fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout for history
and token lookups, and each recipient to Etherscan for its label. Two settings,
"Use Blockscout" and "Check recipients on Etherscan", now gate those requests
where they are made. Both are off in a new profile and offered unticked on
Welcome and in Settings. While one is off, the screens that relied on it say so
in a plain line naming the setting; after either changes in Settings, Back
draws the screen it lands on again. ENS lookups ask only the RPC endpoint, so a
name resolved off-chain does not resolve. README and the user guide say what is
contacted by default and what each setting adds.

Model: opus-5-5

README.md

@@ -14,14 +14,18 @@ None of the common alternatives work on Firefox.
 Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
 Everything you need, nothing you don't. We import as few libraries as possible,
 don't implement any crypto, and don't send user-specific data anywhere but a
-(user-configurable) Ethereum RPC endpoint (which defaults to a public node). The
-extension contacts three user-configurable services: the configured RPC node for
-blockchain interactions, a public CoinDesk API (no API key) for realtime price
-information, and a Blockscout block-explorer API for transaction history and
-token balances. It also performs best-effort Etherscan address label lookups
-during transaction confirmation. A community-maintained phishing domain
-blocklist is built into the extension at build time and checked locally; nothing
-is fetched for it at runtime.
+(user-configurable) Ethereum RPC endpoint (which defaults to a public node)
+unless the user turns on one of the two lookups below. Out of the box the
+extension contacts the configured RPC node for blockchain interactions and a
+public CoinDesk API (no API key) for realtime price information, which is sent
+token symbols and nothing else. Two more services are sent none of the user's
+data until the user turns them on, on the Welcome screen or in Settings: a
+Blockscout block-explorer API for transaction history, the tokens the user has
+not tracked and transaction details ("Use Blockscout"), and best-effort
+Etherscan address label lookups during transaction confirmation ("Check
+recipients on Etherscan"). A community-maintained phishing domain blocklist is
+built into the extension at build time and checked locally; nothing is fetched
+for it at runtime.
 
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -422,6 +426,24 @@ It also covers the red banner on the Settings screen: switching the network
 there to Sepolia must put up the `[TESTNET]` banner, and switching back to
 mainnet must take it down, both while Settings is still on screen.
 
+It also covers what a new install sends to Blockscout and Etherscan
+([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The route handler
+records every request the extension makes, from its pages and its background
+worker, from when the harness installs it, before the first popup page opens; a
+request the background worker makes while it starts up, before then, is not
+recorded. Welcome must offer "Use Blockscout" and "Check recipients on
+Etherscan" unticked. With neither changed, Home, AddressDetail, AddressToken and
+ConfirmTx must show the lines saying what is off; the popup is then closed until
+the background has run a balance refresh of its own, and not one recorded
+request may have gone to Blockscout or Etherscan. "Use Blockscout" is then
+ticked from AddressDetail's gear: on "Back", AddressDetail must ask Blockscout
+for its history and no longer say it is off, and Blockscout must then be asked
+for the token balances. "Check recipients on Etherscan" is ticked from
+ConfirmTx's gear: on "Back", ConfirmTx must ask Etherscan about the recipient
+and show the label the stub page gives it. Both stay on for the rest of the run.
+TransactionDetail with "Use Blockscout" off is not driven here, since no history
+row leads to it then; the unit tests cover it.
+
 It also covers the confirmation screen, for both a native ETH send and an ERC-20
 send: Send disabled while the fee estimate is in flight, enabled once it lands,
 the fee block quoting the expected cost and the reserve separately, the distinct
@@ -845,7 +867,8 @@ src/
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
     alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
+    balances.js       — ETH and tracked token balances via RPC, others via
+                        Blockscout while "Use Blockscout" is on
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
@@ -1243,7 +1266,11 @@ only when no earlier step set it. It finds each side by three rules:
    is their sum; in any other case the step gives no `Amount`. The decoder reads
    no amount from an exact-out action, and an open delta is not a stated amount.
    Its `Min. received` is found the same way, from the `amountOutMin` of the
-   actions that buy the output currency.
+   actions that buy the output currency, except that the step gives none when a
+   swap action in it also spends the output currency, because the step then does
+   not pay out all that those actions buy. A step that buys at least 0.5 WETH
+   with USDT and swaps 0.3 WETH of it for USDC, with WETH as its output side,
+   gives no `Min. received`.
 3. If any swap action in the step could not be read, only `SETTLE`,
    `SETTLE_ALL`, `TAKE` and `TAKE_ALL` name its sides, and the step gives no
    `Amount` or `Min. received`. A side they did not name is unknown, and the
@@ -1375,30 +1402,40 @@ The core hierarchy is **Wallets → Addresses**:
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
-Which tokens an address shows is decided by `fetchTokenBalances()` in
-`src/shared/balances.js`, from the Blockscout `token-balances` response, so
-tokens do appear without the user adding them. An ERC-20 is shown when its
-balance is nonzero and it is in the bundled known-token list, is tracked by the
-user, or has 1,000 or more holders; a token claiming a symbol from the bundled
-list from any other contract address is always dropped, and so is any token
-claiming a symbol that belongs to the native asset and therefore has no
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+Which tokens an address shows is decided on every refresh by `refreshBalances()`
+in `src/shared/balances.js`. The balance of each token tracked on the active
+network is read with `balanceOf` through the RPC endpoint, for every address.
+Its holder count and `decimals` are those of Blockscout's entry for it in the
+same refresh, kept from before while Blockscout fails. A read that fails keeps
+that token's previous entry, as a failed ETH balance keeps its figure, or takes
+Blockscout's entry from the same refresh when there is none. Every other token
+comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
+tokens do appear without the user adding them, and they keep their previous
+figures while Blockscout fails. The refresh asks Blockscout only while the user
+has "Use Blockscout" on. While it is off, as it is until the user turns it on, a
+tracked token's entry has no holder count and no `decimals` of Blockscout's, so
+its balance is stated at the scale the bundled list or the tracked token
+records, and no other token is listed, those from earlier refreshes included. A
+tracked token is shown when its balance is nonzero, and any other ERC-20 when
+its balance is nonzero and it is in the bundled known-token list or has 1,000 or
+more holders. A token claiming a symbol from the bundled list from any other
+contract address is always dropped, tracked or not, and so is any token claiming
+a symbol that belongs to the native asset and therefore has no legitimate
+contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
 tokens with fewer than 1,000 holders" setting governs the transaction history
 and the send-screen token selector, not this list. A token's holder count is
 unknown when the explorer reports none, or reports anything other than a whole
 number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
 in `src/shared/holders.js`). This list does not take an unknown count as 1,000
 or more, so such a token is shown only when it is on the bundled list or
-tracked. `fetchTokenBalances()` stores every nonzero holding of a token it
-admits, however small, but a holding below 0.000001 is left out of the balance
-lists, the send-screen token selector, the address total and the remove-address
-warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
+tracked. Every nonzero holding of a token shown is stored exactly, however
+small, but a holding below 0.000001 is left out of the balance lists, the
+send-screen token selector, the address total and the remove-address warning
+(`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
-zero balance" is on; a token just added on AddToken or SettingsAddToken whose
-balance no refresh has fetched yet is listed there as `quantity unknown` (see
-AddToken).
+zero balance" is on.
 
 #### Stored state and its version
 
@@ -1567,14 +1604,10 @@ renders as it goes, and `viewRouter.js` records every screen that reaches
 more — rendering it a second time would re-fetch and overwrite what it holds,
 such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
-while the user was away from it.
-
-The popup refreshes balances every ten seconds while it is open
-(`doRefreshAndRender()` in `src/popup/index.js`). Each refresh that returns
-draws the wallet list again and, when AddressDetail or AddressToken is up, that
-screen's USD total and balance lines; its transaction list is left alone. No
-other screen is drawn again by a refresh, DeleteAddress and its balance lines
-included.
+while the user was away from it. Changing "Use Blockscout" or "Check recipients
+on Etherscan" in Settings makes every screen but Settings count as not yet
+rendered, so "Back" renders the screen it lands on under the new setting; the
+stack is left as it is.
 
 A network switch leaves every screen on the page showing the previous network.
 The user makes it in Settings, or approves a site's request and the background
@@ -1617,8 +1650,15 @@ view would leave a wallet one click from deletion.
   screen in that case.
 - **Elements**:
     - "Welcome! To get started, add a wallet." text
+    - A well saying that the wallet sends the user's data only to the Ethereum
+      RPC endpoint unless one of the two settings in it is turned on, here or
+      later in Settings: the "Use Blockscout" and "Check recipients on
+      Etherscan" checkboxes, the same two as in Settings, each with its sentence
+      on what it sends and to whom. Both are unticked until the user ticks them
     - "Add wallet" button
 - **Transitions**:
+    - Ticking or unticking either checkbox → stores the setting, as Settings
+      does (no screen change)
     - "Add wallet" → **AddWallet**
 
 #### Home (`main`)
@@ -1639,6 +1679,8 @@ view would leave a wallet one click from deletion.
       holding more than one address); the ENS name, if resolved, is below it;
       then the full address on a row of its own, followed by the address USD
       total and a balance line for ETH and for each token shown for that address
+    - While "Use Blockscout" is off, a line under the wallet list: "Only tracked
+      tokens are listed, because "Use Blockscout" is off in Settings."
     - "Recent Transactions": up to 25 transactions merged across every address
       of every wallet, deduplicated by hash and filtered. Each row is three
       lines: age and direction, then the counterparty's colour dot (with our own
@@ -1646,7 +1688,11 @@ view would leave a wallet one click from deletion.
       counterparty's full address on a row of its own. A contract creation has
       no counterparty: its second line is the amount alone and its third line
       says "This transaction creates a new contract. It has no recipient." The
-      transaction lists on AddressDetail and AddressToken draw the same rows
+      transaction lists on AddressDetail and AddressToken draw the same rows.
+      The history comes from Blockscout. While "Use Blockscout" is off,
+      Blockscout is not asked, and this list and those two show the one line "No
+      transaction history is shown, because "Use Blockscout" is off in
+      Settings."
     - "Add additional wallet..." link at bottom
 - **Transitions**:
     - Tap address row → sets the active address and broadcasts
@@ -1714,10 +1760,13 @@ view would leave a wallet one click from deletion.
     - Full address (color dot, etherscan link, tap to copy)
     - USD total for address (see [Partial USD totals](#partial-usd-totals))
     - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
-      places, USD inline). Each balance row is clickable → **AddressToken**
+      places, USD inline). Each balance row is clickable → **AddressToken**.
+      While "Use Blockscout" is off, the line Home has under its wallet list
+      follows it
     - Send / Receive / + Token buttons and a "···" menu button
     - "···" dropdown containing a single "Export Private Key" entry
-    - Transaction list (with ENS resolution for counterparties)
+    - Transaction list (with ENS resolution for counterparties), or the line
+      Home's list shows while "Use Blockscout" is off
 - **Transitions**:
     - Tap balance row → **AddressToken** (for that token)
     - "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1786,8 +1835,10 @@ view would leave a wallet one click from deletion.
       etherscan link) plus name, symbol, decimals, holder count and project
       website where known. The "Holders:" row is left out, not shown as 0, when
       the token's balance-list entry has no holder count: the explorer did not
-      report a readable one, or the token is not in the balance list
-    - Token-filtered transaction list (only this token's transfers)
+      report a readable one, "Use Blockscout" is off, or the token is not in the
+      balance list
+    - Token-filtered transaction list (only this token's transfers), or the line
+      Home's list shows while "Use Blockscout" is off
 - **Transitions**:
     - "Send" → **Send** (token locked: the dropdown is replaced by a static
       symbol and contract address)
@@ -1873,7 +1924,12 @@ view would leave a wallet one click from deletion.
       recipient that has never sent a transaction and holds no ETH, recipient is
       a contract, burn address, and an Etherscan phishing/scam label. An address
       that has received ETH but never sent a transaction still holds that ETH,
-      so it gets no warning
+      so it gets no warning. The Etherscan label check is made only while "Check
+      recipients on Etherscan" is on. While it is off, the Etherscan box is left
+      out and a line in its place says "This address was not checked on
+      Etherscan, because "Check recipients on Etherscan" is off in Settings."
+      Which of the two is there is known when the screen is drawn, so neither
+      moves anything later
     - Errors (an invalid amount), plus five reserved error boxes, so the balance
       and the fee arriving later move nothing — the amount exceeds the balance
       (for a token whose scale is unknown it says the token's balance is
@@ -1919,8 +1975,8 @@ view would leave a wallet one click from deletion.
       are that network's, so a testnet transaction shows none, its From, To and
       token contract links open that network's explorer, the balance read, the
       fee estimate and the contract and never-sent recipient checks ask that
-      network's RPC endpoint, and the Etherscan label check asks that network's
-      explorer
+      network's RPC endpoint, and the Etherscan label check, when it is made,
+      asks that network's explorer
     - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
       total fee the RPC endpoint fills in at signing is over its bound in
       `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
@@ -2039,7 +2095,12 @@ view would leave a wallet one click from deletion.
   AddressToken. The screen describes the transaction on the network it was sent
   on, whichever network is active: its block, network details, decoded details
   and raw data are read from that network's Blockscout, the one Settings has for
-  it, and its etherscan links open that network's explorer.
+  it, and its etherscan links open that network's explorer. They are read only
+  while "Use Blockscout" is on. The screen can still be shown with it off, when
+  the user opens Settings from it, turns the setting off and presses Back; then
+  Blockscout is not asked, and a line in their place says "No block, decoded
+  details, network details or raw data are shown, because "Use Blockscout" is
+  off in Settings."
 - **Elements** (grouped into logical blocks using light well containers; field
   labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
@@ -2087,14 +2148,7 @@ view would leave a wallet one click from deletion.
     - "Add" button
 - **Transitions**:
     - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
-      **AddressDetail**. The token's balance is not known until a balance
-      refresh that started with it tracked has fetched every address's token
-      balances; until then its balance line reads `quantity unknown`, never
-      `0.0000`, unless the explorer had already listed a holding of it. That
-      holds after the popup is closed and opened again, as the tokens still
-      waiting for a fetch are stored with the profile. A refresh that returns
-      draws AddressDetail's balances again (see Navigation), so the fetched
-      balance shows without the screen being reopened
+      **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2129,8 +2183,18 @@ view would leave a wallet one click from deletion.
       already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
-    - Blockscout API: endpoint URL input + "Save" button (validated against
-      `/stats` before being saved)
+    - Blockscout API: a "Use Blockscout" checkbox, unticked until the user ticks
+      it, with a sentence saying it sends the user's addresses, and the hash of
+      each transaction opened, to the Blockscout API below, for transaction
+      history, tokens not tracked, and transaction details; then the endpoint
+      URL input + "Save" button (validated against `/stats` before being saved,
+      a request the user presses for that carries no user data, made whether or
+      not the checkbox is ticked)
+    - Etherscan: a "Check recipients on Etherscan" checkbox, unticked until the
+      user ticks it, with a sentence saying it sends the address about to be
+      sent to, to Etherscan, to look for a phishing or scam label on it. Both
+      checkboxes are one setting each for every network, and Welcome offers the
+      same two
     - Token Spam Protection:
         - "Hide fake tokens impersonating a known symbol" checkbox
         - "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2154,6 +2218,9 @@ view would leave a wallet one click from deletion.
     - Debug: hidden until revealed, then an "Enable debug mode" checkbox that
       turns on the red banner and verbose logging
 - **Transitions**:
+    - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
+      stores the setting (no screen change). The next balance refresh and every
+      screen drawn after that follow it
     - "+ Add wallet" → **AddWallet**
     - "+ Add token" → **SettingsAddToken**
     - `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2371,9 +2438,7 @@ view would leave a wallet one click from deletion.
       add path
 - **Transitions**:
     - Any of the add paths shown, on success → adds the token and shows an
-      "Added SYMBOL" flash message (no screen change). Until its balance is
-      fetched, its balance line reads `quantity unknown`, as after "Add" on
-      AddToken
+      "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
@@ -2672,16 +2737,27 @@ view would leave a wallet one click from deletion.
 
 ### External Services
 
-AutistMask is not a fully self-contained offline tool. It necessarily
-communicates with three external services to function as a wallet:
+AutistMask is not a fully self-contained offline tool. By default it sends the
+user's data to one service only, the Ethereum RPC endpoint, and asks one more,
+the CoinDesk price API, for prices with nothing but token symbols. Two more
+services are sent none of the user's data until the user turns on the setting
+for each, on the Welcome screen or in Settings: Blockscout ("Use Blockscout")
+and Etherscan ("Check recipients on Etherscan"). Both settings are off in a new
+profile, and each is one setting for every network.
+
+Contacted by default:
 
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
-  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
+  them the balance of every tracked token at every address (`balanceOf`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
-  receipts. The default endpoint is a public RPC (configurable by the user to
-  any endpoint they prefer, including a local node). By default the extension
-  talks to `https://ethereum-rpc.publicnode.com`.
+  receipts. ENS lookups, of a name typed into Send and of the names shown for
+  the user's addresses, are made through it alone, so a name whose resolver says
+  it is resolved off-chain does not resolve. The default endpoint is a public
+  RPC (configurable by the user to any endpoint they prefer, including a local
+  node). By default the extension talks to
+  `https://ethereum-rpc.publicnode.com`.
     - **Data sent**: Ethereum addresses, transaction data, contract call
       parameters. The RPC endpoint can see all on-chain queries and submitted
       transactions.
@@ -2693,13 +2769,36 @@ communicates with three external services to function as a wallet:
     - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
       addresses or user-specific data.
 
-- **Blockscout block-explorer API**: Used to fetch transaction history (normal
-  transactions and ERC-20 token transfers), ERC-20 token balances, and token
-  holder counts (for spam filtering). The default endpoint is
-  `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
-    - **Data sent**: Ethereum addresses. Blockscout receives the user's
-      addresses to query their transaction history and token balances. No
-      private keys, passwords, or signing operations are sent.
+Sent the user's data only while the user has turned the setting on:
+
+- **Blockscout block-explorer API** ("Use Blockscout"): Used to fetch
+  transaction history (normal transactions and ERC-20 token transfers) for Home,
+  AddressDetail and AddressToken, the balances of the ERC-20 tokens the user has
+  not tracked, token holder counts (for spam filtering), and a transaction's
+  block, network details and calldata for TransactionDetail. The default
+  endpoint is `https://eth.blockscout.com/api/v2` (configurable by the user in
+  Settings). While the setting is off, those screens say in a plain line what is
+  not shown and that this setting turns it on, and only tracked tokens are
+  listed, their balances read through the RPC endpoint. The endpoint check
+  Settings makes when the user presses "Save" beside the URL asks only for
+  `/stats` and carries no user data; it is made whether or not the setting is
+  on.
+    - **Data sent**: Ethereum addresses, and the hash of each transaction the
+      user opens. Blockscout receives the user's addresses to query their
+      transaction history and token balances. No private keys, passwords, or
+      signing operations are sent.
+
+- **Etherscan address labels** ("Check recipients on Etherscan"): When
+  confirming a transaction, the extension performs a best-effort lookup of the
+  recipient address on Etherscan to check for phishing/scam labels. This is a
+  direct page fetch with no API key; the user's browser makes the request. While
+  the setting is off, ConfirmTx says that no Etherscan check was made.
+    - **Data sent**: the recipient address. The user's own addresses are not
+      sent.
+
+The etherscan links on the screens open a page in the browser when the user
+clicks one. They are not requests the wallet makes, and nothing is fetched from
+them until then.
 
 What the extension does NOT do:
 
@@ -2708,16 +2807,9 @@ What the extension does NOT do:
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
-In addition to the three user-configurable services above (RPC endpoint,
-CoinDesk price API, and Blockscout API), AutistMask also contacts:
-
-- **Etherscan address labels**: When confirming a transaction, the extension
-  performs a best-effort lookup of the recipient address on Etherscan to check
-  for phishing/scam labels. This is a direct page fetch with no API key; the
-  user's browser makes the request.
-
-Users who want maximum privacy can point the RPC and Blockscout URLs at their
-own self-hosted instances (price fetching can be disabled in a future version).
+Users who want maximum privacy can point the RPC URL at their own node, and,
+when they turn Blockscout on, the Blockscout URL at their own instance (price
+fetching can be disabled in a future version).
 
 ### Dependencies
 
@@ -2899,8 +2991,10 @@ logged.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
-- View ERC-20 token balances (tokens on the bundled known-token list, tokens
-  with 1,000 or more holders, and tokens the user adds by contract address)
+- View ERC-20 token balances (tokens the user adds by contract address, and,
+  while "Use Blockscout" is on, tokens on the bundled known-token list and
+  tokens with 1,000 or more holders)
+- View transaction history and transaction details, while "Use Blockscout" is on
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)

docs/README.md

@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No third-party token list APIs.** Token balances come from the same block
-  explorer you configure for transaction history, and the extension ships its
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
-  detection. Any token you want tracked across all your addresses, you add
-  yourself by contract address.
+- **No third-party token list APIs.** The balances of the tokens you track are
+  read from your RPC endpoint; while you have "Use Blockscout" on, the others
+  come from the same block explorer you configure for transaction history. The
+  extension ships its own hardcoded list of top ERC-20 contract addresses for
+  symbol-spoofing detection. Any token you want tracked across all your
+  addresses, you add yourself by contract address.
 
 - **No backend servers operated by the developer.** Nothing is sent to any
   server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,11 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
-three you configure yourself, and two fixed ones used for scam detection.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing
+but token symbols. Blockscout and Etherscan are sent none of your data until you
+turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome
+screen or later in Settings. Both are off in a new install.
 
 ### External Services
 
@@ -96,16 +100,23 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
-Used to fetch token balances and transaction history. Blockscout is an
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
-transactions and token transfers. You can change this in Settings to a
-self-hosted Blockscout instance.
+Off until you turn on "Use Blockscout". Used to fetch transaction history, the
+balances of the tokens you have not tracked, and the details of a transaction
+you open. Blockscout is an open-source blockchain explorer. AutistMask queries
+it for your ERC-20 token balances (including the holder counts used for spam
+filtering), your recent transactions and token transfers, and the block, fees
+and calldata of a transaction you open. You can change this in Settings to a
+self-hosted Blockscout instance. While it is off, the screens that would show
+history say so, and only the tokens you track are listed.
 
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
+When it is contacted: while "Use Blockscout" is on, on every balance refresh,
+whenever a screen showing transaction history is opened, and when you open a
+transaction. The one exception, whether or not the setting is on, is pressing
+"Save" beside the Blockscout URL in Settings, which checks that URL by asking it
+for `/stats` and sends none of your data.
 
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+What gets sent: your Ethereum addresses (to look up balances and transactions)
+and the hash of each transaction you open.
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
@@ -122,13 +133,16 @@ address.
 
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
+Off until you turn on "Check recipients on Etherscan". When you review a send,
+AutistMask fetches the recipient's public Etherscan address page and looks for a
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
+it finds one. This is a plain page fetch with no API key, made by your browser.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
+user-configurable. While it is off, the confirmation screen says that no
+Etherscan check was made.
 
-When it is contacted: each time you reach the send confirmation screen.
+When it is contacted: only while "Check recipients on Etherscan" is on, each
+time you reach the send confirmation screen.
 
 What gets sent: the recipient address you are about to send to, and your IP
 address. Your own addresses are not sent.
@@ -185,6 +199,9 @@ password.
 
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+   On first use the same screen offers "Use Blockscout" and "Check recipients on
+   Etherscan", both off; tick either if you want what it does (see External
+   Services). You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
    recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +237,11 @@ always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-Tokens you hold show up automatically only if they are in the extension's
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
+Tokens you hold show up automatically only while "Use Blockscout" is on, and
+then only if they are in the extension's bundled list of well-known tokens or
+have at least 1,000 holders; everything else is treated as spam and hidden. To
+track a token explicitly (which also shows it at zero balance, and shows it
+whether or not "Use Blockscout" is on), add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -389,8 +407,10 @@ Click the gear icon on the home screen to access settings:
   that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
-- **Blockscout API**: Change the Blockscout instance used for token balances and
-  transaction history. You can use a self-hosted instance.
+- **Blockscout API**: "Use Blockscout", off until you tick it, and the
+  Blockscout instance used for transaction history, the tokens you have not
+  tracked and transaction details. You can use a self-hosted instance.
+- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.

src/background/index.js

@@ -1397,6 +1397,7 @@ async function backgroundRefresh() {
         wallets,
         s.rpcUrl,
         s.blockscoutUrl,
+        s.useBlockscout,
         s.trackedTokens,
         s.networkId,
     );

src/popup/index.html

@@ -43,6 +43,38 @@
             <!-- ============ WELCOME / FIRST USE ============ -->
             <div id="view-welcome" class="view hidden">
                 <p class="mb-3">Welcome! To get started, add a wallet.</p>
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <p class="text-xs mb-2">
+                        This wallet sends your data only to the Ethereum RPC
+                        endpoint, unless you turn on either of these, here or
+                        later in Settings.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="welcome-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Sends your addresses, and the hash of each transaction
+                        you open, to the Blockscout API, for transaction
+                        history, tokens you have not tracked, and transaction
+                        details.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="welcome-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends the address you are about to send to, to
+                        Etherscan, to look for a phishing or scam label on it.
+                    </p>
+                </div>
                 <button
                     id="btn-welcome-add"
                     class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
@@ -272,6 +304,10 @@
 
                 <!-- wallet list -->
                 <div id="wallet-list"></div>
+                <p id="home-tokens-note" class="text-xs text-muted py-1 hidden">
+                    Only tracked tokens are listed, because "Use Blockscout" is
+                    off in Settings.
+                </p>
 
                 <!-- recent transactions across all addresses -->
                 <div>
@@ -336,6 +372,13 @@
                     <div id="address-balances" class="min-h-[1.25rem]">
                         &nbsp;
                     </div>
+                    <p
+                        id="address-tokens-note"
+                        class="text-xs text-muted hidden"
+                    >
+                        Only tracked tokens are listed, because "Use Blockscout"
+                        is off in Settings.
+                    </p>
                 </div>
 
                 <!-- actions -->
@@ -660,6 +703,13 @@
                         phishing/scam. Do not send funds to this address.
                     </div>
                 </div>
+                <p
+                    id="confirm-etherscan-note"
+                    class="mb-2 text-xs text-muted hidden"
+                >
+                    This address was not checked on Etherscan, because "Check
+                    recipients on Etherscan" is off in Settings.
+                </p>
                 <div
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
@@ -1002,8 +1052,19 @@
 
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Blockscout API</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="settings-use-blockscout" />
+                        Use Blockscout
+                    </label>
+                    <p class="text-xs text-muted mb-2">
+                        Sends your addresses, and the hash of each transaction
+                        you open, to the Blockscout API below, for transaction
+                        history, tokens you have not tracked, and transaction
+                        details.
+                    </p>
                     <p class="text-xs text-muted mb-1">
-                        Used to fetch token balances and transaction history.
                         Change this if you run your own Blockscout instance.
                     </p>
                     <input
@@ -1019,6 +1080,23 @@
                     </button>
                 </div>
 
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <h3 class="font-bold mb-1">Etherscan</h3>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-check-recipients-on-etherscan"
+                        />
+                        Check recipients on Etherscan
+                    </label>
+                    <p class="text-xs text-muted">
+                        Sends the address you are about to send to, to
+                        Etherscan, to look for a phishing or scam label on it.
+                    </p>
+                </div>
+
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Token Spam Protection</h3>
                     <p class="text-xs text-muted mb-2">
@@ -1504,6 +1582,16 @@
                     </div>
                 </div>
 
+                <!-- Shown in place of the block, decoded details, network
+                details and raw data, which only Blockscout gives. -->
+                <p
+                    id="tx-detail-blockscout-note"
+                    class="text-xs text-muted mx-1 mb-3 hidden"
+                >
+                    No block, decoded details, network details or raw data are
+                    shown, because "Use Blockscout" is off in Settings.
+                </p>
+
                 <!-- ── Decoded details ── -->
                 <div id="tx-detail-calldata-section" class="hidden">
                     <div class="bg-well p-3 mx-1 mb-3">

src/popup/index.js

@@ -82,45 +82,28 @@ let refreshTimer = null;
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
 // recorded as done. Results are copied by address, so an address added or
 // removed meanwhile is left as it is.
-//
-// Once the save is done, the wallet list is drawn again, and so are the
-// balances on AddressDetail or AddressToken when that is the screen up. No
-// other screen is drawn again, DeleteAddress and its balance lines included.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
         const networkId = state.networkId;
-        // The tracked tokens this refresh asks the explorer about. A token
-        // added on AddToken after this point is not among them, so this
-        // refresh does not count as having fetched it.
-        const tokens = state.trackedTokens.map((t) => t.address.toLowerCase());
         const wallets = structuredClone(state.wallets);
-        // Taken off the copy, so that an address whose token balances the
-        // explorer did not return comes back without any and keeps its
-        // stored ones.
-        for (const wallet of wallets) {
-            for (const addr of wallet.addresses) delete addr.tokenBalances;
-        }
         await Promise.all([
             refreshPrices(),
             refreshBalances(
                 wallets,
                 state.rpcUrl,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 state.trackedTokens,
                 networkId,
                 pageClosed.signal,
             ),
         ]);
         const refreshed = new Map();
-        let allTokenBalancesFetched = true;
         for (const wallet of wallets) {
             for (const addr of wallet.addresses) {
                 refreshed.set(addr.address, addr);
-                if (addr.tokenBalances === undefined) {
-                    allTokenBalancesFetched = false;
-                }
             }
         }
         await saveState((stored) => {
@@ -135,19 +118,10 @@ async function doRefreshAndRender() {
                     }
                 }
             }
-            // Each token this refresh asked about is now fetched for every
-            // address.
-            if (allTokenBalancesFetched) {
-                state.tokensNotFetched = state.tokensNotFetched.filter(
-                    (token) => !tokens.includes(token),
-                );
-            }
             state.lastBalanceRefresh = Date.now();
             return true;
         });
         renderWalletList();
-        if (state.currentView === "address") addressDetail.renderBalances();
-        if (state.currentView === "address-token") addressToken.renderBalance();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten
         // second interval, and eight views through ctx — so it must never
@@ -424,7 +398,7 @@ async function init() {
     followNetworkSwitch();
 
     if (!state.hasWallet) {
-        showView("welcome");
+        welcome.show();
     } else {
         renderWalletList();
         restoreView();

src/popup/viewRouter.js

@@ -40,9 +40,11 @@ function markViewRendered(view) {
 
 // Begin a fresh page-load scope. The popup gets one by being loaded, and
 // asks for one after a network switch, because every screen then on the page
-// shows the previous network (showNewNetwork() in views/settings.js); the
-// unit tests, which simulate several page loads against one module
-// instance, ask for one too.
+// shows the previous network (showNewNetwork() in views/settings.js), and
+// after "Use Blockscout" or "Check recipients on Etherscan" changes in
+// Settings, because every screen then on the page was drawn under the old
+// setting; the unit tests, which simulate several page loads against one
+// module instance, ask for one too.
 function resetRenderedViews() {
     renderedViews.clear();
 }

src/popup/views/addToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -79,7 +72,7 @@ function init(ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, contractAddr);
-            trackToken({
+            state.trackedTokens.push({
                 address: contractAddr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/popup/views/addressDetail.js

@@ -4,6 +4,7 @@ const {
     showFlash,
     balanceLinesForAddress,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -65,25 +66,11 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
+    const usdTotal = formatAddressTotal(getAddressValue(addr));
+    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element
     ensEl.classList.add("hidden");
-    renderBalances();
-    renderSendTokenSelect(addr);
-    $("tx-list").innerHTML =
-        '<div class="text-muted text-xs py-1">Loading...</div>';
-    showView("address");
-    loadTransactions(addr.address);
-}
-
-// The USD total and the balance list. Drawn again by each balance refresh
-// that returns while this screen is up (doRefreshAndRender() in
-// src/popup/index.js), which leaves the rest of the screen as it is.
-function renderBalances() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const usdTotal = formatAddressTotal(getAddressValue(addr));
-    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || "&nbsp;";
     $("address-balances").innerHTML = balanceLinesForAddress(
         addr,
         state.trackedTokens,
@@ -97,6 +84,13 @@ function renderBalances() {
                 ctx.showAddressToken();
             });
         });
+    // Tokens the user has not tracked are Blockscout's to report.
+    $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
+    renderSendTokenSelect(addr);
+    $("tx-list").innerHTML =
+        '<div class="text-muted text-xs py-1">Loading...</div>';
+    showView("address");
+    loadTransactions(addr.address);
 }
 
 let loadedTxs = [];
@@ -108,6 +102,7 @@ async function loadTransactions(address) {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -164,6 +159,10 @@ async function loadTransactions(address) {
 
 function renderTransactions(txs) {
     const list = $("tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -289,4 +288,4 @@ function init(_ctx) {
     exportPrivkey.init();
 }
 
-module.exports = { init, show, renderBalances };
+module.exports = { init, show };

src/popup/views/addressToken.js

@@ -7,6 +7,7 @@ const {
     showFlash,
     flashCopyFeedback,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -48,18 +49,37 @@ function show() {
     const addr = wallet.addresses[state.selectedAddress];
     const ai = state.selectedAddress;
     const tokenId = state.selectedToken;
+
+    // Determine token symbol and balance
+    let symbol, amount, price;
     const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
-    currentSymbol =
-        tokenId === "ETH"
-            ? nativeCurrency()
-            : resolveSymbol(tokenId, addr.tokenBalances, state.trackedTokens);
+    if (tokenId === "ETH") {
+        symbol = nativeCurrency();
+        amount = parseFloat(addr.balance || "0");
+        price = getPrice("ETH");
+    } else {
+        const tb = (addr.tokenBalances || []).find(
+            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
+        );
+        symbol = resolveSymbol(
+            tokenId,
+            addr.tokenBalances,
+            state.trackedTokens,
+        );
+        // null when the scale is unknown: no quantity to show, and none to
+        // price. balanceLine() states that rather than printing 0.0000.
+        amount = tb ? unknownableAmount(tb.balance) : 0;
+        price = getPrice(symbol);
+    }
+
+    currentSymbol = symbol;
 
     $("address-token-title").textContent =
         wallet.name +
         " \u2014 Address " +
         (ai + 1) +
         " \u2014 " +
-        displaySymbol(currentSymbol);
+        displaySymbol(symbol);
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -81,7 +101,13 @@ function show() {
     $("address-token-line").dataset.full = addr.address;
     attachCopyHandlers($("address-token-line"));
 
-    renderBalance();
+    // USD total for this token only
+    const usdVal = price && amount !== null ? amount * price : null;
+    const usdStr = formatUsd(usdVal);
+    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
+
+    // Single token balance line (no tokenId — not clickable here)
+    $("address-token-balance").innerHTML = balanceLine(symbol, amount, price);
 
     // Token contract details (ERC-20 only)
     const contractInfo = $("address-token-contract-info");
@@ -143,49 +169,12 @@ function show() {
     loadTransactions(addr.address, tokenId);
 }
 
-// The USD total and the balance line of the selected token. Drawn again by
-// each balance refresh that returns while this screen is up
-// (doRefreshAndRender() in src/popup/index.js), which leaves the rest of the
-// screen as it is.
-function renderBalance() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const tokenId = state.selectedToken;
-    let amount, price;
-    if (tokenId === "ETH") {
-        amount = parseFloat(addr.balance || "0");
-        price = getPrice("ETH");
-    } else {
-        const id = tokenId.toLowerCase();
-        const tb = (addr.tokenBalances || []).find(
-            (t) => t.address.toLowerCase() === id,
-        );
-        // null when the scale is unknown, or when no refresh has fetched a
-        // token just added: no quantity to show, and none to price.
-        // balanceLine() states that rather than printing 0.0000.
-        if (tb) amount = unknownableAmount(tb.balance);
-        else amount = state.tokensNotFetched.includes(id) ? null : 0;
-        price = getPrice(currentSymbol);
-    }
-
-    // USD total for this token only
-    const usdVal = price && amount !== null ? amount * price : null;
-    const usdStr = formatUsd(usdVal);
-    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
-
-    // Single token balance line (no tokenId — not clickable here)
-    $("address-token-balance").innerHTML = balanceLine(
-        currentSymbol,
-        amount,
-        price,
-    );
-}
-
 async function loadTransactions(address, tokenId) {
     try {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -252,6 +241,10 @@ async function loadTransactions(address, tokenId) {
 
 function renderTransactions(txs) {
     const list = $("address-token-tx-list");
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (txs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -356,4 +349,4 @@ function init(_ctx) {
     });
 }
 
-module.exports = { init, show, renderBalance };
+module.exports = { init, show };

src/popup/views/confirmTx.js

@@ -334,6 +334,11 @@ function show(txInfo) {
     $("confirm-contract-warning").style.visibility = "hidden";
     $("confirm-burn-warning").style.visibility = "hidden";
     $("confirm-etherscan-warning").style.visibility = "hidden";
+    // While "Check recipients on Etherscan" is off there is no Etherscan
+    // warning to reserve space for, and a line in its place says so.
+    const etherscanOn = !!state.checkRecipientsOnEtherscan;
+    $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
+    $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
 
     // Show burn warning via reserved element (in addition to inline warning)
     if (isBurnAddress(txInfo.to)) {
@@ -612,6 +617,7 @@ async function checkRecipientHistory(txInfo) {
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
             chainId: txInfo.chainId,
+            checkRecipientsOnEtherscan: state.checkRecipientsOnEtherscan,
         });
         // The user may have left this transaction while the checks were in
         // flight; its warnings must not reach another recipient's screen.

src/popup/views/deleteWallet.js

@@ -16,6 +16,7 @@ const {
     broadcastActiveChanged,
 } = require("../../shared/walletDelete");
 const { INVISIBLE_CHARACTERS } = require("../../shared/symbolSpoof");
+const welcome = require("./welcome");
 
 let deleteWalletIndex = null;
 let lostPasswordIndex = null;
@@ -135,7 +136,7 @@ async function finishDelete(walletIdx) {
         // Save before broadcasting: the background reads the active
         // address back out of storage to build accountsChanged.
         if (activeAddressChanged) broadcastActiveChanged();
-        showView("welcome");
+        welcome.show();
         return;
     }
 

src/popup/views/helpers.js

@@ -380,18 +380,6 @@ function balanceLine(symbol, amount, price, tokenId) {
     );
 }
 
-// Tracks `token` on the active network, as every add path on AddToken and
-// SettingsAddToken does, and lists it in `state.tokensNotFetched`: no refresh
-// has fetched its balance yet. An address with no balance row for it has no
-// known balance of it, so its line says the quantity is unknown rather than
-// 0.0000. doRefreshAndRender() in src/popup/index.js takes it off once a
-// refresh that started with it tracked has fetched every address's token
-// balances (https://git.eeqj.de/sneak/AutistMask/issues/516).
-function trackToken(token) {
-    state.trackedTokens.push(token);
-    state.tokensNotFetched.push(token.address.toLowerCase());
-}
-
 function balanceLinesForAddress(addr, trackedTokens, showZero) {
     let html = balanceLine(
         nativeCurrency(),
@@ -421,13 +409,12 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     }
     if (showZero && trackedTokens) {
         for (const t of trackedTokens) {
-            const id = t.address.toLowerCase();
-            if (seen.has(id)) continue;
+            if (seen.has(t.address.toLowerCase())) continue;
             html += balanceLine(
                 t.symbol,
-                state.tokensNotFetched.includes(id) ? null : 0,
+                0,
                 getPrice(t.symbol),
-                id,
+                t.address.toLowerCase(),
             );
         }
     }
@@ -547,6 +534,11 @@ function addressTitle(address, wallets) {
 const CONTRACT_CREATION_TEXT =
     "This transaction creates a new contract. It has no recipient.";
 
+// What the transaction lists on Home, AddressDetail and AddressToken say while
+// the user has "Use Blockscout" off: the history comes from Blockscout alone.
+const HISTORY_OFF_TEXT =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
 // The last two lines of a transaction history row: the counterparty's colour
 // dot and name beside the amount, then its full address. A contract creation
 // the user sent has no counterparty (its `to` is ""), so its row has the
@@ -799,7 +791,6 @@ module.exports = {
     flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
-    trackToken,
     addressHoldsFunds,
     keyMaterialName,
     unknownableAmount,
@@ -813,6 +804,7 @@ module.exports = {
     displaySymbol,
     addressTitle,
     CONTRACT_CREATION_TEXT,
+    HISTORY_OFF_TEXT,
     txCounterpartyHtml,
     formatAddressHtml,
     renderAddressHtml,

src/popup/views/home.js

@@ -7,6 +7,7 @@ const {
     timeAgo,
     addressDotHtml,
     txCounterpartyHtml,
+    HISTORY_OFF_TEXT,
     addressTitle,
     escapeHtml,
     displaySymbol,
@@ -100,6 +101,10 @@ let homeTxs = [];
 function renderHomeTxList(ctx) {
     const list = $("home-tx-list");
     if (!list) return;
+    if (!state.useBlockscout) {
+        list.innerHTML = `<div class="text-muted text-xs py-1">${escapeHtml(HISTORY_OFF_TEXT)}</div>`;
+        return;
+    }
     if (homeTxs.length === 0) {
         list.innerHTML =
             '<div class="text-muted text-xs py-1">No transactions found.</div>';
@@ -192,6 +197,7 @@ async function loadHomeTxs(ctx) {
             fetchRecentTransactions(
                 addr,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 currentNetwork().chainId,
             ),
         );
@@ -300,6 +306,8 @@ function walletListHtml() {
 
 function render(ctx) {
     const container = $("wallet-list");
+    // Tokens the user has not tracked are Blockscout's to report.
+    $("home-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     if (state.wallets.length === 0) {
         container.innerHTML =
             '<p class="text-muted py-2">No wallets yet. Add one to get started.</p>';

src/popup/views/settings.js

@@ -201,6 +201,10 @@ function show() {
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
     $("settings-network").value = state.networkId;
+    // Set on every show, not only at init: Welcome can change these two.
+    $("settings-use-blockscout").checked = state.useBlockscout;
+    $("settings-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
     renderTrackedTokens();
     renderSiteLists();
     renderWalletListSettings();
@@ -363,6 +367,33 @@ function init(_ctx) {
         showFlash("Saved.");
     });
 
+    // The screens under Settings were drawn under the old setting, so each
+    // change makes every screen but Settings count as not yet drawn, as a
+    // network switch does, and Back draws the one it lands on again. Welcome
+    // offers the same two settings and is only unhidden on Back, so its boxes
+    // are set here too.
+    $("settings-use-blockscout").addEventListener("change", async () => {
+        state.useBlockscout = $("settings-use-blockscout").checked;
+        $("welcome-use-blockscout").checked = state.useBlockscout;
+        resetRenderedViews();
+        markViewRendered("settings");
+        await saveState();
+    });
+
+    $("settings-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            state.checkRecipientsOnEtherscan = $(
+                "settings-check-recipients-on-etherscan",
+            ).checked;
+            $("welcome-check-recipients-on-etherscan").checked =
+                state.checkRecipientsOnEtherscan;
+            resetRenderedViews();
+            markViewRendered("settings");
+            await saveState();
+        },
+    );
+
     const networkSelect = $("settings-network");
     networkSelect.addEventListener("change", async () => {
         // Whether `state` already has the network picked is asked only once

src/popup/views/settingsAddToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -50,7 +43,7 @@ function renderTop10() {
                     decimals: parseInt(btn.dataset.decimals, 10),
                     name: btn.dataset.name || btn.dataset.symbol,
                 };
-                trackToken(token);
+                state.trackedTokens.push(token);
                 await saveState();
                 showFlash("Added " + token.symbol);
                 renderTop10();
@@ -117,7 +110,7 @@ function init(_ctx) {
             decimals: parseInt(opt.dataset.decimals, 10),
             name: opt.dataset.name || opt.dataset.symbol,
         };
-        trackToken(token);
+        state.trackedTokens.push(token);
         await saveState();
         showFlash("Added " + token.symbol);
         renderTop10();
@@ -163,7 +156,7 @@ function init(_ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, addr);
-            trackToken({
+            state.trackedTokens.push({
                 address: addr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/popup/views/transactionDetail.js

@@ -191,6 +191,11 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
+    // Those details are Blockscout's; this line says why there are none.
+    $("tx-detail-blockscout-note").classList.toggle(
+        "hidden",
+        !!state.useBlockscout,
+    );
     loadFullTxDetails(tx.hash, tx.chainId);
 
     const isoStr = isoDate(tx.timestamp);
@@ -303,7 +308,11 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
+// The block, network details, calldata and its decoding, from Blockscout. While
+// the user has "Use Blockscout" off, Blockscout is not asked and none of them
+// is shown.
 async function loadFullTxDetails(txHash, chainId) {
+    if (!state.useBlockscout) return;
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");

src/popup/views/welcome.js

@@ -1,7 +1,34 @@
-const { $ } = require("./helpers");
+// The first screen, shown while there is no wallet. It offers the two lookups
+// at services other than the RPC endpoint, both off until the user ticks them,
+// which Settings offers as well.
+
+const { $, showView } = require("./helpers");
+const { state, saveState } = require("../../shared/state");
+
+function show() {
+    $("welcome-use-blockscout").checked = state.useBlockscout;
+    $("welcome-check-recipients-on-etherscan").checked =
+        state.checkRecipientsOnEtherscan;
+    showView("welcome");
+}
 
 function init(ctx) {
     $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
+
+    $("welcome-use-blockscout").addEventListener("change", async () => {
+        state.useBlockscout = $("welcome-use-blockscout").checked;
+        await saveState();
+    });
+
+    $("welcome-check-recipients-on-etherscan").addEventListener(
+        "change",
+        async () => {
+            state.checkRecipientsOnEtherscan = $(
+                "welcome-check-recipients-on-etherscan",
+            ).checked;
+            await saveState();
+        },
+    );
 }
 
-module.exports = { init };
+module.exports = { init, show };

src/shared/addressWarnings.js

@@ -60,6 +60,8 @@ function getLocalWarnings(address, options = {}) {
  * @param {string} [options.fromAddress] - Sender address (for self-send check).
  * @param {string} [options.chainId] - Chain id of the network whose explorer
  *   the Etherscan label check asks; the active network's when omitted.
+ * @param {boolean} [options.checkRecipientsOnEtherscan] - The user's setting
+ *   of that name. The Etherscan label check is made only while it is on.
  * @returns {Promise<Array<{type: string, message: string, severity: string}>>}
  */
 async function getFullWarnings(address, provider, options = {}) {
@@ -114,6 +116,7 @@ async function getFullWarnings(address, provider, options = {}) {
     try {
         const etherscanWarning = await checkEtherscanLabel(
             address,
+            options.checkRecipientsOnEtherscan,
             options.chainId,
         );
         if (etherscanWarning) {

src/shared/balances.js

@@ -1,5 +1,7 @@
-// Balance fetching: ETH balances via RPC, ERC-20 token balances via
-// Blockscout, ENS reverse lookup via RPC.
+// Balance fetching: ETH balances and the balances of the tokens the user
+// tracks via RPC, the other ERC-20 token balances and the holder counts via
+// Blockscout while the user has "Use Blockscout" on, ENS reverse lookup via
+// RPC.
 
 const {
     JsonRpcProvider,
@@ -36,9 +38,18 @@ const { resolveTokenDecimals } = require("./approvalAmount");
 // ethers knows chains this wallet does not, so an id that is not one of ours
 // is a caller bug and must not resolve to a working provider for some other
 // chain.
+//
+// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. Left on, as
+// ethers has it, a resolver that says a name is resolved off-chain makes ethers
+// fetch the web address the resolver gives, straight from the browser, with the
+// name being looked up; for the reverse lookup of the user's addresses that is
+// the user's own name (https://git.eeqj.de/sneak/AutistMask/issues/668). Such a
+// name does not resolve.
 function getProvider(rpcUrl, networkId) {
     const net = Network.from(requireNetworkId(networkId).id);
-    return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
+    provider.disableCcipRead = true;
+    return provider;
 }
 
 function requireNetworkId(networkId) {
@@ -80,8 +91,15 @@ function rawUnits(value) {
 
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
+//
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
+// Blockscout is not asked and the answer is an empty list: no token the user
+// has not tracked is listed.
+//
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders.
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
+// balance is read through the RPC endpoint instead, and its row here gives that
+// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -93,9 +111,11 @@ function rawUnits(value) {
 async function fetchTokenBalances(
     address,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     signal,
 ) {
+    if (!useBlockscout) return [];
     try {
         const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -205,18 +225,109 @@ async function fetchTokenBalances(
     }
 }
 
-// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// The entries at `address` of the tokens the user tracks, shaped as
+// fetchTokenBalances() returns them, for the tokens the address holds.
+//
+// The balance is read with balanceOf through the RPC endpoint. The name and
+// symbol are the tracked token's. `decimals` and `holders` are those of
+// Blockscout's entry for the token in `explorerRequest`, this refresh's
+// fetchTokenBalances() for the address; while Blockscout fails they are kept
+// from the token's entry in `previous`, the address's entries before this
+// refresh. The balance is stated at the scale the screens read the token at
+// (resolveTokenDecimals()): the bundled list's, then the one the tracked token
+// records, then Blockscout's, as in fetchTokenBalances().
+//
+// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
+// balance keeps its figure, or takes Blockscout's entry from this refresh when
+// it has none. The failure is logged. A balance of zero gets no entry, as a
+// zero Blockscout reports gets none: the balance lists take a tracked token's
+// zero from the tracked list. A token whose symbol the spoof rule refuses gets
+// no entry either, as in fetchTokenBalances().
+//
 // `signal` is as for fetchTokenBalances().
+async function fetchTrackedTokenBalances(
+    provider,
+    address,
+    trackedTokens,
+    previous,
+    explorerRequest,
+    signal,
+) {
+    const listed = trackedTokens.filter(
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
+    );
+    // Each token's balanceOf answer, or null where it failed.
+    const balances = await Promise.all(
+        listed.map(async (token) => {
+            try {
+                const contract = new Contract(
+                    token.address,
+                    ERC20_ABI,
+                    provider,
+                );
+                return await contract.balanceOf(address);
+            } catch (e) {
+                if (!signal?.aborted) {
+                    log.errorf(
+                        "token balance failed",
+                        address,
+                        token.address,
+                        e.shortMessage || e.message,
+                    );
+                }
+                return null;
+            }
+        }),
+    );
+    const explorerRows = await explorerRequest;
+    const reported = explorerRows ?? previous;
+
+    const rows = [];
+    listed.forEach((token, i) => {
+        const lower = token.address.toLowerCase();
+        const entryIn = (list) =>
+            list.find((row) => String(row.address).toLowerCase() === lower);
+        const raw = balances[i];
+        if (raw === null) {
+            const kept = entryIn(previous) || entryIn(explorerRows || []);
+            if (kept) rows.push(kept);
+            return;
+        }
+        if (raw === 0n) return;
+        const entry = entryIn(reported);
+        const decimals = entry ? entry.decimals : null;
+        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const scale = known !== null ? known : decimals;
+        rows.push({
+            address: token.address,
+            name: token.name || "",
+            symbol: token.symbol || "???",
+            decimals: decimals,
+            // null when nothing knows the scale: a holding whose amount
+            // cannot be stated, never a zero.
+            balance: scale === null ? null : formatTokenBalance(raw, scale),
+            holders: entry ? entry.holders : null,
+        });
+    });
+    return rows;
+}
+
+// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// `trackedTokens` are the tokens tracked on the active network.
+// `useBlockscout` and `signal` are as for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     networkId,
     signal,
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
+    const tracked = trackedTokens || [];
+    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
 
     for (const wallet of wallets) {
@@ -266,23 +377,44 @@ async function refreshBalances(
                     }),
             );
 
-            // ERC-20 token balances via Blockscout
+            // ERC-20 token balances: the tracked tokens' through the RPC
+            // endpoint, and from Blockscout the tokens the user has not
+            // tracked. When Blockscout fails, the untracked rows from before
+            // this refresh stay; while "Use Blockscout" is off there are none.
+            // The Blockscout request is started first and handed to
+            // fetchTrackedTokenBalances() too, which waits for it after
+            // sending its balanceOf reads, so the two run side by side.
+            const previous = addr.tokenBalances || [];
+            const explorerRequest = fetchTokenBalances(
+                addr.address,
+                blockscoutUrl,
+                useBlockscout,
+                tracked,
+                signal,
+            );
             updates.push(
-                fetchTokenBalances(
-                    addr.address,
-                    blockscoutUrl,
-                    trackedTokens,
-                    signal,
-                ).then((balances) => {
-                    if (balances !== null) {
-                        addr.tokenBalances = balances;
-                        log.debugf(
-                            "Token balances",
-                            addr.address,
-                            balances.length,
-                            "tokens",
-                        );
-                    }
+                Promise.all([
+                    fetchTrackedTokenBalances(
+                        provider,
+                        addr.address,
+                        tracked,
+                        previous,
+                        explorerRequest,
+                        signal,
+                    ),
+                    explorerRequest,
+                ]).then(([trackedRows, explorerRows]) => {
+                    const untrackedRows = (explorerRows ?? previous).filter(
+                        (row) =>
+                            !trackedSet.has(String(row.address).toLowerCase()),
+                    );
+                    addr.tokenBalances = trackedRows.concat(untrackedRows);
+                    log.debugf(
+                        "Token balances",
+                        addr.address,
+                        addr.tokenBalances.length,
+                        "tokens",
+                    );
                 }),
             );
         }

src/shared/etherscanLabels.js

@@ -78,11 +78,20 @@ function parseEtherscanPage(html) {
  * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
  * Sepolia.
  *
+ * While the user's "Check recipients on Etherscan" setting is off, Etherscan
+ * is not asked and the answer is null.
+ *
  * @param {string} address - Ethereum address to check.
+ * @param {boolean} checkRecipientsOnEtherscan - The user's setting.
  * @param {string} [chainId] - Chain id of the network to look it up on.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
-async function checkEtherscanLabel(address, chainId) {
+async function checkEtherscanLabel(
+    address,
+    checkRecipientsOnEtherscan,
+    chainId,
+) {
+    if (!checkRecipientsOnEtherscan) return null;
     try {
         // Lazy require to avoid pulling in chrome.storage at module scope
         // (which breaks unit tests that only exercise parseEtherscanPage).

src/shared/persistedState.js

@@ -28,13 +28,6 @@ const DEFAULT_STATE = {
     // others are restored from when the active network changes. See
     // applyChainSwitchFields().
     networkTrackedTokens: {},
-    // Contract addresses, lowercased, of the tokens the user added that no
-    // balance refresh has fetched yet. trackToken() in
-    // src/popup/views/helpers.js adds one, and doRefreshAndRender() in
-    // src/popup/index.js takes it off. Stored, so a token added just before
-    // the popup closed still reads `quantity unknown` when it opens again
-    // (https://git.eeqj.de/sneak/AutistMask/issues/516).
-    tokensNotFetched: [],
     networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
@@ -55,6 +48,12 @@ const DEFAULT_STATE = {
     hideDustTransactions: true,
     dustThresholdGwei: 100000,
     utcTimestamps: false,
+    // "Use Blockscout" and "Check recipients on Etherscan" in Settings, one
+    // setting each for every network. Both off until the user turns them on:
+    // the requests they allow send the user's addresses to a service other
+    // than the RPC endpoint.
+    useBlockscout: false,
+    checkRecipientsOnEtherscan: false,
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
@@ -413,14 +412,18 @@ function normalizePersisted(saved) {
             : 100000;
     out.utcTimestamps =
         saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
+    out.useBlockscout =
+        saved.useBlockscout !== undefined ? saved.useBlockscout : false;
+    out.checkRecipientsOnEtherscan =
+        saved.checkRecipientsOnEtherscan !== undefined
+            ? saved.checkRecipientsOnEtherscan
+            : false;
     // A list of contract addresses, floored the same way: send.js builds its
     // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
     // and filterTransactions() maps the same list through normalizeAddress(),
     // so a stored string walks through the `|| []` and a stored number walks
     // through an Array.isArray().
     out.fraudContracts = textList(saved.fraudContracts);
-    // Contract addresses too, read with `includes()` and `filter()`.
-    out.tokensNotFetched = textList(saved.tokensNotFetched);
     out.tokenHolderCache = structuredClone(saved.tokenHolderCache || {});
     out.theme = saved.theme || "system";
     out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;

src/shared/transactions.js

@@ -235,12 +235,18 @@ function mergeTransactions(txs, tokenTransfers) {
 // `chainId` is the chain id of the network `blockscoutUrl` serves. Every entry
 // carries it, and a native entry is labelled with that network's
 // `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
+//
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
+// Blockscout is not asked and there is no history: the answer is an empty
+// list.
 async function fetchRecentTransactions(
     address,
     blockscoutUrl,
+    useBlockscout,
     chainId,
     count = 25,
 ) {
+    if (!useBlockscout) return [];
     log.debugf("fetchRecentTransactions", address);
     const addrLower = normalizeAddress(address);
 

src/shared/uniswap.js

@@ -953,7 +953,9 @@ function totalAmount(amounts) {
 // 2. Amount is the amountIn of the swap action that spends Token In. If
 //    several exact-in actions spend it, each with a stated amount, it is
 //    their sum; in any other case there is none. Min. received is the same
-//    for amountOutMin and the actions that buy Token Out.
+//    for amountOutMin and the actions that buy Token Out, except that there
+//    is none when a swap action in the step also spends Token Out: the step
+//    then does not pay out all that those actions buy.
 // 3. If any swap action in the step cannot be read, only SETTLE, SETTLE_ALL,
 //    TAKE and TAKE_ALL name the sides, and there is no Amount or Min.
 //    received.
@@ -1187,11 +1189,13 @@ function decodeV4Swap(input) {
         const boughtOnly = currenciesNotIn(bought, spent);
         if (present(takeToken) || boughtOnly.length === 1) {
             tokenOut = present(takeToken) ? takeToken : boughtOnly[0];
-            amountOutMin = totalAmount(
-                swaps
-                    .filter((s) => s.tokenOut === tokenOut)
-                    .map((s) => s.amountOutMin),
-            );
+            if (!spent.includes(tokenOut)) {
+                amountOutMin = totalAmount(
+                    swaps
+                        .filter((s) => s.tokenOut === tokenOut)
+                        .map((s) => s.amountOutMin),
+                );
+            }
         }
 
         return {

tests/addedTokenBalance.test.js

@@ -1,273 +0,0 @@
-// After "Add" on AddToken, AddressDetail lists the new token, and its line reads
-// `quantity unknown`, not 0.0000, until a balance refresh that asked the
-// explorer about the token has returned for every address, the popup closing
-// and opening again meanwhile included; so does a token added on
-// SettingsAddToken, wherever it is listed. A refresh that returns draws the
-// balances on AddressDetail or AddressToken again, so the fetched balance shows
-// without the screen being reopened
-// (https://git.eeqj.de/sneak/AutistMask/issues/516). Driven through the real
-// popup over a stored profile on Ethereum Mainnet, with "Show tracked tokens
-// with zero balance" on, as it is by default.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-// Tracked by nobody until a test adds it.
-const NEW_TOKEN = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-
-// The explorer's row for a holding of a million NEW_TOKEN, in the shape
-// fetchTokenBalances() stores it.
-const MILLION = {
-    address: NEW_TOKEN,
-    name: "New Token",
-    symbol: "NEW",
-    decimals: 18,
-    balance: "1000000.0",
-    holders: 3,
-};
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressDetail for the one address.
-function bootOnAddress() {
-    return bootPopup(
-        unversionedValidProfile({
-            currentView: "address",
-            selectedWallet: 0,
-            selectedAddress: 0,
-        }),
-    );
-}
-
-// Holds the next balance refresh open. The returned function lets it finish
-// with the address's ETH balance at 2 and `tokenBalances` as the explorer's
-// rows for it, or with no token balances at all when given null: an explorer
-// that did not answer, which the real refreshBalances() leaves unwritten.
-function holdNextRefresh(page) {
-    const { refreshBalances } = require("../src/shared/balances");
-    let release;
-    refreshBalances.mockImplementationOnce(async (wallets) => {
-        const tokenBalances = await new Promise((resolve) => {
-            release = resolve;
-        });
-        wallets[0].addresses[0].balance = "2.0";
-        if (tokenBalances !== null) {
-            wallets[0].addresses[0].tokenBalances = tokenBalances;
-        }
-    });
-    return async (tokenBalances) => {
-        release(tokenBalances);
-        await page.settle();
-    };
-}
-
-// "+ Token", NEW_TOKEN typed in, and "Add", with the contract lookup
-// answering at once.
-async function addNewToken(page) {
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-    await page.click("btn-add-token");
-    page.node("add-token-address").value = NEW_TOKEN;
-    await page.click("btn-add-token-confirm");
-}
-
-// NEW_TOKEN's row in the balance list in element `id`, AddressDetail's unless
-// another is named, as markup.
-function newTokenRow(page, id = "address-balances") {
-    return page
-        .node(id)
-        .innerHTML.split("<div ")
-        .find((row) =>
-            row.includes('data-token="' + NEW_TOKEN.toLowerCase() + '"'),
-        );
-}
-
-// AddressDetail for the one address opened from Home, as its `[info]` button
-// does.
-async function openAddress(page) {
-    const { state } = require("../src/shared/state");
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressDetail").show();
-    await page.settle();
-}
-
-// AddressToken for `token` opened from AddressDetail, as tapping the token's
-// row there does.
-async function openToken(page, token) {
-    const { state } = require("../src/shared/state");
-    state.selectedToken = token;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressToken").show();
-    await page.settle();
-}
-
-test("until the refresh Add started returns, the new token's line reads quantity unknown", async () => {
-    const page = await bootOnAddress();
-    expect(page.pageErrors).toEqual([]);
-    const finish = holdNextRefresh(page);
-
-    await addNewToken(page);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-    await finish([MILLION]);
-});
-
-test("once that refresh returns, AddressDetail shows the fetched balance without being reopened", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-    // Stands for the transactions on the screen, which only show() replaces.
-    page.node("tx-list").innerHTML = "transactions on the screen";
-
-    await finish([MILLION]);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(newTokenRow(page)).toContain("1000000.0000");
-    // Only the balances are drawn again, not the transaction list.
-    expect(page.node("tx-list").innerHTML).toBe("transactions on the screen");
-});
-
-test("a refresh already running when the token is added does not count as fetching it", async () => {
-    const page = await bootOnAddress();
-    const finishRunning = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-
-    await addNewToken(page);
-    await finishRunning([]);
-    await ticking;
-
-    expect(newTokenRow(page)).toContain("quantity unknown");
-
-    // The next one asks the explorer about the token, which lists no holding
-    // of it: a fetched zero.
-    const finishNext = holdNextRefresh(page);
-    const next = page.tick();
-    await page.settle();
-    await finishNext([]);
-    await next;
-
-    expect(newTokenRow(page)).toContain("0.0000");
-});
-
-test("closed and opened again before any refresh has fetched it, the new token's line still reads quantity unknown", async () => {
-    const closed = await bootOnAddress();
-    holdNextRefresh(closed);
-    await addNewToken(closed);
-    cleanupPopup();
-
-    // The refresh this boot starts gets no token balances back: the boot's
-    // stub of refreshBalances() writes none.
-    const page = await bootPopup(undefined, { storage: closed.storage });
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-
-    const finish = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-    await finish([MILLION]);
-    await ticking;
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh in which the explorer did not answer leaves the new token's line quantity unknown", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await finish(null);
-
-    // Drawn again: the ETH balance it fetched is shown.
-    expect(page.node("address-balances").innerHTML).toContain("2.0000");
-    expect(newTokenRow(page)).toContain("quantity unknown");
-});
-
-test("AddressToken for the new token reads quantity unknown until the refresh returns, then the fetched balance", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await openToken(page, NEW_TOKEN.toLowerCase());
-
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    const before = page.node("address-token-balance").innerHTML;
-    expect(before).toContain("quantity unknown");
-    expect(before).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(page.node("address-token-balance").innerHTML).toContain(
-        "1000000.0000",
-    );
-});
-
-test("a token added by contract address on SettingsAddToken reads quantity unknown until the refresh returns", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.visibleViews()).toEqual(["main"]);
-    const finish = holdNextRefresh(page);
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-
-    await page.click("btn-settings");
-    await page.click("btn-settings-add-token");
-    page.node("settings-addtoken-address").value = NEW_TOKEN;
-    await page.click("btn-settings-addtoken-manual");
-    await page.click("btn-settings-addtoken-back");
-    await page.click("btn-settings-back");
-    expect(page.visibleViews()).toEqual(["main"]);
-    const onHome = newTokenRow(page, "wallet-list");
-    expect(onHome).toContain("quantity unknown");
-    expect(onHome).not.toContain("0.0000");
-
-    await openAddress(page);
-    const onAddress = newTokenRow(page);
-    expect(onAddress).toContain("quantity unknown");
-    expect(onAddress).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh that returns while AddressToken is up draws its balance again", async () => {
-    const page = await bootPopup(
-        unversionedValidProfile({
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            selectedToken: "ETH",
-        }),
-    );
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    expect(page.node("address-token-balance").innerHTML).toContain("1.5000");
-    const finish = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-
-    await finish(null);
-    await ticking;
-
-    expect(page.node("address-token-balance").innerHTML).toContain("2.0000");
-});

tests/backgroundStateIsolation.test.js

@@ -410,7 +410,14 @@ describe("a balance refresh under a network switch", () => {
         const ranOn = [];
 
         const bg = loadWorker("sepolia", {
-            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
+            refreshBalances: async (
+                wallets,
+                rpcUrl,
+                explorer,
+                useBlockscout,
+                tokens,
+                id,
+            ) => {
                 ranOn.push(id);
                 reachedNetwork.resolve();
                 await roundTrip.promise;

tests/balanceRefreshCancelled.test.js

@@ -18,6 +18,11 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TRACKED = {
+    address: "0x7777777777777777777777777777777777777777",
+    symbol: "TRK",
+    decimals: 6,
+};
 
 const realFetch = globalThis.fetch;
 let logged;
@@ -30,9 +35,9 @@ beforeEach(() => {
     const failedToFetch = async () => {
         throw new TypeError("Failed to fetch");
     };
-    // The RPC calls (ETH balance, ENS name, and the scan's balance and
-    // transaction count) and the explorer request (token balances) all fail
-    // the same way.
+    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
+    // the scan's balance and transaction count) and the explorer request (the
+    // other token balances) all fail the same way.
     FetchRequest.registerGetUrl(failedToFetch);
     globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -49,7 +54,8 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
-        [],
+        true,
+        [TRACKED],
         "mainnet",
         signal,
     );
@@ -60,6 +66,7 @@ test("a failure while the popup is open is reported", async () => {
     for (const label of [
         "ETH balance failed",
         "ENS reverse failed",
+        "token balance failed",
         "fetchTokenBalances failed: Failed to fetch",
     ]) {
         expect(logged.some((line) => line.includes(label))).toBe(true);

tests/balanceRefreshNetworkSwitch.test.js

@@ -91,7 +91,7 @@ test("a refresh that returns after a switch in Settings writes nothing, and the
 
     await page.tick();
 
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
     expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
         0,
     );

tests/blockscoutEtherscanSettings.test.js

@@ -0,0 +1,470 @@
+// Blockscout and Etherscan are sent none of the user's data until the user
+// turns them on (https://git.eeqj.de/sneak/AutistMask/issues/668). A new
+// profile has "Use Blockscout" and "Check recipients on Etherscan" both off.
+// Each request to either service is skipped where it is made while its setting
+// is off, and made while it is on; the popup and the background hand the
+// stored setting to the code that makes the request. The one exception is the
+// endpoint check Settings makes when the user presses "Save" beside the
+// Blockscout URL. It asks only for `/stats` and carries no user data; it is
+// made whether or not the setting is on.
+//
+// The functions that make the requests are driven directly, against a fetch()
+// that records every URL it is asked for. The screens are driven through the
+// real popup over a stored profile (tests/support/popupBoot.js), whose fetch()
+// stub records the same way.
+
+"use strict";
+
+const { FetchRequest } = require("ethers");
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    ADDRESS,
+} = require("./support/popupBoot");
+const { makeStorageStub } = require("./support/storageStub");
+const {
+    DEFAULT_STATE,
+    normalizePersisted,
+} = require("../src/shared/persistedState");
+const {
+    fetchTokenBalances,
+    refreshBalances,
+} = require("../src/shared/balances");
+const { fetchRecentTransactions } = require("../src/shared/transactions");
+const { getFullWarnings } = require("../src/shared/addressWarnings");
+const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
+
+const RPC_URL = "https://rpc.example.invalid";
+const BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
+const RECIPIENT = "0x2222222222222222222222222222222222222222";
+const TX_HASH = "0x" + "ab".repeat(32);
+const ZERO_WORD = "0x" + "0".repeat(64);
+
+// USDC, from the bundled list, as Blockscout reports a holding of it.
+const USDC_ROW = {
+    value: "5000000",
+    token: {
+        type: "ERC-20",
+        address_hash: "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
+        symbol: "USDC",
+        name: "USD Coin",
+        decimals: "6",
+        holders_count: "50000",
+    },
+};
+
+const realFetch = globalThis.fetch;
+
+afterEach(() => {
+    cleanupPopup();
+    jest.restoreAllMocks();
+});
+
+describe("a new profile", () => {
+    test("has both settings off", () => {
+        expect(DEFAULT_STATE.useBlockscout).toBe(false);
+        expect(DEFAULT_STATE.checkRecipientsOnEtherscan).toBe(false);
+        const loaded = normalizePersisted(undefined);
+        expect(loaded.useBlockscout).toBe(false);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(false);
+    });
+
+    test("keeps either setting the user turned on", () => {
+        const loaded = normalizePersisted({
+            useBlockscout: true,
+            checkRecipientsOnEtherscan: true,
+        });
+        expect(loaded.useBlockscout).toBe(true);
+        expect(loaded.checkRecipientsOnEtherscan).toBe(true);
+    });
+});
+
+describe("where each request is made", () => {
+    // Every URL fetch() was asked for, in order.
+    let asked;
+
+    beforeEach(() => {
+        asked = [];
+        globalThis.fetch = jest.fn(async (url) => {
+            asked.push(String(url));
+            return {
+                ok: true,
+                status: 200,
+                json: async () =>
+                    String(url).endsWith("/token-balances")
+                        ? [USDC_ROW]
+                        : { items: [] },
+                text: async () => "<html><body></body></html>",
+            };
+        });
+    });
+
+    afterEach(() => {
+        globalThis.fetch = realFetch;
+    });
+
+    test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
+        expect(
+            await fetchTokenBalances(ADDRESS, BLOCKSCOUT, false, []),
+        ).toEqual([]);
+        expect(asked).toEqual([]);
+
+        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, true, []);
+        expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
+        expect(asked).toEqual([
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+        ]);
+    });
+
+    test("the transaction history is asked for only while Use Blockscout is on", async () => {
+        expect(
+            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, false, "0x1"),
+        ).toEqual([]);
+        expect(asked).toEqual([]);
+
+        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, true, "0x1");
+        expect(asked.sort()).toEqual([
+            BLOCKSCOUT +
+                "/addresses/" +
+                ADDRESS +
+                "/token-transfers?type=ERC-20",
+            BLOCKSCOUT + "/addresses/" + ADDRESS + "/transactions",
+        ]);
+    });
+
+    test("the Etherscan label check is made only while Check recipients on Etherscan is on", async () => {
+        const provider = {
+            getCode: async () => "0x",
+            getTransactionCount: async () => 1,
+            getBalance: async () => 0n,
+        };
+        await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
+        await getFullWarnings(RECIPIENT, provider, {
+            chainId: "0x1",
+            checkRecipientsOnEtherscan: false,
+        });
+        expect(asked).toEqual([]);
+
+        await getFullWarnings(RECIPIENT, provider, {
+            chainId: "0x1",
+            checkRecipientsOnEtherscan: true,
+        });
+        expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
+    });
+
+    describe("a balance refresh", () => {
+        // The RPC endpoint answers every balance with zero, and every other
+        // call, the ENS reverse lookup's, with no resolver.
+        beforeEach(() => {
+            FetchRequest.registerGetUrl(async (req) => {
+                const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+                const reply = (r) => ({
+                    jsonrpc: "2.0",
+                    id: r.id,
+                    result: r.method === "eth_getBalance" ? "0x0" : ZERO_WORD,
+                });
+                const answer = Array.isArray(body)
+                    ? body.map(reply)
+                    : reply(body);
+                return {
+                    statusCode: 200,
+                    statusMessage: "OK",
+                    headers: { "content-type": "application/json" },
+                    body: Buffer.from(JSON.stringify(answer)),
+                };
+            });
+        });
+
+        afterEach(() => {
+            FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+        });
+
+        // An address that was refreshed while Use Blockscout was on, and holds
+        // the USDC Blockscout reported then.
+        function addressWithUsdc() {
+            return {
+                address: ADDRESS,
+                tokenBalances: [
+                    {
+                        address: USDC_ROW.token.address_hash,
+                        name: "USD Coin",
+                        symbol: "USDC",
+                        decimals: 6,
+                        balance: "5.0",
+                        holders: 50000,
+                    },
+                ],
+            };
+        }
+
+        async function refresh(addr, useBlockscout) {
+            await refreshBalances(
+                [{ addresses: [addr] }],
+                RPC_URL,
+                BLOCKSCOUT,
+                useBlockscout,
+                [],
+                "mainnet",
+            );
+        }
+
+        test("asks Blockscout nothing while Use Blockscout is off, and then lists no token the user has not tracked", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, false);
+            expect(asked).toEqual([]);
+            expect(addr.tokenBalances).toEqual([]);
+        });
+
+        test("asks Blockscout for the token balances while Use Blockscout is on", async () => {
+            const addr = addressWithUsdc();
+            await refresh(addr, true);
+            expect(asked).toEqual([
+                BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
+            ]);
+            expect(addr.tokenBalances.map((row) => row.symbol)).toEqual([
+                "USDC",
+            ]);
+        });
+    });
+});
+
+describe("the popup", () => {
+    // Every URL the booted page handed to fetch().
+    function fetched() {
+        return globalThis.fetch.mock.calls.map((call) => String(call[0]));
+    }
+
+    function blockscoutOrEtherscan(url) {
+        return url.includes("blockscout") || url.includes("etherscan");
+    }
+
+    beforeEach(() => {
+        // The screens below log their failed RPC reads; the stub node in
+        // popupBoot.js answers none.
+        jest.spyOn(console, "error").mockImplementation(() => {});
+    });
+
+    test("hands its balance refresh and Home's history the stored Use Blockscout setting", async () => {
+        await bootPopup(unversionedValidProfile());
+        const {
+            refreshBalances: popupRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: popupHistory,
+        } = require("../src/shared/transactions");
+        expect(popupRefresh.mock.calls[0][3]).toBe(false);
+        expect(popupHistory.mock.calls[0][2]).toBe(false);
+        cleanupPopup();
+
+        await bootPopup(unversionedValidProfile({ useBlockscout: true }));
+        const {
+            refreshBalances: onRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: onHistory,
+        } = require("../src/shared/transactions");
+        expect(onRefresh.mock.calls[0][3]).toBe(true);
+        expect(onHistory.mock.calls[0][2]).toBe(true);
+    });
+
+    test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        expect(page.node("home-tx-list").innerHTML).toContain(
+            escapeHtml(HISTORY_OFF_TEXT),
+        );
+        expect(page.hidden("home-tokens-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            unversionedValidProfile({ useBlockscout: true }),
+        );
+        expect(on.node("home-tx-list").innerHTML).toContain(
+            "No transactions found.",
+        );
+        expect(on.hidden("home-tokens-note")).toBe(true);
+    });
+
+    // The transaction screen, as a reopened popup draws it.
+    function onTransactionScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "transaction",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                tx: {
+                    hash: TX_HASH,
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    value: "1.0000",
+                    exactValue: "1.0",
+                    symbol: "ETH",
+                    timestamp: 1790000000,
+                    isError: false,
+                    direction: "sent",
+                    directionLabel: "Sent",
+                    contractAddress: null,
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("TransactionDetail asks Blockscout for the transaction only while Use Blockscout is on", async () => {
+        const page = await bootPopup(onTransactionScreen());
+        expect(page.visibleViews()).toEqual(["transaction"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onTransactionScreen({ useBlockscout: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            BLOCKSCOUT + "/transactions/" + TX_HASH,
+        ]);
+        expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
+    });
+
+    // The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
+    // reopened popup draws it.
+    function onConfirmScreen(extra) {
+        return unversionedValidProfile({
+            currentView: "confirm-tx",
+            viewStack: ["main"],
+            selectedWallet: 0,
+            selectedAddress: 0,
+            viewData: {
+                pendingTx: {
+                    token: "ETH",
+                    from: ADDRESS,
+                    to: RECIPIENT,
+                    amount: "0.1",
+                    chainId: "0x1",
+                },
+            },
+            ...extra,
+        });
+    }
+
+    test("ConfirmTx asks Etherscan about the recipient only while Check recipients on Etherscan is on", async () => {
+        const page = await bootPopup(onConfirmScreen());
+        expect(page.visibleViews()).toEqual(["confirm-tx"]);
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([]);
+        expect(page.hidden("confirm-etherscan-note")).toBe(false);
+        expect(page.hidden("confirm-etherscan-warning")).toBe(true);
+        cleanupPopup();
+
+        const on = await bootPopup(
+            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
+        );
+        expect(fetched().filter(blockscoutOrEtherscan)).toEqual([
+            "https://etherscan.io/address/" + RECIPIENT,
+        ]);
+        expect(on.hidden("confirm-etherscan-note")).toBe(true);
+        expect(on.hidden("confirm-etherscan-warning")).toBe(false);
+    });
+
+    // Ticks a checkbox on the page, as the user does.
+    async function tick(page, id) {
+        const box = page.node(id);
+        box.checked = true;
+        for (const fn of box.listeners.change) await fn();
+        await page.settle();
+    }
+
+    test("Welcome offers both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(undefined);
+        expect(page.visibleViews()).toEqual(["welcome"]);
+        expect(page.node("welcome-use-blockscout").checked).toBe(false);
+        expect(page.node("welcome-check-recipients-on-etherscan").checked).toBe(
+            false,
+        );
+
+        await tick(page, "welcome-use-blockscout");
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await tick(page, "welcome-check-recipients-on-etherscan");
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+
+    test("Settings shows both settings unticked, and ticking one there stores it", async () => {
+        const page = await bootPopup(unversionedValidProfile());
+        await page.click("btn-settings");
+        expect(page.node("settings-use-blockscout").checked).toBe(false);
+        expect(
+            page.node("settings-check-recipients-on-etherscan").checked,
+        ).toBe(false);
+
+        await tick(page, "settings-use-blockscout");
+        expect(page.storage.read("autistmask").useBlockscout).toBe(true);
+        await tick(page, "settings-check-recipients-on-etherscan");
+        expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
+            true,
+        );
+    });
+});
+
+describe("the background", () => {
+    afterEach(() => {
+        delete globalThis.chrome;
+        jest.dontMock("../src/shared/balances");
+    });
+
+    // Starts the background over `profile`, fires its balance alarm, and
+    // answers with the Use Blockscout setting its refresh was handed.
+    async function settingTheRefreshIsHanded(profile) {
+        jest.resetModules();
+        let handed;
+        const called = new Promise((resolve) => {
+            handed = resolve;
+        });
+        jest.doMock("../src/shared/balances", () => ({
+            getProvider: () => ({}),
+            refreshBalances: async (...args) => handed(args[3]),
+        }));
+        let onAlarm = null;
+        globalThis.chrome = {
+            storage: makeStorageStub({ autistmask: profile }),
+            alarms: {
+                create: () => {},
+                get: async () => undefined,
+                clear: async () => false,
+                onAlarm: {
+                    addListener: (fn) => {
+                        onAlarm = fn;
+                    },
+                },
+            },
+            runtime: {
+                onMessage: { addListener: () => {} },
+                onConnect: { addListener: () => {} },
+                onInstalled: { addListener: () => {} },
+                onStartup: { addListener: () => {} },
+                getURL: (p) => "chrome-extension://test/" + p,
+                lastError: null,
+            },
+            windows: { onRemoved: { addListener: () => {} } },
+            tabs: { query: () => {}, sendMessage: () => {} },
+            action: { setPopup: () => {} },
+        };
+        require("../src/background/index");
+        const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
+        onAlarm({ name: BALANCE_REFRESH_ALARM });
+        return called;
+    }
+
+    test("hands its balance refresh the stored Use Blockscout setting", async () => {
+        const profile = { ...unversionedValidProfile(), lastBalanceRefresh: 0 };
+        expect(await settingTheRefreshIsHanded(profile)).toBe(false);
+        expect(
+            await settingTheRefreshIsHanded({
+                ...profile,
+                useBlockscout: true,
+            }),
+        ).toBe(true);
+    });
+});

tests/confirmTxAmount.test.js

@@ -247,6 +247,7 @@ async function openSend(token, tokenUnits = null) {
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/confirmTxLateResult.test.js

@@ -50,8 +50,14 @@ function explorerPage(title) {
 // The explorer labels no address.
 global.fetch = jest.fn(async () => explorerPage("Etherscan"));
 
+// The Etherscan label check is made, so its box can be shown.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();

tests/confirmTxNetworkSwitch.test.js

@@ -142,13 +142,19 @@ jest.mock("../src/popup/views/txStatus", () => ({
 }));
 
 // The Etherscan label check is its only caller here: the explorer pages it
-// asks for are recorded, and nothing is fetched.
+// asks for are recorded, and nothing is fetched. The stored profile has the
+// check turned on.
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
+global.chrome = {
+    storage: makeStorageStub({
+        autistmask: { checkRecipientsOnEtherscan: true },
+    }),
+    runtime: { sendMessage() {} },
+};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();

tests/contractCreation.test.js

@@ -297,6 +297,8 @@ describe.each([
         state.selectedWallet = 0;
         state.selectedAddress = 0;
         state.selectedToken = "ETH";
+        // The history is Blockscout's.
+        state.useBlockscout = true;
     });
 
     test("a contract creation's row says so, with no colour dot and no address line", async () => {

tests/e2e/network.js

@@ -653,6 +653,12 @@ function traceEnabled(raw) {
  *   confirmed receipt instead of null, so a wait screen resolves.
  * @param {boolean} [opts.failReceiptLookup]  answer eth_getTransactionReceipt
  *   with an error, so every receipt lookup fails; read at request time.
+ * @param {string} [opts.etherscanLabel]  the label Etherscan's page gives the
+ *   address asked about, such as "Fake_Phishing1"; none when unset. Read at
+ *   request time.
+ * @param {object[]} [opts.requests]  every request this handler sees, from the
+ *   popup's pages and the background worker alike, appended in order as
+ *   { method, url, fromWorker }.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -691,6 +697,13 @@ async function installNetworkStubs(ctx, opts) {
             const origin = fromWorker ? "[sw] " : "[page] ";
             console.log("# routed " + origin + req.method() + " " + req.url());
         }
+        if (Array.isArray(opts.requests)) {
+            opts.requests.push({
+                method: req.method(),
+                url: req.url(),
+                fromWorker,
+            });
+        }
 
         // JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
         if (req.method() === "POST") {
@@ -762,12 +775,20 @@ async function installNetworkStubs(ctx, opts) {
             return route.fulfill({ status: 204, body: "" });
         }
 
-        // Best-effort Etherscan address labels: served as an empty page.
+        // Best-effort Etherscan address labels: served as an empty page, or
+        // as a page labelling the address with opts.etherscanLabel.
         if (url.hostname.endsWith("etherscan.io")) {
+            const title = opts.etherscanLabel
+                ? "<title>" +
+                  opts.etherscanLabel +
+                  " | Address: " +
+                  p.split("/").pop() +
+                  " | Etherscan</title>"
+                : "";
             return route.fulfill({
                 status: 200,
                 contentType: "text/html",
-                body: "<html><body></body></html>",
+                body: "<html><head>" + title + "</head><body></body></html>",
             });
         }
 

tests/e2e/run.js

@@ -269,6 +269,62 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
     }
 });
 
+// ------------------ Blockscout and Etherscan are sent no user data (#668)
+//
+// A fresh install sends Blockscout and Etherscan none of the user's data until
+// the user turns on "Use Blockscout" or "Check recipients on Etherscan". The
+// endpoint check Settings makes when the user presses "Save" beside the
+// Blockscout URL asks only for `/stats` and carries no user data; it is made
+// whether or not the setting is on. The route handler in tests/e2e/network.js
+// records every request the extension makes, from its pages and its background
+// worker, in env.routeOpts.requests. Recording starts when launch() in
+// tests/e2e/harness.js installs that handler, before the first popup page
+// opens; a request the background worker makes while it starts up, before
+// then, is not recorded. These tests drive Home, AddressDetail, AddressToken
+// and ConfirmTx, and the background's own balance refresh, before either
+// setting is changed, then turn each on and watch its requests start.
+// TransactionDetail, which also asks Blockscout, is left to the unit tests in
+// tests/blockscoutEtherscanSettings.test.js.
+
+// What the three transaction lists say while Use Blockscout is off. Written
+// out here rather than imported, so the assertion does not compare the popup
+// with itself.
+const HISTORY_OFF =
+    'No transaction history is shown, because "Use Blockscout" is off in Settings.';
+
+// The requests made so far to Blockscout or Etherscan.
+function explorerRequests(env) {
+    return env.routeOpts.requests.filter(({ url }) => {
+        const host = new URL(url).hostname;
+        return host.endsWith("blockscout.com") || host.endsWith("etherscan.io");
+    });
+}
+
+// Waits until the list `listId` says what Use Blockscout being off leaves out.
+async function waitForHistoryOff(page, listId) {
+    await page.waitForFunction(
+        ([id, want]) => document.getElementById(id).textContent.trim() === want,
+        [listId, HISTORY_OFF],
+        { timeout: 15000 },
+    );
+}
+
+test("Welcome offers Use Blockscout and Check recipients on Etherscan, both unticked (#668)", async (env) => {
+    await visible(env.page, "#view-welcome");
+    for (const id of [
+        "welcome-use-blockscout",
+        "welcome-check-recipients-on-etherscan",
+    ]) {
+        const st = await controlState(env.page, id);
+        assert(st !== null, "Welcome has no #" + id);
+        assert(
+            st.tag === "input" && st.type === "checkbox",
+            "#" + id + " is a <" + st.tag + " type=" + st.type + ">",
+        );
+        assert(st.checked === false, "#" + id + " is ticked on a new install");
+    }
+});
+
 // The address scan that follows creating the wallet is held, so the popup
 // reloads while it is in flight. As for the reloads mid-refresh further down,
 // the assertion for that is the harness's own: a console.error from the page
@@ -296,6 +352,202 @@ test("wallet creation through the UI reaches the main view, and reloading mid-sc
     assert(addrCount > 0, "no addresses rendered in the wallet list");
 });
 
+test("with neither setting changed, Home, AddressDetail, AddressToken and ConfirmTx say what is off (#668)", async (env) => {
+    // Funded, so Send leads to the confirmation screen.
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    try {
+        await visible(env.page, "#view-main");
+        await waitForHistoryOff(env.page, "home-tx-list");
+        await visible(env.page, "#home-tokens-note");
+        await env.page.waitForFunction(
+            (want) =>
+                document
+                    .getElementById("wallet-list")
+                    .textContent.includes(want),
+            quantity(FUNDED_ETH_WEI),
+            { timeout: 60000 },
+        );
+
+        await openAddressDetail(env.page);
+        await waitForHistoryOff(env.page, "tx-list");
+        await visible(env.page, "#address-tokens-note");
+
+        await env.page.locator('#address-balances [data-token="ETH"]').click();
+        await visible(env.page, "#view-address-token");
+        await waitForHistoryOff(env.page, "address-token-tx-list");
+        await env.page.click("#btn-address-token-back");
+        await visible(env.page, "#view-address");
+
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await waitForEstimate(env.page);
+        await visible(env.page, "#confirm-etherscan-note");
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-warning")),
+            "ConfirmTx keeps the Etherscan warning's place while no Etherscan check is made",
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+    }
+});
+
+// The background refreshes balances on its alarm, once a minute, and skips a
+// refresh when the stored record says one ran in the last 30 seconds, which
+// the open popup's own refresh does every 10. So the popup is closed, and that
+// record is written back to say no refresh has run, from the background
+// worker, as another extension page saving it would.
+test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
+    await waitForPersisted(
+        env.page,
+        "currentView",
+        "address",
+        "before the popup is closed",
+    );
+    await env.page.close();
+    const [worker] = env.ctx.serviceWorkers();
+    await worker.evaluate(
+        () =>
+            new Promise((resolve) => {
+                chrome.storage.local.get("autistmask", (r) => {
+                    const record = r.autistmask;
+                    record.lastBalanceRefresh = 0;
+                    chrome.storage.local.set({ autistmask: record }, resolve);
+                });
+            }),
+    );
+    const before = env.routeOpts.requests.length;
+    const deadline = Date.now() + 75000;
+    while (
+        !env.routeOpts.requests
+            .slice(before)
+            .some((r) => r.fromWorker && r.method === "POST")
+    ) {
+        assert(
+            Date.now() < deadline,
+            "the background's balance refresh never asked the RPC endpoint",
+        );
+        await sleep(250);
+    }
+    // Its RPC reads and any Blockscout request start together.
+    await sleep(3000);
+
+    const seen = explorerRequests(env);
+    assert(
+        seen.length === 0,
+        "a fresh install asked Blockscout or Etherscan: " +
+            JSON.stringify(seen),
+    );
+    // The watch saw the popup's own traffic as well as the worker's.
+    assert(
+        env.routeOpts.requests.some((r) => !r.fromWorker),
+        "no request from the popup was recorded",
+    );
+    // It reopens on the address screen the test above left it on.
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, "#view-address");
+});
+
+// Ticked from AddressDetail's gear, so Back lands on the screen that said the
+// setting is off.
+test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for that screen's history on Back, then for the tokens (#668)", async (env) => {
+    await openAddressDetail(env.page);
+    await waitForHistoryOff(env.page, "tx-list");
+    await openSettings(env.page);
+    await env.page.check("#settings-use-blockscout");
+    await waitForPersisted(env.page, "useBlockscout", true, "once ticked");
+    const historyAsked = env.page.waitForRequest(
+        (r) =>
+            r.url().includes("blockscout.com") &&
+            r.url().endsWith("/transactions"),
+    );
+    const tokensAsked = env.page.waitForRequest(
+        (r) => r.url().endsWith("/token-balances"),
+        { timeout: 30000 },
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+    await historyAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#address-tokens-note")),
+        "AddressDetail still says only tracked tokens are listed",
+    );
+
+    await goHome(env.page);
+    await tokensAsked;
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("home-tx-list")
+                .textContent.includes("No transactions found."),
+        null,
+        { timeout: 15000 },
+    );
+    assert(
+        !(await env.page.isVisible("#home-tokens-note")),
+        "Home still says only tracked tokens are listed",
+    );
+});
+
+// Ticked from ConfirmTx's gear, so Back lands on the screen that said no
+// Etherscan check was made. Left on for the rest of the run, as the check was
+// always made before #668.
+test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
+    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
+    env.routeOpts.etherscanLabel = "Fake_Phishing668";
+    try {
+        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI });
+        await goToConfirm(env.page, {
+            token: "ETH",
+            balance: FUNDED_ETH_TEXT + " ETH",
+            amount: COMFORTABLE_AMOUNT,
+        });
+        await visible(env.page, "#confirm-etherscan-note");
+
+        await openSettings(env.page);
+        await env.page.check("#settings-check-recipients-on-etherscan");
+        await waitForPersisted(
+            env.page,
+            "checkRecipientsOnEtherscan",
+            true,
+            "once ticked",
+        );
+        const before = env.routeOpts.requests.length;
+        await env.page.click("#btn-settings-back");
+        await visible(env.page, "#view-confirm-tx");
+        await visible(env.page, "#confirm-etherscan-warning", 30000);
+        assert(
+            !(await env.page.isVisible("#confirm-etherscan-note")),
+            "ConfirmTx says no Etherscan check was made, with the check on",
+        );
+        const asked = env.routeOpts.requests
+            .slice(before)
+            .map((r) => r.url.toLowerCase())
+            .filter((url) => url.includes("etherscan.io"));
+        assert(
+            asked.length === 1 &&
+                asked[0] ===
+                    "https://etherscan.io/address/" + STUB_COUNTERPARTY,
+            "ConfirmTx asked Etherscan for " + JSON.stringify(asked),
+        );
+        await backToAddress(env.page);
+    } finally {
+        env.routeOpts.ethBalanceWei = null;
+        env.routeOpts.etherscanLabel = null;
+    }
+});
+
 test("add token screen opens from address detail (#150)", async (env) => {
     await openAddressDetail(env.page);
     await env.page.click("#btn-add-token");
@@ -651,8 +903,7 @@ test("a token added by its contract address is listed on the address screen (#15
     await visible(env.page, "#view-address");
 
     // No wait: the confirm renders the balance list before it shows the
-    // screen. The refresh it starts draws the list again, with the row still
-    // in it.
+    // screen, and nothing renders the list again while the screen is up.
     const row = env.page.locator(
         '#address-balances [data-token="' + STUB_TOKEN.address + '"]',
         { hasText: STUB_TOKEN.symbol },
@@ -3481,6 +3732,24 @@ function hostileSymbolState(page, tokenAddress) {
 }
 
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
+    // The stub token is no longer tracked from here on, so the explorer is
+    // what lists it, as it lists a token airdropped to the victim. A tracked
+    // token is listed from the RPC endpoint under the symbol it was added
+    // with, which the hostile symbol below never reaches
+    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+    await env.page.click("#settings-tracked-tokens .btn-remove-token");
+    // The list is drawn again once the removal is saved.
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("settings-tracked-tokens")
+                .innerText.trim() === "None",
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.seedTokenBalance = true;
     env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;
@@ -5241,10 +5510,17 @@ async function main() {
         seedReceipt: false,
         // Whether eth_getTransactionReceipt fails instead of answering (#315).
         failReceiptLookup: false,
+        // The label Etherscan's page gives an address, when it gives one
+        // (#668).
+        etherscanLabel: null,
         // Every raw signed transaction handed to eth_sendRawTransaction, in
         // order. The dApp transaction round trip asserts against these bytes
         // rather than against anything the extension reported about them.
         broadcastTransactions: [],
+        // Every request the extension makes, in order, from when launch()
+        // installs the route handler, before the first popup page opens
+        // (#668).
+        requests: [],
     };
 
     let session;

tests/ensOffchainLookup.test.js

@@ -0,0 +1,111 @@
+// ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
+// name is resolved off-chain, naming a web address to fetch the answer from;
+// ethers fetches it unless the provider has `disableCcipRead` set, and that
+// request would carry the name to a server other than the RPC endpoint
+// (https://git.eeqj.de/sneak/AutistMask/issues/668). With it set, such a name
+// does not resolve.
+//
+// The provider getProvider() builds runs against a fake JSON-RPC node,
+// answered through ethers' own request hook, which also records the address of
+// every request ethers makes, the off-chain fetch included.
+
+const { FetchRequest, Interface } = require("ethers");
+const { getProvider } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const RESOLVER = "0x5555555555555555555555555555555555555555";
+const USER = "0x1111111111111111111111111111111111111111";
+const NAME = "offchain.eth";
+
+// The ENS registry's resolver(), and the resolver's functions ethers calls: the
+// registry names RESOLVER for every name, the resolver says it resolves names
+// through resolve(), gives NAME as the reverse record of any address, and
+// answers resolve() with the OffchainLookup error that says the name is
+// resolved off-chain.
+const ens = new Interface([
+    "function resolver(bytes32) view returns (address)",
+    "function supportsInterface(bytes4) view returns (bool)",
+    "function name(bytes32) view returns (string)",
+    "function resolve(bytes, bytes) view returns (bytes)",
+    "error OffchainLookup(address sender, string[] urls, bytes callData, bytes4 callbackFunction, bytes extraData)",
+]);
+
+let asked;
+
+// One JSON-RPC answer. Anything but a call to one of the functions above is
+// refused.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    const call =
+        req.method === "eth_call" ? ens.parseTransaction(req.params[0]) : null;
+    if (call === null) {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    if (call.name === "resolve") {
+        const offchain = ens.encodeErrorResult("OffchainLookup", [
+            RESOLVER,
+            ["https://gateway.example.invalid/{sender}/{data}.json"],
+            "0x1234",
+            "0x12345678",
+            "0x",
+        ]);
+        return {
+            ...envelope,
+            error: { code: 3, message: "execution reverted", data: offchain },
+        };
+    }
+    const answers = {
+        resolver: [RESOLVER],
+        supportsInterface: [true],
+        name: [NAME],
+    };
+    return {
+        ...envelope,
+        result: ens.encodeFunctionResult(call.name, answers[call.name]),
+    };
+}
+
+beforeEach(() => {
+    asked = [];
+    FetchRequest.registerGetUrl(async (req) => {
+        asked.push(req.url);
+        // Any other address is the off-chain fetch, answered as not found.
+        if (req.url !== RPC_URL) {
+            return {
+                statusCode: 404,
+                statusMessage: "Not Found",
+                headers: {},
+                body: null,
+            };
+        }
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+});
+
+test("a name typed into Send that is resolved off-chain does not resolve, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.resolveName(NAME)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});
+
+test("the reverse lookup of a user's address whose name is resolved off-chain finds no name, and only the RPC endpoint is asked", async () => {
+    const provider = getProvider(RPC_URL, "mainnet");
+    const [outcome] = await Promise.allSettled([provider.lookupAddress(USER)]);
+    expect(asked.filter((url) => url !== RPC_URL)).toEqual([]);
+    expect(outcome).toEqual({ status: "fulfilled", value: null });
+});

tests/fabricatedDecimals.test.js

@@ -114,6 +114,7 @@ async function fetchOnto(items, trackedTokens = []) {
     const balances = await fetchTokenBalances(
         HOLDER,
         BLOCKSCOUT,
+        true,
         trackedTokens,
     );
     state.trackedTokens = trackedTokens;

tests/flashLine.test.js

@@ -88,7 +88,6 @@ describe.each([
             showFlash: (msg) => flashes.push(msg),
             escapeHtml: (s) => s,
             goBack: () => {},
-            trackToken: () => {},
         }));
 
         require("../src/popup/views/" + view).init({

tests/holders.test.js

@@ -150,19 +150,23 @@ describe("the balance-list spam gate", () => {
 
     test("a token with plenty of reported holders is listed", async () => {
         respondWith([item()]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBe(50000);
     });
 
     test("a token reporting zero holders is still excluded", async () => {
         respondWith([item({ token: { holders_count: "0" } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("an unknown holder count does not admit an unvouched token", async () => {
         respondWith([item({ token: { holders_count: null } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The path that reaches the send selector and the history filter: a token
@@ -171,7 +175,7 @@ describe("the balance-list spam gate", () => {
     // zero that would then hide it downstream.
     test("a tracked token with an unknown count is listed with holders null", async () => {
         respondWith([item({ token: { holders_count: undefined } })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: NOVEL_TOKEN.toUpperCase() },
         ]);
         expect(balances).toHaveLength(1);
@@ -188,7 +192,7 @@ describe("the balance-list spam gate", () => {
                 },
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBeNull();
     });

tests/nativeCurrency.test.js

@@ -436,6 +436,8 @@ describe.each([
         });
 
         test("the transaction detail screen's type line and fee", async () => {
+            // The fee is Blockscout's.
+            state.useBlockscout = true;
             debugFetch.mockImplementationOnce(async () => ({
                 ok: true,
                 status: 200,

tests/persistedFieldContract.test.js

@@ -248,13 +248,6 @@ const CONTRACT = [
         floorOnly: [[42], [null], [{}], [[TOKEN_ADDRESS]]],
         holds: (v) => everyEntry(v, isText),
     },
-    {
-        field: "tokensNotFetched",
-        kind: KIND.ENTRIES,
-        hostile: [42, "notalist", { a: 1 }],
-        floorOnly: [[42], [null], [{}], [[TOKEN_ADDRESS]]],
-        holds: (v) => everyEntry(v, isText),
-    },
     {
         field: "viewStack",
         kind: KIND.ENTRIES,
@@ -625,6 +618,8 @@ const CONTRACT = [
         "hideFraudContracts",
         "hideDustTransactions",
         "utcTimestamps",
+        "useBlockscout",
+        "checkRecipientsOnEtherscan",
         "debugMode",
     ].map((field) => ({
         field,
@@ -632,8 +627,9 @@ const CONTRACT = [
         // A flag: only ever tested for truthiness, and written back verbatim.
         hostile: [42, "notabool", { a: 1 }],
         // Both answers to that truthiness test have to be driven, and 0 is a
-        // value src/ never writes for a flag. For utcTimestamps and debugMode
-        // the falsy answer is also the DEFAULT_STATE default.
+        // value src/ never writes for a flag. For utcTimestamps,
+        // useBlockscout, checkRecipientsOnEtherscan and debugMode the falsy
+        // answer is also the DEFAULT_STATE default.
         falsy: [0],
     })),
 ];

tests/popupBoot.test.js

@@ -44,7 +44,8 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
 
 // A boot onto a screen that sends a request no mocked module answers: that
 // request reaches the boot's fetch() stub, never the internet
-// (https://git.eeqj.de/sneak/AutistMask/issues/559).
+// (https://git.eeqj.de/sneak/AutistMask/issues/559). Both requests are made
+// only while the user has the setting for them on.
 function restoringOnto(view, viewData) {
     return unversionedValidProfile({
         currentView: view,
@@ -52,6 +53,8 @@ function restoringOnto(view, viewData) {
         selectedAddress: 0,
         viewStack: ["main"],
         viewData,
+        useBlockscout: true,
+        checkRecipientsOnEtherscan: true,
     });
 }
 

tests/popupFollowsNetworkSwitch.test.js

@@ -87,7 +87,7 @@ test("the popup open on AddressDetail shows the new network and its balances", a
     // Its next refresh runs on Sepolia, and what it fetched is stored.
     await page.tick();
     const { refreshBalances } = require("../src/shared/balances");
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
     const stored = page.storage.read("autistmask");
     expect(stored.networkId).toBe("sepolia");
     expect(stored.lastBalanceRefresh).toBeGreaterThan(0);

tests/rpcErrorLog.test.js

@@ -88,6 +88,7 @@ test("the balance refresh", async () => {
         wallets,
         RPC_URL,
         "https://explorer.example.invalid/api/v2",
+        true,
         [],
         "mainnet",
     );

tests/sendDisplayFloor.test.js

@@ -224,6 +224,7 @@ async function refreshWith(balanceWei, tokenItems = []) {
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/sendMax.test.js

@@ -217,6 +217,7 @@ async function refreshWith(balanceWei, tokenItems = []) {
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/symbolSpoof.test.js

@@ -582,12 +582,14 @@ describe("surface 3: the balance list", () => {
     // 1,000-holder floor and was listed as a holding named ETH.
     test("a fake ETH token clearing the holder floor is filtered", async () => {
         respondWith([fakeEthItem()]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("tracking the fake token manually does not admit it either", async () => {
         respondWith([fakeEthItem({ holders_count: "0" })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: FAKE_ETH_CONTRACT },
         ]);
         expect(balances).toEqual([]);
@@ -597,12 +599,16 @@ describe("surface 3: the balance list", () => {
     // their belief about what they own, and it renders the symbol into HTML.
     test("a padded fake ETH token is filtered too", async () => {
         respondWith([fakeEthItem({ symbol: " ETH " })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("a fake ETH token padded with a no-break space is filtered", async () => {
         respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The false-positive direction on the surface that matters most: a real
@@ -617,7 +623,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -631,7 +637,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
@@ -642,7 +648,9 @@ describe("surface 3: the balance list", () => {
     // before the symbol rule is consulted.
     test("a non-ERC-20 row claiming ETH never reaches the symbol rule", async () => {
         respondWith([fakeEthItem({ type: "ERC-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The adjacent finding from the same review as issue #260: the type gate
@@ -660,16 +668,20 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
     test("case insensitivity does not admit another token type", async () => {
         respondWith([fakeEthItem({ type: "erc-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
         respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The money test: the user holds real ETH and has been airdropped a fake
@@ -682,6 +694,7 @@ describe("surface 3: the balance list", () => {
             [{ addresses: [addr] }],
             "https://rpc.example.invalid",
             BLOCKSCOUT,
+            true,
             [],
             "mainnet",
         );

tests/timestampDisplay.test.js

@@ -134,6 +134,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 describe.each([

tests/tokenTransferDetail.test.js

@@ -158,6 +158,7 @@ beforeEach(() => {
     globalThis.document = makeDocument();
     globalThis.window = { location: { search: "" } };
     state.blockscoutUrl = EXPLORER;
+    state.useBlockscout = true;
     state.networkEndpoints = {};
     state.wallets = [
         {
@@ -177,6 +178,7 @@ test("a token transfer's decoded details name the token contract and the amount
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.mainnet.chainId,
     );
     expect(row.to).toBe(RECIPIENT);
@@ -209,6 +211,7 @@ test("with mainnet active, a Sepolia transaction is read from Sepolia's Blocksco
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
 
@@ -237,6 +240,7 @@ test("with mainnet active and no Blockscout remembered for Sepolia, a Sepolia tr
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
     mockAsked.length = 0;
@@ -258,6 +262,7 @@ async function showSepoliaTransferWithMainnetActive() {
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
     transactionDetail.show(row);

tests/trackedTokenBalances.test.js

@@ -0,0 +1,304 @@
+// The balance of each token the user tracks is read with balanceOf through the
+// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
+// holder count and decimals, and adds the tokens the user has not tracked
+// (https://git.eeqj.de/sneak/AutistMask/issues/669).
+//
+// The real refreshBalances() runs against a fake JSON-RPC node, answered
+// through ethers' own request hook, and a fake Blockscout, answered through
+// fetch().
+
+const { AbiCoder, FetchRequest } = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
+const FIRST = "0x1111111111111111111111111111111111111111";
+const SECOND = "0x2222222222222222222222222222222222222222";
+
+// A token the user tracks, outside the bundled list, at 6 decimals.
+const TOKEN = "0x7777777777777777777777777777777777777777";
+const TRACKED = {
+    address: TOKEN,
+    symbol: "TRK",
+    name: "Tracked Token",
+    decimals: 6,
+};
+
+// USDC, from the bundled list, which the user does not track.
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+// Neither on the bundled list nor tracked.
+const OTHER = "0x8888888888888888888888888888888888888888";
+
+const ZERO_WORD = "0x" + "0".repeat(64);
+const BALANCE_OF = "0x70a08231";
+
+// What balanceOf answers, by token contract and then by holder. A pair that is
+// not here makes balanceOf fail.
+let holdings;
+// What Blockscout answers for every address; null makes the request fail.
+let explorerRows;
+let logged;
+
+// One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
+// answered with no resolver, so no name.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    if (req.method === "eth_getBalance") {
+        return { ...envelope, result: "0x0" };
+    }
+    if (req.method !== "eth_call") {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    const { to, data } = req.params[0];
+    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
+    const holder = "0x" + data.slice(-40);
+    const amount = (holdings[to.toLowerCase()] || {})[holder];
+    if (amount === undefined) {
+        return {
+            ...envelope,
+            error: { code: -32000, message: "fixture: balanceOf failed" },
+        };
+    }
+    return {
+        ...envelope,
+        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
+    };
+}
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+    holdings = {};
+    explorerRows = null;
+    logged = [];
+    jest.spyOn(console, "error").mockImplementation((...args) => {
+        logged.push(args.map(String).join(" "));
+    });
+    FetchRequest.registerGetUrl(async (req) => {
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+    globalThis.fetch = jest.fn(async () => {
+        if (explorerRows === null) throw new TypeError("Failed to fetch");
+        return { ok: true, status: 200, json: async () => explorerRows };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    jest.restoreAllMocks();
+});
+
+// One Blockscout token-balances row.
+function explorerRow(address, symbol, value, holders = "50000") {
+    return {
+        value: String(value),
+        token: {
+            type: "ERC-20",
+            address_hash: address,
+            symbol: symbol,
+            name: symbol,
+            decimals: "6",
+            holders_count: holders,
+        },
+    };
+}
+
+// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
+// decimals and holder count Blockscout reported for it, if any.
+function trackedRow(balance, decimals = null, holders = null) {
+    return {
+        address: TOKEN,
+        name: "Tracked Token",
+        symbol: "TRK",
+        decimals: decimals,
+        balance: balance,
+        holders: holders,
+    };
+}
+
+async function refresh(addresses, trackedTokens) {
+    await refreshBalances(
+        [{ addresses }],
+        RPC_URL,
+        EXPLORER_URL,
+        true,
+        trackedTokens,
+        "mainnet",
+        new AbortController().signal,
+    );
+    return addresses;
+}
+
+test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
+    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
+    // Exact, never cut: one base unit is not zero.
+    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
+});
+
+test("with Blockscout failing, the untracked rows from before stay", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const usdc = {
+        address: USDC,
+        name: "USD Coin",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [usdc] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
+});
+
+test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [
+        explorerRow(TOKEN, "TRK", 9000000),
+        explorerRow(USDC, "USDC", 5000000),
+        // Too few holders, and neither on the bundled list nor tracked.
+        explorerRow(OTHER, "SPAM", 5000000, "10"),
+        // A known symbol from a contract it does not belong to.
+        explorerRow(OTHER, "USDC", 5000000),
+    ];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        trackedRow("2.0", 6, 50000),
+        {
+            address: USDC,
+            name: "USDC",
+            symbol: "USDC",
+            decimals: 6,
+            balance: "5.0",
+            holders: 50000,
+        },
+    ]);
+});
+
+test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
+    // through to Send's token list.
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const before = trackedRow("7.0", 6, 50000);
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([before]);
+    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
+        true,
+    );
+});
+
+test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
+    // balanceOf fails at FIRST and answers at SECOND.
+    holdings[TOKEN] = { [SECOND]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: TOKEN,
+            name: "TRK",
+            symbol: "TRK",
+            decimals: 6,
+            balance: "9.0",
+            holders: 50000,
+        },
+    ]);
+    // Where balanceOf answers, its figure stands.
+    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
+    holdings[TOKEN] = { [FIRST]: 0n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});
+
+test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
+    holdings[TOKEN] = { [FIRST]: 5n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow(null)]);
+});
+
+test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a tracked token wearing a known symbol from another contract is not listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    // Its entry from before goes too, although Blockscout fails.
+    const before = {
+        address: OTHER,
+        name: "Fake",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});

tests/trackedTokensPerNetwork.test.js

@@ -287,6 +287,7 @@ describe("Back after a switch from the Settings gear", () => {
                 currentView: "confirm-tx",
                 selectedWallet: 0,
                 selectedAddress: 0,
+                checkRecipientsOnEtherscan: true,
                 viewData: {
                     pendingTx: {
                         token: "ETH",

tests/transactionListCancelled.test.js

@@ -125,6 +125,8 @@ beforeEach(() => {
     state.selectedWallet = 0;
     state.selectedAddress = 0;
     state.selectedToken = "ETH";
+    // The history is Blockscout's.
+    state.useBlockscout = true;
 });
 
 afterEach(() => {

tests/transactions.test.js

@@ -1219,7 +1219,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
 
     test("queries only the two Blockscout endpoints for the address", async () => {
         respondWith([], []);
-        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1");
         expect(debugFetch).toHaveBeenCalledTimes(2);
         const urls = debugFetch.mock.calls.map((c) => c[0]);
         expect(urls).toContain(
@@ -1283,7 +1283,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         const merged = txs[0];
         // The received leg (the swap output) supplies the display amount.
@@ -1320,7 +1325,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].value).toBe("1500.5000");
@@ -1346,7 +1356,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([], [leg("1000000"), leg("2000000")]);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         // Keyed by hash plus contract, so the later leg wins.
         expect(txs[0].exactValue).toBe("2.0");
@@ -1386,7 +1401,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
     });
 
@@ -1427,7 +1447,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].exactValue).toBe("1.0");
@@ -1453,7 +1478,13 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([item(6), item(8), item(7)], []);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1", 2);
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+            2,
+        );
         expect(txs.map((t) => t.blockNumber)).toEqual([21000008, 21000007]);
     });
 
@@ -1479,6 +1510,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const sepolia = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0xaa36a7",
         );
         expect(sepolia[0].symbol).toBe("SepoliaETH");
@@ -1487,6 +1519,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const mainnet = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0x1",
         );
         expect(mainnet[0].symbol).toBe("ETH");
@@ -1513,7 +1546,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].contractAddress).toBe(FAKE_ETH_CONTRACT);
         expect(txs[0].holders).toBe(0);
@@ -1555,6 +1593,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1565,6 +1604,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1575,6 +1615,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(filterTransactions(txs, filters()).transactions).toEqual(
@@ -1591,6 +1632,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBe(0);
@@ -1608,7 +1650,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             },
         }));
         await expect(
-            fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1"),
+            fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1"),
         ).resolves.toEqual([]);
     });
 

tests/uniswap.test.js

@@ -3730,6 +3730,88 @@ describe("uniswap decoder", () => {
         },
     );
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/574 — a V4 step that buys
+    // at least 0.5 WETH with 1,000 USDT, spends some of it on USDC, and takes
+    // the USDC and then the WETH, so its output side is WETH. Only what is
+    // left of the 0.5 WETH is sure to reach the user, and the screen read
+    // Min. received 0.5000 WETH.
+    test.each([
+        {
+            spend: "0.3 WETH for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN_SINGLE_ID,
+                param: encodeV4ExactInSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "0.3 WETH through DAI for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN,
+                param: encodeV4ExactIn(
+                    WETH_ADDR,
+                    [DAI_ADDR, USDC_ADDR],
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "at most 0.3 WETH for exactly 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_OUT_SINGLE_ID,
+                param: encodeV4ExactOutSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    594000000n,
+                    300000000000000000n,
+                ),
+            },
+        },
+    ])(
+        "a V4 step that buys WETH and spends $spend, with WETH as its output side, shows no Min. received",
+        ({ swap }) => {
+            const data = buildExecute(
+                "0x10",
+                [
+                    encodeV4Swap(
+                        new Uint8Array([
+                            USDT_FOR_WETH_IN.id,
+                            swap.id,
+                            V4_SETTLE_ALL_ID,
+                            V4_TAKE_ID,
+                            V4_TAKE_ID,
+                        ]),
+                        [
+                            USDT_FOR_WETH_IN.param,
+                            swap.param,
+                            encodeV4SettleAll(USDT_ADDR, 1000000000n),
+                            encodeV4Take(USDC_ADDR),
+                            encodeV4Take(WETH_ADDR),
+                        ],
+                    ),
+                ],
+                9999999999n,
+            );
+
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
+            expect(result.name).toBe("Swap USDT → WETH");
+            expect(detail(result, "Amount").value).toBe("1000.0000 USDT");
+            expect(detail(result, "Token Out").address).toBe(WETH_ADDR);
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
     // A V4 step that spends WETH on USDC and on DAI. Its swap actions buy two
     // currencies that none of them spends, and CLOSE_CURRENCY, which the
     // decoder does not read, names no side, so its output side is unknown.

tests/uniswapRecipient.test.js

@@ -1332,6 +1332,10 @@ describe("any token left in the router is not received", () => {
                 ),
             ),
             left: tokenLine(WETH, "WETH"),
+            // The second swap action spends 1 USDC of what the first buys,
+            // so the step states no minimum
+            // (https://git.eeqj.de/sneak/AutistMask/issues/574).
+            noMin: true,
         },
         {
             kind: "a WRAP_ETH of 1 ETH into the router, then a V4 SETTLE of OPEN_DELTA from the router before the swap, which the user settles",
@@ -1432,7 +1436,7 @@ describe("any token left in the router is not received", () => {
             ),
             left: { label: "Token moved into the router", value: "ETH" },
         },
-    ])("$kind", ({ data, left, spent, unread }) => {
+    ])("$kind", ({ data, left, spent, unread, noMin }) => {
         const result = decode(data);
         expect(labels(result)).toEqual([
             "Protocol",
@@ -1458,7 +1462,7 @@ describe("any token left in the router is not received", () => {
             "Token Out",
             "Paid to",
             "Token moved into the router",
-            "Min. paid out",
+            ...(noMin ? [] : ["Min. paid out"]),
             "Steps",
             "Deadline",
         ]);
@@ -1474,7 +1478,9 @@ describe("any token left in the router is not received", () => {
         }
         expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
         expect(detail(result, "Token moved into the router")).toEqual(left);
-        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
+        expect(detail(result, "Min. paid out")?.value).toBe(
+            noMin ? undefined : "1990.0000 USDC",
+        );
     });
 
     // Uniswap's own routes: a swap paid in ETH wraps into the router what its
@@ -3450,6 +3456,7 @@ async function showDetail(data) {
     globalThis.window = { location: { search: "" } };
     state.networkId = "mainnet";
     state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.useBlockscout = true;
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;

tests/uniswapRouterAddress.test.js

@@ -208,6 +208,7 @@ async function showDetail(row, activeNetworkId) {
     globalThis.window = { location: { search: "" } };
     state.networkId = activeNetworkId;
     state.blockscoutUrl = "https://explorer.example/api/v2";
+    state.useBlockscout = true;
     state.viewData = {};
     state.viewStack = [];
     state.currentView = null;
@@ -287,6 +288,7 @@ async function historyRow(method, sentTo, chainId) {
     const rows = await fetchRecentTransactions(
         RECIPIENT,
         "https://explorer.example/api/v2",
+        true,
         chainId,
     );
     return rows[0];

tests/unknownScaleSend.test.js

@@ -172,7 +172,7 @@ async function fetchOnto(items) {
         statusText: "OK",
         json: async () => items,
     }));
-    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",
@@ -197,14 +197,14 @@ async function fetchOntoBoth(itemsA, itemsB) {
         statusText: "OK",
         json: async () => itemsA,
     }));
-    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
         statusText: "OK",
         json: async () => itemsB,
     }));
-    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, []);
+    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",