fix: tracked tokens' balances are read through the RPC endpoint (closes #669)

refreshBalances() now reads the balance of every token tracked on the
active network, at every address, with balanceOf through the same
provider as the ETH balance. The entry takes its holder count and
decimals from Blockscout's entry for the token in the same refresh, or
keeps them from before while Blockscout fails. A failed balanceOf keeps
the token's previous entry, or takes Blockscout's entry when there is
none, and is logged. Blockscout's answer still adds the tokens the user
has not tracked, as before.

The browser test for a hostile symbol now untracks the stub token
first, because a tracked token is listed under the symbol it was added
with.

Model: opus-5-5

README.md

@@ -845,7 +845,7 @@ src/
     views/            — one JS module per screen (home, send, approval, etc.)
   shared/             — modules used by both popup and background
     alarms.js         — recurring background jobs (extension alarms API)
-    balances.js       — ETH + ERC-20 balance fetching via RPC + Blockscout
+    balances.js       — ETH and tracked token balances via RPC, others via Blockscout
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
@@ -1243,7 +1243,11 @@ only when no earlier step set it. It finds each side by three rules:
    is their sum; in any other case the step gives no `Amount`. The decoder reads
    no amount from an exact-out action, and an open delta is not a stated amount.
    Its `Min. received` is found the same way, from the `amountOutMin` of the
-   actions that buy the output currency.
+   actions that buy the output currency, except that the step gives none when a
+   swap action in it also spends the output currency, because the step then does
+   not pay out all that those actions buy. A step that buys at least 0.5 WETH
+   with USDT and swaps 0.3 WETH of it for USDC, with WETH as its output side,
+   gives no `Min. received`.
 3. If any swap action in the step could not be read, only `SETTLE`,
    `SETTLE_ALL`, `TAKE` and `TAKE_ALL` name its sides, and the step gives no
    `Amount` or `Min. received`. A side they did not name is unknown, and the
@@ -1375,30 +1379,35 @@ The core hierarchy is **Wallets → Addresses**:
 - The user can have multiple wallets, each with multiple addresses (HD) or a
   single address (key).
 
-Which tokens an address shows is decided by `fetchTokenBalances()` in
-`src/shared/balances.js`, from the Blockscout `token-balances` response, so
-tokens do appear without the user adding them. An ERC-20 is shown when its
-balance is nonzero and it is in the bundled known-token list, is tracked by the
-user, or has 1,000 or more holders; a token claiming a symbol from the bundled
-list from any other contract address is always dropped, and so is any token
-claiming a symbol that belongs to the native asset and therefore has no
-legitimate contract at all (`"ETH"`, and every network's `nativeCurrency`, such
-as `"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
-tokens with fewer than 1,000 holders" setting governs the transaction history
-and the send-screen token selector, not this list. A token's holder count is
-unknown when the explorer reports none, or reports anything other than a whole
-number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
-in `src/shared/holders.js`). This list does not take an unknown count as 1,000
-or more, so such a token is shown only when it is on the bundled list or
-tracked. `fetchTokenBalances()` stores every nonzero holding of a token it
-admits, however small, but a holding below 0.000001 is left out of the balance
+Which tokens an address shows is decided on every refresh by `refreshBalances()`
+in `src/shared/balances.js`. The balance of each token tracked on the active
+network is read with `balanceOf` through the RPC endpoint, for every address.
+Its holder count and `decimals` are those of Blockscout's entry for it in the
+same refresh, kept from before while Blockscout fails. A read that fails keeps
+that token's previous entry, as a failed ETH balance keeps its figure, or takes
+Blockscout's entry from the same refresh when there is none. Every other token
+comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
+tokens do appear without the user adding them, and they keep their previous
+figures while Blockscout fails. A tracked token is shown when its balance is
+nonzero, and any other ERC-20 when its balance is nonzero and it is in the
+bundled known-token list or has 1,000 or more holders. A token claiming a symbol
+from the bundled list from any other contract address is always dropped, tracked
+or not, and so is any token claiming a symbol that belongs to the native asset
+and therefore has no legitimate contract at all (`"ETH"`, and every network's
+`nativeCurrency`, such as `"SepoliaETH"`, on every network). That filter is
+unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
+the transaction history and the send-screen token selector, not this list. A
+token's holder count is unknown when the explorer reports none, or reports
+anything other than a whole number written in digits alone, such as `1,000` or
+`1e3` (`parseHoldersCount()` in `src/shared/holders.js`). This list does not
+take an unknown count as 1,000 or more, so such a token is shown only when it is
+on the bundled list or tracked. Every nonzero holding of a token shown is stored
+exactly, however small, but a holding below 0.000001 is left out of the balance
 lists, the send-screen token selector, the address total and the remove-address
 warning (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
-zero balance" is on; a token just added on AddToken or SettingsAddToken whose
-balance no refresh has fetched yet is listed there as `quantity unknown` (see
-AddToken).
+zero balance" is on.
 
 #### Stored state and its version
 
@@ -1569,13 +1578,6 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 
-The popup refreshes balances every ten seconds while it is open
-(`doRefreshAndRender()` in `src/popup/index.js`). Each refresh that returns
-draws the wallet list again and, when AddressDetail or AddressToken is up, that
-screen's USD total and balance lines; its transaction list is left alone. No
-other screen is drawn again by a refresh, DeleteAddress and its balance lines
-included.
-
 A network switch leaves every screen on the page showing the previous network.
 The user makes it in Settings, or approves a site's request and the background
 saves it. Any other popup open meanwhile takes the switch from the stored
@@ -2087,14 +2089,7 @@ view would leave a wallet one click from deletion.
     - "Add" button
 - **Transitions**:
     - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
-      **AddressDetail**. The token's balance is not known until a balance
-      refresh that started with it tracked has fetched every address's token
-      balances; until then its balance line reads `quantity unknown`, never
-      `0.0000`, unless the explorer had already listed a holding of it. That
-      holds after the popup is closed and opened again, as the tokens still
-      waiting for a fetch are stored with the profile. A refresh that returns
-      draws AddressDetail's balances again (see Navigation), so the fetched
-      balance shows without the screen being reopened
+      **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
     - "Add", then a network switch in Settings before the contract lookup
@@ -2371,9 +2366,7 @@ view would leave a wallet one click from deletion.
       add path
 - **Transitions**:
     - Any of the add paths shown, on success → adds the token and shows an
-      "Added SYMBOL" flash message (no screen change). Until its balance is
-      fetched, its balance line reads `quantity unknown`, as after "Add" on
-      AddToken
+      "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
     - "Add" by contract address, then a network switch in Settings before the
@@ -2676,7 +2669,8 @@ AutistMask is not a fully self-contained offline tool. It necessarily
 communicates with three external services to function as a wallet:
 
 - **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
-  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`), among
+  them the balance of every tracked token at every address (`balanceOf`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
   receipts. The default endpoint is a public RPC (configurable by the user to

src/popup/index.js

@@ -82,26 +82,12 @@ let refreshTimer = null;
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
 // recorded as done. Results are copied by address, so an address added or
 // removed meanwhile is left as it is.
-//
-// Once the save is done, the wallet list is drawn again, and so are the
-// balances on AddressDetail or AddressToken when that is the screen up. No
-// other screen is drawn again, DeleteAddress and its balance lines included.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
         const networkId = state.networkId;
-        // The tracked tokens this refresh asks the explorer about. A token
-        // added on AddToken after this point is not among them, so this
-        // refresh does not count as having fetched it.
-        const tokens = state.trackedTokens.map((t) => t.address.toLowerCase());
         const wallets = structuredClone(state.wallets);
-        // Taken off the copy, so that an address whose token balances the
-        // explorer did not return comes back without any and keeps its
-        // stored ones.
-        for (const wallet of wallets) {
-            for (const addr of wallet.addresses) delete addr.tokenBalances;
-        }
         await Promise.all([
             refreshPrices(),
             refreshBalances(
@@ -114,13 +100,9 @@ async function doRefreshAndRender() {
             ),
         ]);
         const refreshed = new Map();
-        let allTokenBalancesFetched = true;
         for (const wallet of wallets) {
             for (const addr of wallet.addresses) {
                 refreshed.set(addr.address, addr);
-                if (addr.tokenBalances === undefined) {
-                    allTokenBalancesFetched = false;
-                }
             }
         }
         await saveState((stored) => {
@@ -135,19 +117,10 @@ async function doRefreshAndRender() {
                     }
                 }
             }
-            // Each token this refresh asked about is now fetched for every
-            // address.
-            if (allTokenBalancesFetched) {
-                state.tokensNotFetched = state.tokensNotFetched.filter(
-                    (token) => !tokens.includes(token),
-                );
-            }
             state.lastBalanceRefresh = Date.now();
             return true;
         });
         renderWalletList();
-        if (state.currentView === "address") addressDetail.renderBalances();
-        if (state.currentView === "address-token") addressToken.renderBalance();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten
         // second interval, and eight views through ctx — so it must never

src/popup/views/addToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -79,7 +72,7 @@ function init(ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, contractAddr);
-            trackToken({
+            state.trackedTokens.push({
                 address: contractAddr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/popup/views/addressDetail.js

@@ -65,25 +65,11 @@ function show() {
     });
     $("address-line").dataset.full = addr.address;
     attachCopyHandlers($("address-line"));
+    const usdTotal = formatAddressTotal(getAddressValue(addr));
+    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || " ";
     const ensEl = $("address-ens");
     // ENS is now shown inside renderAddressHtml, hide the separate element
     ensEl.classList.add("hidden");
-    renderBalances();
-    renderSendTokenSelect(addr);
-    $("tx-list").innerHTML =
-        '<div class="text-muted text-xs py-1">Loading...</div>';
-    showView("address");
-    loadTransactions(addr.address);
-}
-
-// The USD total and the balance list. Drawn again by each balance refresh
-// that returns while this screen is up (doRefreshAndRender() in
-// src/popup/index.js), which leaves the rest of the screen as it is.
-function renderBalances() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const usdTotal = formatAddressTotal(getAddressValue(addr));
-    $("address-usd-total").innerHTML = escapeHtml(usdTotal) || "&nbsp;";
     $("address-balances").innerHTML = balanceLinesForAddress(
         addr,
         state.trackedTokens,
@@ -97,6 +83,11 @@ function renderBalances() {
                 ctx.showAddressToken();
             });
         });
+    renderSendTokenSelect(addr);
+    $("tx-list").innerHTML =
+        '<div class="text-muted text-xs py-1">Loading...</div>';
+    showView("address");
+    loadTransactions(addr.address);
 }
 
 let loadedTxs = [];
@@ -289,4 +280,4 @@ function init(_ctx) {
     exportPrivkey.init();
 }
 
-module.exports = { init, show, renderBalances };
+module.exports = { init, show };

src/popup/views/addressToken.js

@@ -48,18 +48,37 @@ function show() {
     const addr = wallet.addresses[state.selectedAddress];
     const ai = state.selectedAddress;
     const tokenId = state.selectedToken;
+
+    // Determine token symbol and balance
+    let symbol, amount, price;
     const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
-    currentSymbol =
-        tokenId === "ETH"
-            ? nativeCurrency()
-            : resolveSymbol(tokenId, addr.tokenBalances, state.trackedTokens);
+    if (tokenId === "ETH") {
+        symbol = nativeCurrency();
+        amount = parseFloat(addr.balance || "0");
+        price = getPrice("ETH");
+    } else {
+        const tb = (addr.tokenBalances || []).find(
+            (t) => t.address.toLowerCase() === tokenId.toLowerCase(),
+        );
+        symbol = resolveSymbol(
+            tokenId,
+            addr.tokenBalances,
+            state.trackedTokens,
+        );
+        // null when the scale is unknown: no quantity to show, and none to
+        // price. balanceLine() states that rather than printing 0.0000.
+        amount = tb ? unknownableAmount(tb.balance) : 0;
+        price = getPrice(symbol);
+    }
+
+    currentSymbol = symbol;
 
     $("address-token-title").textContent =
         wallet.name +
         " \u2014 Address " +
         (ai + 1) +
         " \u2014 " +
-        displaySymbol(currentSymbol);
+        displaySymbol(symbol);
 
     // Blockie
     const blockieEl = $("address-token-jazzicon");
@@ -81,7 +100,13 @@ function show() {
     $("address-token-line").dataset.full = addr.address;
     attachCopyHandlers($("address-token-line"));
 
-    renderBalance();
+    // USD total for this token only
+    const usdVal = price && amount !== null ? amount * price : null;
+    const usdStr = formatUsd(usdVal);
+    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
+
+    // Single token balance line (no tokenId — not clickable here)
+    $("address-token-balance").innerHTML = balanceLine(symbol, amount, price);
 
     // Token contract details (ERC-20 only)
     const contractInfo = $("address-token-contract-info");
@@ -143,44 +168,6 @@ function show() {
     loadTransactions(addr.address, tokenId);
 }
 
-// The USD total and the balance line of the selected token. Drawn again by
-// each balance refresh that returns while this screen is up
-// (doRefreshAndRender() in src/popup/index.js), which leaves the rest of the
-// screen as it is.
-function renderBalance() {
-    const addr =
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress];
-    const tokenId = state.selectedToken;
-    let amount, price;
-    if (tokenId === "ETH") {
-        amount = parseFloat(addr.balance || "0");
-        price = getPrice("ETH");
-    } else {
-        const id = tokenId.toLowerCase();
-        const tb = (addr.tokenBalances || []).find(
-            (t) => t.address.toLowerCase() === id,
-        );
-        // null when the scale is unknown, or when no refresh has fetched a
-        // token just added: no quantity to show, and none to price.
-        // balanceLine() states that rather than printing 0.0000.
-        if (tb) amount = unknownableAmount(tb.balance);
-        else amount = state.tokensNotFetched.includes(id) ? null : 0;
-        price = getPrice(currentSymbol);
-    }
-
-    // USD total for this token only
-    const usdVal = price && amount !== null ? amount * price : null;
-    const usdStr = formatUsd(usdVal);
-    $("address-token-usd-total").innerHTML = escapeHtml(usdStr) || " ";
-
-    // Single token balance line (no tokenId — not clickable here)
-    $("address-token-balance").innerHTML = balanceLine(
-        currentSymbol,
-        amount,
-        price,
-    );
-}
-
 async function loadTransactions(address, tokenId) {
     try {
         const rawTxs = await fetchRecentTransactions(
@@ -356,4 +343,4 @@ function init(_ctx) {
     });
 }
 
-module.exports = { init, show, renderBalance };
+module.exports = { init, show };

src/popup/views/helpers.js

@@ -380,18 +380,6 @@ function balanceLine(symbol, amount, price, tokenId) {
     );
 }
 
-// Tracks `token` on the active network, as every add path on AddToken and
-// SettingsAddToken does, and lists it in `state.tokensNotFetched`: no refresh
-// has fetched its balance yet. An address with no balance row for it has no
-// known balance of it, so its line says the quantity is unknown rather than
-// 0.0000. doRefreshAndRender() in src/popup/index.js takes it off once a
-// refresh that started with it tracked has fetched every address's token
-// balances (https://git.eeqj.de/sneak/AutistMask/issues/516).
-function trackToken(token) {
-    state.trackedTokens.push(token);
-    state.tokensNotFetched.push(token.address.toLowerCase());
-}
-
 function balanceLinesForAddress(addr, trackedTokens, showZero) {
     let html = balanceLine(
         nativeCurrency(),
@@ -421,13 +409,12 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
     }
     if (showZero && trackedTokens) {
         for (const t of trackedTokens) {
-            const id = t.address.toLowerCase();
-            if (seen.has(id)) continue;
+            if (seen.has(t.address.toLowerCase())) continue;
             html += balanceLine(
                 t.symbol,
-                state.tokensNotFetched.includes(id) ? null : 0,
+                0,
                 getPrice(t.symbol),
-                id,
+                t.address.toLowerCase(),
             );
         }
     }
@@ -799,7 +786,6 @@ module.exports = {
     flashCopyFeedback,
     balanceLine,
     balanceLinesForAddress,
-    trackToken,
     addressHoldsFunds,
     keyMaterialName,
     unknownableAmount,

src/popup/views/settingsAddToken.js

@@ -1,11 +1,4 @@
-const {
-    $,
-    showView,
-    showFlash,
-    escapeHtml,
-    goBack,
-    trackToken,
-} = require("./helpers");
+const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
 const { getTopTokens } = require("../../shared/tokenList");
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { lookupTokenInfo } = require("../../shared/balances");
@@ -50,7 +43,7 @@ function renderTop10() {
                     decimals: parseInt(btn.dataset.decimals, 10),
                     name: btn.dataset.name || btn.dataset.symbol,
                 };
-                trackToken(token);
+                state.trackedTokens.push(token);
                 await saveState();
                 showFlash("Added " + token.symbol);
                 renderTop10();
@@ -117,7 +110,7 @@ function init(_ctx) {
             decimals: parseInt(opt.dataset.decimals, 10),
             name: opt.dataset.name || opt.dataset.symbol,
         };
-        trackToken(token);
+        state.trackedTokens.push(token);
         await saveState();
         showFlash("Added " + token.symbol);
         renderTop10();
@@ -163,7 +156,7 @@ function init(_ctx) {
                 return;
             }
             log.infof("Adding token", info.symbol, addr);
-            trackToken({
+            state.trackedTokens.push({
                 address: addr,
                 symbol: info.symbol,
                 decimals: info.decimals,

src/shared/balances.js

@@ -1,4 +1,5 @@
-// Balance fetching: ETH balances via RPC, ERC-20 token balances via
+// Balance fetching: ETH balances and the balances of the tokens the user
+// tracks via RPC, the other ERC-20 token balances and the holder counts via
 // Blockscout, ENS reverse lookup via RPC.
 
 const {
@@ -81,7 +82,9 @@ function rawUnits(value) {
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
 // Filters out spam: only shows tokens that are in the known token list,
-// explicitly tracked by the user, or have >= 1000 holders.
+// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
+// balance is read through the RPC endpoint instead, and its row here gives that
+// entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
@@ -205,8 +208,96 @@ async function fetchTokenBalances(
     }
 }
 
-// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// The entries at `address` of the tokens the user tracks, shaped as
+// fetchTokenBalances() returns them, for the tokens the address holds.
+//
+// The balance is read with balanceOf through the RPC endpoint. The name and
+// symbol are the tracked token's. `decimals` and `holders` are those of
+// Blockscout's entry for the token in `explorerRequest`, this refresh's
+// fetchTokenBalances() for the address; while Blockscout fails they are kept
+// from the token's entry in `previous`, the address's entries before this
+// refresh. The balance is stated at the scale the screens read the token at
+// (resolveTokenDecimals()): the bundled list's, then the one the tracked token
+// records, then Blockscout's, as in fetchTokenBalances().
+//
+// A token whose balanceOf fails keeps its entry in `previous`, as a failed ETH
+// balance keeps its figure, or takes Blockscout's entry from this refresh when
+// it has none. The failure is logged. A balance of zero gets no entry, as a
+// zero Blockscout reports gets none: the balance lists take a tracked token's
+// zero from the tracked list. A token whose symbol the spoof rule refuses gets
+// no entry either, as in fetchTokenBalances().
+//
 // `signal` is as for fetchTokenBalances().
+async function fetchTrackedTokenBalances(
+    provider,
+    address,
+    trackedTokens,
+    previous,
+    explorerRequest,
+    signal,
+) {
+    const listed = trackedTokens.filter(
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
+    );
+    // Each token's balanceOf answer, or null where it failed.
+    const balances = await Promise.all(
+        listed.map(async (token) => {
+            try {
+                const contract = new Contract(
+                    token.address,
+                    ERC20_ABI,
+                    provider,
+                );
+                return await contract.balanceOf(address);
+            } catch (e) {
+                if (!signal?.aborted) {
+                    log.errorf(
+                        "token balance failed",
+                        address,
+                        token.address,
+                        e.shortMessage || e.message,
+                    );
+                }
+                return null;
+            }
+        }),
+    );
+    const explorerRows = await explorerRequest;
+    const reported = explorerRows ?? previous;
+
+    const rows = [];
+    listed.forEach((token, i) => {
+        const lower = token.address.toLowerCase();
+        const entryIn = (list) =>
+            list.find((row) => String(row.address).toLowerCase() === lower);
+        const raw = balances[i];
+        if (raw === null) {
+            const kept = entryIn(previous) || entryIn(explorerRows || []);
+            if (kept) rows.push(kept);
+            return;
+        }
+        if (raw === 0n) return;
+        const entry = entryIn(reported);
+        const decimals = entry ? entry.decimals : null;
+        const known = resolveTokenDecimals(lower, { trackedTokens });
+        const scale = known !== null ? known : decimals;
+        rows.push({
+            address: token.address,
+            name: token.name || "",
+            symbol: token.symbol || "???",
+            decimals: decimals,
+            // null when nothing knows the scale: a holding whose amount
+            // cannot be stated, never a zero.
+            balance: scale === null ? null : formatTokenBalance(raw, scale),
+            holders: entry ? entry.holders : null,
+        });
+    });
+    return rows;
+}
+
+// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
+// `trackedTokens` are the tokens tracked on the active network. `signal` is as
+// for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
@@ -217,6 +308,8 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
+    const tracked = trackedTokens || [];
+    const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
 
     for (const wallet of wallets) {
@@ -266,23 +359,42 @@ async function refreshBalances(
                     }),
             );
 
-            // ERC-20 token balances via Blockscout
+            // ERC-20 token balances: the tracked tokens' through the RPC
+            // endpoint, and from Blockscout the tokens the user has not
+            // tracked. When Blockscout fails, the untracked rows from before
+            // this refresh stay. The Blockscout request is started first and
+            // handed to fetchTrackedTokenBalances() too, which waits for it
+            // after sending its balanceOf reads, so the two run side by side.
+            const previous = addr.tokenBalances || [];
+            const explorerRequest = fetchTokenBalances(
+                addr.address,
+                blockscoutUrl,
+                tracked,
+                signal,
+            );
             updates.push(
-                fetchTokenBalances(
-                    addr.address,
-                    blockscoutUrl,
-                    trackedTokens,
-                    signal,
-                ).then((balances) => {
-                    if (balances !== null) {
-                        addr.tokenBalances = balances;
-                        log.debugf(
-                            "Token balances",
-                            addr.address,
-                            balances.length,
-                            "tokens",
-                        );
-                    }
+                Promise.all([
+                    fetchTrackedTokenBalances(
+                        provider,
+                        addr.address,
+                        tracked,
+                        previous,
+                        explorerRequest,
+                        signal,
+                    ),
+                    explorerRequest,
+                ]).then(([trackedRows, explorerRows]) => {
+                    const untrackedRows = (explorerRows ?? previous).filter(
+                        (row) =>
+                            !trackedSet.has(String(row.address).toLowerCase()),
+                    );
+                    addr.tokenBalances = trackedRows.concat(untrackedRows);
+                    log.debugf(
+                        "Token balances",
+                        addr.address,
+                        addr.tokenBalances.length,
+                        "tokens",
+                    );
                 }),
             );
         }

src/shared/persistedState.js

@@ -28,13 +28,6 @@ const DEFAULT_STATE = {
     // others are restored from when the active network changes. See
     // applyChainSwitchFields().
     networkTrackedTokens: {},
-    // Contract addresses, lowercased, of the tokens the user added that no
-    // balance refresh has fetched yet. trackToken() in
-    // src/popup/views/helpers.js adds one, and doRefreshAndRender() in
-    // src/popup/index.js takes it off. Stored, so a token added just before
-    // the popup closed still reads `quantity unknown` when it opens again
-    // (https://git.eeqj.de/sneak/AutistMask/issues/516).
-    tokensNotFetched: [],
     networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
@@ -419,8 +412,6 @@ function normalizePersisted(saved) {
     // so a stored string walks through the `|| []` and a stored number walks
     // through an Array.isArray().
     out.fraudContracts = textList(saved.fraudContracts);
-    // Contract addresses too, read with `includes()` and `filter()`.
-    out.tokensNotFetched = textList(saved.tokensNotFetched);
     out.tokenHolderCache = structuredClone(saved.tokenHolderCache || {});
     out.theme = saved.theme || "system";
     out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;

src/shared/uniswap.js

@@ -953,7 +953,9 @@ function totalAmount(amounts) {
 // 2. Amount is the amountIn of the swap action that spends Token In. If
 //    several exact-in actions spend it, each with a stated amount, it is
 //    their sum; in any other case there is none. Min. received is the same
-//    for amountOutMin and the actions that buy Token Out.
+//    for amountOutMin and the actions that buy Token Out, except that there
+//    is none when a swap action in the step also spends Token Out: the step
+//    then does not pay out all that those actions buy.
 // 3. If any swap action in the step cannot be read, only SETTLE, SETTLE_ALL,
 //    TAKE and TAKE_ALL name the sides, and there is no Amount or Min.
 //    received.
@@ -1187,11 +1189,13 @@ function decodeV4Swap(input) {
         const boughtOnly = currenciesNotIn(bought, spent);
         if (present(takeToken) || boughtOnly.length === 1) {
             tokenOut = present(takeToken) ? takeToken : boughtOnly[0];
-            amountOutMin = totalAmount(
-                swaps
-                    .filter((s) => s.tokenOut === tokenOut)
-                    .map((s) => s.amountOutMin),
-            );
+            if (!spent.includes(tokenOut)) {
+                amountOutMin = totalAmount(
+                    swaps
+                        .filter((s) => s.tokenOut === tokenOut)
+                        .map((s) => s.amountOutMin),
+                );
+            }
         }
 
         return {

tests/addedTokenBalance.test.js

@@ -1,273 +0,0 @@
-// After "Add" on AddToken, AddressDetail lists the new token, and its line reads
-// `quantity unknown`, not 0.0000, until a balance refresh that asked the
-// explorer about the token has returned for every address, the popup closing
-// and opening again meanwhile included; so does a token added on
-// SettingsAddToken, wherever it is listed. A refresh that returns draws the
-// balances on AddressDetail or AddressToken again, so the fetched balance shows
-// without the screen being reopened
-// (https://git.eeqj.de/sneak/AutistMask/issues/516). Driven through the real
-// popup over a stored profile on Ethereum Mainnet, with "Show tracked tokens
-// with zero balance" on, as it is by default.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-// Tracked by nobody until a test adds it.
-const NEW_TOKEN = "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-
-// The explorer's row for a holding of a million NEW_TOKEN, in the shape
-// fetchTokenBalances() stores it.
-const MILLION = {
-    address: NEW_TOKEN,
-    name: "New Token",
-    symbol: "NEW",
-    decimals: 18,
-    balance: "1000000.0",
-    holders: 3,
-};
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressDetail for the one address.
-function bootOnAddress() {
-    return bootPopup(
-        unversionedValidProfile({
-            currentView: "address",
-            selectedWallet: 0,
-            selectedAddress: 0,
-        }),
-    );
-}
-
-// Holds the next balance refresh open. The returned function lets it finish
-// with the address's ETH balance at 2 and `tokenBalances` as the explorer's
-// rows for it, or with no token balances at all when given null: an explorer
-// that did not answer, which the real refreshBalances() leaves unwritten.
-function holdNextRefresh(page) {
-    const { refreshBalances } = require("../src/shared/balances");
-    let release;
-    refreshBalances.mockImplementationOnce(async (wallets) => {
-        const tokenBalances = await new Promise((resolve) => {
-            release = resolve;
-        });
-        wallets[0].addresses[0].balance = "2.0";
-        if (tokenBalances !== null) {
-            wallets[0].addresses[0].tokenBalances = tokenBalances;
-        }
-    });
-    return async (tokenBalances) => {
-        release(tokenBalances);
-        await page.settle();
-    };
-}
-
-// "+ Token", NEW_TOKEN typed in, and "Add", with the contract lookup
-// answering at once.
-async function addNewToken(page) {
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-    await page.click("btn-add-token");
-    page.node("add-token-address").value = NEW_TOKEN;
-    await page.click("btn-add-token-confirm");
-}
-
-// NEW_TOKEN's row in the balance list in element `id`, AddressDetail's unless
-// another is named, as markup.
-function newTokenRow(page, id = "address-balances") {
-    return page
-        .node(id)
-        .innerHTML.split("<div ")
-        .find((row) =>
-            row.includes('data-token="' + NEW_TOKEN.toLowerCase() + '"'),
-        );
-}
-
-// AddressDetail for the one address opened from Home, as its `[info]` button
-// does.
-async function openAddress(page) {
-    const { state } = require("../src/shared/state");
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressDetail").show();
-    await page.settle();
-}
-
-// AddressToken for `token` opened from AddressDetail, as tapping the token's
-// row there does.
-async function openToken(page, token) {
-    const { state } = require("../src/shared/state");
-    state.selectedToken = token;
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/addressToken").show();
-    await page.settle();
-}
-
-test("until the refresh Add started returns, the new token's line reads quantity unknown", async () => {
-    const page = await bootOnAddress();
-    expect(page.pageErrors).toEqual([]);
-    const finish = holdNextRefresh(page);
-
-    await addNewToken(page);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-    await finish([MILLION]);
-});
-
-test("once that refresh returns, AddressDetail shows the fetched balance without being reopened", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-    // Stands for the transactions on the screen, which only show() replaces.
-    page.node("tx-list").innerHTML = "transactions on the screen";
-
-    await finish([MILLION]);
-
-    expect(page.visibleViews()).toEqual(["address"]);
-    expect(newTokenRow(page)).toContain("1000000.0000");
-    // Only the balances are drawn again, not the transaction list.
-    expect(page.node("tx-list").innerHTML).toBe("transactions on the screen");
-});
-
-test("a refresh already running when the token is added does not count as fetching it", async () => {
-    const page = await bootOnAddress();
-    const finishRunning = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-
-    await addNewToken(page);
-    await finishRunning([]);
-    await ticking;
-
-    expect(newTokenRow(page)).toContain("quantity unknown");
-
-    // The next one asks the explorer about the token, which lists no holding
-    // of it: a fetched zero.
-    const finishNext = holdNextRefresh(page);
-    const next = page.tick();
-    await page.settle();
-    await finishNext([]);
-    await next;
-
-    expect(newTokenRow(page)).toContain("0.0000");
-});
-
-test("closed and opened again before any refresh has fetched it, the new token's line still reads quantity unknown", async () => {
-    const closed = await bootOnAddress();
-    holdNextRefresh(closed);
-    await addNewToken(closed);
-    cleanupPopup();
-
-    // The refresh this boot starts gets no token balances back: the boot's
-    // stub of refreshBalances() writes none.
-    const page = await bootPopup(undefined, { storage: closed.storage });
-    expect(page.visibleViews()).toEqual(["address"]);
-    const row = newTokenRow(page);
-    expect(row).toContain("quantity unknown");
-    expect(row).not.toContain("0.0000");
-
-    const finish = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-    await finish([MILLION]);
-    await ticking;
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh in which the explorer did not answer leaves the new token's line quantity unknown", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await finish(null);
-
-    // Drawn again: the ETH balance it fetched is shown.
-    expect(page.node("address-balances").innerHTML).toContain("2.0000");
-    expect(newTokenRow(page)).toContain("quantity unknown");
-});
-
-test("AddressToken for the new token reads quantity unknown until the refresh returns, then the fetched balance", async () => {
-    const page = await bootOnAddress();
-    const finish = holdNextRefresh(page);
-    await addNewToken(page);
-
-    await openToken(page, NEW_TOKEN.toLowerCase());
-
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    const before = page.node("address-token-balance").innerHTML;
-    expect(before).toContain("quantity unknown");
-    expect(before).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(page.node("address-token-balance").innerHTML).toContain(
-        "1000000.0000",
-    );
-});
-
-test("a token added by contract address on SettingsAddToken reads quantity unknown until the refresh returns", async () => {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.visibleViews()).toEqual(["main"]);
-    const finish = holdNextRefresh(page);
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    lookupTokenInfo.mockResolvedValueOnce({
-        symbol: "NEW",
-        decimals: 18,
-        name: "New Token",
-    });
-
-    await page.click("btn-settings");
-    await page.click("btn-settings-add-token");
-    page.node("settings-addtoken-address").value = NEW_TOKEN;
-    await page.click("btn-settings-addtoken-manual");
-    await page.click("btn-settings-addtoken-back");
-    await page.click("btn-settings-back");
-    expect(page.visibleViews()).toEqual(["main"]);
-    const onHome = newTokenRow(page, "wallet-list");
-    expect(onHome).toContain("quantity unknown");
-    expect(onHome).not.toContain("0.0000");
-
-    await openAddress(page);
-    const onAddress = newTokenRow(page);
-    expect(onAddress).toContain("quantity unknown");
-    expect(onAddress).not.toContain("0.0000");
-
-    await finish([MILLION]);
-
-    expect(newTokenRow(page)).toContain("1000000.0000");
-});
-
-test("a refresh that returns while AddressToken is up draws its balance again", async () => {
-    const page = await bootPopup(
-        unversionedValidProfile({
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            selectedToken: "ETH",
-        }),
-    );
-    expect(page.visibleViews()).toEqual(["address-token"]);
-    expect(page.node("address-token-balance").innerHTML).toContain("1.5000");
-    const finish = holdNextRefresh(page);
-    const ticking = page.tick();
-    await page.settle();
-
-    await finish(null);
-    await ticking;
-
-    expect(page.node("address-token-balance").innerHTML).toContain("2.0000");
-});

tests/balanceRefreshCancelled.test.js

@@ -18,6 +18,11 @@ const {
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
 const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TRACKED = {
+    address: "0x7777777777777777777777777777777777777777",
+    symbol: "TRK",
+    decimals: 6,
+};
 
 const realFetch = globalThis.fetch;
 let logged;
@@ -30,9 +35,9 @@ beforeEach(() => {
     const failedToFetch = async () => {
         throw new TypeError("Failed to fetch");
     };
-    // The RPC calls (ETH balance, ENS name, and the scan's balance and
-    // transaction count) and the explorer request (token balances) all fail
-    // the same way.
+    // The RPC calls (ETH balance, ENS name, the tracked token's balance, and
+    // the scan's balance and transaction count) and the explorer request (the
+    // other token balances) all fail the same way.
     FetchRequest.registerGetUrl(failedToFetch);
     globalThis.fetch = jest.fn(failedToFetch);
 });
@@ -49,7 +54,7 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
-        [],
+        [TRACKED],
         "mainnet",
         signal,
     );
@@ -60,6 +65,7 @@ test("a failure while the popup is open is reported", async () => {
     for (const label of [
         "ETH balance failed",
         "ENS reverse failed",
+        "token balance failed",
         "fetchTokenBalances failed: Failed to fetch",
     ]) {
         expect(logged.some((line) => line.includes(label))).toBe(true);

tests/e2e/run.js

@@ -651,8 +651,7 @@ test("a token added by its contract address is listed on the address screen (#15
     await visible(env.page, "#view-address");
 
     // No wait: the confirm renders the balance list before it shows the
-    // screen. The refresh it starts draws the list again, with the row still
-    // in it.
+    // screen, and nothing renders the list again while the screen is up.
     const row = env.page.locator(
         '#address-balances [data-token="' + STUB_TOKEN.address + '"]',
         { hasText: STUB_TOKEN.symbol },
@@ -3481,6 +3480,24 @@ function hostileSymbolState(page, tokenAddress) {
 }
 
 test("a token whose symbol() returns markup renders as text (#307)", async (env) => {
+    // The stub token is no longer tracked from here on, so the explorer is
+    // what lists it, as it lists a token airdropped to the victim. A tracked
+    // token is listed from the RPC endpoint under the symbol it was added
+    // with, which the hostile symbol below never reaches
+    // (https://git.eeqj.de/sneak/AutistMask/issues/669).
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+    await env.page.click("#settings-tracked-tokens .btn-remove-token");
+    // The list is drawn again once the removal is saved.
+    await env.page.waitForFunction(
+        () =>
+            document
+                .getElementById("settings-tracked-tokens")
+                .innerText.trim() === "None",
+    );
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.seedTokenBalance = true;
     env.routeOpts.tokenSymbolOverride = HOSTILE_SYMBOL;

tests/flashLine.test.js

@@ -88,7 +88,6 @@ describe.each([
             showFlash: (msg) => flashes.push(msg),
             escapeHtml: (s) => s,
             goBack: () => {},
-            trackToken: () => {},
         }));
 
         require("../src/popup/views/" + view).init({

tests/persistedFieldContract.test.js

@@ -248,13 +248,6 @@ const CONTRACT = [
         floorOnly: [[42], [null], [{}], [[TOKEN_ADDRESS]]],
         holds: (v) => everyEntry(v, isText),
     },
-    {
-        field: "tokensNotFetched",
-        kind: KIND.ENTRIES,
-        hostile: [42, "notalist", { a: 1 }],
-        floorOnly: [[42], [null], [{}], [[TOKEN_ADDRESS]]],
-        holds: (v) => everyEntry(v, isText),
-    },
     {
         field: "viewStack",
         kind: KIND.ENTRIES,

tests/trackedTokenBalances.test.js

@@ -0,0 +1,303 @@
+// The balance of each token the user tracks is read with balanceOf through the
+// RPC endpoint, for every address. Blockscout's answer gives a tracked token its
+// holder count and decimals, and adds the tokens the user has not tracked
+// (https://git.eeqj.de/sneak/AutistMask/issues/669).
+//
+// The real refreshBalances() runs against a fake JSON-RPC node, answered
+// through ethers' own request hook, and a fake Blockscout, answered through
+// fetch().
+
+const { AbiCoder, FetchRequest } = require("ethers");
+const { refreshBalances } = require("../src/shared/balances");
+
+const RPC_URL = "https://rpc.example.invalid";
+const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
+const FIRST = "0x1111111111111111111111111111111111111111";
+const SECOND = "0x2222222222222222222222222222222222222222";
+
+// A token the user tracks, outside the bundled list, at 6 decimals.
+const TOKEN = "0x7777777777777777777777777777777777777777";
+const TRACKED = {
+    address: TOKEN,
+    symbol: "TRK",
+    name: "Tracked Token",
+    decimals: 6,
+};
+
+// USDC, from the bundled list, which the user does not track.
+const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+// Neither on the bundled list nor tracked.
+const OTHER = "0x8888888888888888888888888888888888888888";
+
+const ZERO_WORD = "0x" + "0".repeat(64);
+const BALANCE_OF = "0x70a08231";
+
+// What balanceOf answers, by token contract and then by holder. A pair that is
+// not here makes balanceOf fail.
+let holdings;
+// What Blockscout answers for every address; null makes the request fail.
+let explorerRows;
+let logged;
+
+// One JSON-RPC answer. A call that is not balanceOf is the ENS reverse lookup,
+// answered with no resolver, so no name.
+function reply(req) {
+    const envelope = { jsonrpc: "2.0", id: req.id };
+    if (req.method === "eth_getBalance") {
+        return { ...envelope, result: "0x0" };
+    }
+    if (req.method !== "eth_call") {
+        return {
+            ...envelope,
+            error: { code: -32601, message: "method not found" },
+        };
+    }
+    const { to, data } = req.params[0];
+    if (!data.startsWith(BALANCE_OF)) return { ...envelope, result: ZERO_WORD };
+    const holder = "0x" + data.slice(-40);
+    const amount = (holdings[to.toLowerCase()] || {})[holder];
+    if (amount === undefined) {
+        return {
+            ...envelope,
+            error: { code: -32000, message: "fixture: balanceOf failed" },
+        };
+    }
+    return {
+        ...envelope,
+        result: AbiCoder.defaultAbiCoder().encode(["uint256"], [amount]),
+    };
+}
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+    holdings = {};
+    explorerRows = null;
+    logged = [];
+    jest.spyOn(console, "error").mockImplementation((...args) => {
+        logged.push(args.map(String).join(" "));
+    });
+    FetchRequest.registerGetUrl(async (req) => {
+        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
+        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
+        return {
+            statusCode: 200,
+            statusMessage: "OK",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from(JSON.stringify(answer)),
+        };
+    });
+    globalThis.fetch = jest.fn(async () => {
+        if (explorerRows === null) throw new TypeError("Failed to fetch");
+        return { ok: true, status: 200, json: async () => explorerRows };
+    });
+});
+
+afterEach(() => {
+    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
+    globalThis.fetch = realFetch;
+    jest.restoreAllMocks();
+});
+
+// One Blockscout token-balances row.
+function explorerRow(address, symbol, value, holders = "50000") {
+    return {
+        value: String(value),
+        token: {
+            type: "ERC-20",
+            address_hash: address,
+            symbol: symbol,
+            name: symbol,
+            decimals: "6",
+            holders_count: holders,
+        },
+    };
+}
+
+// The row refreshBalances() writes for TOKEN from a balanceOf answer, with the
+// decimals and holder count Blockscout reported for it, if any.
+function trackedRow(balance, decimals = null, holders = null) {
+    return {
+        address: TOKEN,
+        name: "Tracked Token",
+        symbol: "TRK",
+        decimals: decimals,
+        balance: balance,
+        holders: holders,
+    };
+}
+
+async function refresh(addresses, trackedTokens) {
+    await refreshBalances(
+        [{ addresses }],
+        RPC_URL,
+        EXPLORER_URL,
+        trackedTokens,
+        "mainnet",
+        new AbortController().signal,
+    );
+    return addresses;
+}
+
+test("with Blockscout failing, a tracked token's balance is read through the RPC endpoint for every address", async () => {
+    holdings[TOKEN] = { [FIRST]: 1234500000n, [SECOND]: 1n };
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("1234.5")]);
+    // Exact, never cut: one base unit is not zero.
+    expect(second.tokenBalances).toEqual([trackedRow("0.000001")]);
+});
+
+test("with Blockscout failing, the untracked rows from before stay", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const usdc = {
+        address: USDC,
+        name: "USD Coin",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [usdc] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0"), usdc]);
+});
+
+test("a tracked token Blockscout also reports shows the RPC figure, and an untracked one is admitted as before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [
+        explorerRow(TOKEN, "TRK", 9000000),
+        explorerRow(USDC, "USDC", 5000000),
+        // Too few holders, and neither on the bundled list nor tracked.
+        explorerRow(OTHER, "SPAM", 5000000, "10"),
+        // A known symbol from a contract it does not belong to.
+        explorerRow(OTHER, "USDC", 5000000),
+    ];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        trackedRow("2.0", 6, 50000),
+        {
+            address: USDC,
+            name: "USDC",
+            symbol: "USDC",
+            decimals: 6,
+            balance: "5.0",
+            holders: 50000,
+        },
+    ]);
+});
+
+test("a tracked token's entry carries the holder count and decimals Blockscout reports for it", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    // Fewer holders than "Hide tokens with fewer than 1,000 holders" lets
+    // through to Send's token list.
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000, "10")];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("while Blockscout fails, a tracked token keeps the holder count and decimals of its entry from before", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0", 6, 10)] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 10)]);
+});
+
+test("a failed balanceOf keeps the token's entry from before, and is logged", async () => {
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const before = trackedRow("7.0", 6, 50000);
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([before]);
+    expect(logged.some((line) => line.includes("token balance failed"))).toBe(
+        true,
+    );
+});
+
+test("a failed balanceOf with no entry from before takes Blockscout's entry from this refresh", async () => {
+    // balanceOf fails at FIRST and answers at SECOND.
+    holdings[TOKEN] = { [SECOND]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first, second] = await refresh(
+        [
+            { address: FIRST, tokenBalances: [] },
+            { address: SECOND, tokenBalances: [] },
+        ],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([
+        {
+            address: TOKEN,
+            name: "TRK",
+            symbol: "TRK",
+            decimals: 6,
+            balance: "9.0",
+            holders: 50000,
+        },
+    ]);
+    // Where balanceOf answers, its figure stands.
+    expect(second.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a balance of zero read through the RPC endpoint replaces the previous figure", async () => {
+    holdings[TOKEN] = { [FIRST]: 0n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [trackedRow("7.0")] }],
+        [TRACKED],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});
+
+test("a tracked token whose scale nothing knows gets no quantity, not a zero", async () => {
+    holdings[TOKEN] = { [FIRST]: 5n };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow(null)]);
+});
+
+test("a tracked token whose scale only Blockscout reports is stated at that scale", async () => {
+    holdings[TOKEN] = { [FIRST]: 2000000n };
+    explorerRows = [explorerRow(TOKEN, "TRK", 9000000)];
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [] }],
+        [{ ...TRACKED, decimals: null }],
+    );
+    expect(first.tokenBalances).toEqual([trackedRow("2.0", 6, 50000)]);
+});
+
+test("a tracked token wearing a known symbol from another contract is not listed", async () => {
+    holdings[OTHER] = { [FIRST]: 5000000n };
+    // Its entry from before goes too, although Blockscout fails.
+    const before = {
+        address: OTHER,
+        name: "Fake",
+        symbol: "USDC",
+        decimals: 6,
+        balance: "5.0",
+        holders: 50000,
+    };
+    const [first] = await refresh(
+        [{ address: FIRST, tokenBalances: [before] }],
+        [{ address: OTHER, symbol: "USDC", name: "Fake", decimals: 6 }],
+    );
+    expect(first.tokenBalances).toEqual([]);
+});

tests/uniswap.test.js

@@ -3730,6 +3730,88 @@ describe("uniswap decoder", () => {
         },
     );
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/574 — a V4 step that buys
+    // at least 0.5 WETH with 1,000 USDT, spends some of it on USDC, and takes
+    // the USDC and then the WETH, so its output side is WETH. Only what is
+    // left of the 0.5 WETH is sure to reach the user, and the screen read
+    // Min. received 0.5000 WETH.
+    test.each([
+        {
+            spend: "0.3 WETH for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN_SINGLE_ID,
+                param: encodeV4ExactInSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "0.3 WETH through DAI for at least 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_IN,
+                param: encodeV4ExactIn(
+                    WETH_ADDR,
+                    [DAI_ADDR, USDC_ADDR],
+                    300000000000000000n,
+                    594000000n,
+                ),
+            },
+        },
+        {
+            spend: "at most 0.3 WETH for exactly 594 USDC",
+            swap: {
+                id: V4_SWAP_EXACT_OUT_SINGLE_ID,
+                param: encodeV4ExactOutSingle(
+                    WETH_ADDR,
+                    USDC_ADDR,
+                    594000000n,
+                    300000000000000000n,
+                ),
+            },
+        },
+    ])(
+        "a V4 step that buys WETH and spends $spend, with WETH as its output side, shows no Min. received",
+        ({ swap }) => {
+            const data = buildExecute(
+                "0x10",
+                [
+                    encodeV4Swap(
+                        new Uint8Array([
+                            USDT_FOR_WETH_IN.id,
+                            swap.id,
+                            V4_SETTLE_ALL_ID,
+                            V4_TAKE_ID,
+                            V4_TAKE_ID,
+                        ]),
+                        [
+                            USDT_FOR_WETH_IN.param,
+                            swap.param,
+                            encodeV4SettleAll(USDT_ADDR, 1000000000n),
+                            encodeV4Take(USDC_ADDR),
+                            encodeV4Take(WETH_ADDR),
+                        ],
+                    ),
+                ],
+                9999999999n,
+            );
+
+            const result = uniswap.decode(
+                data,
+                ROUTER_ADDR,
+                "0x1",
+                {},
+                USER_ADDR,
+            );
+            expect(result.name).toBe("Swap USDT → WETH");
+            expect(detail(result, "Amount").value).toBe("1000.0000 USDT");
+            expect(detail(result, "Token Out").address).toBe(WETH_ADDR);
+            expect(detail(result, "Min. received")).toBeUndefined();
+        },
+    );
+
     // A V4 step that spends WETH on USDC and on DAI. Its swap actions buy two
     // currencies that none of them spends, and CLOSE_CURRENCY, which the
     // decoder does not read, names no side, so its output side is unknown.

tests/uniswapRecipient.test.js

@@ -1332,6 +1332,10 @@ describe("any token left in the router is not received", () => {
                 ),
             ),
             left: tokenLine(WETH, "WETH"),
+            // The second swap action spends 1 USDC of what the first buys,
+            // so the step states no minimum
+            // (https://git.eeqj.de/sneak/AutistMask/issues/574).
+            noMin: true,
         },
         {
             kind: "a WRAP_ETH of 1 ETH into the router, then a V4 SETTLE of OPEN_DELTA from the router before the swap, which the user settles",
@@ -1432,7 +1436,7 @@ describe("any token left in the router is not received", () => {
             ),
             left: { label: "Token moved into the router", value: "ETH" },
         },
-    ])("$kind", ({ data, left, spent, unread }) => {
+    ])("$kind", ({ data, left, spent, unread, noMin }) => {
         const result = decode(data);
         expect(labels(result)).toEqual([
             "Protocol",
@@ -1458,7 +1462,7 @@ describe("any token left in the router is not received", () => {
             "Token Out",
             "Paid to",
             "Token moved into the router",
-            "Min. paid out",
+            ...(noMin ? [] : ["Min. paid out"]),
             "Steps",
             "Deadline",
         ]);
@@ -1474,7 +1478,9 @@ describe("any token left in the router is not received", () => {
         }
         expect(paidTo(result)).toEqual([STAYS_IN_ROUTER]);
         expect(detail(result, "Token moved into the router")).toEqual(left);
-        expect(detail(result, "Min. paid out").value).toBe("1990.0000 USDC");
+        expect(detail(result, "Min. paid out")?.value).toBe(
+            noMin ? undefined : "1990.0000 USDC",
+        );
     });
 
     // Uniswap's own routes: a swap paid in ETH wraps into the router what its