Author SHA1 Message Date
sneak d7f0e241ff fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)
check / check (push) Canceled after 0s
e2e / e2e-chrome (push) Canceled after 0s
e2e / e2e-firefox (push) Canceled after 0s
Out of the box the wallet sent the user's addresses to Blockscout for history
and token lookups, and each recipient to Etherscan for its label. Two settings,
"Use Blockscout" and "Check recipients on Etherscan", now gate those requests
where they are made. Both are off in a new profile and offered unticked on
Welcome and in Settings. While one is off, the screens that relied on it say so
in a plain line naming the setting; after either changes in Settings, Back
draws the screen it lands on again. ENS lookups ask only the RPC endpoint, so a
name resolved off-chain does not resolve. README and the user guide say what is
contacted by default and what each setting adds.

Model: opus-5-5
2026-10-21 16:11:02 +00:00
58 changed files with 650 additions and 1735 deletions
+154 -251
View File
@@ -12,27 +12,20 @@ intercepts tx status links to their own site instead of going to Etherscan, etc.
None of the common alternatives work on Firefox.
Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
Everything you need, nothing you don't. We import as few libraries as possible
and don't implement any crypto. By default the wallet sends user-specific data
only to the Ethereum RPC endpoint. The user can change that endpoint in
Settings. It defaults to a public node.
Out of the box the extension contacts two services:
- the configured RPC node, for blockchain interactions
- a public CoinDesk API (no API key), for realtime prices. It is sent token
symbols and nothing else.
Two more services are sent none of the user's data until the user turns them on.
Each has a checkbox on the Welcome screen and in Settings:
- "Use Blockscout": a Blockscout block-explorer API, for transaction history,
the tokens the user has not tracked, and transaction details
- "Check recipients on Etherscan": a best-effort Etherscan label lookup of the
recipient during transaction confirmation
A community-maintained phishing domain blocklist is built into the extension at
build time and checked locally. Nothing is fetched for it at runtime.
Everything you need, nothing you don't. We import as few libraries as possible,
don't implement any crypto, and don't send user-specific data anywhere but a
(user-configurable) Ethereum RPC endpoint (which defaults to a public node)
unless the user turns on one of the two lookups below. Out of the box the
extension contacts the configured RPC node for blockchain interactions and a
public CoinDesk API (no API key) for realtime price information, which is sent
token symbols and nothing else. Two more services are sent none of the user's
data until the user turns them on, on the Welcome screen or in Settings: a
Blockscout block-explorer API for transaction history, the tokens the user has
not tracked and transaction details ("Use Blockscout"), and best-effort
Etherscan address label lookups during transaction confirmation ("Check
recipients on Etherscan"). A community-maintained phishing domain blocklist is
built into the extension at build time and checked locally; nothing is fetched
for it at runtime.
In the extension is a hardcoded list of the top ERC20 contract addresses. You
can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -434,33 +427,22 @@ there to Sepolia must put up the `[TESTNET]` banner, and switching back to
mainnet must take it down, both while Settings is still on screen.
It also covers what a new install sends to Blockscout and Etherscan
([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The harness installs
a route handler before the first popup page opens. From then on, the handler
records every request the extension makes, from its pages and from its
background worker. A request the background worker makes while it starts up
comes earlier and is not recorded. The tests take these steps in order:
- Welcome must offer "Use Blockscout" and "Check recipients on Etherscan"
unticked.
- With neither ticked, Home, AddressDetail, AddressToken and ConfirmTx must each
show the line saying what is off.
- The popup is then closed until the background has run a balance refresh of its
own. No recorded request may have gone to Blockscout or Etherscan.
- "Use Blockscout" is ticked from AddressDetail's gear. On "Back", AddressDetail
must ask Blockscout for its history and no longer say the setting is off.
Blockscout must then be asked for the token balances.
- The stub Blockscout then reports a token the user has not tracked. Home lists
it. "Use Blockscout" is unticked from AddressDetail's gear. On "Back", the
token must be gone from AddressDetail, from Send's token dropdown and from
Home. Those three screens must each show the line saying the setting is off.
The setting is then ticked again.
- "Check recipients on Etherscan" is ticked from ConfirmTx's gear. On "Back",
ConfirmTx must ask Etherscan about the recipient and show the label the stub
page gives it.
Both settings stay on for the rest of the run. TransactionDetail with "Use
Blockscout" off is not driven here, because no history row leads to it then. The
unit tests cover it.
([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The route handler
records every request the extension makes, from its pages and its background
worker, from when the harness installs it, before the first popup page opens; a
request the background worker makes while it starts up, before then, is not
recorded. Welcome must offer "Use Blockscout" and "Check recipients on
Etherscan" unticked. With neither changed, Home, AddressDetail, AddressToken and
ConfirmTx must show the lines saying what is off; the popup is then closed until
the background has run a balance refresh of its own, and not one recorded
request may have gone to Blockscout or Etherscan. "Use Blockscout" is then
ticked from AddressDetail's gear: on "Back", AddressDetail must ask Blockscout
for its history and no longer say it is off, and Blockscout must then be asked
for the token balances. "Check recipients on Etherscan" is ticked from
ConfirmTx's gear: on "Back", ConfirmTx must ask Etherscan about the recipient
and show the label the stub page gives it. Both stay on for the rest of the run.
TransactionDetail with "Use Blockscout" off is not driven here, since no history
row leads to it then; the unit tests cover it.
It also covers the confirmation screen, for both a native ETH send and an ERC-20
send: Send disabled while the fee estimate is in flight, enabled once it lands,
@@ -893,8 +875,6 @@ src/
prices.js — ETH/USD and token/USD via CoinDesk API
scamlist.js — known fraud contract addresses
state.js — persisted state (extension storage)
storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
read from storage by the requests they gate
symbolSpoof.js — the known-symbol spoof rule, shared by all surfaces
tokenList.js — top ERC-20 tokens by market cap (hardcoded)
transactions.js — tx history fetching + anti-poisoning filters
@@ -1165,37 +1145,25 @@ with the same floor (`.5` reads `.5000`).
**Specific Exception — unknown token scale:** Calldata carries base units and no
scale, so every amount on the dApp approval screen needs the token's `decimals`.
It is resolved from these sources, in this order (`resolveTokenDecimals()` in
`src/shared/approvalAmount.js`):
- the bundled token list
- the tokens the user tracks on the network the transaction is for
- what the block explorer reported for the contract in the wallet's balances.
These are the active network's only, and they are used only while "Use
Blockscout" is on (`tokenSourcesByChainId()` in `src/popup/views/helpers.js`).
The token's name comes from the same sources. While "Use Blockscout" is off, a
token's name or decimals may be missing from the bundled list and the tracked
tokens. Then a line under the token says "This token was not looked up on
Blockscout, because "Use Blockscout" is off in Settings." These screens show it:
- TxApproval and SignApproval
- WaitTx, SuccessTx and ErrorTx, which follow TxApproval
Where none of the sources answers, the amount is not formatted: the line reads
`5000000000 base units (decimals unknown)`. A guessed scale is not an
approximation but a different number — 1,000 units of a 6-decimal token
formatted at 18 decimals reads `0.000000001` — on the screen whose only job is
to state what is being authorized. Both amount paths of that screen take this
rule: the ERC-20 `transfer`/`approve` line (`src/popup/views/approval.js`) and
the swap's `Amount`, `Min. received`, `Moved from the sender` and
`Permit2 allowance` lines and the `Paid to` line of a move into the router
(`src/shared/uniswap.js`). The token permission warning on the signature screen
takes the same rule for its amounts. An unbounded allowance or permit needs no
scale to describe and is still shown as `Unlimited`. A source's answer counts
only if it is a whole number from 0 to 80: `decimals()` returns a `uint8`, but
`formatUnits()` cannot format more than 80 decimal places, so a token that
reports 81 to 255 is shown as one whose scale nothing knows.
It is resolved from the bundled token list, then from the tokens the user tracks
on the network the transaction is for, then, when that is the active network,
from what the block explorer reported for the contract in the wallet's balances,
which are the active network's only (`resolveTokenDecimals()` in
`src/shared/approvalAmount.js`). Where none of them answers, the amount is not
formatted: the line reads `5000000000 base units (decimals unknown)`. A guessed
scale is not an approximation but a different number — 1,000 units of a
6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
whose only job is to state what is being authorized. Both amount paths of that
screen take this rule: the ERC-20 `transfer`/`approve` line
(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
a move into the router (`src/shared/uniswap.js`). The token permission warning
on the signature screen takes the same rule for its amounts. An unbounded
allowance or permit needs no scale to describe and is still shown as
`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
decimal places, so a token that reports 81 to 255 is shown as one whose scale
nothing knows.
The rule holds only if nothing invents a scale UPSTREAM of it. Those three
sources are read as authoritative, so a value written into one of them cannot be
@@ -1218,13 +1186,12 @@ and compare against. Reading the stored field directly instead answers `null`
for a bundled or tracked token the explorer merely omitted, which is not a
refusal the wallet has any reason to make.
While "Use Blockscout" is on, the Send screen also consults every address's
explorer reports. So a contract two addresses report different `decimals` for
has no scale there, and the stored balance, formatted at one of those scales, is
withdrawn with it. The Send screen's `Current balance` and the confirmation
screen's balance line then both read `unknown (SYMBOL)`. The balance list
formats each explorer row as it is fetched, without that cross-address check,
and shows the row's figure.
The Send screen also consults every address's explorer reports, so a contract
two addresses report different `decimals` for has no scale there, and the stored
balance, formatted at one of those scales, is withdrawn with it. The Send
screen's `Current balance` and the confirmation screen's balance line then both
read `unknown (SYMBOL)`. The balance list formats each explorer row as it is
fetched, without that cross-address check, and shows the row's figure.
**Decoded amount lines on the transaction approval screen:** the `Amount` line
of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
@@ -1444,22 +1411,12 @@ that token's previous entry, as a failed ETH balance keeps its figure, or takes
Blockscout's entry from the same refresh when there is none. Every other token
comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
tokens do appear without the user adding them, and they keep their previous
figures while Blockscout fails.
The refresh asks Blockscout only while the user has "Use Blockscout" on. The
setting is off until the user turns it on. While it is off:
- Only tracked tokens are listed. Turning the setting off drops every other
token from every address at once.
- A tracked token's entry has no holder count and no `decimals` from Blockscout.
- A tracked token's balance uses the decimals from the bundled list, or else the
decimals saved when the token was tracked.
Blockscout may answer just before the user turns the setting off. So if the
stored setting is off when the refresh saves, in the popup or the background,
the save drops every token the user has not tracked.
A tracked token is shown when its balance is nonzero, and any other ERC-20 when
figures while Blockscout fails. The refresh asks Blockscout only while the user
has "Use Blockscout" on. While it is off, as it is until the user turns it on, a
tracked token's entry has no holder count and no `decimals` of Blockscout's, so
its balance is stated at the scale the bundled list or the tracked token
records, and no other token is listed, those from earlier refreshes included. A
tracked token is shown when its balance is nonzero, and any other ERC-20 when
its balance is nonzero and it is in the bundled known-token list or has 1,000 or
more holders. A token claiming a symbol from the bundled list from any other
contract address is always dropped, tracked or not, and so is any token claiming
@@ -1647,18 +1604,10 @@ renders as it goes, and `viewRouter.js` records every screen that reaches
more — rendering it a second time would re-fetch and overwrite what it holds,
such as an edit typed into Settings and not yet saved. Home is the one screen
"Back" always re-renders, so the wallet list reflects anything that changed
while the user was away from it.
Changing "Use Blockscout" or "Check recipients on Etherscan" in Settings makes
every screen but Settings count as not yet rendered. "Back" then renders again
any screen a reopened popup can render. A change to "Use Blockscout" also cuts
the stack, as a network switch does (below). The cut drops Send, whose token
dropdown was filled under the old setting. "Back" cannot render Send again. A
change to "Check recipients on Etherscan" leaves the stack as it is.
Any other popup open meanwhile takes either change from the stored record, as it
takes a network switch (below). It then draws its screen on top again as a
reopened popup draws it, so Home takes the place of a screen such as Send.
while the user was away from it. Changing "Use Blockscout" or "Check recipients
on Etherscan" in Settings makes every screen but Settings count as not yet
rendered, so "Back" renders the screen it lands on under the new setting; the
stack is left as it is.
A network switch leaves every screen on the page showing the previous network.
The user makes it in Settings, or approves a site's request and the background
@@ -1701,11 +1650,11 @@ view would leave a wallet one click from deletion.
screen in that case.
- **Elements**:
- "Welcome! To get started, add a wallet." text
- A well with a line saying that the wallet sends the user's data only to
the Ethereum RPC endpoint unless one of the two checkboxes below is ticked
- In the well, the "Use Blockscout" and "Check recipients on Etherscan"
checkboxes, the same two as in Settings. Each has a sentence saying what
it sends and where. Both are unticked until the user ticks them
- A well saying that the wallet sends the user's data only to the Ethereum
RPC endpoint unless one of the two settings in it is turned on, here or
later in Settings: the "Use Blockscout" and "Check recipients on
Etherscan" checkboxes, the same two as in Settings, each with its sentence
on what it sends and to whom. Both are unticked until the user ticks them
- "Add wallet" button
- **Transitions**:
- Ticking or unticking either checkbox → stores the setting, as Settings
@@ -1741,7 +1690,7 @@ view would leave a wallet one click from deletion.
says "This transaction creates a new contract. It has no recipient." The
transaction lists on AddressDetail and AddressToken draw the same rows.
The history comes from Blockscout. While "Use Blockscout" is off,
Blockscout is not asked. This list then shows only the line "No
Blockscout is not asked, and this list and those two show the one line "No
transaction history is shown, because "Use Blockscout" is off in
Settings."
- "Add additional wallet..." link at bottom
@@ -1811,14 +1760,13 @@ view would leave a wallet one click from deletion.
- Full address (color dot, etherscan link, tap to copy)
- USD total for address (see [Partial USD totals](#partial-usd-totals))
- Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
places, USD inline). Each balance row is clickable → **AddressToken**
- While "Use Blockscout" is off, a line under the balance list: "Only
tracked tokens are listed, because "Use Blockscout" is off in Settings."
places, USD inline). Each balance row is clickable → **AddressToken**.
While "Use Blockscout" is off, the line Home has under its wallet list
follows it
- Send / Receive / + Token buttons and a "···" menu button
- "···" dropdown containing a single "Export Private Key" entry
- Transaction list (with ENS resolution for counterparties). While "Use
Blockscout" is off, it shows only the line "No transaction history is
shown, because "Use Blockscout" is off in Settings."
- Transaction list (with ENS resolution for counterparties), or the line
Home's list shows while "Use Blockscout" is off
- **Transitions**:
- Tap balance row → **AddressToken** (for that token)
- "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1886,13 +1834,11 @@ view would leave a wallet one click from deletion.
- Token contract well (ERC-20 only): full contract address (tap to copy,
etherscan link) plus name, symbol, decimals, holder count and project
website where known. The "Holders:" row is left out, not shown as 0, when
the token's balance-list entry has no holder count. That happens when:
- the explorer did not report a readable one
- "Use Blockscout" is off
- the token is not in the balance list
- Token-filtered transaction list (only this token's transfers). While "Use
Blockscout" is off, it shows only the line "No transaction history is
shown, because "Use Blockscout" is off in Settings."
the token's balance-list entry has no holder count: the explorer did not
report a readable one, "Use Blockscout" is off, or the token is not in the
balance list
- Token-filtered transaction list (only this token's transfers), or the line
Home's list shows while "Use Blockscout" is off
- **Transitions**:
- "Send" → **Send** (token locked: the dropdown is replaced by a static
symbol and contract address)
@@ -1909,9 +1855,6 @@ view would leave a wallet one click from deletion.
- From: address with color dot + etherscan link
- What to send: token dropdown (or static display with contract address when
locked from AddressToken)
- While "Use Blockscout" is off, a line under the token dropdown: "Only
tracked tokens are listed, because "Use Blockscout" is off in Settings."
The line is hidden with the dropdown when Send is opened from AddressToken
- To: address or ENS name input, with an inline validation message
- Amount input with current balance display, which reads
`Current balance: unknown (SYMBOL)` for a token whose scale is unknown, as
@@ -1931,14 +1874,13 @@ view would leave a wallet one click from deletion.
- **Transitions**:
- "Review" (valid inputs, ENS resolved) → **ConfirmTx**
- "Review" with an unresolvable ENS name or an invalid amount → flash
message, no screen change. A name with no address, or one resolved
off-chain, gets "That ENS name has no on-chain address." An amount is
valid when it is a number above zero, written as digits with at most one
decimal point, with nothing but zeros after the token's last decimal
place. ETH has 18 places, and a token with more, or with an unknown
number, is held to 18. Zeros past those places leave the amount unchanged,
so `1.0000000` of a 6-place token passes and is sent as exactly 1.
ConfirmTx makes the same check before anything can be sent
message, no screen change. An amount is valid when it is a number above
zero, written as digits with at most one decimal point, with nothing but
zeros after the token's last decimal place. ETH has 18 places, and a token
with more, or with an unknown number, is held to 18. Zeros past those
places leave the amount unchanged, so `1.0000000` of a 6-place token
passes and is sent as exactly 1. ConfirmTx makes the same check before
anything can be sent
- "Back" → previous screen (Home, AddressDetail, or AddressToken)
#### ConfirmTx (`confirm-tx`)
@@ -1984,10 +1926,10 @@ view would leave a wallet one click from deletion.
that has received ETH but never sent a transaction still holds that ETH,
so it gets no warning. The Etherscan label check is made only while "Check
recipients on Etherscan" is on. While it is off, the Etherscan box is left
out. A line in its place says "This address was not checked on Etherscan,
because "Check recipients on Etherscan" is off in Settings." The box or
the line is chosen when the screen is drawn, so neither moves anything
later
out and a line in its place says "This address was not checked on
Etherscan, because "Check recipients on Etherscan" is off in Settings."
Which of the two is there is known when the screen is drawn, so neither
moves anything later
- Errors (an invalid amount), plus five reserved error boxes, so the balance
and the fee arriving later move nothing — the amount exceeds the balance
(for a token whose scale is unknown it says the token's balance is
@@ -2033,8 +1975,8 @@ view would leave a wallet one click from deletion.
are that network's, so a testnet transaction shows none, its From, To and
token contract links open that network's explorer, the balance read, the
fee estimate and the contract and never-sent recipient checks ask that
network's RPC endpoint, and the Etherscan label check asks that network's
explorer
network's RPC endpoint, and the Etherscan label check, when it is made,
asks that network's explorer
- "Sign & Send" (correct password) when the gas limit, a fee per gas or the
total fee the RPC endpoint fills in at signing is over its bound in
`assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
@@ -2064,9 +2006,6 @@ view would leave a wallet one click from deletion.
`Unknown (could not be decoded)` with no symbol, not the transaction's ETH
value. When that swap's `Token In` is `ETH (native)`, the transaction's
ETH value in the network's currency, as for any other transaction
- While "Use Blockscout" is off, TxApproval's line under the amount, when
the token's name or decimals are missing from the bundled list and the
tracked tokens
- To: color dot + full address + etherscan link; for a contract creation,
which has no recipient, "This transaction creates a new contract. It has
no recipient." instead
@@ -2099,9 +2038,7 @@ view would leave a wallet one click from deletion.
- **Elements**:
- "Transaction Confirmed" heading
- Decoded action well (shown when the transaction carried recognized
calldata; the top-level Amount and To are hidden in that case). While "Use
Blockscout" is off, it has TxApproval's line under each token whose name
or decimals are missing from the bundled list and the tracked tokens.
calldata; the top-level Amount and To are hidden in that case)
- Amount + symbol
- To: color dot + full address + etherscan link, or for a contract creation
the same sentence as on WaitTx
@@ -2124,7 +2061,6 @@ view would leave a wallet one click from deletion.
- Amount + symbol, or for a swap the approval screen showed no `Amount` for,
the same as on WaitTx: `Unknown (could not be decoded)`, unless its
`Token In` is `ETH (native)`
- While "Use Blockscout" is off, the same line under the amount as on WaitTx
- To: color dot + full address + etherscan link, or for a contract creation
the same sentence as on WaitTx
- Error message (dashed border box)
@@ -2159,11 +2095,12 @@ view would leave a wallet one click from deletion.
AddressToken. The screen describes the transaction on the network it was sent
on, whichever network is active: its block, network details, decoded details
and raw data are read from that network's Blockscout, the one Settings has for
it, and its etherscan links open that network's explorer. The block, network
details, decoded details and raw data are read only while "Use Blockscout" is
on. While it is off, a line in their place says "No block, decoded details,
network details or raw data are shown, because "Use Blockscout" is off in
Settings."
it, and its etherscan links open that network's explorer. They are read only
while "Use Blockscout" is on. The screen can still be shown with it off, when
the user opens Settings from it, turns the setting off and presses Back; then
Blockscout is not asked, and a line in their place says "No block, decoded
details, network details or raw data are shown, because "Use Blockscout" is
off in Settings."
- **Elements** (grouped into logical blocks using light well containers; field
labels are self-explanatory so groups have no headings):
- "Transaction" heading, "Back" button
@@ -2246,21 +2183,18 @@ view would leave a wallet one click from deletion.
already active changes nothing and sends nothing
- Ethereum RPC: endpoint URL input + "Save" button (validated against
`eth_chainId` before being saved)
- Blockscout API:
- "Use Blockscout" checkbox, unticked until the user ticks it
- A sentence saying what it shows and what it sends. It sends the
Blockscout API the user's addresses and the hash of each transaction
opened
- Endpoint URL input + "Save" button. "Save" checks the URL by asking it
for `/stats` before saving it. That request carries no user data. It
is made whether or not "Use Blockscout" is ticked.
- Etherscan:
- "Check recipients on Etherscan" checkbox, unticked until the user
ticks it
- A sentence saying it sends each recipient's address to Etherscan to
check it for a phishing or scam label
- Each of the two settings applies to every network. Welcome offers the same
two checkboxes
- Blockscout API: a "Use Blockscout" checkbox, unticked until the user ticks
it, with a sentence saying it sends the user's addresses, and the hash of
each transaction opened, to the Blockscout API below, for transaction
history, tokens not tracked, and transaction details; then the endpoint
URL input + "Save" button (validated against `/stats` before being saved,
a request the user presses for that carries no user data, made whether or
not the checkbox is ticked)
- Etherscan: a "Check recipients on Etherscan" checkbox, unticked until the
user ticks it, with a sentence saying it sends the address about to be
sent to, to Etherscan, to look for a phishing or scam label on it. Both
checkboxes are one setting each for every network, and Welcome offers the
same two
- Token Spam Protection:
- "Hide fake tokens impersonating a known symbol" checkbox
- "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2286,8 +2220,7 @@ view would leave a wallet one click from deletion.
- **Transitions**:
- Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
stores the setting (no screen change). The next balance refresh and every
screen drawn after that follow it. Unticking "Use Blockscout" also drops
every token the user has not tracked from every address
screen drawn after that follow it
- "+ Add wallet" → **AddWallet**
- "+ Add token" → **SettingsAddToken**
- `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2306,8 +2239,7 @@ view would leave a wallet one click from deletion.
nothing and tells the background nothing
- Ten clicks on the version → reveals the Debug well (no screen change)
- "Back" (or Settings gear again) → previous screen (Home); after a network
switch or a change to "Use Blockscout", the stack is cut first (see the
top of Screen Map)
switch, the stack is cut first (see the top of Screen Map)
#### ShowRecoveryPhrase (`show-phrase`)
@@ -2464,8 +2396,6 @@ view would leave a wallet one click from deletion.
money. The predicate is `addressHoldsFunds()` in
`src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
warning, never a refusal.
- While "Use Blockscout" is off, a line under the warning: "Only tracked
tokens are listed, because "Use Blockscout" is off in Settings."
- The rule that a wallet always keeps at least one address, and that
removing the last one means deleting the wallet from Settings
- Error line
@@ -2598,12 +2528,6 @@ view would leave a wallet one click from deletion.
a swap pays only the From address, a `Paid to` line for each other address
it pays, or saying that a token stays in the router or who it pays is
unknown (see Transaction Decoding)
- While "Use Blockscout" is off, a line under each token in the decoded
action whose name or decimals are missing from the bundled list and the
tracked tokens: "This token was not looked up on Blockscout, because "Use
Blockscout" is off in Settings." Blockscout's report of the user's
balances gives a token's name and decimals only while the setting is on
(see Unknown token scale).
- From: color dot + full address + etherscan link
- Contract: color dot + full address + etherscan link, token symbol label if
known; for a contract creation, the same sentence as on WaitTx
@@ -2683,11 +2607,7 @@ view would leave a wallet one click from deletion.
the site puts in the message, except a `Permit`'s token, which is the
domain's `verifyingContract`; any those fields do not give is shown as
`Unknown`, and the domain, type and message lines still follow. Only typed
data that cannot be read at all is shown as raw text. While "Use
Blockscout" is off, a token whose name or decimals are missing from the
bundled list and the tracked tokens has the same line under it as on
TxApproval. As there, Blockscout's report of the user's balances gives a
token's name and decimals only while the setting is on.
data that cannot be read at all is shown as raw text.
- Raw data (`personal_sign` and `eth_sign`): the message's hex exactly as
the site sent it. The bytes it encodes are what is signed, as an EIP-191
personal message.
@@ -2818,21 +2738,12 @@ view would leave a wallet one click from deletion.
### External Services
AutistMask is not a fully self-contained offline tool. By default it sends the
user's data only to the Ethereum RPC endpoint. It also asks the CoinDesk price
API for prices, sending token symbols and nothing else.
Two more services are sent none of the user's data until the user turns on their
settings:
- Blockscout, with "Use Blockscout"
- Etherscan, with "Check recipients on Etherscan"
Both settings are on the Welcome screen and in Settings. Both are off in a new
install. Each setting applies to every network.
A request that either setting gates reads the setting from storage before it
asks, and again when the answer lands. While the setting is off, nothing is
asked, and an answer that lands is dropped.
user's data to one service only, the Ethereum RPC endpoint, and asks one more,
the CoinDesk price API, for prices with nothing but token symbols. Two more
services are sent none of the user's data until the user turns on the setting
for each, on the Welcome screen or in Settings: Blockscout ("Use Blockscout")
and Etherscan ("Check recipients on Etherscan"). Both settings are off in a new
profile, and each is one setting for every network.
Contacted by default:
@@ -2841,10 +2752,11 @@ Contacted by default:
them the balance of every tracked token at every address (`balanceOf`),
estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
broadcast transactions (`eth_sendRawTransaction`), and check transaction
receipts. Every ENS lookup is made through it alone. A name whose resolver
says it is resolved off-chain therefore does not resolve. The default endpoint
is a public RPC (configurable by the user to any endpoint they prefer,
including a local node). By default the extension talks to
receipts. ENS lookups, of a name typed into Send and of the names shown for
the user's addresses, are made through it alone, so a name whose resolver says
it is resolved off-chain does not resolve. The default endpoint is a public
RPC (configurable by the user to any endpoint they prefer, including a local
node). By default the extension talks to
`https://ethereum-rpc.publicnode.com`.
- **Data sent**: Ethereum addresses, transaction data, contract call
parameters. The RPC endpoint can see all on-chain queries and submitted
@@ -2859,42 +2771,34 @@ Contacted by default:
Sent the user's data only while the user has turned the setting on:
- **Blockscout block-explorer API** ("Use Blockscout"): The default endpoint is
`https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
- **Used for**:
- transaction history (normal transactions and ERC-20 token transfers),
for Home, AddressDetail and AddressToken
- the balances of the ERC-20 tokens the user has not tracked, for Home,
AddressDetail, Send and DeleteAddress
- the names and decimals of those tokens, for TxApproval, SignApproval,
WaitTx, SuccessTx and ErrorTx
- token holder counts, for spam filtering
- a transaction's block, network details and calldata, for
TransactionDetail
- **Contacted**, while the setting is on:
- on every balance refresh, in the popup and in the background
- when Home, AddressDetail or AddressToken loads its history
- when TransactionDetail opens
- **While the setting is off**: each of those screens shows a line saying
what it leaves out and that "Use Blockscout" is off. Only tracked tokens
are listed.
- **Saving the URL**: whether or not the setting is on, pressing "Save"
beside the URL in Settings asks that URL for `/stats`. This request
carries no user data.
- **Blockscout block-explorer API** ("Use Blockscout"): Used to fetch
transaction history (normal transactions and ERC-20 token transfers) for Home,
AddressDetail and AddressToken, the balances of the ERC-20 tokens the user has
not tracked, token holder counts (for spam filtering), and a transaction's
block, network details and calldata for TransactionDetail. The default
endpoint is `https://eth.blockscout.com/api/v2` (configurable by the user in
Settings). While the setting is off, those screens say in a plain line what is
not shown and that this setting turns it on, and only tracked tokens are
listed, their balances read through the RPC endpoint. The endpoint check
Settings makes when the user presses "Save" beside the URL asks only for
`/stats` and carries no user data; it is made whether or not the setting is
on.
- **Data sent**: Ethereum addresses, and the hash of each transaction the
user opens. Blockscout receives the user's addresses to query their
transaction history and token balances. No private keys, passwords, or
signing operations are sent.
- **Etherscan address labels** ("Check recipients on Etherscan"): While the
setting is on, ConfirmTx looks up the recipient's address on Etherscan each
time it is shown. It checks for a phishing or scam label, best-effort. This is
a direct page fetch with no API key; the user's browser makes the request.
While the setting is off, ConfirmTx says that no Etherscan check was made.
- **Data sent**: the recipient's address and nothing else.
- **Etherscan address labels** ("Check recipients on Etherscan"): When
confirming a transaction, the extension performs a best-effort lookup of the
recipient address on Etherscan to check for phishing/scam labels. This is a
direct page fetch with no API key; the user's browser makes the request. While
the setting is off, ConfirmTx says that no Etherscan check was made.
- **Data sent**: the recipient address. The user's own addresses are not
sent.
The etherscan links on the screens open a page in the browser when the user
clicks one. They are not requests the wallet makes.
clicks one. They are not requests the wallet makes, and nothing is fetched from
them until then.
What the extension does NOT do:
@@ -2903,9 +2807,9 @@ What the extension does NOT do:
- No Infura/Alchemy dependency (any JSON-RPC endpoint works)
- No backend servers operated by the developer
Users who want maximum privacy can point the RPC URL at their own node. With
"Use Blockscout" on, they can point the Blockscout URL at their own instance
too.
Users who want maximum privacy can point the RPC URL at their own node, and,
when they turn Blockscout on, the Blockscout URL at their own instance (price
fetching can be disabled in a future version).
### Dependencies
@@ -3087,10 +2991,9 @@ logged.
- Add multiple addresses within an HD wallet
- Manage multiple wallets simultaneously
- View ETH balance per address
- View ERC-20 token balances:
- tokens the user adds by contract address
- while "Use Blockscout" is on, tokens on the bundled known-token list and
tokens with 1,000 or more holders
- View ERC-20 token balances (tokens the user adds by contract address, and,
while "Use Blockscout" is on, tokens on the bundled known-token list and
tokens with 1,000 or more holders)
- View transaction history and transaction details, while "Use Blockscout" is on
- Send ETH to an address
- Send ERC-20 tokens to an address
+40 -55
View File
@@ -58,7 +58,7 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
- **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
- **No third-party token list APIs.** The balances of the tokens you track are
read from your RPC endpoint. While "Use Blockscout" is on, the other tokens
read from your RPC endpoint; while you have "Use Blockscout" on, the others
come from the same block explorer you configure for transaction history. The
extension ships its own hardcoded list of top ERC-20 contract addresses for
symbol-spoofing detection. Any token you want tracked across all your
@@ -71,12 +71,10 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
AutistMask is a browser extension that runs entirely in your browser. It does
not have a backend server. Out of the box it sends your data only to the
Ethereum RPC endpoint. It also asks the CoinDesk price API for prices, sending
token symbols and nothing else.
Blockscout and Etherscan are sent none of your data until you turn them on.
Their settings are "Use Blockscout" and "Check recipients on Etherscan". Both
are on the Welcome screen and in Settings. Both are off in a new install.
Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing
but token symbols. Blockscout and Etherscan are sent none of your data until you
turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome
screen or later in Settings. Both are off in a new install.
### External Services
@@ -90,10 +88,10 @@ this in Settings to any Ethereum JSON-RPC endpoint, including your own local
node.
When it is contacted: on every balance refresh (every 10 seconds while the popup
is open, every 60 seconds in the background), when you review a send to an ENS
name, when a send is prepared and broadcast, while a pending transaction is
polled for its receipt, and for the reverse ENS lookups used to label addresses
(cached for 12 hours).
is open, every 60 seconds in the background), when you type an ENS name into the
Send screen, when a send is prepared and broadcast, while a pending transaction
is polled for its receipt, and for the reverse ENS lookups used to label
addresses (cached for 12 hours).
What gets sent: standard Ethereum JSON-RPC requests (balance queries,
transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
@@ -102,28 +100,20 @@ addresses are necessarily visible to the RPC provider when querying balances.
**Blockscout API** (default: `eth.blockscout.com/api/v2`;
`eth-sepolia.blockscout.com/api/v2` on Sepolia)
Blockscout is an open-source blockchain explorer. AutistMask sends it your data
only while "Use Blockscout" is on. It then asks Blockscout for:
Off until you turn on "Use Blockscout". Used to fetch transaction history, the
balances of the tokens you have not tracked, and the details of a transaction
you open. Blockscout is an open-source blockchain explorer. AutistMask queries
it for your ERC-20 token balances (including the holder counts used for spam
filtering), your recent transactions and token transfers, and the block, fees
and calldata of a transaction you open. You can change this in Settings to a
self-hosted Blockscout instance. While it is off, the screens that would show
history say so, and only the tokens you track are listed.
- your recent transactions and token transfers
- the balances of the tokens you have not tracked, with the holder counts used
for spam filtering
- the block, fees and calldata of a transaction you open
You can change this in Settings to a self-hosted Blockscout instance. While the
setting is off, each screen that would show Blockscout's data says so instead.
Only the tokens you track are listed. When you turn the setting off, every other
token leaves the lists at once.
When it is contacted, while "Use Blockscout" is on:
- on every balance refresh
- whenever a screen showing transaction history is opened
- when you open a transaction
Whether or not the setting is on, pressing "Save" beside the Blockscout URL in
Settings asks that URL for `/stats` to check it. That request sends none of your
data.
When it is contacted: while "Use Blockscout" is on, on every balance refresh,
whenever a screen showing transaction history is opened, and when you open a
transaction. The one exception, whether or not the setting is on, is pressing
"Save" beside the Blockscout URL in Settings, which checks that URL by asking it
for `/stats` and sends none of your data.
What gets sent: your Ethereum addresses (to look up balances and transactions)
and the hash of each transaction you open.
@@ -143,21 +133,19 @@ address.
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
public Etherscan address page when you review a send. It looks for a
Off until you turn on "Check recipients on Etherscan". When you review a send,
AutistMask fetches the recipient's public Etherscan address page and looks for a
"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
it finds one. This is a plain page fetch with no API key, made by your browser.
It is best-effort: if it fails, it is silently ignored. This endpoint is not
user-configurable.
The setting is off in a new install. While it is off, the confirmation screen
says that no Etherscan check was made.
user-configurable. While it is off, the confirmation screen says that no
Etherscan check was made.
When it is contacted: only while "Check recipients on Etherscan" is on, each
time you reach the send confirmation screen.
What gets sent: the recipient's address and nothing else. As with any request,
Etherscan sees your IP address.
What gets sent: the recipient address you are about to send to, and your IP
address. Your own addresses are not sent.
Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
contracts) are ordinary links. They contact nothing until you click them.
@@ -211,9 +199,9 @@ password.
1. Click the AutistMask icon in your browser toolbar.
2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
On first use, the screen with "Add wallet" also offers "Use Blockscout" and
"Check recipients on Etherscan", both off. Tick either if you want what it
does (see External Services). You can change both later in Settings.
On first use the same screen offers "Use Blockscout" and "Check recipients on
Etherscan", both off; tick either if you want what it does (see External
Services). You can change both later in Settings.
3. On the "From Phrase" tab, click the die button to generate a random 12-word
recovery phrase.
4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -249,14 +237,11 @@ always produce the same sequence of addresses.
### Adding ERC-20 Tokens
Tokens you hold show up automatically only while "Use Blockscout" is on. Even
then, a token shows up only if it is in the extension's bundled list of
well-known tokens or has at least 1,000 holders. Everything else is treated as
spam and hidden.
A token you track is shown whether or not "Use Blockscout" is on. By default it
is shown at zero balance too (see Display in Settings). To track a token, add it
by contract address:
Tokens you hold show up automatically only while "Use Blockscout" is on, and
then only if they are in the extension's bundled list of well-known tokens or
have at least 1,000 holders; everything else is treated as spam and hidden. To
track a token explicitly (which also shows it at zero balance, and shows it
whether or not "Use Blockscout" is on), add it by contract address:
1. Go to an address detail view (click `[info]` on any address).
2. Click "+ Token".
@@ -272,8 +257,7 @@ screen. Tokens can also be added from Settings, under "Tracked Tokens".
1. Click "Send" from the home screen or an address detail view.
2. Select what to send (ETH, or any ERC-20 token with a balance on this address
that survives the spam filters).
3. Enter the recipient address or ENS name (e.g. `vitalik.eth`). AutistMask does
not look up a name resolved off-chain, so enter its address instead.
3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
4. Enter the amount, or click "Max" to fill it in: a token's balance, cut to 18
decimal places, or your ETH balance minus the amount reserved for the network
fee.
@@ -423,8 +407,9 @@ Click the gear icon on the home screen to access settings:
that network's defaults if you have not used it before.
- **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
You can use your own node for maximum privacy.
- **Blockscout API**: the "Use Blockscout" checkbox, off until you tick it, and
the URL of the Blockscout instance. You can use a self-hosted instance.
- **Blockscout API**: "Use Blockscout", off until you tick it, and the
Blockscout instance used for transaction history, the tokens you have not
tracked and transaction details. You can use a self-hosted instance.
- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
- **Token Spam Protection**: Toggle individual scam filters and set the dust
transaction threshold.
+2 -12
View File
@@ -17,11 +17,7 @@ const { applyChainSwitchFields } = require("../shared/chainSwitchFields");
// the same prohibition reported early, not the guarantee.
const { getState, updateState } = require("./state");
const { StateUnusableError } = require("../shared/stateSchema");
const {
refreshBalances,
dropUntrackedTokens,
getProvider,
} = require("../shared/balances");
const { refreshBalances, getProvider } = require("../shared/balances");
const { debugFetch, log } = require("../shared/log");
const {
verifySignedTx,
@@ -1390,10 +1386,6 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
// lastBalanceRefresh is left as the switch set it, so the next tick refreshes
// the new network.
//
// Blockscout may have answered before the user turned "Use Blockscout" off. So
// when "Use Blockscout" stored NOW is off, the save drops every token the user
// has not tracked.
async function backgroundRefresh() {
const s = await getState();
const now = Date.now();
@@ -1405,6 +1397,7 @@ async function backgroundRefresh() {
wallets,
s.rpcUrl,
s.blockscoutUrl,
s.useBlockscout,
s.trackedTokens,
s.networkId,
);
@@ -1431,9 +1424,6 @@ async function backgroundRefresh() {
}
}
}
if (!fresh.useBlockscout) {
dropUntrackedTokens(fresh.wallets, fresh.trackedTokens);
}
fresh.lastBalanceRefresh = now;
});
}
+20 -40
View File
@@ -46,8 +46,8 @@
<div class="bg-well p-3 mx-1 mb-3">
<p class="text-xs mb-2">
This wallet sends your data only to the Ethereum RPC
endpoint, unless you turn on one of these. You can
change them later in Settings.
endpoint, unless you turn on either of these, here or
later in Settings.
</p>
<label
class="text-xs flex items-center gap-1 cursor-pointer mb-1"
@@ -56,10 +56,10 @@
Use Blockscout
</label>
<p class="text-xs text-muted mb-2">
Shows transaction history, tokens you have not tracked
and transaction details. Sends your addresses, and the
hash of each transaction you open, to the Blockscout
API.
Sends your addresses, and the hash of each transaction
you open, to the Blockscout API, for transaction
history, tokens you have not tracked, and transaction
details.
</p>
<label
class="text-xs flex items-center gap-1 cursor-pointer mb-1"
@@ -71,8 +71,8 @@
Check recipients on Etherscan
</label>
<p class="text-xs text-muted">
Sends each recipient's address to Etherscan to check it
for a phishing or scam label.
Sends the address you are about to send to, to
Etherscan, to look for a phishing or scam label on it.
</p>
</div>
<button
@@ -569,23 +569,12 @@
</div>
<div class="mb-2">
<label class="block mb-1">What to send</label>
<!-- The token dropdown and the line under it. Both are
hidden when AddressToken opens Send for its own token. -->
<div id="send-token-dropdown">
<select
id="send-token"
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
>
<option value="ETH">ETH</option>
</select>
<p
id="send-tokens-note"
class="text-xs text-muted hidden"
>
Only tracked tokens are listed, because "Use
Blockscout" is off in Settings.
</p>
</div>
<select
id="send-token"
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
>
<option value="ETH">ETH</option>
</select>
<div id="send-token-static" class="text-sm hidden"></div>
</div>
<div class="mb-2">
@@ -811,7 +800,6 @@
<div class="mb-3">
<div class="text-xs text-muted mb-1">Amount</div>
<div id="wait-tx-summary" class="font-bold"></div>
<div id="wait-tx-token-note"></div>
</div>
<div class="mb-3">
<div class="text-xs text-muted mb-1">To</div>
@@ -858,7 +846,6 @@
<div class="mb-3">
<div class="text-xs text-muted mb-1">Amount</div>
<div id="error-tx-summary" class="font-bold"></div>
<div id="error-tx-token-note"></div>
</div>
<div class="mb-3">
<div class="text-xs text-muted mb-1">To</div>
@@ -1072,10 +1059,10 @@
Use Blockscout
</label>
<p class="text-xs text-muted mb-2">
Shows transaction history, tokens you have not tracked
and transaction details. Sends your addresses, and the
hash of each transaction you open, to the Blockscout API
below.
Sends your addresses, and the hash of each transaction
you open, to the Blockscout API below, for transaction
history, tokens you have not tracked, and transaction
details.
</p>
<p class="text-xs text-muted mb-1">
Change this if you run your own Blockscout instance.
@@ -1105,8 +1092,8 @@
Check recipients on Etherscan
</label>
<p class="text-xs text-muted">
Sends each recipient's address to Etherscan to check it
for a phishing or scam label.
Sends the address you are about to send to, to
Etherscan, to look for a phishing or scam label on it.
</p>
</div>
@@ -1382,13 +1369,6 @@
>
&nbsp;
</div>
<p
id="delete-address-tokens-note"
class="text-xs text-muted mb-2 hidden"
>
Only tracked tokens are listed, because "Use Blockscout" is
off in Settings.
</p>
<p class="text-xs text-muted mb-3">
A wallet always keeps at least one address. To remove the
last one, delete the whole wallet from Settings instead.
+18 -53
View File
@@ -11,7 +11,7 @@ const {
const { StateUnusableError } = require("../shared/stateSchema");
const { log, setRuntimeDebug } = require("../shared/log");
const { refreshPrices } = require("../shared/prices");
const { refreshBalances, dropUntrackedTokens } = require("../shared/balances");
const { refreshBalances } = require("../shared/balances");
const { clearPopupCaches } = require("../shared/chainSwitch");
const {
$,
@@ -71,27 +71,21 @@ let refreshInFlight = false;
// the recovery screen: there is no profile left to refresh.
let refreshTimer = null;
// The refresh first takes any change to the network or to either setting saved
// elsewhere (followStoredSettings() below), so what it draws follows them.
//
// The refresh writes into a copy of the wallets. Inside the save, under the
// lock, its results are copied onto the address records in `state` only if the
// network it ran on is still the active one, on this page and in the stored
// record; the background's switch, after the user approves a site's request,
// reaches this page only after the stored record (followStoredSettings()).
// reaches this page only after the stored record (followNetworkSwitch() below).
// A switch while the refresh ran cleared every address's balances
// (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
// previous network's must not come back over them
// (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
// recorded as done. Results are copied by address, so an address added or
// removed meanwhile is left as it is. Blockscout may have answered before the
// user turned "Use Blockscout" off. So if the stored setting is off when the
// refresh saves, the save drops every token the user has not tracked.
// removed meanwhile is left as it is.
async function doRefreshAndRender() {
if (refreshInFlight) return;
refreshInFlight = true;
try {
await followStoredSettings();
const networkId = state.networkId;
const wallets = structuredClone(state.wallets);
await Promise.all([
@@ -100,6 +94,7 @@ async function doRefreshAndRender() {
wallets,
state.rpcUrl,
state.blockscoutUrl,
state.useBlockscout,
state.trackedTokens,
networkId,
pageClosed.signal,
@@ -123,9 +118,6 @@ async function doRefreshAndRender() {
}
}
}
if (!stored.useBlockscout) {
dropUntrackedTokens(state.wallets, stored.trackedTokens);
}
state.lastBalanceRefresh = Date.now();
return true;
});
@@ -237,36 +229,17 @@ function fallbackView() {
// src/shared/chainSwitch.js), so a record naming a network other than this
// page's always holds a switch saved elsewhere, and a switch the user picks
// here while this waits for the lock is made after it.
//
// Another page may change "Use Blockscout" or "Check recipients on Etherscan".
// This page takes either change the same way and draws its screens again. Its
// own changes to them are made under the lock too (views/settings.js,
// views/welcome.js).
async function followStoredSettings() {
let changed = false;
async function followNetworkSwitch() {
let switched = false;
// A failed save is reported by saveState() itself: see onSaveFailure().
await saveState((stored) => {
if (stored.networkId !== state.networkId) {
settings.cutViewStack();
takeStoredNetwork(stored);
clearPopupCaches();
changed = true;
}
if (stored.useBlockscout !== state.useBlockscout) {
settings.setUseBlockscout(stored.useBlockscout);
changed = true;
}
if (
stored.checkRecipientsOnEtherscan !==
state.checkRecipientsOnEtherscan
) {
state.checkRecipientsOnEtherscan =
stored.checkRecipientsOnEtherscan;
changed = true;
}
if (!changed) return false;
if (stored.networkId === state.networkId) return false;
settings.cutViewStack();
takeStoredNetwork(stored);
clearPopupCaches();
switched = true;
}).catch(() => {});
if (changed) settings.showNewSettings();
if (switched) settings.showNewNetwork();
}
// The background opens the approval window as wide as the page, but the
@@ -413,24 +386,16 @@ async function init() {
settingsAddToken.init(ctx);
deleteAddress.init(ctx);
// Only a record whose network, "Use Blockscout" or "Check recipients on
// Etherscan" differs from this page's is followed. A record this page's
// own save wrote matches this page. A record naming no network is no
// switch.
// Only a record naming a network other than this page's is followed: the
// one this page's own switch in Settings saves names the network it
// already has, and a record naming none is no switch.
onStorageChanged((changes) => {
const written = changes.autistmask && changes.autistmask.newValue;
if (!written || !written.networkId) return;
if (
written.networkId !== state.networkId ||
written.useBlockscout !== state.useBlockscout ||
written.checkRecipientsOnEtherscan !==
state.checkRecipientsOnEtherscan
) {
followStoredSettings();
}
if (written.networkId !== state.networkId) followNetworkSwitch();
});
// A change saved since loadState() above, before there was a listener.
followStoredSettings();
// A switch saved since loadState() above, before there was a listener.
followNetworkSwitch();
if (!state.hasWallet) {
welcome.show();
+7 -10
View File
@@ -38,16 +38,13 @@ function markViewRendered(view) {
if (view) renderedViews.add(view);
}
// Begin a fresh page-load scope. The popup gets one by being loaded. It also
// asks for one when every screen on the page is out of date:
//
// - after a network switch, since those screens show the previous network
// (showNewSettings() in views/settings.js)
// - after "Use Blockscout" or "Check recipients on Etherscan" changes, here
// or on another page, since those screens were drawn under the old setting
//
// The unit tests, which simulate several page loads against one module
// instance, ask for one too.
// Begin a fresh page-load scope. The popup gets one by being loaded, and
// asks for one after a network switch, because every screen then on the page
// shows the previous network (showNewNetwork() in views/settings.js), and
// after "Use Blockscout" or "Check recipients on Etherscan" changes in
// Settings, because every screen then on the page was drawn under the old
// setting; the unit tests, which simulate several page loads against one
// module instance, ask for one too.
function resetRenderedViews() {
renderedViews.clear();
}
+2 -1
View File
@@ -102,6 +102,7 @@ async function loadTransactions(address) {
const rawTxs = await fetchRecentTransactions(
address,
state.blockscoutUrl,
state.useBlockscout,
currentNetwork().chainId,
);
const result = filterTransactions(rawTxs, {
@@ -236,7 +237,7 @@ function init(_ctx) {
}
$("send-to").value = "";
$("send-amount").value = "";
$("send-token-dropdown").classList.remove("hidden");
$("send-token").classList.remove("hidden");
$("send-token-static").classList.add("hidden");
updateSendBalance();
resetSendValidation();
+2 -1
View File
@@ -174,6 +174,7 @@ async function loadTransactions(address, tokenId) {
const rawTxs = await fetchRecentTransactions(
address,
state.blockscoutUrl,
state.useBlockscout,
currentNetwork().chainId,
);
const result = filterTransactions(rawTxs, {
@@ -329,7 +330,7 @@ function init(_ctx) {
$("send-token").value = tokenId;
}
// Hide dropdown, show static token display
$("send-token-dropdown").classList.add("hidden");
$("send-token").classList.add("hidden");
let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
if (tokenId !== "ETH") {
staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
+4 -7
View File
@@ -11,7 +11,6 @@ const {
onViewLeave,
formatFee,
tokenLabel,
tokenLookupOffHtml,
tokenSourcesByChainId,
} = require("./helpers");
const { state, saveState, currentNetwork } = require("../../shared/state");
@@ -402,10 +401,6 @@ function showTxApproval(details) {
if (d.address) {
if (d.isToken) {
detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
detailsHtml += tokenLookupOffHtml(
d.address,
approvedTx.chainId,
);
}
detailsHtml += approvalAddressHtml(
d.address,
@@ -628,7 +623,10 @@ function permitWarningHtml(types, primaryType, domain, message) {
return "";
}
const sources = tokenSourcesByChainId();
const sources = {
trackedTokens: state.trackedTokens,
wallets: state.wallets,
};
const spender = addressOrNull(
declaredField(types, primaryType, message, "spender")?.value,
);
@@ -657,7 +655,6 @@ function permitWarningHtml(types, primaryType, domain, message) {
html += `<div class="mb-2"><div>Token</div>`;
if (token) {
html += `<div>${escapeHtml(tokenLabel(token) || "Unknown token")}</div>`;
html += tokenLookupOffHtml(token);
html += approvalAddressHtml(token);
} else {
html += `<div>Unknown</div>`;
+3 -2
View File
@@ -334,8 +334,8 @@ function show(txInfo) {
$("confirm-contract-warning").style.visibility = "hidden";
$("confirm-burn-warning").style.visibility = "hidden";
$("confirm-etherscan-warning").style.visibility = "hidden";
// While "Check recipients on Etherscan" is off, there is no Etherscan
// warning to reserve space for. A line in its place says so.
// While "Check recipients on Etherscan" is off there is no Etherscan
// warning to reserve space for, and a line in its place says so.
const etherscanOn = !!state.checkRecipientsOnEtherscan;
$("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
$("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
@@ -617,6 +617,7 @@ async function checkRecipientHistory(txInfo) {
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
fromAddress: txInfo.from,
chainId: txInfo.chainId,
checkRecipientsOnEtherscan: state.checkRecipientsOnEtherscan,
});
// The user may have left this transaction while the checks were in
// flight; its warnings must not reach another recipient's screen.
-5
View File
@@ -119,11 +119,6 @@ function show(walletIdx, addrIdx) {
$("delete-address-recovery").textContent = recoveryPathText(wallet);
$("delete-address-balance").innerHTML = balanceWarningHtml(addr);
// Tokens the user has not tracked are Blockscout's to report.
$("delete-address-tokens-note").classList.toggle(
"hidden",
!!state.useBlockscout,
);
setFlash("");
showView("delete-address-confirm");
+6 -37
View File
@@ -21,10 +21,7 @@ const {
truncateAmountNeverZero,
isBelowOneMillionth,
} = require("../../shared/amountDisplay");
const {
resolveTokenDecimals,
resolveTokenSymbol,
} = require("../../shared/approvalAmount");
const { resolveTokenSymbol } = require("../../shared/approvalAmount");
const { getProvider } = require("../../shared/balances");
const { DEBUG } = require("../../shared/constants");
const { escapeHtml } = require("../../shared/html");
@@ -309,16 +306,10 @@ function nativeCurrency() {
// names a token on one network only, and every token balance held is the
// active network's, so another network gets the tokens tracked on it
// (state.networkTrackedTokens, see applyChainSwitchFields()) and no balances.
//
// The balances give what Blockscout reported for each token. So they are given
// only while "Use Blockscout" is on.
function tokenSourcesByChainId(chainId) {
const net = chainId ? networkByChainId(chainId) : currentNetwork();
if (net && net.id === state.networkId) {
return {
trackedTokens: state.trackedTokens,
wallets: state.useBlockscout ? state.wallets : [],
};
return { trackedTokens: state.trackedTokens, wallets: state.wallets };
}
return {
trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
@@ -326,32 +317,11 @@ function tokenSourcesByChainId(chainId) {
};
}
// The line shown under a token while "Use Blockscout" is off, when its name or
// decimals are missing from the bundled list and the tracked tokens. Otherwise
// "". The token is a contract address on the network with `chainId`, or on the
// active network when none is given. "ETH" and null are no contract, and get
// "".
function tokenLookupOffHtml(token, chainId) {
if (state.useBlockscout || !token || token === "ETH") return "";
const sources = tokenSourcesByChainId(chainId);
if (
resolveTokenSymbol(token, sources) !== null &&
resolveTokenDecimals(token, sources) !== null
) {
return "";
}
return (
'<div class="text-xs text-muted">This token was not looked up on' +
' Blockscout, because "Use Blockscout" is off in Settings.</div>'
);
}
// The symbol shown for a token line on the network with `chainId`, or on the
// active network when none is given: from the bundled list, the tokens the
// user tracks, and, while "Use Blockscout" is on, the explorer's report. The
// amount line's scale comes from the same sources. Null when no source names
// one, so the token lines keep saying `Unknown token` for a token nothing
// knows.
// user tracks, and the explorer's report, the sources the amount line's scale
// comes from. Null when no source names one, so the token lines keep saying
// `Unknown token` for a token nothing knows.
function tokenLabel(address, chainId) {
return resolveTokenSymbol(address, tokenSourcesByChainId(chainId));
}
@@ -565,7 +535,7 @@ const CONTRACT_CREATION_TEXT =
"This transaction creates a new contract. It has no recipient.";
// What the transaction lists on Home, AddressDetail and AddressToken say while
// the user has "Use Blockscout" off. Their history comes from Blockscout alone.
// the user has "Use Blockscout" off: the history comes from Blockscout alone.
const HISTORY_OFF_TEXT =
'No transaction history is shown, because "Use Blockscout" is off in Settings.';
@@ -826,7 +796,6 @@ module.exports = {
unknownableAmount,
nativeCurrency,
tokenSourcesByChainId,
tokenLookupOffHtml,
tokenLabel,
formatFee,
addressDotHtml,
+2 -1
View File
@@ -197,6 +197,7 @@ async function loadHomeTxs(ctx) {
fetchRecentTransactions(
addr,
state.blockscoutUrl,
state.useBlockscout,
currentNetwork().chainId,
),
);
@@ -454,7 +455,7 @@ function init(ctx) {
}
$("send-to").value = "";
$("send-amount").value = "";
$("send-token-dropdown").classList.remove("hidden");
$("send-token").classList.remove("hidden");
$("send-token-static").classList.add("hidden");
renderSendTokenSelect(addr);
updateSendBalance();
+7 -12
View File
@@ -10,7 +10,6 @@ const {
renderAddressHtml,
attachCopyHandlers,
goBack,
tokenSourcesByChainId,
} = require("./helpers");
const { state, currentAddress } = require("../../shared/state");
let ctx;
@@ -142,8 +141,6 @@ function updateToValidation() {
}
function renderSendTokenSelect(addr) {
// Tokens the user has not tracked are Blockscout's to report.
$("send-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
const sel = $("send-token");
sel.innerHTML = `<option value="ETH">${escapeHtml(nativeCurrency())}</option>`;
const fraudSet = new Set(
@@ -188,9 +185,7 @@ function renderSendTokenSelect(addr) {
// so the transfer is encoded with the number the user read rather than with
// whatever the contract answers at signing time (see
// src/shared/transferAmount.js). balances.js is formatting one explorer row at
// fetch time and cannot consult a state it is in the middle of replacing. As on
// the approval screens, tokenSourcesByChainId() gives the wallets only while
// "Use Blockscout" is on.
// fetch time and cannot consult a state it is in the middle of replacing.
//
// The two resolutions can therefore differ, and where they do, the stored
// `balance` is a quantity computed at a scale this screen has just declined to
@@ -203,7 +198,10 @@ function tokenBalanceAndDecimals(addr, token) {
const tb = (addr.tokenBalances || []).find(
(t) => t.address.toLowerCase() === token.toLowerCase(),
);
const tokenDecimals = resolveTokenDecimals(token, tokenSourcesByChainId());
const tokenDecimals = resolveTokenDecimals(token, {
trackedTokens: state.trackedTokens,
wallets: state.wallets,
});
if (!tb) return { tokenBalance: "0", tokenDecimals };
if (tokenDecimals === null) return { tokenBalance: null, tokenDecimals };
return { tokenBalance: tb.balance ?? null, tokenDecimals };
@@ -403,11 +401,8 @@ function init(_ctx) {
try {
const provider = getProvider(state.rpcUrl, state.networkId);
const resolved = await provider.resolveName(to);
// getProvider() does not look up a name resolved off-chain,
// so such a name comes back with no address too. The message
// covers both, in the one line the flash area shows.
if (!resolved) {
showFlash("That ENS name has no on-chain address.");
showFlash("That ENS name has no address.");
return;
}
resolvedTo = resolved;
@@ -431,7 +426,7 @@ function init(_ctx) {
});
$("btn-send-back").addEventListener("click", () => {
$("send-token-dropdown").classList.remove("hidden");
$("send-token").classList.remove("hidden");
$("send-token-static").classList.add("hidden");
goBack();
});
+25 -54
View File
@@ -17,7 +17,6 @@ const {
const { state, saveState, currentNetwork } = require("../../shared/state");
const { onChainSwitch } = require("../../shared/chainSwitch");
const { restorableStack } = require("../../shared/persistedState");
const { dropUntrackedTokens } = require("../../shared/balances");
const { resetRenderedViews, markViewRendered } = require("../viewRouter");
const {
log,
@@ -252,20 +251,16 @@ async function renderSiteLists() {
// A network switch, made by the user here or saved by the background once the
// user approved a site's request (src/popup/index.js), leaves every screen on
// the page showing the previous network. Two functions leave the page as
// README's Screen Map describes:
//
// - cutViewStack(), before the switch is saved, so that save keeps the cut for
// a popup closed straight after
// - showNewSettings(), once `state` holds the new network
// the page showing the previous network. These two leave the page as README's
// Screen Map describes, the first before the switch is saved, so that save
// keeps the cut for a popup closed straight after, the second once `state`
// holds the new network.
//
// The stack is cut at the first screen that cannot be rendered from saved
// state, such as Send or AddToken, and at AddressToken unless it shows the
// native token: any other token there was picked on the previous network, so
// it is no longer selected either. Without a wallet the stack starts at
// Welcome, which that cut would drop, and Welcome shows nothing from a network.
// A change to "Use Blockscout" cuts the stack the same way (setUseBlockscout()
// below).
function cutViewStack() {
if (!state.hasWallet) return;
if (state.selectedToken !== "ETH") {
@@ -278,39 +273,18 @@ function cutViewStack() {
state.viewStack = restorableStack(state.viewStack, state.currentView);
}
// Sets "Use Blockscout" to `on` on this page. It is called inside a save,
// holding the lock, for the user's change here or another page's
// (followStoredSettings() in src/popup/index.js).
//
// Send's token dropdown was filled under the old setting, and Back cannot draw
// Send again. So the stack is cut, as for a network switch. Turning the setting
// off also drops every token the user has not tracked.
function setUseBlockscout(on) {
state.useBlockscout = on;
cutViewStack();
if (!on) dropUntrackedTokens(state.wallets, state.trackedTokens);
}
// Draws the page again after a network switch, or after another page changed
// "Use Blockscout" or "Check recipients on Etherscan". Every screen counts as
// not yet rendered, so "Back" renders the one it lands on under the new
// settings. Settings on top is brought up to date in place; any other screen is
// drawn again as a reopened popup draws it, which is Home for one that cannot
// be rendered from saved state. Without a wallet any other screen is Welcome or
// AddWallet. Back only unhides Welcome, so its two checkboxes are set here.
function showNewSettings() {
// Every screen counts as not yet rendered, so "Back" renders the one it lands
// on for the new network. Settings on top is brought up to date in place;
// any other screen is drawn again as a reopened popup draws it, which is Home
// for one that cannot be rendered from saved state. Without a wallet any other
// screen is Welcome or AddWallet, which show nothing from a network.
function showNewNetwork() {
resetRenderedViews();
$("welcome-use-blockscout").checked = state.useBlockscout;
$("welcome-check-recipients-on-etherscan").checked =
state.checkRecipientsOnEtherscan;
if (state.currentView === "settings") {
markViewRendered("settings");
$("settings-network").value = state.networkId;
$("settings-rpc").value = state.rpcUrl;
$("settings-blockscout").value = state.blockscoutUrl;
$("settings-use-blockscout").checked = state.useBlockscout;
$("settings-check-recipients-on-etherscan").checked =
state.checkRecipientsOnEtherscan;
renderTrackedTokens();
} else if (state.hasWallet) {
ctx.restoreView();
@@ -393,32 +367,30 @@ function init(_ctx) {
showFlash("Saved.");
});
// Each change is made inside the save, holding the lock. Then
// followStoredSettings() in src/popup/index.js never takes this page's
// unsaved change for another page's.
//
// The screens under Settings were drawn under the old setting. So each
// The screens under Settings were drawn under the old setting, so each
// change makes every screen but Settings count as not yet drawn, as a
// network switch does. Back then draws again any screen a reopened popup
// can draw. Back only unhides Welcome, so its boxes are set here too.
// network switch does, and Back draws the one it lands on again. Welcome
// offers the same two settings and is only unhidden on Back, so its boxes
// are set here too.
$("settings-use-blockscout").addEventListener("change", async () => {
const on = $("settings-use-blockscout").checked;
await saveState(() => setUseBlockscout(on));
$("welcome-use-blockscout").checked = on;
state.useBlockscout = $("settings-use-blockscout").checked;
$("welcome-use-blockscout").checked = state.useBlockscout;
resetRenderedViews();
markViewRendered("settings");
await saveState();
});
$("settings-check-recipients-on-etherscan").addEventListener(
"change",
async () => {
const on = $("settings-check-recipients-on-etherscan").checked;
await saveState(() => {
state.checkRecipientsOnEtherscan = on;
});
$("welcome-check-recipients-on-etherscan").checked = on;
state.checkRecipientsOnEtherscan = $(
"settings-check-recipients-on-etherscan",
).checked;
$("welcome-check-recipients-on-etherscan").checked =
state.checkRecipientsOnEtherscan;
resetRenderedViews();
markViewRendered("settings");
await saveState();
},
);
@@ -435,7 +407,7 @@ function init(_ctx) {
// Open pages are told by the background, as after a site's approved
// switch request.
notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
showNewSettings();
showNewNetwork();
showFlash("Switched to " + net.name + ".");
});
@@ -575,6 +547,5 @@ module.exports = {
show,
renderSiteLists,
cutViewStack,
setUseBlockscout,
showNewSettings,
showNewNetwork,
};
+4 -7
View File
@@ -26,7 +26,6 @@ const { state } = require("../../shared/state");
const { nativeCurrencyByChainId } = require("../../shared/networks");
const { formatEther, formatUnits } = require("ethers");
const { log, debugFetch } = require("../../shared/log");
const { storedSettingIsOn } = require("../../shared/storedSettings");
const { decodeCalldata } = require("./approval");
/**
@@ -309,12 +308,11 @@ function populateOnChainDetails(txData, chainId) {
}
}
// Reads the block, network details and calldata from Blockscout, and decodes
// the calldata. While the stored "Use Blockscout" is off, Blockscout is not
// asked, and an answer that lands after it went off is dropped
// (src/shared/storedSettings.js). Either way none of them is shown.
// The block, network details, calldata and its decoding, from Blockscout. While
// the user has "Use Blockscout" off, Blockscout is not asked and none of them
// is shown.
async function loadFullTxDetails(txHash, chainId) {
if (!(await storedSettingIsOn("useBlockscout"))) return;
if (!state.useBlockscout) return;
const section = $("tx-detail-calldata-section");
const actionEl = $("tx-detail-calldata-action");
const detailsEl = $("tx-detail-calldata-details");
@@ -330,7 +328,6 @@ async function loadFullTxDetails(txHash, chainId) {
);
if (!resp.ok) return;
const txData = await resp.json();
if (!(await storedSettingIsOn("useBlockscout"))) return;
// Populate on-chain detail fields (block, nonce, gas, fee)
populateOnChainDetails(txData, chainId);
-8
View File
@@ -14,7 +14,6 @@ const {
displaySymbol,
clearViewStack,
tokenLabel,
tokenLookupOffHtml,
reviewedNetworkProvider,
} = require("./helpers");
const { state } = require("../../shared/state");
@@ -109,10 +108,6 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
}
$("wait-tx-summary").textContent =
txInfo.amount + (symbol ? " " + symbol : "");
$("wait-tx-token-note").innerHTML = tokenLookupOffHtml(
txInfo.token,
txInfo.chainId,
);
$("wait-tx-to").innerHTML = toAddressHtml(txInfo.to, txInfo.chainId);
$("wait-tx-hash").innerHTML = txHashHtml(txHash, txInfo.chainId);
attachCopyHandlers("view-wait-tx");
@@ -287,7 +282,6 @@ function decodedDetailsHtml(decoded, chainId) {
if (d.isToken) {
const sym = tokenLabel(d.address, chainId) || "Unknown token";
html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
html += tokenLookupOffHtml(d.address, chainId);
html += toAddressHtml(d.address, chainId);
} else {
html += toAddressHtml(d.address, chainId);
@@ -351,7 +345,6 @@ function showError(txInfo, txHash, message) {
state.viewData = {
amount: txInfo.amount,
symbol: symbol,
token: txInfo.token,
to: txInfo.to,
hash: txHash || null,
message: message,
@@ -365,7 +358,6 @@ function renderError() {
if (!d || !d.message) return;
$("error-tx-summary").textContent =
d.amount + (d.symbol ? " " + d.symbol : "");
$("error-tx-token-note").innerHTML = tokenLookupOffHtml(d.token, d.chainId);
$("error-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
$("error-tx-message").textContent = d.message;
+9 -12
View File
@@ -1,6 +1,6 @@
// The first screen, shown while there is no wallet. It offers "Use Blockscout"
// and "Check recipients on Etherscan", which Settings offers too. Both are off
// until the user ticks them.
// The first screen, shown while there is no wallet. It offers the two lookups
// at services other than the RPC endpoint, both off until the user ticks them,
// which Settings offers as well.
const { $, showView } = require("./helpers");
const { state, saveState } = require("../../shared/state");
@@ -12,24 +12,21 @@ function show() {
showView("welcome");
}
// Each change is made inside the save, holding the lock, as Settings makes it.
function init(ctx) {
$("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
$("welcome-use-blockscout").addEventListener("change", async () => {
const on = $("welcome-use-blockscout").checked;
await saveState(() => {
state.useBlockscout = on;
});
state.useBlockscout = $("welcome-use-blockscout").checked;
await saveState();
});
$("welcome-check-recipients-on-etherscan").addEventListener(
"change",
async () => {
const on = $("welcome-check-recipients-on-etherscan").checked;
await saveState(() => {
state.checkRecipientsOnEtherscan = on;
});
state.checkRecipientsOnEtherscan = $(
"welcome-check-recipients-on-etherscan",
).checked;
await saveState();
},
);
}
+3
View File
@@ -60,6 +60,8 @@ function getLocalWarnings(address, options = {}) {
* @param {string} [options.fromAddress] - Sender address (for self-send check).
* @param {string} [options.chainId] - Chain id of the network whose explorer
* the Etherscan label check asks; the active network's when omitted.
* @param {boolean} [options.checkRecipientsOnEtherscan] - The user's setting
* of that name. The Etherscan label check is made only while it is on.
* @returns {Promise<Array<{type: string, message: string, severity: string}>>}
*/
async function getFullWarnings(address, provider, options = {}) {
@@ -114,6 +116,7 @@ async function getFullWarnings(address, provider, options = {}) {
try {
const etherscanWarning = await checkEtherscanLabel(
address,
options.checkRecipientsOnEtherscan,
options.chainId,
);
if (etherscanWarning) {
+23 -41
View File
@@ -1,10 +1,7 @@
// Balance fetching:
//
// - ETH balances, and the balances of the tokens the user tracks, via RPC
// - the other ERC-20 token balances and the holder counts via Blockscout,
// while the user has "Use Blockscout" on. Those balances are dropped when
// it is off.
// - ENS reverse lookup via RPC
// Balance fetching: ETH balances and the balances of the tokens the user
// tracks via RPC, the other ERC-20 token balances and the holder counts via
// Blockscout while the user has "Use Blockscout" on, ENS reverse lookup via
// RPC.
const {
JsonRpcProvider,
@@ -22,7 +19,6 @@ const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
const { isSpoofedSymbol } = require("./symbolSpoof");
const { toDecimals } = require("./transferAmount");
const { resolveTokenDecimals } = require("./approvalAmount");
const { storedSettingIsOn } = require("./storedSettings");
// Use a static network to skip auto-detection (which can fail and cause
// "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -43,12 +39,12 @@ const { storedSettingIsOn } = require("./storedSettings");
// is a caller bug and must not resolve to a working provider for some other
// chain.
//
// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. A resolver can
// say a name is resolved off-chain and give a web address for it. By default
// ethers then fetches that address straight from the browser, sending the name
// being looked up. For the reverse lookup of the user's addresses, that is the
// user's own name (https://git.eeqj.de/sneak/AutistMask/issues/668). With the
// flag set, such a name does not resolve.
// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. Left on, as
// ethers has it, a resolver that says a name is resolved off-chain makes ethers
// fetch the web address the resolver gives, straight from the browser, with the
// name being looked up; for the reverse lookup of the user's addresses that is
// the user's own name (https://git.eeqj.de/sneak/AutistMask/issues/668). Such a
// name does not resolve.
function getProvider(rpcUrl, networkId) {
const net = Network.from(requireNetworkId(networkId).id);
const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
@@ -96,10 +92,9 @@ function rawUnits(value) {
// Fetch token balances for a single address from Blockscout.
// Returns [{ address, name, symbol, decimals, balance, holders }].
//
// While the stored "Use Blockscout" is off, Blockscout is not asked, and an
// answer that lands after it went off is dropped (src/shared/storedSettings.js).
// Either way the answer is an empty list, so no token the user has not tracked
// is listed.
// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
// Blockscout is not asked and the answer is an empty list: no token the user
// has not tracked is listed.
//
// Filters out spam: only shows tokens that are in the known token list,
// explicitly tracked by the user, or have >= 1000 holders. A tracked token's
@@ -116,10 +111,11 @@ function rawUnits(value) {
async function fetchTokenBalances(
address,
blockscoutUrl,
useBlockscout,
trackedTokens,
signal,
) {
if (!(await storedSettingIsOn("useBlockscout"))) return [];
if (!useBlockscout) return [];
try {
const resp = await debugFetch(
blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -129,7 +125,6 @@ async function fetchTokenBalances(
return null;
}
const items = await resp.json();
if (!(await storedSettingIsOn("useBlockscout"))) return [];
if (!Array.isArray(items)) return null;
const trackedSet = new Set(
@@ -318,12 +313,13 @@ async function fetchTrackedTokenBalances(
}
// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
// `trackedTokens` are the tokens tracked on the active network. `signal` is as
// for fetchTokenBalances().
// `trackedTokens` are the tokens tracked on the active network.
// `useBlockscout` and `signal` are as for fetchTokenBalances().
async function refreshBalances(
wallets,
rpcUrl,
blockscoutUrl,
useBlockscout,
trackedTokens,
networkId,
signal,
@@ -384,14 +380,15 @@ async function refreshBalances(
// ERC-20 token balances: the tracked tokens' through the RPC
// endpoint, and from Blockscout the tokens the user has not
// tracked. When Blockscout fails, the untracked rows from before
// this refresh stay. While "Use Blockscout" is off, there are no
// untracked rows. The Blockscout request is started first and
// handed to fetchTrackedTokenBalances() too, which waits for it
// after sending its balanceOf reads, so the two run side by side.
// this refresh stay; while "Use Blockscout" is off there are none.
// The Blockscout request is started first and handed to
// fetchTrackedTokenBalances() too, which waits for it after
// sending its balanceOf reads, so the two run side by side.
const previous = addr.tokenBalances || [];
const explorerRequest = fetchTokenBalances(
addr.address,
blockscoutUrl,
useBlockscout,
tracked,
signal,
);
@@ -427,20 +424,6 @@ async function refreshBalances(
log.debugf("refreshBalances done");
}
// Drops the balance of each token not in `trackedTokens` from every address.
// Callers run it while "Use Blockscout" is off, since only Blockscout reports
// those tokens.
function dropUntrackedTokens(wallets, trackedTokens) {
const tracked = new Set(trackedTokens.map((t) => t.address.toLowerCase()));
for (const wallet of wallets) {
for (const addr of wallet.addresses || []) {
addr.tokenBalances = (addr.tokenBalances || []).filter((row) =>
tracked.has(String(row.address).toLowerCase()),
);
}
}
}
// Look up token metadata from its contract.
// Calls symbol() and decimals() to verify it implements ERC-20.
// `signal` is as for fetchTokenBalances().
@@ -559,7 +542,6 @@ async function scanForAddresses(xpub, rpcUrl, networkId, signal, gapLimit = 5) {
module.exports = {
fetchTokenBalances,
refreshBalances,
dropUntrackedTokens,
lookupTokenInfo,
getProvider,
scanForAddresses,
+2 -2
View File
@@ -4,7 +4,7 @@
//
// - onChainSwitch() below makes the switch the user picks in Settings, with
// applyChainSwitchFields() (chainSwitchFields.js).
// - followStoredSettings() in src/popup/index.js takes a switch the background
// - followNetworkSwitch() in src/popup/index.js takes a switch the background
// or another popup page saved, from the stored record, with
// takeStoredNetwork() (state.js), which copies it with
// copyChainSwitchFields() (chainSwitchFields.js).
@@ -45,7 +45,7 @@ function clearPopupCaches() {
//
// `state` is switched inside the save that stores the switch, holding the
// lock, so it is never switched while a follow of a switch saved elsewhere
// waits for the lock (followStoredSettings() in src/popup/index.js): that
// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
// follow runs first, and this switch is made after it.
async function onChainSwitch(newNetworkId) {
const { state, saveState } = require("./state");
+9 -11
View File
@@ -3,7 +3,6 @@
// This is a best-effort enrichment: network failures return null silently.
const { networkByChainId } = require("./networks");
const { storedSettingIsOn } = require("./storedSettings");
// Patterns in the page title that indicate a flagged address.
// Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
@@ -79,19 +78,21 @@ function parseEtherscanPage(html) {
* when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
* Sepolia.
*
* While the stored "Check recipients on Etherscan" is off, Etherscan is not
* asked, and an answer that lands after it went off is dropped
* (src/shared/storedSettings.js). Either way the answer is null.
* While the user's "Check recipients on Etherscan" setting is off, Etherscan
* is not asked and the answer is null.
*
* @param {string} address - Ethereum address to check.
* @param {boolean} checkRecipientsOnEtherscan - The user's setting.
* @param {string} [chainId] - Chain id of the network to look it up on.
* @returns {Promise<{type: string, message: string, severity: string}|null>}
*/
async function checkEtherscanLabel(address, chainId) {
async function checkEtherscanLabel(
address,
checkRecipientsOnEtherscan,
chainId,
) {
if (!checkRecipientsOnEtherscan) return null;
try {
if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
return null;
}
// Lazy require to avoid pulling in chrome.storage at module scope
// (which breaks unit tests that only exercise parseEtherscanPage).
const { currentNetwork } = require("./state");
@@ -102,9 +103,6 @@ async function checkEtherscanLabel(address, chainId) {
});
if (!resp.ok) return null;
const html = await resp.text();
if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
return null;
}
const result = parseEtherscanPage(html);
if (result.isPhishing) {
return {
+10 -10
View File
@@ -48,12 +48,10 @@ const DEFAULT_STATE = {
hideDustTransactions: true,
dustThresholdGwei: 100000,
utcTimestamps: false,
// "Use Blockscout" and "Check recipients on Etherscan" in Settings. Each
// setting applies to every network. Both are off until the user turns them
// on. With "Use Blockscout" on, Blockscout is sent the user's addresses and
// the hash of each transaction opened. With "Check recipients on
// Etherscan" on, Etherscan is sent the recipient's address and nothing
// else.
// "Use Blockscout" and "Check recipients on Etherscan" in Settings, one
// setting each for every network. Both off until the user turns them on:
// the requests they allow send the user's addresses to a service other
// than the RPC endpoint.
useBlockscout: false,
checkRecipientsOnEtherscan: false,
fraudContracts: [],
@@ -414,10 +412,12 @@ function normalizePersisted(saved) {
: 100000;
out.utcTimestamps =
saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
// Anything but true is off: each setting lets a request reach another
// service.
out.useBlockscout = saved.useBlockscout === true;
out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true;
out.useBlockscout =
saved.useBlockscout !== undefined ? saved.useBlockscout : false;
out.checkRecipientsOnEtherscan =
saved.checkRecipientsOnEtherscan !== undefined
? saved.checkRecipientsOnEtherscan
: false;
// A list of contract addresses, floored the same way: send.js builds its
// fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
// and filterTransactions() maps the same list through normalizeAddress(),
+3 -4
View File
@@ -470,9 +470,8 @@ function mergeNetworkEndpoints(base, ours, theirs) {
// (caught by tests/txStatus.test.js). A page's live picture of a field it
// does not own goes on being whatever its last loadState() saw, same as
// before this fix; only the persisted record is guaranteed current. The
// network, "Use Blockscout" and "Check recipients on Etherscan" are the
// exceptions: the popup takes a change another context saved through
// `beforeWrite` (followStoredSettings() in src/popup/index.js).
// network is the exception: the popup takes a switch another context saved
// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
async function saveStateOnce(beforeWrite) {
const result = await storageGet("autistmask");
// The record in storage right now is about to be merged into and written
@@ -604,7 +603,7 @@ function saveState(beforeWrite) {
}
// Give this page the network switch held by `stored`, a record a save of this
// page has just read (followStoredSettings() in src/popup/index.js calls this
// page has just read (followNetworkSwitch() in src/popup/index.js calls this
// from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
// with a whole record. The switch is then not this page's own change, even when
// that save fails to write: a later switch back to the previous network still
-24
View File
@@ -1,24 +0,0 @@
// Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
// profile.
//
// A request that either setting gates reads it here twice: before it asks, and
// again when the answer lands. While the setting is off, nothing is asked, and
// an answer that lands is dropped. A page's own copy of the setting is not
// used, because another page may have just changed it.
const { storageGet } = require("./browserApi");
const { normalizePersisted } = require("./persistedState");
// Whether `name`, "useBlockscout" or "checkRecipientsOnEtherscan", is on in the
// stored profile. The profile is read through normalizePersisted(), as a load
// reads it, so only a stored true is on. A failed read counts as off.
async function storedSettingIsOn(name) {
try {
const { autistmask } = await storageGet("autistmask");
return normalizePersisted(autistmask)[name];
} catch {
return false;
}
}
module.exports = { storedSettingIsOn };
+5 -6
View File
@@ -21,7 +21,6 @@ const { toDecimals } = require("./transferAmount");
// detail view is the authoritative record and already shows exact precision.
const { truncateAmount: formatTxValue } = require("./amountDisplay");
const { routerRelease } = require("./uniswap");
const { storedSettingIsOn } = require("./storedSettings");
// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
// over the address, not part of its identity. Every address comparison in
@@ -237,16 +236,17 @@ function mergeTransactions(txs, tokenTransfers) {
// carries it, and a native entry is labelled with that network's
// `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
//
// While the stored "Use Blockscout" is off, Blockscout is not asked, and an
// answer that lands after it went off is dropped (src/shared/storedSettings.js).
// Either way the answer is an empty list.
// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
// Blockscout is not asked and there is no history: the answer is an empty
// list.
async function fetchRecentTransactions(
address,
blockscoutUrl,
useBlockscout,
chainId,
count = 25,
) {
if (!(await storedSettingIsOn("useBlockscout"))) return [];
if (!useBlockscout) return [];
log.debugf("fetchRecentTransactions", address);
const addrLower = normalizeAddress(address);
@@ -277,7 +277,6 @@ async function fetchRecentTransactions(
const txJson = txResp.ok ? await txResp.json() : {};
const ttJson = ttResp.ok ? await ttResp.json() : {};
if (!(await storedSettingIsOn("useBlockscout"))) return [];
const txs = mergeTransactions(
(txJson.items || []).map((tx) => parseTx(tx, addrLower, chainId)),
-2
View File
@@ -41,8 +41,6 @@ jest.mock("../src/shared/balances", () => ({
refreshBalances: jest.fn(async () => {
mockBalanceRefreshAt.push(Date.now());
}),
dropUntrackedTokens: jest.requireActual("../src/shared/balances")
.dropUntrackedTokens,
getProvider: jest.fn(() => ({})),
}));
-3
View File
@@ -84,9 +84,6 @@ function walletsHolding(token, decimals) {
beforeEach(() => {
state.trackedTokens = [];
state.wallets = [];
// The approval screen reads the explorer's report only while "Use
// Blockscout" is on.
state.useBlockscout = true;
});
describe("resolveTokenDecimals", () => {
-262
View File
@@ -1,262 +0,0 @@
// While "Use Blockscout" is off, the approval screens and the screens after
// TxApproval name a token, and scale its amount, from the bundled list and the
// tracked tokens alone (https://git.eeqj.de/sneak/AutistMask/issues/668). A
// token they lack gets a line saying it was not looked up on Blockscout. While
// the setting is on, what Blockscout reported for a token the user holds names
// and scales it, as before.
//
// Booted through the real popup entry point, as the approval window or as a
// popup reopened onto SuccessTx. The vault is mocked so that no password has to
// be hashed: the stored secret decrypts to the test key below.
jest.mock("../src/shared/vault", () => ({
decryptWithPassword: jest.fn(),
encryptWithPassword: jest.fn(),
}));
const { Interface, Wallet } = require("ethers");
const {
bootPopup,
cleanupPopup,
unversionedValidProfile,
} = require("./support/popupBoot");
// A published test key, never used for real funds.
const SIGNER_KEY =
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
const signer = new Wallet(SIGNER_KEY);
const ORIGIN = "https://dapp.example";
const RECIPIENT = "0x2222222222222222222222222222222222222222";
const TX_HASH = "0x" + "ab".repeat(32);
// Outside the bundled list, and not tracked.
const TOKEN = "0xE2E0000000000000000000000000000000000E2e";
// In the bundled list, at 6 decimals.
const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
const LINE =
'This token was not looked up on Blockscout, because "Use Blockscout" is off in Settings.';
// TOKEN as Blockscout reports the user's holding of it.
const TOKEN_ROW = {
address: TOKEN,
name: "Novel",
symbol: "NOVEL",
decimals: "6",
balance: "5000.0",
holders: 5000,
};
// A transfer of 5,000 of a 6-decimal token to RECIPIENT.
const TRANSFER_DATA = new Interface([
"function transfer(address to, uint256 amount)",
]).encodeFunctionData("transfer", [RECIPIENT, 5000000000n]);
// An EIP-2612 permit letting RECIPIENT take 5,000 of TOKEN.
const PERMIT = {
types: {
EIP712Domain: [
{ name: "name", type: "string" },
{ name: "chainId", type: "uint256" },
{ name: "verifyingContract", type: "address" },
],
Permit: [
{ name: "owner", type: "address" },
{ name: "spender", type: "address" },
{ name: "value", type: "uint256" },
{ name: "nonce", type: "uint256" },
{ name: "deadline", type: "uint256" },
],
},
primaryType: "Permit",
domain: { name: "Novel", chainId: 1, verifyingContract: TOKEN },
message: {
owner: signer.address,
spender: RECIPIENT,
value: "5000000000",
nonce: "0",
deadline: "1790000000",
},
};
// The stored profile: the user's one address holds `tokenBalances`.
function profile(useBlockscout, tokenBalances, extra) {
return unversionedValidProfile({
useBlockscout,
wallets: [
{
type: "key",
name: "Wallet 1",
encryptedSecret: "encrypted-key",
addresses: [
{
address: signer.address,
balance: "1.0",
tokenBalances,
},
],
},
],
activeAddress: signer.address,
allowedSites: { [signer.address]: [ORIGIN] },
...extra,
});
}
// The approval window for the site's request: a transfer sent to `token`, or
// with `signParams`, a signature. The background answers the signed
// transaction with `txResponse`.
function bootApproval(stored, { token = TOKEN, signParams, txResponse } = {}) {
return bootPopup(stored, {
search: "?approval=approval-1",
runtime: {
connect: () => ({ postMessage: () => {} }),
sendMessage: (msg, reply) => {
if (msg.type === "AUTISTMASK_GET_APPROVAL") {
reply({
type: signParams ? "sign" : "tx",
origin: ORIGIN,
isPhishingDomain: false,
approvedFrom: signer.address,
signParams,
approvedTx: {
type: 2,
from: signer.address,
chainId: "0x1",
nonce: "0x7",
gasLimit: "0x30d40",
maxPriorityFeePerGas: "0x3b9aca00",
maxFeePerGas: "0x77359400",
to: token,
value: "0x0",
data: TRANSFER_DATA,
accessList: [],
},
});
} else if (msg.type === "AUTISTMASK_TX_RESPONSE") {
reply(txResponse);
} else {
reply(undefined);
}
},
},
});
}
beforeEach(() => {
// The page logs its failed RPC reads; the stub node in popupBoot.js
// answers none.
jest.spyOn(console, "error").mockImplementation(() => {});
});
afterEach(() => {
cleanupPopup();
jest.restoreAllMocks();
});
describe("TxApproval", () => {
test("says a token it cannot name was not looked up on Blockscout while Use Blockscout is off", async () => {
const page = await bootApproval(profile(false, []));
const details = page.node("approve-tx-decoded-details").innerHTML;
expect(details).toContain("Unknown token");
expect(details).toContain(LINE);
expect(details).toContain("5000000000 base units (decimals unknown)");
cleanupPopup();
// The bundled list names USDC, so there is nothing to say.
const bundled = await bootApproval(profile(false, []), {
token: USDC,
});
expect(
bundled.node("approve-tx-decoded-details").innerHTML,
).not.toContain(LINE);
cleanupPopup();
const on = await bootApproval(profile(true, [TOKEN_ROW]));
const named = on.node("approve-tx-decoded-details").innerHTML;
expect(named).toContain("5000.0000 NOVEL");
expect(named).not.toContain(LINE);
});
test("names nothing from a Blockscout entry still in the balances while Use Blockscout is off", async () => {
const page = await bootApproval(profile(false, [TOKEN_ROW]));
const details = page.node("approve-tx-decoded-details").innerHTML;
expect(details).not.toContain("NOVEL");
expect(details).toContain("Unknown token");
expect(details).toContain(LINE);
});
test.each([
["WaitTx", { txHash: TX_HASH }, "wait-tx"],
[
"ErrorTx",
{ error: "The transaction could not be sent.", retryable: false },
"error-tx",
],
])(
"%s after it says so under the amount while Use Blockscout is off",
async (_name, txResponse, view) => {
const page = await bootApproval(profile(false, []), {
txResponse,
});
const { decryptWithPassword } = require("../src/shared/vault");
decryptWithPassword.mockResolvedValue(SIGNER_KEY);
page.node("approve-tx-password").value = "any password";
await page.click("btn-approve-tx");
expect(page.visibleViews()).toEqual([view]);
expect(page.node(view + "-token-note").innerHTML).toBe(
`<div class="text-xs text-muted">${LINE}</div>`,
);
},
);
});
test("SuccessTx says so under the decoded token while Use Blockscout is off", async () => {
const page = await bootPopup(
profile(false, [], {
currentView: "success-tx",
viewStack: ["main"],
viewData: {
amount: "5000000000 base units (decimals unknown)",
symbol: "?",
to: RECIPIENT,
hash: TX_HASH,
blockNumber: 21000000,
chainId: "0x1",
decoded: {
name: "Token Transfer",
description: "Transfer ERC-20 token",
details: [
{
label: "Token",
value: TOKEN,
address: TOKEN,
isToken: true,
},
],
},
},
}),
);
expect(page.visibleViews()).toEqual(["success-tx"]);
const decoded = page.node("success-tx-decoded").innerHTML;
expect(decoded).toContain("Unknown token");
expect(decoded).toContain(LINE);
});
test("SignApproval says so under a permit's token while Use Blockscout is off", async () => {
const signParams = {
method: "eth_signTypedData_v4",
typedData: JSON.stringify(PERMIT),
from: signer.address,
};
const page = await bootApproval(profile(false, []), { signParams });
const message = page.node("approve-sign-message").innerHTML;
expect(message).toContain("Unknown token");
expect(message).toContain(LINE);
cleanupPopup();
const on = await bootApproval(profile(true, [TOKEN_ROW]), { signParams });
const named = on.node("approve-sign-message").innerHTML;
expect(named).toContain("5000.0000 NOVEL");
expect(named).not.toContain(LINE);
});
+8 -54
View File
@@ -142,8 +142,6 @@ function loadWorker(networkId, opts) {
},
refreshBalances:
options.refreshBalances || jest.fn(async () => undefined),
dropUntrackedTokens: jest.requireActual("../src/shared/balances")
.dropUntrackedTokens,
}));
jest.doMock("../src/shared/phishingDomains", () => ({
isPhishingDomain: () => false,
@@ -412,7 +410,14 @@ describe("a balance refresh under a network switch", () => {
const ranOn = [];
const bg = loadWorker("sepolia", {
refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
refreshBalances: async (
wallets,
rpcUrl,
explorer,
useBlockscout,
tokens,
id,
) => {
ranOn.push(id);
reachedNetwork.resolve();
await roundTrip.promise;
@@ -445,54 +450,3 @@ describe("a balance refresh under a network switch", () => {
);
});
});
describe("a balance refresh under a change of Use Blockscout", () => {
// Turning "Use Blockscout" off drops the tokens the user has not tracked
// (src/popup/views/settings.js). Blockscout may have answered a refresh
// just before. That refresh still saves its balances when it returns, but
// not those tokens. The same refresh in the popup is in
// tests/blockscoutEtherscanSettings.test.js.
test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
const roundTrip = deferred();
const started = deferred();
const bg = loadWorker("mainnet", {
refreshBalances: async (wallets) => {
started.resolve();
await roundTrip.promise;
wallets[0].addresses[0].balance = "7.0";
wallets[0].addresses[0].tokenBalances = [
{
address: "0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
name: "Test Token",
symbol: "TST",
decimals: 18,
balance: "5.0",
holders: 50000,
},
];
},
});
global.chrome.storage.write("autistmask", {
...bg.persisted(),
useBlockscout: true,
});
const refresh = bg.fireBalanceAlarm();
await started.promise;
// The user unticks "Use Blockscout" in Settings while the round trip
// is out.
global.chrome.storage.write("autistmask", {
...bg.persisted(),
useBlockscout: false,
});
roundTrip.resolve();
await refresh;
const after = bg.persisted();
expect(after.wallets[0].addresses[0].balance).toBe("7.0");
expect(after.wallets[0].addresses[0].tokenBalances).toEqual([]);
});
});
+1 -6
View File
@@ -24,12 +24,6 @@ const TRACKED = {
decimals: 6,
};
// Blockscout is asked only while the stored "Use Blockscout" is on.
const { makeStorageStub } = require("./support/storageStub");
globalThis.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
};
const realFetch = globalThis.fetch;
let logged;
@@ -60,6 +54,7 @@ function refresh(signal) {
wallets,
RPC_URL,
EXPLORER_URL,
true,
[TRACKED],
"mainnet",
signal,
+1 -1
View File
@@ -91,7 +91,7 @@ test("a refresh that returns after a switch in Settings writes nothing, and the
await page.tick();
expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
0,
);
+120 -491
View File
@@ -1,23 +1,16 @@
// Blockscout and Etherscan are sent none of the user's data until the user
// turns them on (https://git.eeqj.de/sneak/AutistMask/issues/668). A new
// profile has "Use Blockscout" and "Check recipients on Etherscan" both off.
// While a setting is off, the code that would ask its service asks nothing.
//
// The one request made with the setting off is the check behind "Save" beside
// the Blockscout URL in Settings. It asks that URL only for `/stats` and sends
// none of the user's data.
//
// A request that either setting gates reads the stored setting, not the page's
// copy, before it asks and again when the answer lands. So a change another
// page saved applies to it at once. An open page also takes such a change and
// draws its screens again.
//
// Only Blockscout reports the tokens the user has not tracked. While "Use
// Blockscout" is off, no address keeps them and no screen lists them.
// Each request to either service is skipped where it is made while its setting
// is off, and made while it is on; the popup and the background hand the
// stored setting to the code that makes the request. The one exception is the
// endpoint check Settings makes when the user presses "Save" beside the
// Blockscout URL. It asks only for `/stats` and carries no user data; it is
// made whether or not the setting is on.
//
// The functions that make the requests are driven directly, against a fetch()
// that records every URL it is asked for. The screens are driven through the
// real popup over a stored profile (tests/support/popupBoot.js). Its fetch()
// real popup over a stored profile (tests/support/popupBoot.js), whose fetch()
// stub records the same way.
"use strict";
@@ -28,7 +21,6 @@ const {
cleanupPopup,
unversionedValidProfile,
ADDRESS,
TOKEN_ADDRESS,
} = require("./support/popupBoot");
const { makeStorageStub } = require("./support/storageStub");
const {
@@ -41,7 +33,6 @@ const {
} = require("../src/shared/balances");
const { fetchRecentTransactions } = require("../src/shared/transactions");
const { getFullWarnings } = require("../src/shared/addressWarnings");
const { checkEtherscanLabel } = require("../src/shared/etherscanLabels");
const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
const RPC_URL = "https://rpc.example.invalid";
@@ -63,25 +54,6 @@ const USDC_ROW = {
},
};
// A transfer of 1 ETH from RECIPIENT to ADDRESS, as Blockscout lists it in
// ADDRESS's history.
const HISTORY_ITEM = {
hash: TX_HASH,
block_number: 21000000,
timestamp: "2026-02-27T12:00:00.000Z",
from: { hash: RECIPIENT },
to: { hash: ADDRESS, is_contract: false },
value: "1000000000000000000",
method: null,
status: "ok",
};
// Etherscan's page for RECIPIENT, which labels it a phishing address.
const PHISHING_PAGE =
"<html><head><title>Fake_Phishing1 | Address: " +
RECIPIENT +
" | Etherscan</title></head><body></body></html>";
const realFetch = globalThis.fetch;
afterEach(() => {
@@ -112,55 +84,33 @@ describe("where each request is made", () => {
// Every URL fetch() was asked for, in order.
let asked;
// What Blockscout and Etherscan answer: USDC among ADDRESS's tokens,
// HISTORY_ITEM in its history, and PHISHING_PAGE for RECIPIENT.
function answer(url) {
return {
ok: true,
status: 200,
json: async () => {
if (url.endsWith("/token-balances")) return [USDC_ROW];
if (url.endsWith("/transactions")) {
return { items: [HISTORY_ITEM] };
}
return { items: [] };
},
text: async () => PHISHING_PAGE,
};
}
async function recordAndAnswer(url) {
asked.push(String(url));
return answer(String(url));
}
beforeEach(() => {
asked = [];
globalThis.fetch = jest.fn(recordAndAnswer);
globalThis.fetch = jest.fn(async (url) => {
asked.push(String(url));
return {
ok: true,
status: 200,
json: async () =>
String(url).endsWith("/token-balances")
? [USDC_ROW]
: { items: [] },
text: async () => "<html><body></body></html>",
};
});
});
afterEach(() => {
globalThis.fetch = realFetch;
delete globalThis.chrome;
});
// Storage holds `profile` as the stored profile, or nothing when it is
// undefined.
function storing(profile) {
globalThis.chrome = {
storage: makeStorageStub(
profile === undefined ? {} : { autistmask: profile },
),
};
}
test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
storing({ useBlockscout: false });
expect(await fetchTokenBalances(ADDRESS, BLOCKSCOUT, [])).toEqual([]);
expect(
await fetchTokenBalances(ADDRESS, BLOCKSCOUT, false, []),
).toEqual([]);
expect(asked).toEqual([]);
storing({ useBlockscout: true });
const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, []);
const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, true, []);
expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
expect(asked).toEqual([
BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
@@ -168,14 +118,12 @@ describe("where each request is made", () => {
});
test("the transaction history is asked for only while Use Blockscout is on", async () => {
storing({ useBlockscout: false });
expect(
await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, false, "0x1"),
).toEqual([]);
expect(asked).toEqual([]);
storing({ useBlockscout: true });
await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1");
await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, true, "0x1");
expect(asked.sort()).toEqual([
BLOCKSCOUT +
"/addresses/" +
@@ -185,84 +133,26 @@ describe("where each request is made", () => {
]);
});
test("the Etherscan label check is made only while the stored profile has Check recipients on Etherscan on", async () => {
test("the Etherscan label check is made only while Check recipients on Etherscan is on", async () => {
const provider = {
getCode: async () => "0x",
getTransactionCount: async () => 1,
getBalance: async () => 0n,
};
const checkWith = async (profile) => {
storing(profile);
await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
};
await checkWith(undefined);
await checkWith({ checkRecipientsOnEtherscan: false });
// Only a stored true is on, as when the profile is loaded.
await checkWith({ checkRecipientsOnEtherscan: "true" });
await checkWith({ checkRecipientsOnEtherscan: 42 });
await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
await getFullWarnings(RECIPIENT, provider, {
chainId: "0x1",
checkRecipientsOnEtherscan: false,
});
expect(asked).toEqual([]);
await checkWith({ checkRecipientsOnEtherscan: true });
await getFullWarnings(RECIPIENT, provider, {
chainId: "0x1",
checkRecipientsOnEtherscan: true,
});
expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
});
// Asks with `setting` on in storage. Once every request is out, storage
// holds `after` for it, as when the user changes it here or on another
// page. Only then does each request get its answer.
async function answeredAfter(setting, after, ask) {
storing({ [setting]: true });
let release;
const held = new Promise((resolve) => {
release = resolve;
});
let requested;
const out = new Promise((resolve) => {
requested = resolve;
});
globalThis.fetch = jest.fn(async (url) => {
requested();
await held;
return recordAndAnswer(url);
});
const result = ask();
await out;
globalThis.chrome.storage.write("autistmask", { [setting]: after });
release();
return result;
}
// Each request, the setting that gates it, how to make it, and its answer
// while that setting is off.
test.each([
[
"Blockscout's token balances",
"useBlockscout",
() => fetchTokenBalances(ADDRESS, BLOCKSCOUT, []),
[],
],
[
"the transaction history",
"useBlockscout",
() => fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
[],
],
[
"the Etherscan label check",
"checkRecipientsOnEtherscan",
() => checkEtherscanLabel(RECIPIENT, "0x1"),
null,
],
])(
"%s keeps an answer that lands while its setting is on, and drops one that lands after it went off",
async (_what, setting, ask, dropped) => {
expect(await answeredAfter(setting, true, ask)).not.toEqual(
dropped,
);
expect(await answeredAfter(setting, false, ask)).toEqual(dropped);
},
);
describe("a balance refresh", () => {
// The RPC endpoint answers every balance with zero, and every other
// call, the ENS reverse lookup's, with no resolver.
@@ -309,11 +199,11 @@ describe("where each request is made", () => {
}
async function refresh(addr, useBlockscout) {
storing({ useBlockscout });
await refreshBalances(
[{ addresses: [addr] }],
RPC_URL,
BLOCKSCOUT,
useBlockscout,
[],
"mainnet",
);
@@ -355,6 +245,29 @@ describe("the popup", () => {
jest.spyOn(console, "error").mockImplementation(() => {});
});
test("hands its balance refresh and Home's history the stored Use Blockscout setting", async () => {
await bootPopup(unversionedValidProfile());
const {
refreshBalances: popupRefresh,
} = require("../src/shared/balances");
const {
fetchRecentTransactions: popupHistory,
} = require("../src/shared/transactions");
expect(popupRefresh.mock.calls[0][3]).toBe(false);
expect(popupHistory.mock.calls[0][2]).toBe(false);
cleanupPopup();
await bootPopup(unversionedValidProfile({ useBlockscout: true }));
const {
refreshBalances: onRefresh,
} = require("../src/shared/balances");
const {
fetchRecentTransactions: onHistory,
} = require("../src/shared/transactions");
expect(onRefresh.mock.calls[0][3]).toBe(true);
expect(onHistory.mock.calls[0][2]).toBe(true);
});
test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
const page = await bootPopup(unversionedValidProfile());
expect(page.node("home-tx-list").innerHTML).toContain(
@@ -415,51 +328,6 @@ describe("the popup", () => {
expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
});
// Another page turns "Use Blockscout" off while TransactionDetail's request
// to Blockscout is out. This page draws TransactionDetail again with its
// line, and only then does Blockscout answer.
test("TransactionDetail shows nothing from an answer that lands after another page turned Use Blockscout off", async () => {
const page = await bootPopup(
onTransactionScreen({ useBlockscout: true }),
);
let release;
const held = new Promise((resolve) => {
release = resolve;
});
globalThis.fetch = jest.fn(async () => {
await held;
return {
ok: true,
status: 200,
json: async () => ({
block_number: 21000000,
fee: { value: "21000000000000" },
raw_input: "0x12345678",
method: "doSomething",
}),
};
});
require("../src/popup/views/transactionDetail").render();
await page.settle();
expect(fetched()).toEqual([BLOCKSCOUT + "/transactions/" + TX_HASH]);
await anotherPageAnnounces(page, { useBlockscout: false });
release();
await page.settle();
expect(page.visibleViews()).toEqual(["transaction"]);
expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
for (const id of [
"tx-detail-block-section",
"tx-detail-network-section",
"tx-detail-calldata-section",
"tx-detail-rawdata-section",
]) {
expect(page.hidden(id)).toBe(true);
}
expect(fetched()).toHaveLength(1);
});
// The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
// reopened popup draws it.
function onConfirmScreen(extra) {
@@ -499,10 +367,10 @@ describe("the popup", () => {
expect(on.hidden("confirm-etherscan-warning")).toBe(false);
});
// Ticks or unticks a checkbox on the page, as the user does.
async function setBox(page, id, checked) {
// Ticks a checkbox on the page, as the user does.
async function tick(page, id) {
const box = page.node(id);
box.checked = checked;
box.checked = true;
for (const fn of box.listeners.change) await fn();
await page.settle();
}
@@ -515,9 +383,9 @@ describe("the popup", () => {
false,
);
await setBox(page, "welcome-use-blockscout", true);
await tick(page, "welcome-use-blockscout");
expect(page.storage.read("autistmask").useBlockscout).toBe(true);
await setBox(page, "welcome-check-recipients-on-etherscan", true);
await tick(page, "welcome-check-recipients-on-etherscan");
expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
true,
);
@@ -531,311 +399,72 @@ describe("the popup", () => {
page.node("settings-check-recipients-on-etherscan").checked,
).toBe(false);
await setBox(page, "settings-use-blockscout", true);
await tick(page, "settings-use-blockscout");
expect(page.storage.read("autistmask").useBlockscout).toBe(true);
await setBox(page, "settings-check-recipients-on-etherscan", true);
await tick(page, "settings-check-recipients-on-etherscan");
expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
true,
);
});
});
// A token the user tracks, and one Blockscout reported that the user has
// not tracked. Both are written in lower case, as the balance rows' and
// the dropdown's token ids are compared below.
const TRACKED = "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
const UNTRACKED = TOKEN_ADDRESS.toLowerCase();
const SECOND_ADDRESS = "0x3333333333333333333333333333333333333333";
describe("the background", () => {
afterEach(() => {
delete globalThis.chrome;
jest.dontMock("../src/shared/balances");
});
function tokenRow(address, symbol) {
return {
address,
name: symbol,
symbol,
decimals: 18,
balance: "5.0",
holders: 50000,
// Starts the background over `profile`, fires its balance alarm, and
// answers with the Use Blockscout setting its refresh was handed.
async function settingTheRefreshIsHanded(profile) {
jest.resetModules();
let handed;
const called = new Promise((resolve) => {
handed = resolve;
});
jest.doMock("../src/shared/balances", () => ({
getProvider: () => ({}),
refreshBalances: async (...args) => handed(args[3]),
}));
let onAlarm = null;
globalThis.chrome = {
storage: makeStorageStub({ autistmask: profile }),
alarms: {
create: () => {},
get: async () => undefined,
clear: async () => false,
onAlarm: {
addListener: (fn) => {
onAlarm = fn;
},
},
},
runtime: {
onMessage: { addListener: () => {} },
onConnect: { addListener: () => {} },
onInstalled: { addListener: () => {} },
onStartup: { addListener: () => {} },
getURL: (p) => "chrome-extension://test/" + p,
lastError: null,
},
windows: { onRemoved: { addListener: () => {} } },
tabs: { query: () => {}, sendMessage: () => {} },
action: { setPopup: () => {} },
};
require("../src/background/index");
const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
onAlarm({ name: BALANCE_REFRESH_ALARM });
return called;
}
// AddressDetail of the first of two addresses, as a reopened popup draws
// it. Both addresses hold the tracked token. While "Use Blockscout" is on,
// both hold the untracked one too.
function onAddressDetail(useBlockscout) {
const profile = unversionedValidProfile({
useBlockscout,
currentView: "address",
viewStack: ["main"],
selectedWallet: 0,
selectedAddress: 0,
trackedTokens: [
{ address: TRACKED, name: "TRK", symbol: "TRK", decimals: 18 },
],
});
const wallet = profile.wallets[0];
wallet.nextIndex = 2;
wallet.addresses.push({ address: SECOND_ADDRESS, balance: "0.0" });
for (const addr of wallet.addresses) {
addr.tokenBalances = useBlockscout
? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
: [tokenRow(TRACKED, "TRK")];
}
return profile;
}
// The token ids of the options created after the first `from` elements.
// The page stub keeps no children, so this is where the options Send's
// dropdown was filled with are read.
function optionsSince(page, from) {
return page.document.created
.slice(from)
.filter((el) => el.tagName === "OPTION")
.map((el) => el.value.toLowerCase());
}
test("unticking Use Blockscout from AddressDetail's gear takes the untracked token off AddressDetail, Send's dropdown and Home on Back", async () => {
const page = await bootPopup(onAddressDetail(true));
expect(page.visibleViews()).toEqual(["address"]);
expect(page.node("address-balances").innerHTML).toContain(UNTRACKED);
await page.click("btn-settings");
await setBox(page, "settings-use-blockscout", false);
const from = page.document.created.length;
await page.click("btn-settings-back");
expect(page.visibleViews()).toEqual(["address"]);
const balances = page.node("address-balances").innerHTML;
expect(balances).toContain(TRACKED);
expect(balances).not.toContain(UNTRACKED);
expect(page.hidden("address-tokens-note")).toBe(false);
expect(optionsSince(page, from)).toEqual([TRACKED]);
await page.click("btn-send");
expect(page.visibleViews()).toEqual(["send"]);
expect(page.hidden("send-token-dropdown")).toBe(false);
expect(page.hidden("send-tokens-note")).toBe(false);
await page.click("btn-send-back");
await page.click("btn-address-back");
expect(page.visibleViews()).toEqual(["main"]);
const home = page.node("wallet-list").innerHTML;
expect(home).toContain(TRACKED);
expect(home).not.toContain(UNTRACKED);
const stored = page.storage.read("autistmask");
for (const addr of stored.wallets[0].addresses) {
expect(
addr.tokenBalances.map((row) => row.address.toLowerCase()),
).toEqual([TRACKED]);
}
});
// Send's dropdown was filled under the old setting, and Back cannot draw
// Send again. So Back lands on the screen under it.
test.each([
["unticking", true],
["ticking", false],
])(
"%s Use Blockscout from Send's gear lands Back on AddressDetail",
async (_how, before) => {
const page = await bootPopup(onAddressDetail(before));
await page.click("btn-send");
expect(page.visibleViews()).toEqual(["send"]);
await page.click("btn-settings");
await setBox(page, "settings-use-blockscout", !before);
await page.click("btn-settings-back");
expect(page.visibleViews()).toEqual(["address"]);
expect(page.hidden("address-tokens-note")).toBe(!before);
},
);
test("Send says under its token dropdown that only tracked tokens are listed while Use Blockscout is off", async () => {
const off = await bootPopup(onAddressDetail(false));
await off.click("btn-send");
expect(off.hidden("send-token-dropdown")).toBe(false);
expect(off.hidden("send-tokens-note")).toBe(false);
cleanupPopup();
const on = await bootPopup(onAddressDetail(true));
await on.click("btn-send");
expect(on.hidden("send-token-dropdown")).toBe(false);
expect(on.hidden("send-tokens-note")).toBe(true);
});
test("Send opened from AddressToken shows neither the dropdown nor its line", async () => {
const page = await bootPopup({
...onAddressDetail(false),
currentView: "address-token",
viewStack: ["main", "address"],
selectedToken: "ETH",
});
expect(page.visibleViews()).toEqual(["address-token"]);
await page.click("btn-address-token-send");
expect(page.visibleViews()).toEqual(["send"]);
expect(page.hidden("send-token-dropdown")).toBe(true);
expect(page.hidden("send-token-static")).toBe(false);
});
test("DeleteAddress says only tracked tokens are listed while Use Blockscout is off", async () => {
for (const useBlockscout of [false, true]) {
const page = await bootPopup(onAddressDetail(useBlockscout));
require("../src/popup/views/deleteAddress").show(0, 1);
expect(page.visibleViews()).toEqual(["delete-address-confirm"]);
expect(page.hidden("delete-address-tokens-note")).toBe(
useBlockscout,
);
cleanupPopup();
}
});
// The token ids of the first address's balances in the stored profile.
function storedTokens(page) {
return page.storage
.read("autistmask")
.wallets[0].addresses[0].tokenBalances.map((row) =>
row.address.toLowerCase(),
);
}
// Turning the setting off dropped the untracked token. A refresh that
// started while it was on still saves its balances when it returns, but
// not that token. The same refresh in the background is in
// tests/backgroundStateIsolation.test.js.
test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
const page = await bootPopup(onAddressDetail(true));
const { refreshBalances: held } = require("../src/shared/balances");
let answer;
held.mockImplementationOnce(async (wallets) => {
await new Promise((resolve) => {
answer = resolve;
});
wallets[0].addresses[0].balance = "7.0";
wallets[0].addresses[0].tokenBalances = [
tokenRow(TRACKED, "TRK"),
tokenRow(UNTRACKED, "TST"),
];
});
const ticking = page.tick();
await page.settle();
await page.click("btn-settings");
await setBox(page, "settings-use-blockscout", false);
answer();
await ticking;
test("hands its balance refresh the stored Use Blockscout setting", async () => {
const profile = { ...unversionedValidProfile(), lastBalanceRefresh: 0 };
expect(await settingTheRefreshIsHanded(profile)).toBe(false);
expect(
page.storage.read("autistmask").wallets[0].addresses[0].balance,
).toBe("7.0");
expect(storedTokens(page)).toEqual([TRACKED]);
await page.click("btn-settings-back");
expect(page.node("address-balances").innerHTML).not.toContain(
UNTRACKED,
);
});
// Another page saves `change` over the stored profile. The browser is not
// made to tell this page, so this page sees the change only by reading the
// stored profile.
function anotherPageSaves(page, change) {
page.storage.write("autistmask", {
...page.storage.read("autistmask"),
...change,
});
}
test.each([
["off", true, false],
["on", false, true],
])(
"after another page turns Use Blockscout %s, this page takes the change and its next refresh is saved",
async (_how, before, after) => {
const page = await bootPopup(onAddressDetail(before));
// The refresh answers as it does under the stored setting.
const { refreshBalances: held } = require("../src/shared/balances");
held.mockImplementationOnce(async (wallets) => {
const addr = wallets[0].addresses[0];
addr.balance = "7.0";
addr.tokenBalances = after
? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
: [tokenRow(TRACKED, "TRK")];
});
anotherPageSaves(page, { useBlockscout: after });
await page.tick();
expect(
page.storage.read("autistmask").wallets[0].addresses[0].balance,
).toBe("7.0");
expect(storedTokens(page)).toEqual(
after ? [TRACKED, UNTRACKED] : [TRACKED],
);
expect(page.hidden("address-tokens-note")).toBe(after);
},
);
test.each([
["off", true, false],
["on", false, true],
])(
"after another page turns Check recipients on Etherscan %s, this page's next Etherscan check follows the stored setting",
async (_how, before, after) => {
const page = await bootPopup(
onConfirmScreen({ checkRecipientsOnEtherscan: before }),
);
anotherPageSaves(page, { checkRecipientsOnEtherscan: after });
const from = fetched().length;
require("../src/popup/views/confirmTx").show({
token: "ETH",
from: ADDRESS,
to: RECIPIENT,
amount: "0.1",
chainId: "0x1",
});
await page.settle();
// The page also takes the change and draws ConfirmTx again, which
// checks once more. So each URL asked for is counted once.
const asked = new Set(
fetched().slice(from).filter(blockscoutOrEtherscan),
);
expect([...asked]).toEqual(
after ? ["https://etherscan.io/address/" + RECIPIENT] : [],
);
},
);
// Another page's save of the whole profile with `change`, which the
// browser announces to this page as it announces any write.
async function anotherPageAnnounces(page, change) {
await page.storage.local.set({
autistmask: { ...page.storage.read("autistmask"), ...change },
});
await page.settle();
}
test("a page open on AddressDetail draws it again when another page turns Use Blockscout off", async () => {
const page = await bootPopup(onAddressDetail(true));
expect(page.hidden("address-tokens-note")).toBe(true);
await anotherPageAnnounces(page, { useBlockscout: false });
expect(page.visibleViews()).toEqual(["address"]);
expect(page.hidden("address-tokens-note")).toBe(false);
expect(page.node("address-balances").innerHTML).not.toContain(
UNTRACKED,
);
expect(storedTokens(page)).toEqual([TRACKED]);
});
test("a page open on ConfirmTx draws it again when another page turns Check recipients on Etherscan off", async () => {
const page = await bootPopup(
onConfirmScreen({ checkRecipientsOnEtherscan: true }),
);
expect(page.hidden("confirm-etherscan-note")).toBe(true);
await anotherPageAnnounces(page, { checkRecipientsOnEtherscan: false });
expect(page.visibleViews()).toEqual(["confirm-tx"]);
expect(page.hidden("confirm-etherscan-note")).toBe(false);
await settingTheRefreshIsHanded({
...profile,
useBlockscout: true,
}),
).toBe(true);
});
});
-2
View File
@@ -73,8 +73,6 @@ function loadColdWorker(networkId, opts) {
jest.doMock("../src/shared/balances", () => ({
getProvider: () => ({}),
refreshBalances: options.refreshBalances || jest.fn(async () => {}),
dropUntrackedTokens: jest.requireActual("../src/shared/balances")
.dropUntrackedTokens,
}));
jest.doMock("../src/shared/phishingDomains", () => ({
isPhishingDomain: () => false,
+2 -7
View File
@@ -108,10 +108,7 @@ global.fetch = jest.fn(() => {
});
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
runtime: { sendMessage() {} },
};
global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
// A stub DOM: every id resolves to a recording element.
const elements = new Map();
@@ -246,13 +243,11 @@ async function openSend(token, tokenUnits = null) {
];
state.selectedWallet = 0;
state.selectedAddress = 0;
// Blockscout is asked only while the stored "Use Blockscout" is on. The
// screens save this page's copy of it over the stored one.
state.useBlockscout = true;
await refreshBalances(
state.wallets,
"https://rpc.example.invalid",
"https://blockscout.example/api/v2",
true,
state.trackedTokens,
"mainnet",
);
+21 -83
View File
@@ -272,22 +272,19 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
// ------------------ Blockscout and Etherscan are sent no user data (#668)
//
// A fresh install sends Blockscout and Etherscan none of the user's data until
// the user turns on "Use Blockscout" or "Check recipients on Etherscan". One
// request is made with the setting off: pressing "Save" beside the Blockscout
// URL asks that URL for `/stats`. It carries no user data.
//
// The route handler in tests/e2e/network.js records every request the
// extension makes in env.routeOpts.requests, from its pages and its background
// worker. Recording starts when launch() in tests/e2e/harness.js installs that
// handler, before the first popup page opens. A request the background worker
// makes while it starts up comes earlier and is not recorded.
//
// Before either setting is changed, these tests drive Home, AddressDetail,
// AddressToken and ConfirmTx, and the background's own balance refresh. Then
// they turn each setting on and watch its requests start. "Use Blockscout" is
// also turned off once and on again, to see a token the user has not tracked
// leave every list. TransactionDetail, which also asks Blockscout, is left to
// the unit tests in tests/blockscoutEtherscanSettings.test.js.
// the user turns on "Use Blockscout" or "Check recipients on Etherscan". The
// endpoint check Settings makes when the user presses "Save" beside the
// Blockscout URL asks only for `/stats` and carries no user data; it is made
// whether or not the setting is on. The route handler in tests/e2e/network.js
// records every request the extension makes, from its pages and its background
// worker, in env.routeOpts.requests. Recording starts when launch() in
// tests/e2e/harness.js installs that handler, before the first popup page
// opens; a request the background worker makes while it starts up, before
// then, is not recorded. These tests drive Home, AddressDetail, AddressToken
// and ConfirmTx, and the background's own balance refresh, before either
// setting is changed, then turn each on and watch its requests start.
// TransactionDetail, which also asks Blockscout, is left to the unit tests in
// tests/blockscoutEtherscanSettings.test.js.
// What the three transaction lists say while Use Blockscout is off. Written
// out here rather than imported, so the assertion does not compare the popup
@@ -303,7 +300,7 @@ function explorerRequests(env) {
});
}
// Waits until the list `listId` shows the line saying "Use Blockscout" is off.
// Waits until the list `listId` says what Use Blockscout being off leaves out.
async function waitForHistoryOff(page, listId) {
await page.waitForFunction(
([id, want]) => document.getElementById(id).textContent.trim() === want,
@@ -398,11 +395,11 @@ test("with neither setting changed, Home, AddressDetail, AddressToken and Confir
}
});
// The background refreshes balances on its alarm, once a minute. It skips a
// refresh when the stored record says one ran in the last 30 seconds, and the
// open popup's own refresh runs every 10. So the popup is closed first. The
// background worker then writes that record back to say no refresh has run, as
// another extension page saving it would.
// The background refreshes balances on its alarm, once a minute, and skips a
// refresh when the stored record says one ran in the last 30 seconds, which
// the open popup's own refresh does every 10. So the popup is closed, and that
// record is written back to say no refresh has run, from the background
// worker, as another extension page saving it would.
test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
await waitForPersisted(
env.page,
@@ -503,68 +500,9 @@ test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for th
);
});
// Unticked from AddressDetail's gear while the address holds the stub token,
// which the user has not tracked and only Blockscout reports. Ticked again at
// the end, so the rest of the run has Blockscout as before.
test("turning off Use Blockscout from AddressDetail's gear takes an untracked token off AddressDetail, Send and Home on Back (#668)", async (env) => {
env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
env.routeOpts.seedTokenBalance = true;
const tokenRow = '[data-token="' + STUB_TOKEN.address + '"]';
try {
await settleOnMain(env, { ethWei: FUNDED_ETH_WEI, expectToken: true });
await openAddressDetail(env.page);
await visible(env.page, "#address-balances " + tokenRow);
await openSettings(env.page);
await env.page.uncheck("#settings-use-blockscout");
await waitForPersisted(
env.page,
"useBlockscout",
false,
"once unticked",
);
await env.page.click("#btn-settings-back");
await visible(env.page, "#view-address");
await visible(env.page, "#address-tokens-note");
assert(
(await env.page
.locator("#address-balances " + tokenRow)
.count()) === 0,
"AddressDetail still lists the untracked token",
);
await env.page.click("#btn-send");
await visible(env.page, "#view-send");
await visible(env.page, "#send-tokens-note");
const offered = await env.page.$$eval("#send-token option", (opts) =>
opts.map((opt) => opt.value.toLowerCase()),
);
assert(
!offered.includes(STUB_TOKEN.address),
"Send's dropdown still offers the untracked token",
);
await env.page.click("#btn-send-back");
await visible(env.page, "#view-address");
await goHome(env.page);
await visible(env.page, "#home-tokens-note");
assert(
(await env.page.locator("#wallet-list " + tokenRow).count()) === 0,
"Home still lists the untracked token",
);
} finally {
await openSettings(env.page);
await env.page.check("#settings-use-blockscout");
await waitForPersisted(env.page, "useBlockscout", true, "ticked again");
await env.page.click("#btn-settings-back");
env.routeOpts.ethBalanceWei = null;
env.routeOpts.seedTokenBalance = false;
}
});
// Ticked from ConfirmTx's gear, so Back lands on the screen that said no
// Etherscan check was made. Left on for the rest of the run, so the later
// confirmation screens are driven with the check made.
// Etherscan check was made. Left on for the rest of the run, as the check was
// always made before #668.
test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
env.routeOpts.etherscanLabel = "Fake_Phishing668";
+13 -15
View File
@@ -1,13 +1,13 @@
// ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
// name is resolved off-chain, naming a web address to fetch the answer from.
// ethers fetches it unless the provider has `disableCcipRead` set. That request
// would carry the name to a server other than the RPC endpoint
// (https://git.eeqj.de/sneak/AutistMask/issues/668). With the flag set, such a
// name does not resolve.
// name is resolved off-chain, naming a web address to fetch the answer from;
// ethers fetches it unless the provider has `disableCcipRead` set, and that
// request would carry the name to a server other than the RPC endpoint
// (https://git.eeqj.de/sneak/AutistMask/issues/668). With it set, such a name
// does not resolve.
//
// The provider getProvider() builds runs against a fake JSON-RPC node. Its
// answers go through ethers' own request hook, which also records the address
// of every request ethers makes, the off-chain fetch included.
// The provider getProvider() builds runs against a fake JSON-RPC node,
// answered through ethers' own request hook, which also records the address of
// every request ethers makes, the off-chain fetch included.
const { FetchRequest, Interface } = require("ethers");
const { getProvider } = require("../src/shared/balances");
@@ -17,13 +17,11 @@ const RESOLVER = "0x5555555555555555555555555555555555555555";
const USER = "0x1111111111111111111111111111111111111111";
const NAME = "offchain.eth";
// The ENS registry's resolver(), and the resolver's functions ethers calls:
//
// - the registry names RESOLVER for every name
// - the resolver says it resolves names through resolve()
// - it gives NAME as the reverse record of any address
// - it answers resolve() with the OffchainLookup error, which says the name
// is resolved off-chain
// The ENS registry's resolver(), and the resolver's functions ethers calls: the
// registry names RESOLVER for every name, the resolver says it resolves names
// through resolve(), gives NAME as the reverse record of any address, and
// answers resolve() with the OffchainLookup error that says the name is
// resolved off-chain.
const ens = new Interface([
"function resolver(bytes32) view returns (address)",
"function supportsInterface(bytes4) view returns (bool)",
+2 -7
View File
@@ -35,11 +35,8 @@ global.fetch = jest.fn(() => {
throw new Error("tests must not perform network requests");
});
// Blockscout is asked only while the stored "Use Blockscout" is on.
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
};
global.chrome = { storage: makeStorageStub() };
const { AbiCoder, Interface } = require("ethers");
const { ERC20_ABI } = require("../src/shared/constants");
@@ -117,6 +114,7 @@ async function fetchOnto(items, trackedTokens = []) {
const balances = await fetchTokenBalances(
HOLDER,
BLOCKSCOUT,
true,
trackedTokens,
);
state.trackedTokens = trackedTokens;
@@ -168,9 +166,6 @@ beforeEach(() => {
debugFetch.mockReset();
state.trackedTokens = [];
state.wallets = [];
// The approval screens read the explorer's report only while the page's
// "Use Blockscout" is on.
state.useBlockscout = true;
});
describe("what fetchTokenBalances stores for an absent scale", () => {
+10 -10
View File
@@ -21,11 +21,7 @@ jest.mock("../src/shared/log", () => ({
global.fetch = jest.fn(() => {
throw new Error("tests must not perform network requests");
});
// Blockscout is asked only while the stored "Use Blockscout" is on.
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
};
global.chrome = { storage: { local: {} } };
const {
LOW_HOLDER_THRESHOLD,
@@ -154,19 +150,23 @@ describe("the balance-list spam gate", () => {
test("a token with plenty of reported holders is listed", async () => {
respondWith([item()]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
expect(balances).toHaveLength(1);
expect(balances[0].holders).toBe(50000);
});
test("a token reporting zero holders is still excluded", async () => {
respondWith([item({ token: { holders_count: "0" } })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
test("an unknown holder count does not admit an unvouched token", async () => {
respondWith([item({ token: { holders_count: null } })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
// The path that reaches the send selector and the history filter: a token
@@ -175,7 +175,7 @@ describe("the balance-list spam gate", () => {
// zero that would then hide it downstream.
test("a tracked token with an unknown count is listed with holders null", async () => {
respondWith([item({ token: { holders_count: undefined } })]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
{ address: NOVEL_TOKEN.toUpperCase() },
]);
expect(balances).toHaveLength(1);
@@ -192,7 +192,7 @@ describe("the balance-list spam gate", () => {
},
}),
]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
expect(balances).toHaveLength(1);
expect(balances[0].holders).toBeNull();
});
+1 -6
View File
@@ -436,13 +436,8 @@ describe.each([
});
test("the transaction detail screen's type line and fee", async () => {
// The fee is Blockscout's, asked for only while the stored "Use
// Blockscout" is on.
// The fee is Blockscout's.
state.useBlockscout = true;
global.chrome.storage.write("autistmask", {
...global.chrome.storage.read("autistmask"),
useBlockscout: true,
});
debugFetch.mockImplementationOnce(async () => ({
ok: true,
status: 200,
+1 -5
View File
@@ -286,12 +286,8 @@ describe("a malformed fraudContracts", () => {
function stubSendDocument() {
const select = { innerHTML: "", children: [] };
select.appendChild = (child) => select.children.push(child);
const elements = {
"send-token": select,
"send-tokens-note": { classList: { toggle: () => {} } },
};
globalThis.document = {
getElementById: (id) => elements[id] || null,
getElementById: (id) => (id === "send-token" ? select : null),
createElement: () => ({ value: "", textContent: "" }),
};
return select;
+5 -10
View File
@@ -618,6 +618,8 @@ const CONTRACT = [
"hideFraudContracts",
"hideDustTransactions",
"utcTimestamps",
"useBlockscout",
"checkRecipientsOnEtherscan",
"debugMode",
].map((field) => ({
field,
@@ -625,18 +627,11 @@ const CONTRACT = [
// A flag: only ever tested for truthiness, and written back verbatim.
hostile: [42, "notabool", { a: 1 }],
// Both answers to that truthiness test have to be driven, and 0 is a
// value src/ never writes for a flag. For utcTimestamps and debugMode
// the falsy answer is also the DEFAULT_STATE default.
// value src/ never writes for a flag. For utcTimestamps,
// useBlockscout, checkRecipientsOnEtherscan and debugMode the falsy
// answer is also the DEFAULT_STATE default.
falsy: [0],
})),
// Each lets a request reach another service, so anything but true is off.
...["useBlockscout", "checkRecipientsOnEtherscan"].map((field) => ({
field,
kind: KIND.SCALAR,
hostile: [42, "notabool", { a: 1 }],
floorOnly: [0, null, "true"],
holds: (v) => v === false,
})),
];
function siteMapHolds(v) {
+2 -3
View File
@@ -44,9 +44,8 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
// A boot onto a screen that sends a request no mocked module answers: that
// request reaches the boot's fetch() stub, never the internet
// (https://git.eeqj.de/sneak/AutistMask/issues/559). TransactionDetail asks
// Blockscout only while "Use Blockscout" is on. ConfirmTx asks Etherscan only
// while "Check recipients on Etherscan" is on. So the profile turns both on.
// (https://git.eeqj.de/sneak/AutistMask/issues/559). Both requests are made
// only while the user has the setting for them on.
function restoringOnto(view, viewData) {
return unversionedValidProfile({
currentView: view,
+1 -1
View File
@@ -87,7 +87,7 @@ test("the popup open on AddressDetail shows the new network and its balances", a
// Its next refresh runs on Sepolia, and what it fetched is stored.
await page.tick();
const { refreshBalances } = require("../src/shared/balances");
expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
const stored = page.storage.read("autistmask");
expect(stored.networkId).toBe("sepolia");
expect(stored.lastBalanceRefresh).toBeGreaterThan(0);
+1
View File
@@ -88,6 +88,7 @@ test("the balance refresh", async () => {
wallets,
RPC_URL,
"https://explorer.example.invalid/api/v2",
true,
[],
"mainnet",
);
+2 -4
View File
@@ -90,7 +90,7 @@ let approvalDetails = null;
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
storage: makeStorageStub(),
runtime: {
connect: () => ({
postMessage() {},
@@ -220,13 +220,11 @@ async function refreshWith(balanceWei, tokenItems = []) {
state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
state.selectedWallet = 0;
state.selectedAddress = 0;
// Blockscout is asked only while the stored "Use Blockscout" is on. The
// screens save this page's copy of it over the stored one.
state.useBlockscout = true;
await refreshBalances(
state.wallets,
"https://rpc.example.invalid",
"https://blockscout.example/api/v2",
true,
state.trackedTokens,
"mainnet",
);
+2 -7
View File
@@ -100,10 +100,7 @@ global.fetch = jest.fn(() => {
});
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
runtime: { sendMessage() {} },
};
global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
// A stub DOM: every id resolves to a recording element.
const elements = new Map();
@@ -216,13 +213,11 @@ async function refreshWith(balanceWei, tokenItems = []) {
];
state.selectedWallet = 0;
state.selectedAddress = 0;
// Blockscout is asked only while the stored "Use Blockscout" is on. The
// screens save this page's copy of it over the stored one.
state.useBlockscout = true;
await refreshBalances(
state.wallets,
"https://rpc.example.invalid",
"https://blockscout.example/api/v2",
true,
state.trackedTokens,
"mainnet",
);
+1 -5
View File
@@ -27,12 +27,8 @@ let select;
function installStubDocument() {
select = { innerHTML: "", children: [] };
select.appendChild = (child) => select.children.push(child);
const elements = {
"send-token": select,
"send-tokens-note": { classList: { toggle: () => {} } },
};
globalThis.document = {
getElementById: (id) => elements[id] || null,
getElementById: (id) => (id === "send-token" ? select : null),
createElement: () => ({ value: "", textContent: "" }),
};
}
+7 -9
View File
@@ -523,15 +523,13 @@ describe("a garbage value in a field the gate does not check", () => {
});
test("a malformed tokenBalances entry is dropped, and the wallet and its address survive", async () => {
// "Use Blockscout" is on, or the boot's balance refresh drops the
// well-formed entry too: the user has not tracked its token.
const profile = profileWithTokenBalances([
null,
42,
{ address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
]);
profile.useBlockscout = true;
const env = await bootPopup(profile);
const env = await bootPopup(
profileWithTokenBalances([
null,
42,
{ address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
]),
);
const stored = env.storage.read("autistmask");
expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
-2
View File
@@ -283,8 +283,6 @@ async function bootPopup(stored, options) {
jest.doMock("../../src/shared/balances", () => ({
fetchTokenBalances: jest.fn(async () => []),
refreshBalances: jest.fn(async () => {}),
dropUntrackedTokens: jest.requireActual("../../src/shared/balances")
.dropUntrackedTokens,
lookupTokenInfo: jest.fn(async () => null),
getProvider: () => ({}),
scanForAddresses: jest.fn(async () => ({
+25 -22
View File
@@ -52,14 +52,8 @@ jest.mock("../src/shared/log", () => ({
global.fetch = jest.fn(() => {
throw new Error("tests must not perform network requests");
});
// Blockscout is asked only while the stored "Use Blockscout" is on.
global.chrome = {
storage: {
local: {
get: async () => ({ autistmask: { useBlockscout: true } }),
set: async () => {},
},
},
storage: { local: { get: async () => ({}), set: async () => {} } },
};
const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
@@ -491,12 +485,8 @@ describe("surface 2: the Send token selector", () => {
function render(tokenBalances) {
select = { innerHTML: "", children: [] };
select.appendChild = (child) => select.children.push(child);
const elements = {
"send-token": select,
"send-tokens-note": { classList: { toggle: () => {} } },
};
globalThis.document = {
getElementById: (id) => elements[id] || null,
getElementById: (id) => (id === "send-token" ? select : null),
createElement: () => ({ value: "", textContent: "" }),
};
renderSendTokenSelect({
@@ -592,12 +582,14 @@ describe("surface 3: the balance list", () => {
// 1,000-holder floor and was listed as a holding named ETH.
test("a fake ETH token clearing the holder floor is filtered", async () => {
respondWith([fakeEthItem()]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
test("tracking the fake token manually does not admit it either", async () => {
respondWith([fakeEthItem({ holders_count: "0" })]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
{ address: FAKE_ETH_CONTRACT },
]);
expect(balances).toEqual([]);
@@ -607,12 +599,16 @@ describe("surface 3: the balance list", () => {
// their belief about what they own, and it renders the symbol into HTML.
test("a padded fake ETH token is filtered too", async () => {
respondWith([fakeEthItem({ symbol: " ETH " })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
test("a fake ETH token padded with a no-break space is filtered", async () => {
respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
// The false-positive direction on the surface that matters most: a real
@@ -627,7 +623,7 @@ describe("surface 3: the balance list", () => {
decimals: "6",
}),
]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
expect(balances).toHaveLength(1);
expect(balances[0].symbol).toBe(" USDC ");
});
@@ -641,7 +637,7 @@ describe("surface 3: the balance list", () => {
decimals: "6",
}),
]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
expect(balances).toHaveLength(1);
expect(balances[0].symbol).toBe("USDC");
});
@@ -652,7 +648,9 @@ describe("surface 3: the balance list", () => {
// before the symbol rule is consulted.
test("a non-ERC-20 row claiming ETH never reaches the symbol rule", async () => {
respondWith([fakeEthItem({ type: "ERC-721" })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
// The adjacent finding from the same review as issue #260: the type gate
@@ -670,16 +668,20 @@ describe("surface 3: the balance list", () => {
decimals: "6",
}),
]);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
expect(balances).toHaveLength(1);
expect(balances[0].symbol).toBe("USDC");
});
test("case insensitivity does not admit another token type", async () => {
respondWith([fakeEthItem({ type: "erc-721" })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
[],
);
});
// The money test: the user holds real ETH and has been airdropped a fake
@@ -692,6 +694,7 @@ describe("surface 3: the balance list", () => {
[{ addresses: [addr] }],
"https://rpc.example.invalid",
BLOCKSCOUT,
true,
[],
"mainnet",
);
+5 -7
View File
@@ -38,14 +38,8 @@ jest.mock("../src/shared/log", () => ({
isDebug: () => false,
}));
// Blockscout is asked only while the stored "Use Blockscout" is on.
globalThis.chrome = {
storage: {
local: {
get: async () => ({ autistmask: { useBlockscout: true } }),
set: async () => {},
},
},
storage: { local: { get: async () => ({}), set: async () => {} } },
};
const { state } = require("../src/shared/state");
@@ -184,6 +178,7 @@ test("a token transfer's decoded details name the token contract and the amount
const [row] = await fetchRecentTransactions(
HOLDER,
EXPLORER,
true,
NETWORKS.mainnet.chainId,
);
expect(row.to).toBe(RECIPIENT);
@@ -216,6 +211,7 @@ test("with mainnet active, a Sepolia transaction is read from Sepolia's Blocksco
const [row] = await fetchRecentTransactions(
HOLDER,
EXPLORER,
true,
NETWORKS.sepolia.chainId,
);
@@ -244,6 +240,7 @@ test("with mainnet active and no Blockscout remembered for Sepolia, a Sepolia tr
const [row] = await fetchRecentTransactions(
HOLDER,
EXPLORER,
true,
NETWORKS.sepolia.chainId,
);
mockAsked.length = 0;
@@ -265,6 +262,7 @@ async function showSepoliaTransferWithMainnetActive() {
const [row] = await fetchRecentTransactions(
HOLDER,
EXPLORER,
true,
NETWORKS.sepolia.chainId,
);
transactionDetail.show(row);
+1 -6
View File
@@ -9,12 +9,6 @@
const { AbiCoder, FetchRequest } = require("ethers");
const { refreshBalances } = require("../src/shared/balances");
const { makeStorageStub } = require("./support/storageStub");
// Blockscout is asked only while the stored "Use Blockscout" is on.
globalThis.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
};
const RPC_URL = "https://rpc.example.invalid";
const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
@@ -138,6 +132,7 @@ async function refresh(addresses, trackedTokens) {
[{ addresses }],
RPC_URL,
EXPLORER_URL,
true,
trackedTokens,
"mainnet",
new AbortController().signal,
+51 -11
View File
@@ -1215,13 +1215,11 @@ function respondWith(txItems, tokenTransferItems) {
describe("fetchRecentTransactions merge and dedup", () => {
beforeEach(() => {
debugFetch.mockReset();
// Blockscout is asked only while the stored "Use Blockscout" is on.
global.chrome.storage.write("autistmask", { useBlockscout: true });
});
test("queries only the two Blockscout endpoints for the address", async () => {
respondWith([], []);
await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
await fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1");
expect(debugFetch).toHaveBeenCalledTimes(2);
const urls = debugFetch.mock.calls.map((c) => c[0]);
expect(urls).toContain(
@@ -1285,7 +1283,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
],
);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs).toHaveLength(1);
const merged = txs[0];
// The received leg (the swap output) supplies the display amount.
@@ -1322,7 +1325,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
],
);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs).toHaveLength(1);
expect(txs[0].symbol).toBe("USDC");
expect(txs[0].value).toBe("1500.5000");
@@ -1348,7 +1356,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
});
respondWith([], [leg("1000000"), leg("2000000")]);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs).toHaveLength(1);
// Keyed by hash plus contract, so the later leg wins.
expect(txs[0].exactValue).toBe("2.0");
@@ -1388,7 +1401,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
],
);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
});
@@ -1429,7 +1447,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
],
);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs).toHaveLength(1);
expect(txs[0].symbol).toBe("USDC");
expect(txs[0].exactValue).toBe("1.0");
@@ -1455,7 +1478,13 @@ describe("fetchRecentTransactions merge and dedup", () => {
});
respondWith([item(6), item(8), item(7)], []);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1", 2);
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
2,
);
expect(txs.map((t) => t.blockNumber)).toEqual([21000008, 21000007]);
});
@@ -1481,6 +1510,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const sepolia = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0xaa36a7",
);
expect(sepolia[0].symbol).toBe("SepoliaETH");
@@ -1489,6 +1519,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const mainnet = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(mainnet[0].symbol).toBe("ETH");
@@ -1515,7 +1546,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
],
);
const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs).toHaveLength(1);
expect(txs[0].contractAddress).toBe(FAKE_ETH_CONTRACT);
expect(txs[0].holders).toBe(0);
@@ -1557,6 +1593,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs[0].holders).toBeNull();
@@ -1567,6 +1604,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs[0].holders).toBeNull();
@@ -1577,6 +1615,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(filterTransactions(txs, filters()).transactions).toEqual(
@@ -1593,6 +1632,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
const txs = await fetchRecentTransactions(
VICTIM,
BLOCKSCOUT,
true,
"0x1",
);
expect(txs[0].holders).toBe(0);
@@ -1610,7 +1650,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
},
}));
await expect(
fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1"),
fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1"),
).resolves.toEqual([]);
});
+1 -7
View File
@@ -42,14 +42,8 @@ jest.mock("../src/shared/log", () => ({
isDebug: () => false,
}));
// Blockscout is asked only while the stored "Use Blockscout" is on.
globalThis.chrome = {
storage: {
local: {
get: async () => ({ autistmask: { useBlockscout: true } }),
set: async () => {},
},
},
storage: { local: { get: async () => ({}), set: async () => {} } },
};
const uniswap = require("../src/shared/uniswap");
+2 -7
View File
@@ -34,14 +34,8 @@ jest.mock("../src/shared/log", () => ({
isDebug: () => false,
}));
// Blockscout is asked only while the stored "Use Blockscout" is on.
globalThis.chrome = {
storage: {
local: {
get: async () => ({ autistmask: { useBlockscout: true } }),
set: async () => {},
},
},
storage: { local: { get: async () => ({}), set: async () => {} } },
};
const { state } = require("../src/shared/state");
@@ -294,6 +288,7 @@ async function historyRow(method, sentTo, chainId) {
const rows = await fetchRecentTransactions(
RECIPIENT,
"https://explorer.example/api/v2",
true,
chainId,
);
return rows[0];
-3
View File
@@ -90,9 +90,6 @@ function swapDetail(data, label) {
beforeEach(() => {
state.trackedTokens = [];
state.wallets = [];
// The approval screen reads the explorer's report only while "Use
// Blockscout" is on.
state.useBlockscout = true;
});
describe("a swap of a token outside the bundled list", () => {
+4 -11
View File
@@ -72,12 +72,8 @@ global.fetch = jest.fn(() => {
throw new Error("tests must not perform network requests");
});
// Blockscout is asked only while the stored "Use Blockscout" is on.
const { makeStorageStub } = require("./support/storageStub");
global.chrome = {
storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
runtime: { sendMessage() {} },
};
global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
// A stub DOM. Every id in index.html that these two views touch resolves to a
// fresh recording element; nothing here depends on layout, only on what the
@@ -176,7 +172,7 @@ async function fetchOnto(items) {
statusText: "OK",
json: async () => items,
}));
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
state.wallets = [
{
name: "Wallet 1",
@@ -201,14 +197,14 @@ async function fetchOntoBoth(itemsA, itemsB) {
statusText: "OK",
json: async () => itemsA,
}));
const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
debugFetch.mockImplementation(async () => ({
ok: true,
status: 200,
statusText: "OK",
json: async () => itemsB,
}));
const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, []);
const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, true, []);
state.wallets = [
{
name: "Wallet 1",
@@ -272,9 +268,6 @@ beforeEach(() => {
state.fraudContracts = [];
state.hideLowHolderTokens = false;
state.currentView = null;
// The screens save this page's copy of "Use Blockscout" over the stored
// one, so it is on here too.
state.useBlockscout = true;
});
describe("the Send screen resolves the scale rather than reading the stored one", () => {