRows.concat(untrackedRows);
+                    log.debugf(
+                        "Token balances",
+                        addr.address,
+                        addr.tokenBalances.length,
+                        "tokens",
+                    );
                 }),
             );
         }

src/shared/uniswap.js

@@ -953,7 +953,9 @@ function totalAmount(amounts) {
 // 2. Amount is the amountIn of the swap action that spends Token In. If
 //    several exact-in actions spend it, each with a stated amount, it is
 //    their sum; in any other case there is none. Min. received is the same
-//    for amountOutMin and the actions that buy Token Out.
+//    for amountOutMin and the actions that buy Token Out, except that there
+//    is none when a swap action in the step also spends Token Out: the step
+//    then does not pay out all that those actions buy.
 // 3. If any swap action in the step cannot be read, only SETTLE, SETTLE_ALL,
 //    TAKE and TAKE_ALL name the sides, and there is no Amount or Min.
 //    received.
@@ -1187,11 +1189,13 @@ function decodeV4Swap(input) {
         const boughtOnly = currenciesNotIn(bought, spent);
         if (present(takeToken) || boughtOnly.length === 1) {
             tokenOut = present(takeToken) ? takeToken : boughtOnly[0];
-            amountOutMin = totalAmount(
-                swaps
-                    .filter((s) => s.tokenOut === tokenOut)
-                    .map((s) => s.amountOutMin),
-            );
+            if (!spent.includes(tokenOut)) {
+                amountOutMin = totalAmount(
+                    swaps
+                        .filter((s) => s.tokenOut === tokenOut)
+                        .map((s) => s.amountOutMin),
+                );
+            }
         }
 
         return {

tests/balanceRefreshCancelled.test.js

@@ -18,6 +18,11 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TRACKED = {
+    address: "0x7777777777777777777777777777777777777777",
+    symbol: "TRK",
+    decimals: 6,
+};
 
 const realFetch = globalThis.fetch;
 let logged;
@@ -30,9 +35,9 @@ beforeEach(() => {
     const failedToFetch = async () => {
         throw new TypeError("Failed to fetch");
     };
-    // The RPC calls (ETH balance, ENS name, and the scan's balance and
-    // transaction count) and the explorer request (token balances) all fail
-    // the same way.
+    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
+    // the scan's balance and transaction count) and the explorer request (the
+    // other token balances) all fail the same way.
     FetchRequest.registerGetUrl(failedToFetch);
     globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -49,7 +54,7 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
-        [],
+        [TRACKED],
         "mainnet",
         signal,
     );
@@ -60,6 +65,7 @@ test("a failure while the popup is open is reported", async () => {
     for (const label of [
         "ETH balance failed",
         "ENS reverse failed",
+        "token balance failed",
         "fetchTokenBalances failed: Failed to fetch",
     ]) {
         expect(logged.some((line) => line.includes(label))).toBe(true);

tests/e2e/run.js

@@ -3480,6 +3480,24 @@ function hostileSymbolState(page, tokenAddress) {
 }
 
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
+    // The stub token is no longer tracked from here on, so the explorer is
+    // what lists it, as it lists a token airdropped to the victim. A tracked
+    // token is listed from the RPC endpoint under the symbol it was added
+    // with, which the hostile symbol below never reaches
+    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+    await env.page.click("#settings-tracked-tokens .btn-remove-token");
+    // The list is drawn again once the removal is saved.
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("settings-tracked-tokens")
+                .innerText.trim() === "None",
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.seedTokenBalance = true;
     env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;

tests/trackedTokenBalances.test.js

@@ -0,0 +1,303 @@
+// The balance of each token the user tracks is read with balanceOf through the
+// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
+// holder count and decimals, and adds the tokens the user has not tracked
+// (https://git.eeqj.de/sneak/AutistMask/issues/669).
+//
+// The real refreshBalances() runs against a fake JSON-RPC node, answered
+// through ethers' own request hook, and a fake Blockscout, answered through
+// fetch().
+
+const { AbiCoder, FetchRequest } = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
+const FIRST = "0x1111111111111111111111111111111111111111";
+const SECOND = "0x2222222222222222222222222222222222222222";
+
+// A token the user tracks, outside the bundled list, at 6 decimals.
+const TOKEN = "0x7777777777777777777777777777777777777777";
+const TRACKED = {
+    address: TOKEN,
+    symbol: "TRK",
+    name: "Tracked Token",
+    decimals: 6,
+};
+
+// USDC, from the bundled list, which the user does not track.
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+// Neither on the bundled list nor tracked.
+const OTHER = "0x8888888888888888888888888888888888888888";
+
+const ZERO_WORD = "0x" + "0".repeat(64);
+const BALANCE_OF = "0x70a08231";
+
+// What balanceOf answers, by token contract and then by holder. A pair that is
+// not here makes balanceOf fail.
+let holdings;
+// What Blockscout answers for every address; null makes the request fail.
+let explorerRows;
+let logged;
+
+// One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
+// answered with no resolver, so no name.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    if (req.method === "eth_getBalance") {
+        return { ...envelope, result: "0x0" };
+    }
+    if (req.method !== "eth_call") {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    const { to, data } = req.params[0];
+    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
+    const holder = "0x" + data.slice(-40);
+    const amount = (holdings[to.toLowerCase()] || {})[holder];
+    if (amount === undefined) {
+        return {
+            ...envelope,
+            error: { code: -32000, message: "fixture: balanceOf failed" },
+        };
+    }
+    return {
+        ...envelope,
+        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
+    };
+}
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+    holdings = {};
+    explorerRows = null;
+    logged = [];
+    jest.spyOn(console, "error").mockImplementation((...args) => {
+        logged.push(args.map(String).join(" "));
+    });
+    FetchRequest.registerGetUrl(async (req) => {
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+    globalThis.fetch = jest.fn(async () => {
+        if (explorerRows === null) throw new TypeError("Failed to fetch");
+        return { ok: true, status: 200, json: async () => explorerRows };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    jest.restoreAllMocks();
+});
+
+// One Blockscout token-balances row.
+function explorerRow(address, symbol, value, holders = "50000") {
+    return {
+        value: String(value),
+        token: {
+            type: "ERC-20",
+            address_hash: address,
+            symbol: symbol,
+            name: symbol,
+            decimals: "6",
+            holders_count: holders,
+        },
+    };
+}
+
+// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
+// decimals and holder count Blockscout reported for it, if any.
+function trackedRow(balance, decimals = null, holders = null) {
+    return {
+        address: TOKEN,
+        name: "Tracked Token",
+        symbol: "TRK",
+        decimals: decimals,
+        balance: balance,
+        holders: holders,
+    };
+}
+
+async function refresh(addresses, trackedTokens) {
+    await refreshBalances(
+        [{ addresses }],
+        RPC_URL,
+        EXPLORER_URL,
+        trackedTokens,
+        "mainnet",
+        new AbortController().signal,
+    );
+    return addresses;
+}
+
+test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
+    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
+    // Exact, never cut: one base unit is not zero.
+    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
+});
+
+test("with Blockscout failing, the untracked rows from before stay", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const usdc = {
+        address: USDC,
+        name: "USD Coin",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [usdc] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
+});
+
+test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [
+        explorerRow(TOKEN, "TRK", 9000000),
+        explorerRow(USDC, "USDC", 5000000),
+        // Too few holders, and neither on the bundled list nor tracked.
+        explorerRow(OTHER, "SPAM", 5000000, "10"),
+        // A known symbol from a contract it does not belong to.
+        explorerRow(OTHER, "USDC", 5000000),
+    ];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        trackedRow("2.0", 6, 50000),
+        {
+            address: USDC,
+            name: "USDC",
+            symbol: "USDC",
+            decimals: 6,
+            balance: "5.0",
+            holders: 50000,
+        },
+    ]);
+});
+
+test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
+    // through to Send's token list.
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const before = trackedRow("7.0", 6, 50000);
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([before]);
+    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
+        true,
+    );
+});
+
+test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
+    // balanceOf fails at FIRST and answers at SECOND.
+    holdings[TOKEN] = { [SECOND]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: TOKEN,
+            name: "TRK",
+            symbol: "TRK",
+            decimals: 6,
+            balance: "9.0",
+            holders: 50000,
+        },
+    ]);
+    // Where balanceOf answers, its figure stands.
+    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
+    holdings[TOKEN] = { [FIRST]: 0n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});
+
+test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
+    holdings[TOKEN] = { [FIRST]: 5n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow(null)]);
+});
+
+test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a tracked token wearing a known symbol from another contract is not listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    // Its entry from before goes too, although Blockscout fails.
+    const before = {
+        address: OTHER,
+        name: "Fake",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});

tests/uniswap.test.js

@@ -3730,6 +3730,88 @@ describe("uniswap decoder", () => {
         },
     );
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/574 — a V4 step that buys
+    // at least 0.5 WETH with 1,000 USDT, spends some of it on USDC, and takes
+    // the USDC and then the WETH, so its output side is WETH. Only what is
+    // left of the 0.5 WETH is sure to reach the user, and the screen read
+    // Min. received 0.5000 WETH.
+    test.each([
+        {
+            spend: "0.3 WETH for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN_SINGLE_ID,
+                param: encodeV4ExactInSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "0.3 WETH through DAI for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN,
+                param: encodeV4ExactIn(
+                    WETH_ADDR,
+                    [DAI_ADDR, USDC_ADDR],
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "at most 0.3 WETH for exactly 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_OUT_SINGLE_ID,
+                param: encodeV4ExactOutSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    594000000n,
+                    300000000000000000n,
+                ),
+            },
+        },
+    ])(
+        "a V4 step that buys WETH and spends $spend, with WETH as its output side, shows no Min. received",
+        ({ swap }) => {
+            const data = buildExecute(
+                "0x10",
+                [
+                    encodeV4Swap(
+                        new Uint8Array([
+                            USDT_FOR_WETH_IN.id,
+                            swap.id,
+                            V4_SETTLE_ALL_ID,
+                            V4_TAKE_ID,
+                            V4_TAKE_ID,
+                        ]),
+                        [
+                            USDT_FOR_WETH_IN.param,
+                            swap.param,
+                            encodeV4SettleAll(USDT_ADDR, 1000000000n),
+                            encodeV4Take(USDC_ADDR),
+                            encodeV4Take(WETH_ADDR),
+                        ],
+                    ),
+                ],
+                9999999999n,
+            );
+
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
+            expect(result.name).toBe("Swap USDT → WETH");
+            expect(detail(result, "Amount").value).toBe("1000.0000 USDT");
+            expect(detail(result, "Token Out").address).toBe(WETH_ADDR);
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
     // A V4 step that spends WETH on USDC and on DAI. Its swap actions buy two
     // currencies that none of them spends, and CLOSE_CURRENCY, which the
     // decoder does not read, names no side, so its output side is unknown.

tests/uniswapRecipient.test.js

@@ -1332,6 +1332,10 @@ describe("any token left in the router is not received", () => {
                 ),
             ),
             left: tokenLine(WETH, "WETH"),
+            // The second swap action spends 1 USDC of what the first buys,
+            // so the step states no minimum
+            // (https://git.eeqj.de/sneak/AutistMask/issues/574).
+            noMin: true,
         },
         {
             kind: "a WRAP_ETH of 1 ETH into the router, then a V4 SETTLE of OPEN_DELTA from the router before the swap, which the user settles",
@@ -1432,7 +1436,7 @@ describe("any token left in the router is not received", () => {
             ),
             left: { label: "Token moved into the router", value: "ETH" },
         },
-    ])("$kind", ({ data, left, spent, unread }) => {
+    ])("$kind", ({ data, left, spent, unread, noMin }) => {
         const result = decode(data);
         expect(labels(result)).toEqual([
             "Protocol",
@@ -1458,7 +1462,7 @@ describe("any token left in the router is not received", () => {
             "Token Out",
             "Paid to",
             "Token moved into the router",
-            "Min. paid out",
+            ...(noMin ? [] : ["Min. paid out"]),
             "Steps",
             "Deadline",
         ]);
@@ -1474,7 +1478,9 @@ describe("any token left in the router is not received", () => {
         }
         expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
         expect(detail(result, "Token moved into the router")).toEqual(left);
-        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
+        expect(detail(result, "Min. paid out")?.value).toBe(
+            noMin ? undefined : "1990.0000 USDC",
+        );
     });
 
     // Uniswap's own routes: a swap paid in ETH wraps into the router what its