fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

A network switch now puts the outgoing network's tracked tokens away in a new
persisted field, networkTrackedTokens, and brings back the incoming network's
list, or an empty one, the way endpoints are already kept per network.
trackedTokens stays the active network's list, so its readers are unchanged,
and the background's switch keeps the lists too because it goes through the
same function. The two add-token screens show their common-token picks, which
come from the bundled list of mainnet contracts, on Ethereum Mainnet only;
adding by contract address works on every network. Settings redraws its
tracked-token list after a switch.

Model: opus-5-5

README.md

@@ -1013,16 +1013,14 @@ rendered differently on two screens.
 
 The native token's label is a network's `nativeCurrency` in
 `src/shared/networks.js`: `ETH` on mainnet, `SepoliaETH` on Sepolia. The
-wallet's balances and the Send screen, which sends on the active network, use
-the active network's. The confirmation screen uses the one of the network it is
-drawn for, the network active when it was shown, even after the network is
-switched in Settings while it is open. A transaction's figures use the one of
+wallet's balances and the Send and confirmation screens, which send on the
+active network, use the active network's. A transaction's figures use the one of
 the network its chain id names, whichever network is active: the value and fee
 on the approval screen, the amount on the wait, success and error screens, the
 transaction history and the transaction detail screen, and the refusal of a fee
 above 1 ETH. A chain id that names no network reads `ETH`. Wherever this
 document shows ETH as the label of a native balance, value or fee, in a "Native
-ETH transfer" type line, in the two recipient warnings or in that refusal,
+ETH transfer" type line, in the contract-recipient warning or in that refusal,
 Sepolia shows `SepoliaETH`. The swap lines keep `ETH`, the router's own name for
 the native currency, and the ETH/USD price line, shown on mainnet only, keeps
 its fixed wording.
@@ -1721,18 +1719,10 @@ view would leave a wallet one click from deletion.
       the reserve the transaction does not use. If the balance no longer covers
       the fee, the amount is left as it was and the amount-plus-fee error below
       blocks the send
-    - Your balance: the From address's balance on the network the screen is
-      drawn for, read from that network's RPC endpoint each time the screen is
-      shown, so a screen the popup reopens onto after the network was switched
-      states and checks the balance on the new network. "Loading..." until the
-      read returns, then value + symbol (USD in parentheses), or
-      `unknown (SYMBOL)` for a token whose scale is unknown or when the read
-      failed. The amount check uses the same balances: the ETH balance, and for
-      a token transfer the token balance as well
+    - Your balance: value + symbol (USD in parentheses), or `unknown (SYMBOL)`
+      for a token whose scale is unknown
     - Network fee: "Estimating..." then two lines, or "Unable to estimate",
-      fetched async once the balance is read, from the same RPC endpoint as the
-      balance, even if the network is switched in Settings while the balance is
-      being read. The first line is what the transfer is expected to cost,
+      fetched async. The first line is what the transfer is expected to cost,
       `gasLimit * gasPrice` (USD in parentheses); the second is the
       `gasLimit * maxFeePerGas` reserve the node requires, which is what the
       balance check gates on. The second line is omitted on a network with no
@@ -1740,26 +1730,21 @@ view would leave a wallet one click from deletion.
       reserved either way
     - Warnings: inline warnings from the local checks (scam address, self-send)
       plus four reserved warning boxes made visible by the async checks —
-      recipient that has never sent a transaction and holds no ETH, recipient is
-      a contract, burn address, and an Etherscan phishing/scam label. An address
-      that has received ETH but never sent a transaction still holds that ETH,
-      so it gets no warning
-    - Errors (an invalid amount), plus five reserved error boxes, so the balance
-      and the fee arriving later move nothing — the amount exceeds the balance
-      (for a token whose scale is unknown it says the token's balance is
-      unknown), the balance could not be read (it asks the user to go back and
-      try again), the amount plus the fee exceeds the balance (ETH transfers),
-      not enough ETH to pay the fee for the transfer (ERC-20 transfers), and the
-      fee could not be estimated. The third and fourth are mutually exclusive
-      per transfer type, so only the applicable one holds space. The last names
-      its cause: for a token whose scale is unknown the fee can never be
-      estimated, and it says the wallet does not know how many decimal places
-      the token uses and that the transaction cannot be sent; for any other
-      failure it asks the user to go back and try again
+      recipient with no transaction history, recipient is a contract, burn
+      address, and an Etherscan phishing/scam label
+    - Errors (insufficient balance), plus three reserved error boxes — the
+      amount plus the fee exceeds the balance (ETH transfers), not enough ETH to
+      pay the fee for the transfer (ERC-20 transfers), and the fee could not be
+      estimated. The first two are mutually exclusive per transfer type, so only
+      the applicable one holds space. The last names its cause: for a token
+      whose scale is unknown the fee can never be estimated, and it says the
+      wallet does not know how many decimal places the token uses and that the
+      transaction cannot be sent; for any other failure it asks the user to go
+      back and try again
     - Password: an inline field on this screen, not a modal, with its own error
       line
-    - "Sign & Send" button (disabled if errors, while the balance is being read,
-      and while the network fee estimate is pending or unavailable)
+    - "Sign & Send" button (disabled if errors, and while the network fee
+      estimate is pending or unavailable)
 - **Transitions**:
     - "Sign & Send" (correct password) → broadcast tx → **WaitTx**
     - "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
@@ -1913,7 +1898,8 @@ view would leave a wallet one click from deletion.
     - Contract address input
     - Status line ("Looking up token...", cleared or replaced on failure)
     - Common token quick-pick buttons (top 25 by market cap), which fill the
-      contract address input
+      contract address input. Shown on Ethereum Mainnet only, because the
+      bundled token list holds mainnet contracts
     - "Add" button
 - **Transitions**:
     - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
@@ -1930,16 +1916,19 @@ view would leave a wallet one click from deletion.
     - Wallets: one row per wallet with its name (tap to rename inline), a
       `[recovery phrase]` button on HD wallets only, and an `[x]` delete button,
       plus a "+ Add wallet" button
-    - Tracked Tokens: one row per tracked token with an `[x]` remove button,
-      plus a "+ Add token" button
+    - Tracked Tokens: one row per token tracked on the active network with an
+      `[x]` remove button, plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
       Timestamps" checkbox, and a Theme selector (System / Light / Dark)
     - Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
       network changes only here, or when the user approves a site's request on
       **NetworkApproval**; either way, switching restores the RPC and Blockscout
       endpoints last used on that network, or that network's defaults if it has
-      none, and sends `chainChanged` with the new chain id to every open tab.
-      Choosing the network already active changes nothing and sends nothing
+      none, and the tokens tracked on that network, and sends `chainChanged`
+      with the new chain id to every open tab. A token is tracked only on the
+      network it was added on, because a contract address names a token on one
+      network only. Choosing the network already active changes nothing and
+      sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2163,7 +2152,8 @@ view would leave a wallet one click from deletion.
 #### SettingsAddToken (`settings-addtoken`)
 
 - **When**: User tapped "+ Add token" in Settings. Tokens added here are tracked
-  across every address, unlike AddToken which is reached from one address.
+  across every address on the active network, unlike AddToken which is reached
+  from one address.
 - **Elements**:
     - "Back" button, "Add Token" heading
     - Instruction text
@@ -2172,8 +2162,12 @@ view would leave a wallet one click from deletion.
     - "Or pick from top 100:" dropdown (already-tracked tokens are disabled) +
       "Add selected" button
     - "Or enter contract address:" input, a status line, and an "Add" button
+    - The two lists from the bundled token list, "Top tokens:" and "Or pick from
+      top 100:", are shown on Ethereum Mainnet only, because that list holds
+      mainnet contracts. On any other network the contract address is the only
+      add path
 - **Transitions**:
-    - Any of the three add paths, on success → adds the token and shows an
+    - Any of the add paths shown, on success → adds the token and shows an
       "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
@@ -2391,8 +2385,9 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
     - "Switch" → closes popup; the background switches the network as
       **Settings** does, restoring the RPC and Blockscout endpoints last used on
-      that network (or that network's defaults if it has none), sends
-      `chainChanged` to every open tab, and answers the site with success
+      that network (or that network's defaults if it has none) and the tokens
+      tracked on that network, sends `chainChanged` to every open tab, and
+      answers the site with success
     - "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
       nothing changes
     - Popup window closed without answering → the same as "Reject"

src/popup/index.html

@@ -634,12 +634,17 @@
                     </div>
                 </div>
                 <div id="confirm-warnings" class="mb-2 invisible"></div>
-                <!-- These two sentences name the network's native token, so
-                show() in confirmTx.js sets them. -->
-                <div
-                    id="confirm-recipient-warning"
-                    class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500 invisible"
-                ></div>
+                <div id="confirm-recipient-warning" class="mb-2 invisible">
+                    <div
+                        class="border border-red-500 border-dashed p-2 text-xs font-bold text-red-500"
+                    >
+                        WARNING: The recipient address has ZERO transaction
+                        history. This may indicate a fresh or unused address.
+                        Double-check the address before sending.
+                    </div>
+                </div>
+                <!-- Its sentence names the network's native token, so show()
+                in confirmTx.js sets it. -->
                 <div
                     id="confirm-contract-warning"
                     class="mb-2 border border-red-500 border-dashed p-2 text-xs font-bold text-red-500 invisible"
@@ -664,20 +669,6 @@
                     id="confirm-errors"
                     class="mb-2 border border-border border-dashed p-2 invisible min-h-[1.25rem]"
                 ></div>
-                <!-- Its sentence names the token, or why the token's balance
-                is unknown, so show() in confirmTx.js sets it. -->
-                <div
-                    id="confirm-balance-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
-                ></div>
-                <div
-                    id="confirm-balance-read-error"
-                    class="mb-2 border border-border border-dashed p-2 text-xs invisible"
-                >
-                    Your balance could not be read from the network, so this
-                    transaction cannot be checked against it. Please go back and
-                    try again.
-                </div>
                 <div
                     id="confirm-amount-fee-error"
                     class="mb-2 border border-border border-dashed p-2 text-xs invisible"
@@ -852,7 +843,7 @@
                     id="add-token-info"
                     class="text-xs text-muted mb-2 min-h-[1.25rem] invisible"
                 ></div>
-                <div class="mb-2">
+                <div id="add-token-common" class="mb-2">
                     <label class="block mb-1 text-xs text-muted"
                         >Or pick a common token:</label
                     >
@@ -1335,36 +1326,39 @@
                 <h2 class="font-bold mb-2">Add Token</h2>
                 <p class="text-xs text-muted mb-3">
                     Pick a common token or enter a contract address manually.
+                    Common tokens are offered on Ethereum Mainnet only.
                 </p>
 
-                <!-- top 10 quick-pick buttons -->
-                <div class="mb-3">
-                    <label class="block mb-1 text-xs text-muted"
-                        >Top tokens:</label
-                    >
-                    <div
-                        id="settings-addtoken-top10"
-                        class="flex flex-wrap gap-1"
-                    ></div>
-                </div>
+                <div id="settings-addtoken-common">
+                    <!-- top 10 quick-pick buttons -->
+                    <div class="mb-3">
+                        <label class="block mb-1 text-xs text-muted"
+                            >Top tokens:</label
+                        >
+                        <div
+                            id="settings-addtoken-top10"
+                            class="flex flex-wrap gap-1"
+                        ></div>
+                    </div>
 
-                <!-- top 100 dropdown -->
-                <div class="mb-3">
-                    <label class="block mb-1 text-xs text-muted"
-                        >Or pick from top 100:</label
-                    >
-                    <select
-                        id="settings-addtoken-select"
-                        class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
-                    >
-                        <option value="">-- select --</option>
-                    </select>
-                    <button
-                        id="btn-settings-addtoken-select"
-                        class="border border-border px-2 py-1 mt-1 hover:bg-fg hover:text-bg cursor-pointer"
-                    >
-                        Add selected
-                    </button>
+                    <!-- top 100 dropdown -->
+                    <div class="mb-3">
+                        <label class="block mb-1 text-xs text-muted"
+                            >Or pick from top 100:</label
+                        >
+                        <select
+                            id="settings-addtoken-select"
+                            class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
+                        >
+                            <option value="">-- select --</option>
+                        </select>
+                        <button
+                            id="btn-settings-addtoken-select"
+                            class="border border-border px-2 py-1 mt-1 hover:bg-fg hover:text-bg cursor-pointer"
+                        >
+                            Add selected
+                        </button>
+                    </div>
                 </div>
 
                 <!-- manual contract address -->

src/popup/views/addToken.js

@@ -9,6 +9,12 @@ function show() {
     $("add-token-address").value = "";
     $("add-token-info").textContent = "";
     $("add-token-info").style.visibility = "hidden";
+    // The bundled list holds Ethereum Mainnet contracts, which name no token
+    // on any other network.
+    $("add-token-common").classList.toggle(
+        "hidden",
+        state.networkId !== "mainnet",
+    );
     const list = $("common-token-list");
     list.innerHTML = getTopTokens(25)
         .map(

src/popup/views/confirmTx.js

@@ -2,13 +2,7 @@
 // Shows transaction details, warnings, errors. On Sign & Send,
 // reads inline password, decrypts secret, signs and broadcasts.
 
-const {
-    parseEther,
-    parseUnits,
-    formatEther,
-    formatUnits,
-    Contract,
-} = require("ethers");
+const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
 const {
     $,
     showError,
@@ -17,6 +11,7 @@ const {
     addressTitle,
     escapeHtml,
     displaySymbol,
+    nativeCurrency,
     renderAddressHtml,
     blockieHtml,
     attachCopyHandlers,
@@ -25,7 +20,6 @@ const {
     formatFee,
 } = require("./helpers");
 const { state, currentNetwork } = require("../../shared/state");
-const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
 const { decryptWithPassword } = require("../../shared/vault");
@@ -38,7 +32,6 @@ const {
 const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
 const {
     displayedDecimals,
-    toDecimals,
     transferAmountUnits,
 } = require("../../shared/transferAmount");
 const { assertWithinCeilings } = require("../../shared/approvalVerify");
@@ -67,14 +60,6 @@ let feeWei = null;
 // amount was derived from. Null for any other send, which ethers prices from
 // the node at signing time.
 let maxSendFees = null;
-// The From address's balances on the network this screen is drawn for, read
-// from that network's node by readBalances() each time the screen is shown.
-// The popup can reopen onto this screen after the network was switched, so
-// any balance Send knew may be another network's. Null until the read
-// returns; then `eth` and `token` are decimal strings, `token` null for an
-// ETH send or a token whose scale is unknown, and both null if the read
-// failed.
-let balances = null;
 
 function restore() {
     const d = state.viewData;
@@ -102,9 +87,7 @@ function valueWithUsd(text, usdAmount) {
 // once its amount is re-derived from the fee estimate.
 function renderAmount(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-    const rawSymbol = isErc20
-        ? txInfo.tokenSymbol || "?"
-        : nativeCurrencyByChainId(txInfo.chainId);
+    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : nativeCurrency();
     const price = isErc20 ? getPrice(rawSymbol) : getPrice("ETH");
     const amountUsd = price ? parseFloat(txInfo.amount) * price : null;
     $("confirm-amount").textContent = valueWithUsd(
@@ -113,56 +96,21 @@ function renderAmount(txInfo) {
     );
 }
 
-// The balance line, with its USD value: "Loading..." until readBalances()
-// returns, then the balance it read.
-function renderBalance(txInfo) {
-    const isErc20 = txInfo.token !== "ETH";
-    const rawSymbol = isErc20
-        ? txInfo.tokenSymbol || "?"
-        : nativeCurrencyByChainId(txInfo.chainId);
-    const symbol = displaySymbol(rawSymbol);
-    if (balances === null) {
-        $("confirm-balance").textContent = "Loading...";
-        return;
-    }
-    // A null balance is one nobody established, for a token whose scale is
-    // unknown or after a read that failed, and is stated as unknown, never as
-    // zero (https://git.eeqj.de/sneak/AutistMask/issues/349).
-    const bal = isErc20 ? balances.token : balances.eth;
-    if (bal === null) {
-        $("confirm-balance").textContent = "unknown (" + symbol + ")";
-        return;
-    }
-    const price = isErc20 ? getPrice(rawSymbol) : getPrice("ETH");
-    const balUsd = price ? parseFloat(bal) * price : null;
-    $("confirm-balance").textContent = valueWithUsd(
-        truncateAmountNeverZero(bal) + " " + symbol,
-        balUsd,
-    );
-}
-
 function show(txInfo) {
     pendingTx = txInfo;
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
-    balances = null;
     // The network this screen is drawn for, and the only one it sends on:
-    // Settings can switch the active network while the screen is open. This
-    // screen and the wait, success and error screens label amounts by it.
+    // Settings can switch the active network while the screen is open. The
+    // wait, success and error screens label the amount by it too.
     txInfo.chainId = currentNetwork().chainId;
-    // That network's node, read here once and passed to every read below, so
-    // a read still in flight when the network is switched, and the fee
-    // estimate that follows the balance read, stay on it.
-    const provider = getProvider(state.rpcUrl, state.networkId);
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
     // screen says. Truncating before the lookup would silently drop the
     // price of any token whose symbol is long enough to be capped.
-    const rawSymbol = isErc20
-        ? txInfo.tokenSymbol || "?"
-        : nativeCurrencyByChainId(txInfo.chainId);
+    const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : nativeCurrency();
     const symbol = displaySymbol(rawSymbol);
 
     // Transaction type
@@ -204,7 +152,33 @@ function show(txInfo) {
     $("confirm-to-ens").classList.add("hidden");
 
     renderAmount(txInfo);
-    renderBalance(txInfo);
+
+    // Balance (with inline USD)
+    const ethPrice = getPrice("ETH");
+    const tokenPrice = getPrice(rawSymbol);
+    if (isErc20) {
+        // null is a balance whose scale nothing knows, not a balance of zero
+        // (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
+        // refused at encode time for the same missing scale; what this line
+        // must not do is state a quantity nobody established.
+        const bal = txInfo.tokenBalance;
+        const balUsd =
+            tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
+        $("confirm-balance").textContent =
+            bal == null
+                ? "unknown (" + symbol + ")"
+                : valueWithUsd(
+                      truncateAmountNeverZero(bal) + " " + symbol,
+                      balUsd,
+                  );
+    } else {
+        const bal = txInfo.balance || "0";
+        const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
+        $("confirm-balance").textContent = valueWithUsd(
+            truncateAmountNeverZero(bal) + " " + symbol,
+            balUsd,
+        );
+    }
 
     // Check for warnings (synchronous local checks)
     const localWarnings = getLocalWarnings(txInfo.to, {
@@ -238,22 +212,15 @@ function show(txInfo) {
     $("confirm-gas-error").classList.toggle("hidden", !isErc20);
     $("confirm-gas-error").textContent =
         "You do not have enough " +
-        nativeCurrencyByChainId(txInfo.chainId) +
+        nativeCurrency() +
         " to pay the network fee for this transfer. Please add " +
-        nativeCurrencyByChainId(txInfo.chainId) +
+        nativeCurrency() +
         " to this address and try again.";
 
-    // Both shown later, by checkRecipientHistory(). The first sentence says
-    // exactly what getFullWarnings() checks.
-    $("confirm-recipient-warning").textContent =
-        "WARNING: The recipient address has never sent a transaction and" +
-        " holds no " +
-        nativeCurrencyByChainId(txInfo.chainId) +
-        ". This may indicate a fresh or unused address. Double-check the" +
-        " address before sending.";
+    // Shown later, once checkRecipientHistory() finds a contract.
     $("confirm-contract-warning").textContent =
         "WARNING: The recipient is a smart contract. Sending " +
-        nativeCurrencyByChainId(txInfo.chainId) +
+        nativeCurrency() +
         " or tokens directly to a contract may result in permanent loss of" +
         " funds.";
 
@@ -270,20 +237,6 @@ function show(txInfo) {
               " cannot be checked against your balance. Please go back and" +
               " try again.";
 
-    // So does the message for an amount the balance does not cover. It is
-    // set here, before the first paint, so the balance read returning only
-    // makes it visible and moves nothing, which is why it quotes no balance.
-    // Without the token's scale readBalances() reads no token balance.
-    $("confirm-balance-error").textContent =
-        isErc20 && toDecimals(txInfo.tokenDecimals) === null
-            ? "This token's balance is unknown, because nothing this wallet" +
-              " can consult reports how many decimal places it uses, so the" +
-              " amount you are trying to send cannot be checked against it."
-            : "Your " +
-              symbol +
-              " balance does not cover this amount. Please go back and send" +
-              " a smaller amount.";
-
     renderValidation(txInfo);
 
     // Reset password field and error
@@ -309,77 +262,69 @@ function show(txInfo) {
         $("confirm-burn-warning").style.visibility = "visible";
     }
 
-    // The fee is estimated once the balances are read, because a max ETH
-    // send's amount is the ETH balance minus the estimate's reserve.
-    readBalances(txInfo, provider).then(() => estimateGas(txInfo, provider));
-    checkRecipientHistory(txInfo, provider);
-}
-
-// Read the From address's balances from `provider`, the node of the network
-// this screen is drawn for: ETH, and for a token send the token, at the scale
-// the screen renders the amount with. A token whose scale is unknown has no
-// balance to read. Never rejects.
-async function readBalances(txInfo, provider) {
-    let read;
-    try {
-        const decimals = toDecimals(txInfo.tokenDecimals);
-        const readToken = txInfo.token !== "ETH" && decimals !== null;
-        const [ethWei, tokenUnits] = await Promise.all([
-            provider.getBalance(txInfo.from),
-            readToken
-                ? new Contract(txInfo.token, ERC20_ABI, provider).balanceOf(
-                      txInfo.from,
-                  )
-                : null,
-        ]);
-        read = {
-            eth: formatEther(ethWei),
-            token: readToken ? formatUnits(tokenUnits, decimals) : null,
-        };
-    } catch (e) {
-        log.errorf("balance read failed:", e.shortMessage || e.message);
-        read = { eth: null, token: null };
-    }
-    // The user may have left this transaction while the read was in flight.
-    if (pendingTx !== txInfo) return;
-    balances = read;
-    renderBalance(txInfo);
-    renderValidation(txInfo);
+    estimateGas(txInfo);
+    checkRecipientHistory(txInfo);
 }
 
 // Render the balance check for the transaction on screen. Called once during
-// show(), again when the balances are read, and again when the fee estimate
-// resolves or fails. Every element it touches already occupies its space, so
-// re-running it never moves anything.
+// show() and again when the fee estimate resolves or fails. Every element it
+// touches already occupies its space, so re-running it never moves anything.
 function renderValidation(txInfo) {
     const isErc20 = txInfo.token !== "ETH";
-
-    // Null while the balances are being read and after a read that failed.
-    // validateTransfer() takes a missing balance as nothing to spend from, so
-    // sending stays blocked either way, and the only message shown for it is
-    // the one saying the read failed.
-    const ethBalance = balances ? balances.eth : null;
-    const tokenBalance = balances ? balances.token : null;
-    const balanceRead = ethBalance !== null;
+    const symbol = isErc20
+        ? displaySymbol(txInfo.tokenSymbol || "?")
+        : nativeCurrency();
 
     const { canSend, codes } = validateTransfer({
         isErc20,
         amount: txInfo.amount,
         tokenDecimals: txInfo.tokenDecimals,
-        ethBalance,
-        tokenBalance,
+        ethBalance: txInfo.balance,
+        tokenBalance: txInfo.tokenBalance,
         feeStatus,
         feeWei,
     });
 
-    // An invalid amount is known before the first paint, so its message is
-    // written here. Every message a later result brings has a reserved
-    // element, its sentence fixed in index.html or set by show(), and is only
-    // made visible below, so nothing moves when the result arrives.
+    // Messages carrying the user's own numbers are built here; the fixed
+    // sentences live in the reserved elements in index.html, except the
+    // gas and fee-unknown ones, which show() sets.
     const messages = [];
     if (codes.includes(CODES.AMOUNT_INVALID)) {
         messages.push("Please enter a valid amount to send.");
     }
+    if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
+        messages.push(
+            txInfo.tokenBalance == null
+                ? "This token's balance is unknown, because nothing this" +
+                      " wallet can consult reports how many decimal places it" +
+                      " uses, so the amount you are trying to send cannot be" +
+                      " checked against it."
+                : "Insufficient " +
+                      symbol +
+                      " balance. You have " +
+                      truncateAmountNeverZero(txInfo.tokenBalance) +
+                      " " +
+                      symbol +
+                      " but are trying to send " +
+                      txInfo.amount +
+                      " " +
+                      symbol +
+                      ".",
+        );
+    }
+    if (codes.includes(CODES.INSUFFICIENT_ETH)) {
+        messages.push(
+            "Insufficient balance. You have " +
+                truncateAmountNeverZero(txInfo.balance || "0") +
+                " " +
+                symbol +
+                " but are trying to send " +
+                txInfo.amount +
+                " " +
+                symbol +
+                ".",
+        );
+    }
 
     const errorsEl = $("confirm-errors");
     if (messages.length > 0) {
@@ -392,20 +337,13 @@ function renderValidation(txInfo) {
         errorsEl.style.visibility = "hidden";
     }
 
-    setVisible("confirm-balance-read-error", balances !== null && !balanceRead);
-    setVisible(
-        "confirm-balance-error",
-        balanceRead &&
-            (codes.includes(CODES.INSUFFICIENT_TOKEN) ||
-                codes.includes(CODES.INSUFFICIENT_ETH)),
-    );
     setVisible(
         "confirm-amount-fee-error",
-        balanceRead && codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
+        codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
     );
     setVisible(
         "confirm-gas-error",
-        balanceRead && codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
+        codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
     );
     setVisible(
         "confirm-fee-unknown-error",
@@ -424,10 +362,9 @@ function setVisible(id, visible) {
     $(id).style.visibility = visible ? "visible" : "hidden";
 }
 
-// Estimate the network fee on `provider`, the node of the network this screen
-// is drawn for.
-async function estimateGas(txInfo, provider) {
+async function estimateGas(txInfo) {
     try {
+        const provider = getProvider(state.rpcUrl, state.networkId);
         const feeData = await provider.getFeeData();
         let gasLimit;
 
@@ -475,13 +412,12 @@ async function estimateGas(txInfo, provider) {
         // does, so the same fee reads the same on both.
         if (estimateWei !== null && estimateWei < gasCostWei) {
             $("confirm-fee-amount").textContent =
-                "~" +
-                formatFee(estimateWei, nativeCurrencyByChainId(txInfo.chainId));
+                "~" + formatFee(estimateWei, nativeCurrency());
             $("confirm-fee-reserve").textContent =
                 "up to " +
                 truncateAmountNeverZero(formatEther(gasCostWei)) +
                 " " +
-                nativeCurrencyByChainId(txInfo.chainId) +
+                nativeCurrency() +
                 " reserved";
             setVisible("confirm-fee-reserve", true);
         } else {
@@ -490,20 +426,20 @@ async function estimateGas(txInfo, provider) {
             // cost is not below the reserve. Show the reserve alone.
             $("confirm-fee-amount").textContent = formatFee(
                 gasCostWei,
-                nativeCurrencyByChainId(txInfo.chainId),
+                nativeCurrency(),
             );
             setVisible("confirm-fee-reserve", false);
         }
         feeStatus = FEE_KNOWN;
         feeWei = gasCostWei;
-        // A max ETH send is the balance readBalances() read minus this
-        // estimate's reserve, not the Send screen's, and is signed with this
-        // estimate's fee fields: fees fetched again at signing could exceed
-        // the reserve it leaves, and the node would refuse it for want of
-        // funds. Where the balance is unknown or no longer covers the fee, the
-        // amount is left as it is and the balance check below says so.
+        // A max ETH send is the balance minus this estimate's reserve, not the
+        // Send screen's, and is signed with this estimate's fee fields: fees
+        // fetched again at signing could exceed the reserve it leaves, and the
+        // node would refuse it for want of funds. Where the balance no longer
+        // covers the fee, the amount is left as it is and the balance check
+        // below says so.
         if (txInfo.max && txInfo.token === "ETH") {
-            const amount = maxEthAmount(balances?.eth, gasCostWei);
+            const amount = maxEthAmount(txInfo.balance, gasCostWei);
             if (amount !== null) {
                 txInfo.amount = amount;
                 renderAmount(txInfo);
@@ -578,8 +514,9 @@ function showSendError(message) {
     el.style.visibility = "visible";
 }
 
-async function checkRecipientHistory(txInfo, provider) {
+async function checkRecipientHistory(txInfo) {
     try {
+        const provider = getProvider(state.rpcUrl, state.networkId);
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
         });

src/popup/views/send.js

@@ -164,9 +164,8 @@ function renderSendTokenSelect(addr) {
     }
 }
 
-// The token balance the Send screen states, and the scale it hands the
-// confirmation screen, which reads the balance itself from the network it is
-// drawn for.
+// The token balance and scale the Send screen states and hands the
+// confirmation screen, so the two screens describe the holding the same way.
 //
 // The scale is resolved the same way balances.js resolved the scale it
 // DISPLAYED this token's balance at: bundled list, then the user's tracked
@@ -189,11 +188,13 @@ function renderSendTokenSelect(addr) {
 //
 // The two resolutions can therefore differ, and where they do, the stored
 // `balance` is a quantity computed at a scale this screen has just declined to
-// stand behind, so it is withdrawn: unknown scale means unknown balance. It is
-// null rather than "0": this screen states it as unknown, as the confirmation
-// screen does, and Max fills nothing in for it. Only a stored quantity is
-// withdrawn: the "0" for a token that has no row at all is an absence of
-// holdings, which is true at every scale.
+// stand behind. Stating it would leave validateTransfer() checking the amount
+// against a number the wallet does not vouch for, so it is withdrawn: unknown
+// scale means unknown balance. It is null rather than "0": both screens state
+// an unknown balance as unknown, and validateTransfer() treats it as no balance
+// to spend from, which is the fail-closed side of an amount nobody can check.
+// Only a stored quantity is withdrawn: the "0" for a token that has no row at
+// all is an absence of holdings, which is true at every scale.
 function tokenBalanceAndDecimals(addr, token) {
     const tb = (addr.tokenBalances || []).find(
         (t) => t.address.toLowerCase() === token.toLowerCase(),
@@ -377,6 +378,7 @@ function init(_ctx) {
         const addr = currentAddress();
 
         let tokenSymbol = null;
+        let tokenBalance = null;
         let tokenDecimals = null;
         if (token !== "ETH") {
             tokenSymbol = resolveSymbol(
@@ -384,7 +386,10 @@ function init(_ctx) {
                 addr.tokenBalances,
                 state.trackedTokens,
             );
-            ({ tokenDecimals } = tokenBalanceAndDecimals(addr, token));
+            ({ tokenBalance, tokenDecimals } = tokenBalanceAndDecimals(
+                addr,
+                token,
+            ));
         }
 
         // The confirmation screen's own amount check, so it is never shown
@@ -419,7 +424,9 @@ function init(_ctx) {
             ensName: ensName,
             amount: amount,
             token: token,
+            balance: addr.balance,
             tokenSymbol: tokenSymbol,
+            tokenBalance: tokenBalance,
             tokenDecimals: tokenDecimals,
             max: amountIsMax,
         });

src/popup/views/settings.js

@@ -325,6 +325,7 @@ function init(ctx) {
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
+        renderTrackedTokens();
         showFlash("Switched to " + net.name + ".");
     });
 

src/popup/views/settingsAddToken.js

@@ -75,6 +75,12 @@ function show() {
     $("settings-addtoken-address").value = "";
     $("settings-addtoken-info").textContent = "";
     $("settings-addtoken-info").style.visibility = "hidden";
+    // The bundled list holds Ethereum Mainnet contracts, which name no token
+    // on any other network.
+    $("settings-addtoken-common").classList.toggle(
+        "hidden",
+        state.networkId !== "mainnet",
+    );
     renderTop10();
     renderDropdown();
     showView("settings-addtoken");

src/shared/addressWarnings.js

@@ -51,8 +51,7 @@ function getLocalWarnings(address, options = {}) {
 
 /**
  * Check an address against local lists AND via RPC queries.
- * Async — performs network calls to check contract status, tx count and
- * balance.
+ * Async — performs network calls to check contract status and tx history.
  *
  * @param {string} address - The target address to check.
  * @param {object} provider - An ethers.js provider instance.
@@ -79,30 +78,21 @@ async function getFullWarnings(address, provider, options = {}) {
         log.errorf("contract check failed:", e.shortMessage || e.message);
     }
 
-    // The transaction count is the number of transactions the address has
-    // sent, so an address that has only ever received has a count of zero.
-    // Native token it received stays in its balance until it sends a
-    // transaction, so the warning also needs a zero balance. A contract is
-    // skipped: it has its own warning above.
+    // Skip tx count check for contracts — they may legitimately have
+    // zero inbound EOA transactions.
     if (!isContract) {
         try {
             const txCount = await provider.getTransactionCount(address);
             if (txCount === 0) {
-                const balance = await provider.getBalance(address);
-                if (balance === 0n) {
-                    warnings.push({
-                        type: "new-address",
-                        message:
-                            "This address has never sent a transaction and holds none of the network's native token. Double-check it is correct.",
-                        severity: "info",
-                    });
-                }
+                warnings.push({
+                    type: "new-address",
+                    message:
+                        "This address has never sent a transaction. Double-check it is correct.",
+                    severity: "info",
+                });
             }
         } catch (e) {
-            log.errorf(
-                "tx count or balance check failed:",
-                e.shortMessage || e.message,
-            );
+            log.errorf("tx count check failed:", e.shortMessage || e.message);
         }
     }
 

src/shared/chainSwitchFields.js

@@ -38,6 +38,16 @@ function applyChainSwitchFields(s, newNetworkId) {
         blockscoutUrl: s.blockscoutUrl,
     };
     const remembered = s.networkEndpoints[net.id] || {};
+
+    // Tracked tokens are kept per network the same way, because a contract
+    // address names a token on one network only. s.trackedTokens stays the
+    // active network's list, so nothing that reads it changes: the outgoing
+    // list is put away under its network, and the incoming network's list, or
+    // an empty one, takes its place.
+    if (!s.networkTrackedTokens) s.networkTrackedTokens = {};
+    s.networkTrackedTokens[s.networkId] = s.trackedTokens;
+    s.trackedTokens = s.networkTrackedTokens[net.id] || [];
+
     s.networkId = net.id;
     s.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
     s.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;

src/shared/persistedState.js

@@ -23,6 +23,11 @@ const DEFAULT_STATE = {
     hasWallet: false,
     wallets: [],
     trackedTokens: [],
+    // Tracked tokens remembered per network: { [networkId]: [token, ...] }.
+    // trackedTokens above is the active network's list; this is what the
+    // others are restored from when the active network changes. See
+    // applyChainSwitchFields().
+    networkTrackedTokens: {},
     networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
@@ -289,6 +294,20 @@ function normalizePersisted(saved) {
     // profile whose wallets are perfectly fine. An empty list is a legitimate
     // value and survives.
     out.trackedTokens = structuredClone(tokenRefs(saved.trackedTokens));
+    // Each remembered list is floored like trackedTokens, because
+    // applyChainSwitchFields() puts it straight back onto trackedTokens when
+    // its network becomes the active one. A key that is not a network in
+    // networks.js is dropped, which also keeps an own "__proto__" key from
+    // reaching the plain assignment below.
+    out.networkTrackedTokens = {};
+    if (isRecord(saved.networkTrackedTokens)) {
+        for (const netId of Object.keys(saved.networkTrackedTokens)) {
+            if (!isKnownNetworkId(netId)) continue;
+            out.networkTrackedTokens[netId] = structuredClone(
+                tokenRefs(saved.networkTrackedTokens[netId]),
+            );
+        }
+    }
     // The loud refusal for an unknown id is assertStateUsable(); this is the
     // floor under it. networkId is an object KEY into networkEndpoints below,
     // so a value that is not a network in networks.js must never get that far

src/shared/state.js

@@ -42,9 +42,11 @@ const { log } = require("./log");
 // and writes THIS object, never the proxy: the guard is for callers.
 const rawState = {
     ...DEFAULT_STATE,
-    // Its own object, not the one DEFAULT_STATE holds: applyChainSwitchFields()
-    // mutates this map in place, and a spread copies the reference.
+    // Their own objects, not the ones DEFAULT_STATE holds:
+    // applyChainSwitchFields() mutates these maps in place, and a spread copies
+    // the reference.
     networkEndpoints: {},
+    networkTrackedTokens: {},
     currentView: null,
     selectedWallet: null,
     selectedAddress: null,
@@ -438,12 +440,14 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 //
 // Every other persisted field stays a whole-field diff:
 // `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
-// per-element identity to merge by; `tokenHolderCache` is a map shaped like
-// the ones above, but nothing in src/ ever writes an entry into it — it is
-// only ever reset wholesale to `{}` (applyChainSwitchFields()) — so there is
-// no in-place mutation for a whole-field diff to collide with; `viewData` is
-// this page's own UI scratch space, not data another page has any reason to
-// share membership of.
+// per-element identity to merge by; `networkTrackedTokens` is diffed whole like
+// `trackedTokens` and `networkId`, the two fields a network switch moves
+// together with it; `tokenHolderCache` is a map shaped like the ones above,
+// but nothing in src/ ever writes an entry into it — it is only ever reset
+// wholesale to `{}` (applyChainSwitchFields()) — so there is no in-place
+// mutation for a whole-field diff to collide with; `viewData` is this page's
+// own UI scratch space, not data another page has any reason to share
+// membership of.
 //
 // This does not make two pages that both change the SAME leaf concurrently
 // safe: last write wins on that one leaf, same as before. What it removes

src/shared/txValidation.js

@@ -111,8 +111,8 @@ function isValidAmount(amount, tokenDecimals = null) {
 
 // The most ETH a send can carry: the exact balance minus the fee reserve from
 // feeReserveWei(), as a decimal string, so validateTransfer() passes it with
-// exactly that reserve left behind. `ethBalance` is an exact decimal string as
-// formatEther() writes it, never a rounded one. Null when the balance does not
+// exactly that reserve left behind. `ethBalance` is the exact decimal string
+// balances.js stores, never a rounded one. Null when the balance does not
 // leave anything to send once the fee is paid, or when either input is
 // unusable.
 function maxEthAmount(ethBalance, feeWei) {

tests/addressKey.test.js

@@ -291,6 +291,7 @@ async function confirmSend(from, selected) {
         to: RECIPIENT,
         amount: "0.5",
         token: "ETH",
+        balance: "1.0",
     });
     await settle();
     node("confirm-tx-password").value = PASSWORD;

tests/addressWarnings.test.js

@@ -1,39 +0,0 @@
-// The confirmation screen's warning for a recipient that has never sent a
-// transaction (https://git.eeqj.de/sneak/AutistMask/issues/528).
-//
-// The node's transaction count for an address is the number of transactions
-// it has sent, so an address that only ever receives, such as a savings
-// address or an exchange deposit address, has a count of zero. The warning
-// used to fire on that count alone. It now also needs a zero balance: ETH an
-// address received stays in its balance until it sends a transaction.
-
-"use strict";
-
-const { getFullWarnings } = require("../src/shared/addressWarnings");
-
-global.fetch = jest.fn(async () => {
-    throw new Error("tests must not perform network requests");
-});
-
-const RECIPIENT = "0x" + "b".repeat(40);
-
-// The warning types getFullWarnings() returns for RECIPIENT when the node
-// reports it as a regular address with `txCount` sent transactions and a
-// balance of `balance` wei.
-async function warningTypes(txCount, balance) {
-    const provider = {
-        getCode: async () => "0x",
-        getTransactionCount: async () => txCount,
-        getBalance: async () => balance,
-    };
-    const warnings = await getFullWarnings(RECIPIENT, provider);
-    return warnings.map((w) => w.type);
-}
-
-test("a recipient that has received 0.5 ETH and never sent a transaction gets no warning", async () => {
-    expect(await warningTypes(0, 500000000000000000n)).toEqual([]);
-});
-
-test("a recipient that has never sent a transaction and holds no ETH gets the warning", async () => {
-    expect(await warningTypes(0, 0n)).toEqual(["new-address"]);
-});

tests/coldWorkerChainSwitch.test.js

@@ -204,17 +204,21 @@ describe("a chain switch on a worker that never loaded state", () => {
         expect(after.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
 
         // And it took nothing else with it. Without the load these come back
-        // as [], {}, [] and "system" from DEFAULT_STATE — every wallet in the
+        // as [], {}, {} and "system" from DEFAULT_STATE — every wallet in the
         // extension gone, encrypted secrets included.
         expect(after.wallets).toEqual(walletFixture());
         expect(after.hasWallet).toBe(true);
         expect(after.activeAddress).toBe(ADDRESS);
         expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_ORIGIN] });
-        expect(after.trackedTokens).toEqual([
-            { address: TOKEN, symbol: "DAI", decimals: 18 },
-        ]);
+        expect(after.networkTrackedTokens).toEqual({
+            mainnet: [{ address: TOKEN, symbol: "DAI", decimals: 18 }],
+        });
         expect(after.theme).toBe("dark");
 
+        // The mainnet token is tracked on mainnet only: Sepolia starts with
+        // none of its own.
+        expect(after.trackedTokens).toEqual([]);
+
         // The user's mainnet endpoint is remembered rather than replaced by
         // the public default, so switching back returns it.
         expect(after.networkEndpoints.mainnet).toEqual({
@@ -226,6 +230,9 @@ describe("a chain switch on a worker that never loaded state", () => {
         expect(bg.persisted().rpcUrl).toBe(CUSTOM_RPC);
         expect(bg.persisted().blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
         expect(bg.persisted().wallets).toEqual(walletFixture());
+        expect(bg.persisted().trackedTokens).toEqual([
+            { address: TOKEN, symbol: "DAI", decimals: 18 },
+        ]);
     });
 
     test("compares the requested chain against the stored one, not the default", async () => {

tests/confirmTxNetworkSwitch.test.js

@@ -7,35 +7,17 @@
 // reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
 // Settings in between.
 //
-// Its balance line and balance check are that network's too
-// (https://git.eeqj.de/sneak/AutistMask/issues/558). The popup can reopen onto
-// a confirmation screen saved before the network was switched in another
-// popup, and the screen, drawn again for the new network, showed and checked
-// the balance Send had read on the old one. The balance read and the fee
-// estimate after it stay on that network when it is switched while they run.
-//
 // Driven through the real confirmation screen, signer and chain switch, with
 // only the node and the DOM stubbed. The stub node is on the network its
-// provider was built for, so a broadcast records the network it went to, and
-// a balance read answers with that network's balance.
+// provider was built for, so a broadcast records the network it went to.
 
 "use strict";
 
-// The balances the stub node reports on each network, by network name: ETH
-// in wei and the token in its base units. The networks whose node was asked
-// for the fee, in order. And the signed transactions it was handed, with its
-// network's chain id.
-const mockNode = {
-    balanceWei: {},
-    tokenUnits: {},
-    feeAskedOn: [],
-    broadcast: [],
-};
+// The signed transactions the stub node was handed, with its network's chain id.
+const mockNode = { broadcast: [] };
 
 jest.mock("ethers", () => {
     const actual = jest.requireActual("ethers");
-    // The selector of balanceOf(address).
-    const BALANCE_OF = "0x70a08231";
     class StubProvider {
         constructor(url, network) {
             this.network = network;
@@ -43,22 +25,7 @@ jest.mock("ethers", () => {
         async getNetwork() {
             return this.network;
         }
-        async getBalance() {
-            return mockNode.balanceWei[this.network.name];
-        }
-        // balanceOf() is the one contract call the screen makes before Sign
-        // & Send.
-        async call(tx) {
-            if (!tx.data.startsWith(BALANCE_OF)) {
-                throw new Error("the stub node answers only balanceOf()");
-            }
-            return actual.AbiCoder.defaultAbiCoder().encode(
-                ["uint256"],
-                [mockNode.tokenUnits[this.network.name]],
-            );
-        }
         async getFeeData() {
-            mockNode.feeAskedOn.push(this.network.name);
             return {
                 maxFeePerGas: 20000000000n,
                 maxPriorityFeePerGas: 1000000000n,
@@ -156,13 +123,7 @@ global.document = {
 };
 global.navigator = { clipboard: { writeText() {} } };
 
-const {
-    BaseWallet,
-    JsonRpcProvider,
-    Transaction,
-    Wallet,
-    parseEther,
-} = require("ethers");
+const { BaseWallet, Transaction, Wallet } = require("ethers");
 const { encryptWithPassword } = require("../src/shared/vault");
 const { state, loadState } = require("../src/shared/state");
 const { onChainSwitch } = require("../src/shared/chainSwitch");
@@ -174,8 +135,6 @@ const PRIVATE_KEY = "0x" + "11".repeat(32);
 const HOLDER = new Wallet(PRIVATE_KEY).address;
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const PASSWORD = "correct horse battery staple";
-// A token with 6 decimal places, which the bundled list does not know.
-const TOKEN = "0x" + "d".repeat(40);
 
 function el(id) {
     return global.document.getElementById(id);
@@ -191,12 +150,6 @@ beforeAll(async () => {
 
 beforeEach(() => {
     elements.clear();
-    mockNode.balanceWei = {
-        mainnet: parseEther("5"),
-        sepolia: parseEther("5"),
-    };
-    mockNode.tokenUnits = { mainnet: 0n, sepolia: 0n };
-    mockNode.feeAskedOn = [];
     mockNode.broadcast = [];
     txStatus.showWait.mockClear();
     txStatus.showError.mockClear();
@@ -207,23 +160,16 @@ afterEach(() => {
     signTransaction.mockRestore();
 });
 
-// show() reads the balances and estimates the fee without awaiting either;
-// this lets both settle.
-async function settle() {
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-}
-
-// Show the confirmation screen for 1 of the native token on `networkId`, or
-// for what `send` describes instead, as Review on the Send screen does, with
-// its balance read and its fee estimate settled.
-async function review(networkId, send = {}) {
+// Show the confirmation screen for 1 of the native token on `networkId`, as
+// Review on the Send screen does, with its fee estimate settled.
+async function review(networkId) {
     await onChainSwitch(networkId);
     state.wallets = [
         {
             type: "key",
             name: "Wallet 1",
             encryptedSecret,
-            addresses: [{ address: HOLDER }],
+            addresses: [{ address: HOLDER, balance: "5.0" }],
         },
     ];
     state.selectedWallet = 0;
@@ -235,36 +181,13 @@ async function review(networkId, send = {}) {
         ensName: null,
         amount: "1",
         token: "ETH",
+        balance: "5.0",
         tokenSymbol: null,
+        tokenBalance: null,
         tokenDecimals: null,
         max: false,
-        ...send,
     });
-    await settle();
-}
-
-// Switch the network to `networkId` as Settings in another popup does, then
-// open the popup again onto the confirmation screen it saved.
-async function reopenOn(networkId) {
-    const saved = JSON.parse(JSON.stringify(state.viewData));
-    await onChainSwitch(networkId);
-    elements.clear();
-    state.viewData = saved;
-    confirmTx.init({});
-    confirmTx.restore();
-    await settle();
-}
-
-function errors() {
-    return el("confirm-errors").innerHTML;
-}
-
-function shown(id) {
-    return el(id).style.visibility === "visible";
-}
-
-function sendDisabled() {
-    return el("btn-confirm-send").disabled;
+    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
 }
 
 async function signAndSend() {
@@ -334,174 +257,3 @@ test("the send is refused by a signer on another network's node", async () => {
     expect(signTransaction).not.toHaveBeenCalled();
     expect(mockNode.broadcast).toEqual([]);
 });
-
-describe("a confirmation screen saved on mainnet and reopened after a switch to Sepolia", () => {
-    test("states and checks the Sepolia balance, which covers the send", async () => {
-        mockNode.balanceWei = {
-            mainnet: parseEther("0.5"),
-            sepolia: parseEther("5"),
-        };
-        await review("mainnet");
-        expect(el("confirm-balance").textContent).toBe("0.5000 ETH");
-        expect(sendDisabled()).toBe(true);
-
-        await reopenOn("sepolia");
-        expect(el("confirm-type").textContent).toBe(
-            "Native SepoliaETH transfer",
-        );
-        expect(el("confirm-balance").textContent).toBe("5.0000 SepoliaETH");
-        expect(errors()).toBe("");
-        expect(shown("confirm-balance-error")).toBe(false);
-        expect(el("confirm-amount-fee-error").style.visibility).toBe("hidden");
-        expect(sendDisabled()).toBe(false);
-    });
-
-    test("states and checks the Sepolia balance, which does not cover the send", async () => {
-        mockNode.balanceWei = {
-            mainnet: parseEther("5"),
-            sepolia: parseEther("0.5"),
-        };
-        await review("mainnet");
-        expect(el("confirm-balance").textContent).toBe("5.0000 ETH");
-        expect(sendDisabled()).toBe(false);
-
-        await reopenOn("sepolia");
-        expect(el("confirm-balance").textContent).toBe("0.5000 SepoliaETH");
-        expect(shown("confirm-balance-error")).toBe(true);
-        expect(el("confirm-balance-error").textContent).toBe(
-            "Your SepoliaETH balance does not cover this amount. Please go" +
-                " back and send a smaller amount.",
-        );
-        expect(sendDisabled()).toBe(true);
-    });
-
-    const tokenSend = {
-        token: TOKEN,
-        tokenSymbol: "TOK",
-        tokenDecimals: 6,
-    };
-
-    test("states and checks the Sepolia token balance, which covers the send", async () => {
-        mockNode.tokenUnits = { mainnet: 0n, sepolia: 10000000n };
-        await review("mainnet", tokenSend);
-        expect(el("confirm-balance").textContent).toBe("0.0000 TOK");
-        expect(sendDisabled()).toBe(true);
-
-        await reopenOn("sepolia");
-        expect(el("confirm-balance").textContent).toBe("10.0000 TOK");
-        expect(errors()).toBe("");
-        expect(shown("confirm-balance-error")).toBe(false);
-        expect(el("confirm-gas-error").style.visibility).toBe("hidden");
-        expect(sendDisabled()).toBe(false);
-    });
-
-    test("states and checks the Sepolia token balance, which does not cover the send", async () => {
-        mockNode.tokenUnits = { mainnet: 10000000n, sepolia: 500000n };
-        await review("mainnet", tokenSend);
-        expect(el("confirm-balance").textContent).toBe("10.0000 TOK");
-        expect(sendDisabled()).toBe(false);
-
-        await reopenOn("sepolia");
-        expect(el("confirm-balance").textContent).toBe("0.5000 TOK");
-        expect(shown("confirm-balance-error")).toBe(true);
-        expect(el("confirm-balance-error").textContent).toBe(
-            "Your TOK balance does not cover this amount. Please go back and" +
-                " send a smaller amount.",
-        );
-        expect(sendDisabled()).toBe(true);
-    });
-});
-
-describe("the balance read", () => {
-    test("leaves the balance line Loading... and Sign & Send disabled until it returns", async () => {
-        let answer;
-        const getBalance = jest
-            .spyOn(JsonRpcProvider.prototype, "getBalance")
-            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
-        try {
-            await review("sepolia");
-        } finally {
-            getBalance.mockRestore();
-        }
-        expect(el("confirm-balance").textContent).toBe("Loading...");
-        expect(el("confirm-fee-amount").textContent).toBe("Estimating...");
-        expect(el("confirm-errors").style.visibility).toBe("hidden");
-        expect(shown("confirm-balance-error")).toBe(false);
-        expect(shown("confirm-balance-read-error")).toBe(false);
-        expect(sendDisabled()).toBe(true);
-
-        answer(parseEther("5"));
-        await settle();
-        expect(el("confirm-balance").textContent).toBe("5.0000 SepoliaETH");
-        expect(sendDisabled()).toBe(false);
-    });
-
-    // The Chrome suite measures that nothing moves; this checks the message
-    // is already written, only hidden, before the read returns.
-    test("that finds the amount not covered only makes a message written before it visible", async () => {
-        let answer;
-        const getBalance = jest
-            .spyOn(JsonRpcProvider.prototype, "getBalance")
-            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
-        try {
-            await review("sepolia");
-        } finally {
-            getBalance.mockRestore();
-        }
-        const message =
-            "Your SepoliaETH balance does not cover this amount. Please go" +
-            " back and send a smaller amount.";
-        expect(el("confirm-balance-error").textContent).toBe(message);
-        expect(shown("confirm-balance-error")).toBe(false);
-
-        answer(parseEther("0.5"));
-        await settle();
-        expect(el("confirm-balance-error").textContent).toBe(message);
-        expect(shown("confirm-balance-error")).toBe(true);
-        expect(errors()).toBe("");
-        expect(sendDisabled()).toBe(true);
-    });
-
-    // The fee is estimated once the read returns, so a node chosen then would
-    // be the new network's.
-    test("still in flight when Sepolia is chosen in Settings leaves the balance and the fee on mainnet", async () => {
-        let answer;
-        const getBalance = jest
-            .spyOn(JsonRpcProvider.prototype, "getBalance")
-            .mockImplementationOnce(() => new Promise((r) => (answer = r)));
-        try {
-            await review("mainnet");
-        } finally {
-            getBalance.mockRestore();
-        }
-        expect(mockNode.feeAskedOn).toEqual([]);
-
-        await onChainSwitch("sepolia");
-        answer(parseEther("5"));
-        await settle();
-
-        expect(mockNode.feeAskedOn).toEqual(["mainnet"]);
-        expect(el("confirm-balance").textContent).toBe("5.0000 ETH");
-        // 21000 gas at 10 gwei expected, at 20 gwei reserved.
-        expect(el("confirm-fee-amount").textContent).toBe("~0.0002 ETH");
-        expect(el("confirm-fee-reserve").textContent).toBe(
-            "up to 0.0004 ETH reserved",
-        );
-    });
-
-    test("that fails states the balance as unknown, not zero, and blocks sending", async () => {
-        const getBalance = jest
-            .spyOn(JsonRpcProvider.prototype, "getBalance")
-            .mockRejectedValueOnce(new Error("the node did not answer"));
-        try {
-            await review("sepolia");
-        } finally {
-            getBalance.mockRestore();
-        }
-        expect(el("confirm-balance").textContent).toBe("unknown (SepoliaETH)");
-        expect(shown("confirm-balance-read-error")).toBe(true);
-        expect(shown("confirm-balance-error")).toBe(false);
-        expect(errors()).toBe("");
-        expect(sendDisabled()).toBe(true);
-    });
-});

tests/e2e/network.js

@@ -244,21 +244,16 @@ function latestBlock() {
     };
 }
 
-// keccak("decimals()")[0:4], and the same for symbol(), name() and
-// balanceOf(address).
+// keccak("decimals()")[0:4], and the same for symbol() and name().
 const SELECTOR_DECIMALS = "0x313ce567";
 const SELECTOR_SYMBOL = "0x95d89b41";
 const SELECTOR_NAME = "0x06fdde03";
-const SELECTOR_BALANCE_OF = "0x70a08231";
 
-// Every eth_call still answers with a zero word except decimals(), symbol(),
-// name() and balanceOf() on the stub token. The wallet reads decimals() back
-// at signing time to compare with the scale the confirmation screen rendered
-// (issue #305). Adding the token by its contract address reads the first three
-// (issue #295); symbol() and name() answer what the explorer reports for it.
-// The confirmation screen reads balanceOf()
-// (https://git.eeqj.de/sneak/AutistMask/issues/558), which answers the holding
-// the explorer reports, or zero when no holding is seeded.
+// Every eth_call still answers with a zero word except decimals(), symbol()
+// and name() on the stub token. The wallet reads decimals() back at signing
+// time to compare with the scale the confirmation screen rendered (issue
+// #305). Adding the token by its contract address reads all three (issue
+// #295); symbol() and name() answer what the explorer reports for it.
 //
 // opts.tokenDecimalsOverride is the lying contract: set it and decimals()
 // answers something other than the value this same fixture reports through
@@ -283,9 +278,6 @@ function ethCallResult(req, opts) {
     if (data.startsWith(SELECTOR_NAME)) {
         return abi.encode(["string"], [tokenObject(opts).name]);
     }
-    if (data.startsWith(SELECTOR_BALANCE_OF) && opts.seedTokenBalance) {
-        return word(tokenBalanceItems(opts)[0].value);
-    }
     return ZERO_WORD;
 }
 
@@ -428,10 +420,9 @@ const HOLD_MAX_MS = 30000;
 
 // Hold a reply open for as long as the test asks: until opts[name] is false.
 //
-// The switch (holdBalance, holdGasEstimate, holdTransactionCount or
-// holdBlockscout) is read here rather than captured, so a test flips it on the
-// same options object the route was registered with — the same pattern as
-// seedTokenTransfer. This is
+// The switch (holdGasEstimate, holdTransactionCount or holdBlockscout) is read
+// here rather than captured, so a test flips it on the same options object the
+// route was registered with — the same pattern as seedTokenTransfer. This is
 // the only way to observe a screen while its request is genuinely in flight;
 // sampling the screen and hoping to win a race against the network would
 // assert nothing on a slow machine.
@@ -566,9 +557,6 @@ async function handleRpc(route, postData, opts, report) {
         report("unstubbed request: POST " + route.request().url());
         return route.abort();
     }
-    if (batch.some((req) => req.method === "eth_getBalance")) {
-        await awaitRelease(opts, "holdBalance", report);
-    }
     if (batch.some((req) => req.method === "eth_estimateGas")) {
         await awaitRelease(opts, "holdGasEstimate", report);
     }
@@ -627,8 +615,6 @@ function traceEnabled(raw) {
  *   fixture expects.
  * @param {boolean} [opts.failGasEstimate]  answer eth_estimateGas with a
  *   node-side refusal.
- * @param {boolean} [opts.holdBalance]  hold every batch containing an
- *   eth_getBalance until this is cleared again.
  * @param {boolean} [opts.holdGasEstimate]  hold every batch containing an
  *   eth_estimateGas until this is cleared again.
  * @param {boolean} [opts.holdTransactionCount]  hold every batch containing an

tests/e2e/run.js

@@ -2232,7 +2232,7 @@ function feeEth(wei) {
 
 // What the confirmation screen is showing right now, read out of the DOM in
 // one pass: whether sending is allowed, which reason it is giving, what the
-// fee block says, how tall the whole view is, and where Sign & Send sits in it.
+// fee block says, and how tall the whole view is.
 async function confirmState(page) {
     return page.evaluate(() => {
         const el = (id) => document.getElementById(id);
@@ -2245,9 +2245,6 @@ async function confirmState(page) {
         };
         return {
             height: el("view-confirm-tx").getBoundingClientRect().height,
-            sendTop:
-                el("btn-confirm-send").getBoundingClientRect().top -
-                el("view-confirm-tx").getBoundingClientRect().top,
             type: el("confirm-type").textContent.trim(),
             balance: el("confirm-balance").textContent.trim(),
             fee: el("confirm-fee-amount").textContent.trim(),
@@ -2256,9 +2253,6 @@ async function confirmState(page) {
             errors: shown("confirm-errors")
                 ? el("confirm-errors").textContent.trim()
                 : "",
-            balanceError: shown("confirm-balance-error")
-                ? el("confirm-balance-error").textContent.trim()
-                : "",
             amountFeeError: shown("confirm-amount-fee-error"),
             gasError: shown("confirm-gas-error"),
             feeUnknownError: shown("confirm-fee-unknown-error"),
@@ -2277,16 +2271,6 @@ async function waitForEstimate(page) {
     );
 }
 
-async function waitForBalance(page) {
-    await page.waitForFunction(
-        () =>
-            document.getElementById("confirm-balance").textContent.trim() !==
-            "Loading...",
-        null,
-        { timeout: 60000 },
-    );
-}
-
 async function backToAddress(page) {
     if (await page.isVisible("#view-confirm-tx")) {
         await page.click("#btn-confirm-back");
@@ -2298,14 +2282,13 @@ async function backToAddress(page) {
     await openAddressDetail(page);
 }
 
-// Drive the popup to the confirmation screen for one send, and return as soon
-// as the screen is shown, its balance read still in flight.
+// Drive the popup to the confirmation screen for one send.
 //
 // It waits for the send screen to be showing `balance`, the fixture's balance
 // as that screen displays it, before filling anything in. Waiting for it —
 // rather than for a refresh to have probably landed — is what keeps every
 // assertion below deterministic after a fixture change.
-async function openConfirm(page, { token, balance, amount }) {
+async function goToConfirm(page, { token, balance, amount }) {
     await backToAddress(page);
     await page.click("#btn-send");
     await visible(page, "#view-send");
@@ -2320,14 +2303,6 @@ async function openConfirm(page, { token, balance, amount }) {
     await page.fill("#send-amount", amount);
     await page.click("#btn-send-review");
     await visible(page, "#view-confirm-tx");
-}
-
-// The same, returning once the screen has read the balance. It reads it
-// before it estimates the fee, so every state below is read with the balance
-// in place, the pending fee included.
-async function goToConfirm(page, send) {
-    await openConfirm(page, send);
-    await waitForBalance(page);
     await assertAddressesFit(page, "the confirmation screen");
 }
 
@@ -2403,10 +2378,7 @@ test("ConfirmTx blocks sending while the fee estimate is pending (#238)", async
         "the estimate-failed message is shown for an estimate that is merely pending",
     );
     assert(
-        !st.amountFeeError &&
-            !st.gasError &&
-            st.errors === "" &&
-            st.balanceError === "",
+        !st.amountFeeError && !st.gasError && st.errors === "",
         "a balance message is shown before the fee is known",
     );
 });
@@ -2437,7 +2409,6 @@ test("ConfirmTx enables Send once the estimate lands, quoting both numbers (#238
     );
     assert(
         st.errors === "" &&
-            st.balanceError === "" &&
             !st.amountFeeError &&
             !st.gasError &&
             !st.feeUnknownError,
@@ -2504,54 +2475,30 @@ test("ConfirmTx gates on the fee RESERVE, not the displayed estimate (#238)", as
     );
 });
 
-// The screen is first measured with its balance read held, so the message the
-// read brings must already hold its space when the read returns (#558).
-test("ConfirmTx refuses a send that exceeds the balance outright, and nothing moves when the balance arrives (#238)", async (env) => {
-    env.routeOpts.holdBalance = true;
-    let reading;
-    try {
-        await openConfirm(env.page, {
-            token: "ETH",
-            balance: FUNDED_ETH_TEXT + " ETH",
-            amount: OVER_BALANCE_AMOUNT,
-        });
-        reading = await confirmState(env.page);
-    } finally {
-        env.routeOpts.holdBalance = false;
-    }
-    assert(
-        reading.balance === "Loading...",
-        "the balance read was not held: " + JSON.stringify(reading.balance),
-    );
-    await waitForBalance(env.page);
+test("ConfirmTx refuses a send that exceeds the balance outright (#238)", async (env) => {
+    await goToConfirm(env.page, {
+        token: "ETH",
+        balance: FUNDED_ETH_TEXT + " ETH",
+        amount: OVER_BALANCE_AMOUNT,
+    });
     await waitForEstimate(env.page);
 
     const st = await confirmState(env.page);
-    assert(
-        st.balance === FUNDED_ETH_TEXT + " ETH",
-        "the confirmation screen shows the wrong balance: " +
-            JSON.stringify(st.balance),
-    );
     const want =
-        "Your ETH balance does not cover this amount. Please go back and" +
-        " send a smaller amount.";
+        "Insufficient balance. You have " +
+        FUNDED_ETH_TEXT +
+        " ETH but are trying to send " +
+        OVER_BALANCE_AMOUNT +
+        " ETH.";
     assert(
-        st.balanceError === want,
-        "wrong over-balance message: " + JSON.stringify(st.balanceError),
+        st.errors === want,
+        "wrong over-balance message: " + JSON.stringify(st.errors),
     );
     assert(st.sendDisabled, "Send is enabled for a send that exceeds balance");
     assert(
         !st.amountFeeError,
         "the amount-plus-fee message is shown for an amount that alone exceeds the balance",
     );
-    assert(
-        st.sendTop === reading.sendTop,
-        "Sign & Send moved when the balance read returned: " +
-            reading.sendTop +
-            "px -> " +
-            st.sendTop +
-            "px",
-    );
 });
 
 test("ConfirmTx refuses to send when the fee estimate fails, with its own message (#238)", async (env) => {
@@ -2595,10 +2542,7 @@ test("ConfirmTx refuses to send when the fee estimate fails, with its own messag
             "the estimate-failed message is not shown after a failed estimate",
         );
         assert(
-            !st.amountFeeError &&
-                !st.gasError &&
-                st.errors === "" &&
-                st.balanceError === "",
+            !st.amountFeeError && !st.gasError && st.errors === "",
             "a balance message is shown for an estimate that simply failed",
         );
         assert(
@@ -2689,19 +2633,21 @@ test("ConfirmTx refuses an ERC-20 send that exceeds the token balance (#238)", a
     await waitForEstimate(env.page);
 
     const st = await confirmState(env.page);
-    assert(
-        st.balance === TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
-        "the confirmation screen shows the wrong token balance: " +
-            JSON.stringify(st.balance),
-    );
     const want =
-        "Your " +
+        "Insufficient " +
         STUB_TOKEN.symbol +
-        " balance does not cover this amount. Please go back and send a" +
-        " smaller amount.";
+        " balance. You have " +
+        TOKEN_BALANCE_TEXT +
+        " " +
+        STUB_TOKEN.symbol +
+        " but are trying to send " +
+        OVER_TOKEN_AMOUNT +
+        " " +
+        STUB_TOKEN.symbol +
+        ".";
     assert(
-        st.balanceError === want,
-        "wrong over-token-balance message: " + JSON.stringify(st.balanceError),
+        st.errors === want,
+        "wrong over-token-balance message: " + JSON.stringify(st.errors),
     );
     assert(
         st.sendDisabled,
@@ -2757,9 +2703,9 @@ test("ConfirmTx gates the ERC-20 fee on the RESERVE, with the ERC-20 message (#2
         "the native-ETH over-budget message is shown on an ERC-20 transfer",
     );
     assert(
-        st.errors === "" && st.balanceError === "",
+        st.errors === "",
         "a token-balance message is shown for a transfer the token balance covers: " +
-            JSON.stringify(st.errors + st.balanceError),
+            JSON.stringify(st.errors),
     );
     assert(
         st.height === env.erc20PendingHeight,
@@ -4913,9 +4859,6 @@ async function main() {
         seedTokenBalance: false,
         ethBalanceWei: null,
         failGasEstimate: false,
-        // Whether a JSON-RPC batch asking for a balance is held unanswered:
-        // the confirmation screen's own balance read (#558).
-        holdBalance: false,
         holdGasEstimate: false,
         // Whether a JSON-RPC batch asking for a transaction count is held
         // unanswered: the address scan after creating a wallet (#475).

tests/nativeCurrency.test.js

@@ -17,10 +17,6 @@ jest.mock("ethers", () => {
         async lookupAddress() {
             return null;
         }
-        // The 1.5 of the native token the address holds on either network.
-        async getBalance() {
-            return 1500000000000000000n;
-        }
         // 10 gwei expected, 20 gwei reserved per gas.
         async getFeeData() {
             return { maxFeePerGas: 20000000000n, gasPrice: 10000000000n };
@@ -271,13 +267,6 @@ describe.each([
         );
     });
 
-    test("the warning for a recipient that has never sent a transaction", async () => {
-        await confirmSend("0.1");
-        expect(text("confirm-recipient-warning")).toContain(
-            "has never sent a transaction and holds no " + symbol + ".",
-        );
-    });
-
     // A token reports whatever symbol it likes. One reporting the label the
     // wallet shows its native token under, on this network or any other, is
     // a fake, exactly as one reporting `ETH` always was.
@@ -343,11 +332,14 @@ describe.each([
 
     test("the insufficient-balance error", async () => {
         await confirmSend("2");
-        expect(text("confirm-balance-error")).toBe(
-            "Your " +
+        expect(
+            global.document.getElementById("confirm-errors").innerHTML,
+        ).toContain(
+            "You have 1.5000 " +
                 symbol +
-                " balance does not cover this amount. Please go back and send" +
-                " a smaller amount.",
+                " but are trying to send 2 " +
+                symbol +
+                ".",
         );
     });
 });

tests/persistedFieldContract.test.js

@@ -97,6 +97,7 @@ const {
     normalizePersisted,
 } = require("../src/shared/persistedState");
 const { stateProblem } = require("../src/shared/stateSchema");
+const { isKnownNetworkId } = require("../src/shared/networks");
 const { RESTORABLE_VIEWS } = require("../src/shared/restorableViews");
 const {
     bootPopup,
@@ -193,6 +194,29 @@ const CONTRACT = [
         floorOnly: [[1, 2], [null], [{}], [[TOKEN_ADDRESS]]],
         holds: (v) => everyEntry(v, (t) => isRecord(t) && isText(t.address)),
     },
+    {
+        field: "networkTrackedTokens",
+        kind: KIND.ENTRIES,
+        hostile: [42, "notarecord", { sepolia: "notalist" }],
+        floorOnly: [
+            [1, 2],
+            { sepolia: [1, 2] },
+            { mainnet: [null, {}, [TOKEN_ADDRESS]] },
+            { notanetwork: [{ address: TOKEN_ADDRESS }] },
+            JSON.parse('{"__proto__":[{"address":"0xabc"}]}'),
+        ],
+        // Each list is put straight back onto trackedTokens by
+        // applyChainSwitchFields() when its network becomes the active one, so
+        // it is floored the same way; a key that names no network is dropped.
+        holds: (v) =>
+            isRecord(v) &&
+            Object.getPrototypeOf(v) === Object.prototype &&
+            Object.keys(v).every(
+                (id) =>
+                    isKnownNetworkId(id) &&
+                    everyEntry(v[id], (t) => isRecord(t) && isText(t.address)),
+            ),
+    },
     {
         field: "allowedSites",
         kind: KIND.ENTRIES,
@@ -767,6 +791,7 @@ const WELL_FORMED_DATA = {
         from: ADDRESS,
         to: ADDRESS,
         amount: "1",
+        balance: "2",
     },
     pendingWait: {
         hash: "0x1",

tests/rpcErrorLog.test.js

@@ -74,7 +74,7 @@ test("ethers puts the URL in the error message, not in the short message", async
 test("the recipient checks before a send", async () => {
     await getFullWarnings(ADDRESS, getProvider(RPC_URL, "mainnet"));
     expectFailureLoggedWithoutKey("contract check failed");
-    expectFailureLoggedWithoutKey("tx count or balance check failed");
+    expectFailureLoggedWithoutKey("tx count check failed");
 });
 
 test("the ENS reverse lookup", async () => {

tests/sendAmountRule.test.js

@@ -23,10 +23,7 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
-const { AbiCoder } = require("ethers");
-
-// What the confirmation screen asks the node for. The address holds the 1 ETH
-// and 250 TOK the wallet below records.
+// What the confirmation screen asks the node for.
 const mockProvider = {
     getFeeData: async () => ({
         maxFeePerGas: 2000000000n,
@@ -35,11 +32,7 @@ const mockProvider = {
     estimateGas: async () => 21000n,
     getCode: async () => "0x",
     getTransactionCount: async () => 1,
-    getBalance: async () => 1000000000000000000n,
-    // The one contract call the screen makes, balanceOf(), answered at the
-    // token's 6 decimal places.
-    call: async () =>
-        AbiCoder.defaultAbiCoder().encode(["uint256"], [250000000n]),
+    getBalance: async () => 0n,
 };
 
 jest.mock("../src/shared/balances", () => {

tests/sendDisplayFloor.test.js

@@ -18,7 +18,6 @@
 // What the stub node answers. Each test sets what it needs.
 const mockNode = {
     balanceWei: 0n,
-    tokenUnits: 0n,
     feeData: { maxFeePerGas: 1n, gasPrice: 1n },
 };
 
@@ -31,13 +30,6 @@ jest.mock("ethers", () => {
         async getBalance() {
             return mockNode.balanceWei;
         }
-        // balanceOf(), the one contract call these screens make.
-        async call() {
-            return actual.AbiCoder.defaultAbiCoder().encode(
-                ["uint256"],
-                [mockNode.tokenUnits],
-            );
-        }
         async lookupAddress() {
             return null;
         }
@@ -203,19 +195,10 @@ function errors() {
     return global.document.getElementById("confirm-errors").innerHTML;
 }
 
-// The message for an amount the balance does not cover, while it is shown.
-function balanceError() {
-    const box = global.document.getElementById("confirm-balance-error");
-    return box.style.visibility === "visible" ? box.textContent : "";
-}
-
 // The ETH balance the node reports and the token rows the explorer reports,
-// fetched and stored exactly where the popup stores them. The node reports the
-// token holding the explorer does.
+// fetched and stored exactly where the popup stores them.
 async function refreshWith(balanceWei, tokenItems = []) {
     mockNode.balanceWei = balanceWei;
-    mockNode.tokenUnits =
-        tokenItems.length > 0 ? BigInt(tokenItems[0].value) : 0n;
     mockExplorer.items = tokenItems;
     state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
     state.selectedWallet = 0;
@@ -317,10 +300,9 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         await confirmSend("0.0000005", TOKEN);
         expect(text("confirm-balance")).toBe("0.0000005 TOK");
         expect(errors()).toBe("");
-        expect(balanceError()).toBe("");
         await confirmSend("0.0000006", TOKEN);
-        expect(balanceError()).toContain(
-            "Your TOK balance does not cover this amount.",
+        expect(errors()).toContain(
+            "You have 0.0000005 TOK but are trying to send 0.0000006 TOK.",
         );
     });
 
@@ -334,7 +316,6 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         await confirmSend("1.5", TOKEN);
         expect(text("confirm-balance")).toBe("1.5000 TOK");
         expect(errors()).toBe("");
-        expect(balanceError()).toBe("");
     });
 
     test("with more than 18 decimals and a holding below 10^-18", async () => {
@@ -348,8 +329,9 @@ describe("a tracked token holding below 0.000001 never renders as zero", () => {
         );
         await confirmSend("0.000000000000000001", TOKEN);
         expect(text("confirm-balance")).toBe("0.000000000000000000000001 TOK");
-        expect(balanceError()).toContain(
-            "Your TOK balance does not cover this amount.",
+        expect(errors()).toContain(
+            "You have 0.000000000000000000000001 TOK but are trying to send" +
+                " 0.000000000000000001 TOK.",
         );
     });
 });
@@ -374,10 +356,9 @@ describe("an untracked token holding below 0.000001 never renders as zero", () =
         await confirmSend("0.0000005", TOKEN);
         expect(text("confirm-balance")).toBe("0.0000005 TOK");
         expect(errors()).toBe("");
-        expect(balanceError()).toBe("");
         await confirmSend("0.0000006", TOKEN);
-        expect(balanceError()).toContain(
-            "Your TOK balance does not cover this amount.",
+        expect(errors()).toContain(
+            "You have 0.0000005 TOK but are trying to send 0.0000006 TOK.",
         );
     });
 });

tests/sendMax.test.js

@@ -17,7 +17,6 @@
 // What the stub node answers, and the signed transactions it was handed.
 const mockNode = {
     balanceWei: 0n,
-    tokenUnits: 0n,
     feeData: null,
     broadcast: [],
 };
@@ -31,14 +30,6 @@ jest.mock("ethers", () => {
         async getBalance() {
             return mockNode.balanceWei;
         }
-        // balanceOf(), the one contract call these screens make before Sign
-        // & Send.
-        async call() {
-            return actual.AbiCoder.defaultAbiCoder().encode(
-                ["uint256"],
-                [mockNode.tokenUnits],
-            );
-        }
         async lookupAddress() {
             return null;
         }
@@ -196,12 +187,9 @@ function text(id) {
 }
 
 // The ETH balance the node reports and the token rows the explorer reports,
-// fetched and stored exactly where the popup stores them. The node reports the
-// token holding the explorer does.
+// fetched and stored exactly where the popup stores them.
 async function refreshWith(balanceWei, tokenItems = []) {
     mockNode.balanceWei = balanceWei;
-    mockNode.tokenUnits =
-        tokenItems.length > 0 ? BigInt(tokenItems[0].value) : 0n;
     mockExplorer.items = tokenItems;
     state.wallets = [
         {

tests/trackedTokensPerNetwork.test.js

@@ -0,0 +1,102 @@
+// Tracked tokens are kept per network, and the two add-token screens offer the
+// bundled token list, which holds Ethereum Mainnet contracts, on Ethereum
+// Mainnet only (https://git.eeqj.de/sneak/AutistMask/issues/523). Driven
+// through the real popup over a stored profile; the same switch made by the
+// background is in tests/coldWorkerChainSwitch.test.js.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+
+const SEPOLIA_TOKEN = {
+    address: TOKEN_ADDRESS,
+    symbol: "TST",
+    decimals: 18,
+    name: "Test Token",
+};
+const MAINNET_TOKEN = {
+    address: "0x6B175474E89094C44Da98b954EedeAC495271d0F",
+    symbol: "DAI",
+    decimals: 18,
+    name: "Dai Stablecoin",
+};
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// The popup reopened onto SettingsAddToken, on `networkId`.
+function bootOnAddToken(networkId, extra) {
+    return bootPopup(
+        unversionedValidProfile({
+            networkId,
+            currentView: "settings-addtoken",
+            ...extra,
+        }),
+    );
+}
+
+// Picks `networkId` in the Settings network selector, as the user does.
+async function chooseNetwork(boot, networkId) {
+    const select = boot.node("settings-network");
+    select.value = networkId;
+    for (const fn of select.listeners.change) await fn();
+    await boot.settle();
+}
+
+describe.each([
+    ["mainnet", false],
+    ["sepolia", true],
+])("on %s", (networkId, hidden) => {
+    test(`the common tokens are hidden: ${hidden}`, async () => {
+        const boot = await bootOnAddToken(networkId);
+        expect(boot.pageErrors).toEqual([]);
+        expect(boot.visibleViews()).toEqual(["settings-addtoken"]);
+        expect(boot.hidden("settings-addtoken-common")).toBe(hidden);
+
+        require("../src/popup/views/addToken").show();
+        expect(boot.visibleViews()).toEqual(["add-token"]);
+        expect(boot.hidden("add-token-common")).toBe(hidden);
+    });
+});
+
+test("a token added by contract address on Sepolia is tracked on Sepolia only", async () => {
+    const boot = await bootOnAddToken("sepolia", {
+        networkTrackedTokens: { mainnet: [MAINNET_TOKEN] },
+    });
+    const stored = () => boot.storage.read("autistmask");
+    const { lookupTokenInfo } = require("../src/shared/balances");
+    lookupTokenInfo.mockResolvedValueOnce({
+        symbol: SEPOLIA_TOKEN.symbol,
+        decimals: SEPOLIA_TOKEN.decimals,
+        name: SEPOLIA_TOKEN.name,
+    });
+
+    boot.node("settings-addtoken-address").value = TOKEN_ADDRESS;
+    await boot.click("btn-settings-addtoken-manual");
+
+    expect(lookupTokenInfo).toHaveBeenCalledWith(
+        TOKEN_ADDRESS,
+        expect.any(String),
+        "sepolia",
+        expect.anything(),
+    );
+    expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
+
+    await chooseNetwork(boot, "mainnet");
+    expect(stored().networkId).toBe("mainnet");
+    expect(stored().trackedTokens).toEqual([MAINNET_TOKEN]);
+    const onMainnet = boot.node("settings-tracked-tokens").innerHTML;
+    expect(onMainnet).toContain("DAI");
+    expect(onMainnet).not.toContain("TST");
+
+    await chooseNetwork(boot, "sepolia");
+    expect(stored().networkId).toBe("sepolia");
+    expect(stored().trackedTokens).toEqual([SEPOLIA_TOKEN]);
+    const onSepolia = boot.node("settings-tracked-tokens").innerHTML;
+    expect(onSepolia).toContain("TST");
+    expect(onSepolia).not.toContain("DAI");
+});

tests/unknownScaleSend.test.js

@@ -39,8 +39,7 @@ jest.mock("../src/shared/log", () => ({
 
 // Everything the confirmation screen would reach the network for. The gas
 // estimate is the point: with a usable scale it must succeed, so that a failure
-// in these tests is a failure of the scale and not of the stub. The address
-// holds the 1 ETH the wallets below record, and `tokenUnits` of the token.
+// in these tests is a failure of the scale and not of the stub.
 const mockProvider = {
     getFeeData: async () => ({
         maxFeePerGas: 2000000000n,
@@ -49,14 +48,7 @@ const mockProvider = {
     estimateGas: async () => 21000n,
     getCode: async () => "0x",
     getTransactionCount: async () => 1,
-    getBalance: async () => 1000000000000000000n,
-    tokenUnits: 0n,
-    // The one contract call the screen makes, balanceOf().
-    call: async () =>
-        AbiCoder.defaultAbiCoder().encode(
-            ["uint256"],
-            [mockProvider.tokenUnits],
-        ),
+    getBalance: async () => 0n,
 };
 
 jest.mock("../src/shared/balances", () => {
@@ -122,7 +114,7 @@ global.document = {
 };
 global.navigator = { clipboard: { writeText() {} } };
 
-const { AbiCoder, parseUnits } = require("ethers");
+const { parseUnits } = require("ethers");
 const { fetchTokenBalances } = require("../src/shared/balances");
 const { debugFetch } = require("../src/shared/log");
 const { state } = require("../src/shared/state");
@@ -163,9 +155,8 @@ function row(token = {}, value = FIVE_WETH) {
 }
 
 // Fetch the explorer's rows through the real fetcher and put them exactly where
-// refreshBalances() puts them. The node reports the holding the explorer does.
+// refreshBalances() puts them.
 async function fetchOnto(items) {
-    mockProvider.tokenUnits = BigInt(items[0].value);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
@@ -190,7 +181,6 @@ async function fetchOnto(items) {
 // is from the first. Two addresses is what it takes to reach
 // explorerDecimals()'s disagreement check, which is only reachable across rows.
 async function fetchOntoBoth(itemsA, itemsB) {
-    mockProvider.tokenUnits = BigInt(itemsA[0].value);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
@@ -249,12 +239,6 @@ function errors() {
     return el("confirm-errors").innerHTML;
 }
 
-// The message for an amount the balance does not cover, while it is shown.
-function balanceError() {
-    const box = el("confirm-balance-error");
-    return box.style.visibility === "visible" ? box.textContent : "";
-}
-
 function sendDisabled() {
     return el("btn-confirm-send").disabled;
 }
@@ -286,6 +270,7 @@ describe("the Send screen resolves the scale rather than reading the stored one"
         const txInfo = await reviewSend(WETH, "1.5");
         expect(txInfo.tokenDecimals).toBe(18);
         expect(txInfo.tokenDecimals).not.toBe(balances[0].decimals);
+        expect(txInfo.tokenBalance).toBe("5.0");
     });
 
     test("that scale estimates a fee and leaves Send enabled", async () => {
@@ -322,10 +307,11 @@ describe("the Send screen resolves the scale rather than reading the stored one"
         // No fallback was introduced: resolution answers null here, and the
         // null is what goes forward.
         expect(txInfo.tokenDecimals).toBeNull();
+        expect(txInfo.tokenBalance).toBeNull();
         confirmTx.show(txInfo);
         await settle();
         expect(text("confirm-balance")).toBe("unknown (NOVEL)");
-        expect(balanceError()).toContain("This token's balance is unknown");
+        expect(errors()).toContain("This token's balance is unknown");
         expect(sendDisabled()).toBe(true);
     });
 });
@@ -369,8 +355,7 @@ describe("a scale the explorer's own rows disagree about", () => {
         const txInfo = await reviewSend(NOVEL, "1.5");
         expect(txInfo.tokenDecimals).toBeNull();
         // The regression this closes: null scale alongside a non-null balance.
-        send.updateSendBalance();
-        expect(text("send-balance")).toBe("Current balance: unknown (NOVEL)");
+        expect(txInfo.tokenBalance).toBeNull();
     });
 
     test("so the user is told the balance is unknown, not only that the fee failed", async () => {
@@ -382,7 +367,8 @@ describe("a scale the explorer's own rows disagree about", () => {
         // confirm-fee-unknown-error — "the network fee could not be
         // estimated... please go back and try again" — as the only explanation
         // for a screen that can never proceed.
-        expect(balanceError()).toContain("This token's balance is unknown");
+        expect(errors()).not.toBe("");
+        expect(errors()).toContain("This token's balance is unknown");
         expect(text("confirm-balance")).toBe("unknown (NOVEL)");
         expect(sendDisabled()).toBe(true);
         // The fee line still reports the estimate as unavailable, because it
@@ -448,20 +434,31 @@ describe("a scale the explorer's own rows disagree about", () => {
         expect(text("send-balance")).toBe("Current balance: 5.0000 NOVEL");
         const txInfo = await reviewSend(NOVEL, "1.5");
         expect(txInfo.tokenDecimals).toBe(6);
+        expect(txInfo.tokenBalance).toBe("5.0");
         confirmTx.show(txInfo);
         await settle();
         expect(text("confirm-balance")).toBe("5.0000 NOVEL");
         expect(errors()).toBe("");
-        expect(balanceError()).toBe("");
         expect(sendDisabled()).toBe(false);
     });
 });
 
 describe("the confirmation screen tells an unknown balance from a zero one", () => {
-    // A send of 1.5 NOVEL from an address the node reports none of, with the
-    // token's scale `tokenDecimals`, or null for a scale nobody knows.
-    async function render(tokenDecimals) {
-        mockProvider.tokenUnits = 0n;
+    function txInfo(tokenBalance) {
+        return {
+            from: HOLDER,
+            to: RECIPIENT,
+            ensName: null,
+            amount: "1.5",
+            token: NOVEL,
+            balance: "1.0",
+            tokenSymbol: "NOVEL",
+            tokenBalance,
+            tokenDecimals: tokenBalance === null ? null : 18,
+        };
+    }
+
+    async function render(tokenBalance) {
         state.wallets = [
             {
                 name: "Wallet 1",
@@ -472,40 +469,30 @@ describe("the confirmation screen tells an unknown balance from a zero one", ()
         ];
         state.selectedWallet = 0;
         state.selectedAddress = 0;
-        confirmTx.show({
-            from: HOLDER,
-            to: RECIPIENT,
-            ensName: null,
-            amount: "1.5",
-            token: NOVEL,
-            tokenSymbol: "NOVEL",
-            tokenDecimals,
-        });
+        confirmTx.show(txInfo(tokenBalance));
         await settle();
-        return { balance: text("confirm-balance"), message: balanceError() };
+        return { balance: text("confirm-balance"), errors: errors() };
     }
 
     test("the balance line states unknown rather than a quantity of zero", async () => {
         const unknown = await render(null);
-        const zero = await render(18);
+        const zero = await render("0.0");
         expect(unknown.balance).not.toBe(zero.balance);
         expect(unknown.balance).toBe("unknown (NOVEL)");
         expect(zero.balance).toBe("0.0000 NOVEL");
     });
 
     // Both hit INSUFFICIENT_TOKEN — an unknown balance is treated as nothing to
-    // spend from, which is the fail-closed side — but "your balance does not
-    // cover this amount" is a claim about the holding, and this one has no
-    // established quantity to claim.
-    test("the insufficient-balance message names the reason, not a shortfall", async () => {
+    // spend from, which is the fail-closed side — but "you have 0.0" is a claim
+    // about the holding, and this one has no established quantity to claim.
+    test("the insufficient-balance message names the reason, not a figure", async () => {
         const unknown = await render(null);
-        const zero = await render(18);
-        expect(unknown.message).toContain("This token's balance is unknown");
-        expect(unknown.message).not.toContain("does not cover");
-        expect(zero.message).toBe(
-            "Your NOVEL balance does not cover this amount. Please go back and" +
-                " send a smaller amount.",
-        );
+        const zero = await render("0.0");
+        expect(unknown.errors).not.toBe(zero.errors);
+        expect(unknown.errors).toContain("This token's balance is unknown");
+        expect(unknown.errors).not.toContain("You have");
+        expect(zero.errors).toContain("You have 0.0000 NOVEL");
+        expect(zero.errors).not.toContain("balance is unknown");
     });
 });