fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout for history
and token lookups, and each recipient to Etherscan for its label. Two settings,
"Use Blockscout" and "Check recipients on Etherscan", now gate those requests
where they are made. Both are off in a new profile and offered unticked on
Welcome and in Settings. While one is off, the screens that relied on it say so
in a plain line naming the setting; after either changes in Settings, Back
draws the screen it lands on again. ENS lookups ask only the RPC endpoint, so a
name resolved off-chain does not resolve. README and the user guide say what is
contacted by default and what each setting adds.

Model: opus-5-5

README.md

@@ -12,29 +12,20 @@ intercepts tx status links to their own site instead of going to Etherscan, etc.
 None of the common alternatives work on Firefox.
 
 Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform.
-Everything you need, nothing you don't. We import as few libraries as possible
+Everything you need, nothing you don't. We import as few libraries as possible,
-and don't implement any crypto. By default the wallet sends user-specific data
+don't implement any crypto, and don't send user-specific data anywhere but a
-only to the Ethereum RPC endpoint. The user can change that endpoint in
+(user-configurable) Ethereum RPC endpoint (which defaults to a public node)
-Settings. The endpoint defaults to a public node.
+unless the user turns on one of the two lookups below. Out of the box the
-
+extension contacts the configured RPC node for blockchain interactions and a
-Out of the box the extension contacts one service, the configured RPC node. The
+public CoinDesk API (no API key) for realtime price information, which is sent
-wallet uses the node for:
+token symbols and nothing else. Two more services are sent none of the user's
-
+data until the user turns them on, on the Welcome screen or in Settings: a
-- blockchain interactions
+Blockscout block-explorer API for transaction history, the tokens the user has
-- USD prices on mainnet, read from Chainlink price feed contracts
+not tracked and transaction details ("Use Blockscout"), and best-effort
-
+Etherscan address label lookups during transaction confirmation ("Check
-Two more services are sent none of the user's data until the user ticks a
+recipients on Etherscan"). A community-maintained phishing domain blocklist is
-checkbox for each. Welcome and Settings both offer the two checkboxes:
+built into the extension at build time and checked locally; nothing is fetched
-
+for it at runtime.
-- "Use Blockscout": a Blockscout block-explorer API, used for:
-    - transaction history
-    - the tokens the user has not tracked
-    - transaction details
-- "Check recipients on Etherscan": a best-effort Etherscan label lookup of the
-  recipient during transaction confirmation
-
-A community-maintained phishing domain blocklist is built into the extension at
-build time and checked locally. Nothing is fetched for it at runtime.
 
 In the extension is a hardcoded list of the top ERC20 contract addresses. You
 can add any ERC20 contract by contract address if you wish, but the hardcoded
@@ -436,33 +427,22 @@ there to Sepolia must put up the `[TESTNET]` banner, and switching back to
 mainnet must take it down, both while Settings is still on screen.
 
 It also covers what a new install sends to Blockscout and Etherscan
-([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The harness installs
+([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The route handler
-a route handler before the first popup page opens. From then on, the handler
+records every request the extension makes, from its pages and its background
-records every request the extension makes, from its pages and from its
+worker, from when the harness installs it, before the first popup page opens; a
-background worker. The background worker starts earlier, but it makes no request
+request the background worker makes while it starts up, before then, is not
-while it starts up. The tests take these steps in order:
+recorded. Welcome must offer "Use Blockscout" and "Check recipients on
-
+Etherscan" unticked. With neither changed, Home, AddressDetail, AddressToken and
-- Welcome must offer "Use Blockscout" and "Check recipients on Etherscan"
+ConfirmTx must show the lines saying what is off; the popup is then closed until
-  unticked.
+the background has run a balance refresh of its own, and not one recorded
-- With neither ticked, Home, AddressDetail, AddressToken and ConfirmTx must each
+request may have gone to Blockscout or Etherscan. "Use Blockscout" is then
-  show the line saying what is off.
+ticked from AddressDetail's gear: on "Back", AddressDetail must ask Blockscout
-- The popup is then closed until the background has run a balance refresh of its
+for its history and no longer say it is off, and Blockscout must then be asked
-  own. No recorded request may have gone to Blockscout or Etherscan.
+for the token balances. "Check recipients on Etherscan" is ticked from
-- "Use Blockscout" is ticked from AddressDetail's gear. On "Back", AddressDetail
+ConfirmTx's gear: on "Back", ConfirmTx must ask Etherscan about the recipient
-  must ask Blockscout for its history and no longer say the setting is off.
+and show the label the stub page gives it. Both stay on for the rest of the run.
-  Blockscout must then be asked for the token balances.
+TransactionDetail with "Use Blockscout" off is not driven here, since no history
-- The stub Blockscout then reports a token the user has not tracked. Home lists
+row leads to it then; the unit tests cover it.
-  it. "Use Blockscout" is unticked from AddressDetail's gear. On "Back", the
-  token must be gone from AddressDetail, from Send's token dropdown and from
-  Home. Those three screens must each show the line saying the setting is off.
-  The setting is then ticked again.
-- "Check recipients on Etherscan" is ticked from ConfirmTx's gear. On "Back",
-  ConfirmTx must ask Etherscan about the recipient and show the label the stub
-  page gives the recipient.
-
-Both settings stay on for the rest of the run. TransactionDetail with "Use
-Blockscout" off is not driven here: while the setting is off, there is no
-history row to open it from. The unit tests cover that case.
 
 It also covers the confirmation screen, for both a native ETH send and an ERC-20
 send: Send disabled while the fee estimate is in flight, enabled once it lands,
@@ -512,10 +492,7 @@ window of its own, and the password is required to be absent from every message
 the approval window sends to the background — with the message that would carry
 it required to be present, so that check cannot pass by observing nothing. That
 last one is the standing floor under
-[#157](https://git.eeqj.de/sneak/AutistMask/issues/157). Closing a transaction
+[#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
-or signature approval window is required to leave the dApp's request unanswered.
-The suite then opens that approval at the URL the toolbar button holds, and
-answers it there.
 
 The limits of that coverage and of the rest of the Chrome suite, none of them
 papered over:
@@ -524,9 +501,9 @@ papered over:
   network with real funds; that remains a human pass before 1.0.0.
 - The site-connection prompt is raised through `chrome.action.openPopup()`, and
   headless Chromium's browser-action popup is not a page Playwright can see or
-  click. So that prompt, and an approval reopened after its window closed, are
+  click, so that one prompt is driven at the URL the extension itself puts on
-  opened in a tab at the URL the extension puts on the action. Whether a real
+  the action — the same page and the same approval id, but whether a real
-  toolbar click shows that page is not observable here.
+  toolbar click shows it is not observable here.
 - Each site-connection request is made 1.5 seconds after the tab it will be
   driven in is opened (`APPROVAL_TAB_SETTLE_MS` in `tests/e2e/run.js`), because
   opening that tab closes the previous prompt's toolbar popup; a request made
@@ -645,24 +622,15 @@ above, it does not fail on page errors.
 
 `make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
 real Firefox**, installed as an unpacked MV2 temporary add-on via geckodriver.
-It covers:
+It covers popup load, the StateRecovery screen (the same cases as the Chrome
-
+suite), wallet creation through the UI, the Add Token screen, and the dApp round
-- popup load
+trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
-- the StateRecovery screen, with the same cases as the Chrome suite
+rejected and then approved, `eth_sendTransaction`, and a closed approval window
-- wallet creation through the UI
+rejecting with EIP-1193 4001 — driven through the real content script,
-- the Add Token screen
+background page and approval windows. The popup open all along is required to
-- `eth_requestAccounts` from a dApp
+show the `[TESTNET]` banner once the switch to Sepolia is approved and to drop
-- `personal_sign` from a dApp
+it once the switch back is. The `personal_sign` prompt is also required to fit
-- `wallet_switchEthereumChain` from a dApp, rejected and then approved
+its window without scrolling sideways, with the extension's pages at 170% zoom.
-- `eth_sendTransaction` from a dApp
-- an approval window closed without an answer, which leaves its request pending
-  until it is rejected
-
-Each dApp request runs through the real content script and background page, and
-opens a real approval window. The popup open all along is required to show the
-`[TESTNET]` banner once the switch to Sepolia is approved and to drop it once
-the switch back is. The `personal_sign` prompt is also required to fit its
-window without scrolling sideways, with the extension's pages at 170% zoom.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -778,11 +746,13 @@ Three limits are worth knowing, all real differences from the Chrome suite:
   in `tests/e2e/dapp.js`, which serves the dApp page and a JSON-RPC node and
   which the extension's `rpcUrl` is pointed at for the dApp steps; a JSON-RPC
   method that fixture does not model fails the run rather than answering `null`.
-  The suite leaves "Use Blockscout" off, so Blockscout is not asked. A
+  Everything else, Blockscout and the price feed among it, has no fixture and
-  `ReferenceError` in the success path of `renderTransactions`, or of price
+  simply fails, and the extension swallows its own fetch failures, so only the
-  rendering, passes this suite green. The offline run is also weaker than the
+  _failure_ branches of that code are ever executed. A `ReferenceError` in the
-  Chrome suite's interception: it proves nothing got out, but it cannot report
+  success path of `renderTransactions`, or of price rendering, passes this suite
-  which requests were attempted.
+  green. The offline run is also weaker than the Chrome suite's interception for
+  those calls: it proves nothing got out, but it cannot report which requests
+  were attempted.
 - **The site-connection prompt always opens in a window of its own.** The
   profile turns off `extensions.openPopupWithoutUserGesture.enabled`, so
   `src/background/index.js` falls back from the toolbar popup, which WebDriver
@@ -902,14 +872,11 @@ src/
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
-    prices.js         — ETH/USD and token/USD from Chainlink price feeds
+    prices.js         — ETH/USD and token/USD via CoinDesk API
     scamlist.js       — known fraud contract addresses
     state.js          — persisted state (extension storage)
-    storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
-                        read from storage for the requests those settings gate
     symbolSpoof.js    — the known-symbol spoof rule, shared by all surfaces
-    tokenList.js      — top ERC-20 tokens by market cap, and their Chainlink
+    tokenList.js      — top ERC-20 tokens by market cap (hardcoded)
-                        price feeds (hardcoded)
     transactions.js   — tx history fetching + anti-poisoning filters
     uniswap.js        — Uniswap Universal Router calldata decoder
     vault.js          — password-based encryption via libsodium
@@ -1178,39 +1145,25 @@ with the same floor (`.5` reads `.5000`).
 
 **Specific Exception — unknown token scale:** Calldata carries base units and no
 scale, so every amount on the dApp approval screen needs the token's `decimals`.
-The wallet takes the `decimals` from these sources, in this order
+It is resolved from the bundled token list, then from the tokens the user tracks
-(`resolveTokenDecimals()` in `src/shared/approvalAmount.js`):
+on the network the transaction is for, then, when that is the active network,
-
+from what the block explorer reported for the contract in the wallet's balances,
-- the bundled token list
+which are the active network's only (`resolveTokenDecimals()` in
-- the tokens the user tracks on the network the transaction is for
+`src/shared/approvalAmount.js`). Where none of them answers, the amount is not
-- what the block explorer reported for the contract in the wallet's balances.
+formatted: the line reads `5000000000 base units (decimals unknown)`. A guessed
-  Those balances cover the active network only. This source is used only while
+scale is not an approximation but a different number — 1,000 units of a
-  "Use Blockscout" is on (`tokenSourcesByChainId()` in
+6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
-  `src/popup/views/helpers.js`).
+whose only job is to state what is being authorized. Both amount paths of that
-
+screen take this rule: the ERC-20 `transfer`/`approve` line
-The token's name comes from the same sources. While "Use Blockscout" is off, a
+(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
-token gets a line under it when the bundled list and the tracked tokens lack its
+`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
-name or decimals. The line says "Blockscout's report of your balances is not
+a move into the router (`src/shared/uniswap.js`). The token permission warning
-used to name this token, because "Use Blockscout" is off in Settings." These
+on the signature screen takes the same rule for its amounts. An unbounded
-screens show the line:
+allowance or permit needs no scale to describe and is still shown as
-
+`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
-- TxApproval and SignApproval
+`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
-- WaitTx, SuccessTx and ErrorTx, which follow TxApproval
+decimal places, so a token that reports 81 to 255 is shown as one whose scale
-
+nothing knows.
-Where none of the sources answers, the amount is not formatted. The amount line
-then reads `5000000000 base units (decimals unknown)`. A guessed scale is not an
-approximation but a different number — 1,000 units of a 6-decimal token
-formatted at 18 decimals reads `0.000000001` — on the screen whose only job is
-to state what is being authorized. Both amount paths of that screen take this
-rule: the ERC-20 `transfer`/`approve` line (`src/popup/views/approval.js`) and
-the swap's `Amount`, `Min. received`, `Moved from the sender` and
-`Permit2 allowance` lines and the `Paid to` line of a move into the router
-(`src/shared/uniswap.js`). The token permission warning on the signature screen
-takes the same rule for its amounts. An unbounded allowance or permit needs no
-scale to describe and is still shown as `Unlimited`. A source's answer counts
-only if it is a whole number from 0 to 80: `decimals()` returns a `uint8`, but
-`formatUnits()` cannot format more than 80 decimal places, so a token that
-reports 81 to 255 is shown as one whose scale nothing knows.
 
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -1233,13 +1186,12 @@ and compare against. Reading the stored field directly instead answers `null`
 for a bundled or tracked token the explorer merely omitted, which is not a
 refusal the wallet has any reason to make.
 
-While "Use Blockscout" is on, the Send screen also consults every address's
+The Send screen also consults every address's explorer reports, so a contract
-explorer reports. The reports for two addresses may give different `decimals`
+two addresses report different `decimals` for has no scale there, and the stored
-for one contract. That token then has no scale on Send. Its stored balance is
+balance, formatted at one of those scales, is withdrawn with it. The Send
-not shown either. The Send screen's `Current balance` and the confirmation
+screen's `Current balance` and the confirmation screen's balance line then both
-screen's balance line then both read `unknown (SYMBOL)`. The balance list
+read `unknown (SYMBOL)`. The balance list formats each explorer row as it is
-formats each explorer row as it is fetched, without that cross-address check,
+fetched, without that cross-address check, and shows the row's figure.
-and shows the row's figure.
 
 **Decoded amount lines on the transaction approval screen:** the `Amount` line
 of a decoded ERC-20 call, and the `Amount` and `Min. received` lines of a
@@ -1372,10 +1324,10 @@ whole swap undecoded.
 
 #### Partial USD totals
 
-Only a token with a Chainlink price feed has a price, so an address can hold
+Prices are fetched for the top 25 tokens only, so an address can hold assets the
-assets the extension has no price for. Worth zero and worth an unknown amount
+extension has no price for. Worth zero and worth an unknown amount are different
-are different facts and are never collapsed into one number. `getAddressValue()`
+facts and are never collapsed into one number. `getAddressValue()` in
-in `src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
+`src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
 holdings, and whether an unpriced holding was left out of it — and every screen
 renders it through `formatAddressTotal()`, so the wording cannot drift:
 
@@ -1459,23 +1411,12 @@ that token's previous entry, as a failed ETH balance keeps its figure, or takes
 Blockscout's entry from the same refresh when there is none. Every other token
 comes from the Blockscout `token-balances` response (`fetchTokenBalances()`), so
 tokens do appear without the user adding them, and they keep their previous
-figures while Blockscout fails.
+figures while Blockscout fails. The refresh asks Blockscout only while the user
-
+has "Use Blockscout" on. While it is off, as it is until the user turns it on, a
-The refresh asks Blockscout only while the user has "Use Blockscout" on. The
+tracked token's entry has no holder count and no `decimals` of Blockscout's, so
-setting is off until the user turns it on. While it is off:
+its balance is stated at the scale the bundled list or the tracked token
-
+records, and no other token is listed, those from earlier refreshes included. A
-- Only tracked tokens are listed. Turning the setting off drops every other
+tracked token is shown when its balance is nonzero, and any other ERC-20 when
-  token from every address at once.
-- A tracked token's entry has no holder count and no `decimals` from Blockscout.
-- A tracked token's balance uses the decimals from the bundled list, or else the
-  decimals saved when the token was tracked.
-
-Blockscout may answer just before the user turns the setting off. So the popup's
-refresh and the background's both check the stored setting again when they save.
-If the setting is off by then, the save drops every token the user has not
-tracked.
-
-A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
 more holders. A token claiming a symbol from the bundled list from any other
 contract address is always dropped, tracked or not, and so is any token claiming
@@ -1507,12 +1448,11 @@ wrote last, the record says which build's shape it is in.
 Each write reads the record, changes it and writes it back, holding a lock from
 the read to the write: the browser's own (`navigator.locks`), taken through
 `withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
-background share it, except a page in a Firefox private window, which has locks
+background share it, except a page in a Firefox private window, which Firefox
-of its own. `manifest/firefox.json` sets `"incognito": "not_allowed"`, so such a
+gives locks of its own (see https://git.eeqj.de/sneak/AutistMask/issues/646).
-page cannot read or write extension storage. In Chrome, a page opened from an
+The popup's `saveState()`, the background's `updateState()` and the
-incognito window still runs outside incognito and shares the lock. The popup's
+StateRecovery reset all take it, so among the pages and the background that
-`saveState()`, the background's `updateState()` and the StateRecovery reset all
+share it, no write lands between another write's read and its write, where it
-take it, so no write lands between another write's read and its write, where it
 would be lost. Chrome has it from version 69, older than any Chrome that runs a
 Manifest V3 extension, in pages and in the service worker; Firefox from version
 96, older than the 115 `manifest/firefox.json` declares. Where it is missing, a
@@ -1664,19 +1604,10 @@ renders as it goes, and `viewRouter.js` records every screen that reaches
 more — rendering it a second time would re-fetch and overwrite what it holds,
 such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
-while the user was away from it.
+while the user was away from it. Changing "Use Blockscout" or "Check recipients
-
+on Etherscan" in Settings makes every screen but Settings count as not yet
-Changing "Use Blockscout" or "Check recipients on Etherscan" in Settings makes
+rendered, so "Back" renders the screen it lands on under the new setting; the
-every screen but Settings count as not yet rendered. "Back" then renders again
+stack is left as it is.
-any screen that a reopened popup can render. A change to "Use Blockscout" also
-cuts the stack, as a network switch does (below). The cut drops Send, whose
-token dropdown was filled under the old setting. "Back" cannot render Send
-again. A change to "Check recipients on Etherscan" leaves the stack as it is.
-
-Any other open popup takes either change from the stored record, as it takes a
-network switch (below). That popup then redraws its top screen as a reopened
-popup would. A screen that a reopened popup cannot render, such as Send, is
-replaced by Home.
 
 A network switch leaves every screen on the page showing the previous network.
 The user makes it in Settings, or approves a site's request and the background
@@ -1719,13 +1650,11 @@ view would leave a wallet one click from deletion.
   screen in that case.
 - **Elements**:
     - "Welcome! To get started, add a wallet." text
-    - A well opening with "This wallet sends your data only to the Ethereum RPC
+    - A well saying that the wallet sends the user's data only to the Ethereum
-      endpoint, unless you turn on one of these. You can change them later in
+      RPC endpoint unless one of the two settings in it is turned on, here or
-      Settings."
+      later in Settings: the "Use Blockscout" and "Check recipients on
-    - In the well, the "Use Blockscout" and "Check recipients on Etherscan"
+      Etherscan" checkboxes, the same two as in Settings, each with its sentence
-      checkboxes, the same two as in Settings. Under each, a sentence says what
+      on what it sends and to whom. Both are unticked until the user ticks them
-      the setting sends and to which service. Both are unticked until the user
-      ticks them
     - "Add wallet" button
 - **Transitions**:
     - Ticking or unticking either checkbox → stores the setting, as Settings
@@ -1761,7 +1690,7 @@ view would leave a wallet one click from deletion.
       says "This transaction creates a new contract. It has no recipient." The
       transaction lists on AddressDetail and AddressToken draw the same rows.
       The history comes from Blockscout. While "Use Blockscout" is off,
-      Blockscout is not asked. This list then shows only the line "No
+      Blockscout is not asked, and this list and those two show the one line "No
       transaction history is shown, because "Use Blockscout" is off in
       Settings."
     - "Add additional wallet..." link at bottom
@@ -1801,20 +1730,18 @@ view would leave a wallet one click from deletion.
       without it, the lost-password route on DeleteWallet is the first they
       would hear of it. The hint line reserves its height, so switching tabs
       cannot move the password fields under the pointer.
-    - The password needs at least 12 characters. With "Allow weak passwords"
-      ticked in Settings, one character is enough.
     - "Import" button, with the error line beside it so that it adds no height
       to a screen whose button already starts near the bottom of the popup
 - **Transitions**:
-    - "Import" with a valid entry and a matching password that is long enough →
+    - "Import" with a valid entry and a matching password of at least 12
-      creates the wallet, clears the navigation stack, and → **Home**. When no
+      characters → creates the wallet, clears the navigation stack, and →
-      address is active yet, as on the first wallet, the new wallet's first
+      **Home**. When no address is active yet, as on the first wallet, the new
-      address becomes the active one. The phrase and xprv modes then scan for
+      wallet's first address becomes the active one. The phrase and xprv modes
-      further used addresses and report the count as a flash message. When the
+      then scan for further used addresses and report the count as a flash
-      scan finds two or more used addresses, they replace the wallet's list,
+      message. When the scan finds two or more used addresses, they replace the
-      which then holds the first address only if it was used. If the first
+      wallet's list, which then holds the first address only if it was used. If
-      address was active and is not in the new list, the new list's first
+      the first address was active and is not in the new list, the new list's
-      address becomes the active one and `AUTISTMASK_ACTIVE_CHANGED` is
+      first address becomes the active one and `AUTISTMASK_ACTIVE_CHANGED` is
       broadcast.
     - "Import" with a missing, short or mismatched password → full-sentence
       error on the error line, no screen change
@@ -1833,14 +1760,13 @@ view would leave a wallet one click from deletion.
     - Full address (color dot, etherscan link, tap to copy)
     - USD total for address (see [Partial USD totals](#partial-usd-totals))
     - Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
-      places, USD inline). Each balance row is clickable → **AddressToken**
+      places, USD inline). Each balance row is clickable → **AddressToken**.
-    - While "Use Blockscout" is off, a line under the balance list: "Only
+      While "Use Blockscout" is off, the line Home has under its wallet list
-      tracked tokens are listed, because "Use Blockscout" is off in Settings."
+      follows it
     - Send / Receive / + Token buttons and a "···" menu button
     - "···" dropdown containing a single "Export Private Key" entry
-    - Transaction list (with ENS resolution for counterparties). While "Use
+    - Transaction list (with ENS resolution for counterparties), or the line
-      Blockscout" is off, it shows only the line "No transaction history is
+      Home's list shows while "Use Blockscout" is off
-      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
     - Tap balance row → **AddressToken** (for that token)
     - "Send" → **Send** (refuses with a flash message on a zero balance)
@@ -1908,13 +1834,11 @@ view would leave a wallet one click from deletion.
     - Token contract well (ERC-20 only): full contract address (tap to copy,
       etherscan link) plus name, symbol, decimals, holder count and project
       website where known. The "Holders:" row is left out, not shown as 0, when
-      the token's balance-list entry has no holder count. That happens when:
+      the token's balance-list entry has no holder count: the explorer did not
-        - the explorer did not report a readable one
+      report a readable one, "Use Blockscout" is off, or the token is not in the
-        - "Use Blockscout" is off
+      balance list
-        - the token is not in the balance list
+    - Token-filtered transaction list (only this token's transfers), or the line
-    - Token-filtered transaction list (only this token's transfers). While "Use
+      Home's list shows while "Use Blockscout" is off
-      Blockscout" is off, it shows only the line "No transaction history is
-      shown, because "Use Blockscout" is off in Settings."
 - **Transitions**:
     - "Send" → **Send** (token locked: the dropdown is replaced by a static
       symbol and contract address)
@@ -1931,9 +1855,6 @@ view would leave a wallet one click from deletion.
     - From: address with color dot + etherscan link
     - What to send: token dropdown (or static display with contract address when
       locked from AddressToken)
-    - While "Use Blockscout" is off, a line under the token dropdown: "Only
-      tracked tokens are listed, because "Use Blockscout" is off in Settings."
-      The line is hidden with the dropdown when Send is opened from AddressToken
     - To: address or ENS name input, with an inline validation message
     - Amount input with current balance display, which reads
       `Current balance: unknown (SYMBOL)` for a token whose scale is unknown, as
@@ -1953,14 +1874,13 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
     - "Review" (valid inputs, ENS resolved) → **ConfirmTx**
     - "Review" with an unresolvable ENS name or an invalid amount → flash
-      message, no screen change. A name with no address, or one resolved
+      message, no screen change. An amount is valid when it is a number above
-      off-chain, gets "That ENS name has no on-chain address." An amount is
+      zero, written as digits with at most one decimal point, with nothing but
-      valid when it is a number above zero, written as digits with at most one
+      zeros after the token's last decimal place. ETH has 18 places, and a token
-      decimal point, with nothing but zeros after the token's last decimal
+      with more, or with an unknown number, is held to 18. Zeros past those
-      place. ETH has 18 places, and a token with more, or with an unknown
+      places leave the amount unchanged, so `1.0000000` of a 6-place token
-      number, is held to 18. Zeros past those places leave the amount unchanged,
+      passes and is sent as exactly 1. ConfirmTx makes the same check before
-      so `1.0000000` of a 6-place token passes and is sent as exactly 1.
+      anything can be sent
-      ConfirmTx makes the same check before anything can be sent
     - "Back" → previous screen (Home, AddressDetail, or AddressToken)
 
 #### ConfirmTx (`confirm-tx`)
@@ -2005,11 +1925,11 @@ view would leave a wallet one click from deletion.
       a contract, burn address, and an Etherscan phishing/scam label. An address
       that has received ETH but never sent a transaction still holds that ETH,
       so it gets no warning. The Etherscan label check is made only while "Check
-      recipients on Etherscan" is on. While the setting is off, the Etherscan
+      recipients on Etherscan" is on. While it is off, the Etherscan box is left
-      box is left out. A line in its place says "This address was not checked on
+      out and a line in its place says "This address was not checked on
       Etherscan, because "Check recipients on Etherscan" is off in Settings."
-      The box or the line is chosen when the screen is drawn, so neither moves
+      Which of the two is there is known when the screen is drawn, so neither
-      anything later
+      moves anything later
     - Errors (an invalid amount), plus five reserved error boxes, so the balance
       and the fee arriving later move nothing — the amount exceeds the balance
       (for a token whose scale is unknown it says the token's balance is
@@ -2055,8 +1975,8 @@ view would leave a wallet one click from deletion.
       are that network's, so a testnet transaction shows none, its From, To and
       token contract links open that network's explorer, the balance read, the
       fee estimate and the contract and never-sent recipient checks ask that
-      network's RPC endpoint, and the Etherscan label check asks that network's
+      network's RPC endpoint, and the Etherscan label check, when it is made,
-      explorer
+      asks that network's explorer
     - "Sign & Send" (correct password) when the gas limit, a fee per gas or the
       total fee the RPC endpoint fills in at signing is over its bound in
       `assertWithinCeilings()` (`src/shared/approvalVerify.js`) → nothing is
@@ -2086,9 +2006,6 @@ view would leave a wallet one click from deletion.
       `Unknown (could not be decoded)` with no symbol, not the transaction's ETH
       value. When that swap's `Token In` is `ETH (native)`, the transaction's
       ETH value in the network's currency, as for any other transaction
-    - A line under the amount, worded as on TxApproval. While "Use Blockscout"
-      is off, the line shows when the bundled list and the tracked tokens lack
-      the token's name or decimals.
     - To: color dot + full address + etherscan link; for a contract creation,
       which has no recipient, "This transaction creates a new contract. It has
       no recipient." instead
@@ -2121,9 +2038,7 @@ view would leave a wallet one click from deletion.
 - **Elements**:
     - "Transaction Confirmed" heading
     - Decoded action well (shown when the transaction carried recognized
-      calldata; the top-level Amount and To are hidden in that case). Each token
+      calldata; the top-level Amount and To are hidden in that case)
-      in the well gets TxApproval's line under it whenever TxApproval would show
-      that line.
     - Amount + symbol
     - To: color dot + full address + etherscan link, or for a contract creation
       the same sentence as on WaitTx
@@ -2146,8 +2061,6 @@ view would leave a wallet one click from deletion.
     - Amount + symbol, or for a swap the approval screen showed no `Amount` for,
       the same as on WaitTx: `Unknown (could not be decoded)`, unless its
       `Token In` is `ETH (native)`
-    - The same line under the amount as on WaitTx, whenever WaitTx would show
-      it.
     - To: color dot + full address + etherscan link, or for a contract creation
       the same sentence as on WaitTx
     - Error message (dashed border box)
@@ -2182,11 +2095,12 @@ view would leave a wallet one click from deletion.
   AddressToken. The screen describes the transaction on the network it was sent
   on, whichever network is active: its block, network details, decoded details
   and raw data are read from that network's Blockscout, the one Settings has for
-  it, and its etherscan links open that network's explorer. While "Use
+  it, and its etherscan links open that network's explorer. They are read only
-  Blockscout" is off, Blockscout is not asked. One line then takes the place of
+  while "Use Blockscout" is on. The screen can still be shown with it off, when
-  the block, network details, decoded details and raw data: "This screen shows
+  the user opens Settings from it, turns the setting off and presses Back; then
-  no block, decoded details, network details or raw data, because "Use
+  Blockscout is not asked, and a line in their place says "No block, decoded
-  Blockscout" is off in Settings."
+  details, network details or raw data are shown, because "Use Blockscout" is
+  off in Settings."
 - **Elements** (grouped into logical blocks using light well containers; field
   labels are self-explanatory so groups have no headings):
     - "Transaction" heading, "Back" button
@@ -2251,10 +2165,6 @@ view would leave a wallet one click from deletion.
     - Wallets: one row per wallet with its name (tap to rename inline), a
       `[recovery phrase]` button on HD wallets only, and an `[x]` delete button,
       plus a "+ Add wallet" button
-    - Passwords:
-        - "Allow weak passwords" checkbox, unticked until the user ticks it
-        - A sentence saying the setting lets the user choose a password shorter
-          than 12 characters on AddWallet
     - Tracked Tokens: one row per token tracked on the active network with an
       `[x]` remove button, plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
@@ -2273,21 +2183,18 @@ view would leave a wallet one click from deletion.
       already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
-    - Blockscout API:
+    - Blockscout API: a "Use Blockscout" checkbox, unticked until the user ticks
-        - "Use Blockscout" checkbox, unticked until the user ticks it
+      it, with a sentence saying it sends the user's addresses, and the hash of
-        - A sentence saying what the setting shows and what it sends. With the
+      each transaction opened, to the Blockscout API below, for transaction
-          setting on, the wallet sends the Blockscout API the user's addresses
+      history, tokens not tracked, and transaction details; then the endpoint
-          and the hash of each transaction opened
+      URL input + "Save" button (validated against `/stats` before being saved,
-        - Endpoint URL input + "Save" button. "Save" asks the URL for `/stats`
+      a request the user presses for that carries no user data, made whether or
-          and saves the URL only if that request succeeds. The request carries
+      not the checkbox is ticked)
-          no user data and is made whether or not "Use Blockscout" is ticked.
+    - Etherscan: a "Check recipients on Etherscan" checkbox, unticked until the
-    - Etherscan:
+      user ticks it, with a sentence saying it sends the address about to be
-        - "Check recipients on Etherscan" checkbox, unticked until the user
+      sent to, to Etherscan, to look for a phishing or scam label on it. Both
-          ticks it
+      checkboxes are one setting each for every network, and Welcome offers the
-        - A sentence saying the setting sends each recipient's address to
+      same two
-          Etherscan, to check the address for a phishing or scam label
-    - Each of the two settings applies to every network. Welcome offers the same
-      two checkboxes
     - Token Spam Protection:
         - "Hide fake tokens impersonating a known symbol" checkbox
         - "Hide tokens with fewer than 1,000 holders" checkbox
@@ -2312,9 +2219,8 @@ view would leave a wallet one click from deletion.
       turns on the red banner and verbose logging
 - **Transitions**:
     - Ticking or unticking "Use Blockscout" or "Check recipients on Etherscan" →
-      stores the setting (no screen change). From then on, every screen drawn
+      stores the setting (no screen change). The next balance refresh and every
-      and every balance refresh uses the new setting. Unticking "Use Blockscout"
+      screen drawn after that follow it
-      also drops every token the user has not tracked from every address
     - "+ Add wallet" → **AddWallet**
     - "+ Add token" → **SettingsAddToken**
     - `[recovery phrase]` on an HD wallet → **ShowRecoveryPhrase**
@@ -2333,8 +2239,7 @@ view would leave a wallet one click from deletion.
       nothing and tells the background nothing
     - Ten clicks on the version → reveals the Debug well (no screen change)
     - "Back" (or Settings gear again) → previous screen (Home); after a network
-      switch or a change to "Use Blockscout", the stack is cut first (see the
+      switch, the stack is cut first (see the top of Screen Map)
-      top of Screen Map)
 
 #### ShowRecoveryPhrase (`show-phrase`)
 
@@ -2491,8 +2396,6 @@ view would leave a wallet one click from deletion.
       money. The predicate is `addressHoldsFunds()` in
       `src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
       warning, never a refusal.
-    - While "Use Blockscout" is off, a line under the warning: "Only tracked
-      tokens are listed, because "Use Blockscout" is off in Settings."
     - The rule that a wallet always keeps at least one address, and that
       removing the last one means deleting the wallet from Settings
     - Error line
@@ -2625,12 +2528,6 @@ view would leave a wallet one click from deletion.
       a swap pays only the From address, a `Paid to` line for each other address
       it pays, or saying that a token stays in the router or who it pays is
       unknown (see Transaction Decoding)
-    - A line under each token of the decoded action: "Blockscout's report of
-      your balances is not used to name this token, because "Use Blockscout" is
-      off in Settings." While "Use Blockscout" is off, the line shows when the
-      bundled list and the tracked tokens lack the token's name or decimals.
-      While the setting is on, Blockscout's report of the user's balances is a
-      third source of a token's name and decimals (see Unknown token scale).
     - From: color dot + full address + etherscan link
     - Contract: color dot + full address + etherscan link, token symbol label if
       known; for a contract creation, the same sentence as on WaitTx
@@ -2657,14 +2554,8 @@ view would leave a wallet one click from deletion.
       Data Model) → full-sentence error on the error line saying why, nothing
       signed (no screen change)
     - "Reject" → closes popup (returns rejection to background)
-    - "Reject" after "Confirm", while the transaction is being sent → the
+    - Popup window closed without answering → the request is rejected with
-      background's message on the error line, no screen change
+      EIP-1193 code 4001
-    - Popup window closed without answering → the request stays pending, and the
-      site gets no answer. The browser can close this window when the user
-      clicks away from it, for example to copy the password from a password
-      manager. Until the request is answered, the toolbar button opens this
-      screen instead of the wallet. When several requests wait with their
-      windows closed, the toolbar button opens the oldest first.
 
 #### SignApproval (`approve-sign`)
 
@@ -2716,10 +2607,7 @@ view would leave a wallet one click from deletion.
       the site puts in the message, except a `Permit`'s token, which is the
       domain's `verifyingContract`; any those fields do not give is shown as
       `Unknown`, and the domain, type and message lines still follow. Only typed
-      data that cannot be read at all is shown as raw text. A token gets the
+      data that cannot be read at all is shown as raw text.
-      same line under it as on TxApproval, whenever TxApproval would show that
-      line. As there, Blockscout's report of the user's balances is a source of
-      a token's name and decimals only while "Use Blockscout" is on.
     - Raw data (`personal_sign` and `eth_sign`): the message's hex exactly as
       the site sent it. The bytes it encodes are what is signed, as an EIP-191
       personal message.
@@ -2753,11 +2641,8 @@ view would leave a wallet one click from deletion.
     - "Sign" (wrong password, or a signing failure) → error line, no screen
       change
     - "Reject" → closes popup (returns rejection to background)
-    - "Reject" after "Sign", while the signature is being checked → the
+    - Popup window closed without answering → the request is rejected with
-      background's message on the error line, no screen change
+      EIP-1193 code 4001
-    - Popup window closed without answering → the request stays pending, as on
-      TxApproval. Until the request is answered, the toolbar button opens this
-      screen instead of the wallet.
 
 #### NetworkApproval (`approve-network`)
 
@@ -2821,9 +2706,6 @@ view would leave a wallet one click from deletion.
     - "Export Saved Data" button, and the read-only text box it fills
     - What erasing does and does not do, in bold: every wallet stored in this
       browser is deleted; nothing on chain changes and no money is moved
-    - What a wallet can be added again from: a kept copy of its recovery phrase,
-      private key or extended private key. Without that copy or the exported
-      copy, everything the wallet holds is gone forever.
     - A text input asking for `ERASE MY WALLET` to be typed back
     - Error line
     - "Erase Saved Data" button
@@ -2855,23 +2737,13 @@ view would leave a wallet one click from deletion.
 
 ### External Services
 
-AutistMask is not a fully self-contained offline tool. By default it contacts
+AutistMask is not a fully self-contained offline tool. By default it sends the
-only the Ethereum RPC endpoint. USD prices are read from Chainlink price feed
+user's data to one service only, the Ethereum RPC endpoint, and asks one more,
-contracts through that endpoint.
+the CoinDesk price API, for prices with nothing but token symbols. Two more
-
+services are sent none of the user's data until the user turns on the setting
-Two more services are sent none of the user's data until the user turns on a
+for each, on the Welcome screen or in Settings: Blockscout ("Use Blockscout")
-setting for each:
+and Etherscan ("Check recipients on Etherscan"). Both settings are off in a new
-
+profile, and each is one setting for every network.
-- Blockscout, with "Use Blockscout"
-- Etherscan, with "Check recipients on Etherscan"
-
-Both settings are off in a new install. Welcome and Settings both offer them.
-Each setting applies to every network.
-
-Before each request that sends the user's data to Blockscout or Etherscan, the
-wallet reads that service's setting from storage. The wallet reads the setting
-again when the answer lands. While the setting is off, no such request is made,
-and an answer that lands after the setting went off is dropped.
 
 Contacted by default:
 
@@ -2880,12 +2752,9 @@ Contacted by default:
   them the balance of every tracked token at every address (`balanceOf`),
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
-  receipts. Every ENS lookup is made through the RPC endpoint alone. So a name
+  receipts. ENS lookups, of a name typed into Send and of the names shown for
-  does not resolve when its resolver says the name is resolved off-chain. On
+  the user's addresses, are made through it alone, so a name whose resolver says
-  mainnet the extension also reads USD prices from Chainlink price feed
+  it is resolved off-chain does not resolve. The default endpoint is a public
-  contracts (`latestRoundData`). The prices of ETH and of each held or tracked
-  token with a feed are read as one batched request. That request is sent at
-  most every 5 minutes while the popup is open. The default endpoint is a public
   RPC (configurable by the user to any endpoint they prefer, including a local
   node). By default the extension talks to
   `https://ethereum-rpc.publicnode.com`.
@@ -2893,44 +2762,43 @@ Contacted by default:
       parameters. The RPC endpoint can see all on-chain queries and submitted
       transactions.
 
-Sent the user's data only while its setting is on:
+- **CoinDesk CADLI price API**: Used to fetch ETH/USD and token/USD prices for
+  displaying fiat values. The price is cached for 5 minutes to avoid excessive
+  requests. No API key required. No user data is sent — only a list of token
+  symbols. Note that CoinDesk will receive your client IP.
+    - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
+      addresses or user-specific data.
 
-- **Blockscout block-explorer API** ("Use Blockscout"): The default endpoint is
+Sent the user's data only while the user has turned the setting on:
-  `https://eth.blockscout.com/api/v2` (configurable by the user in Settings).
+
-    - **Used for**:
+- **Blockscout block-explorer API** ("Use Blockscout"): Used to fetch
-        - transaction history (normal transactions and ERC-20 token transfers),
+  transaction history (normal transactions and ERC-20 token transfers) for Home,
-          for Home, AddressDetail and AddressToken
+  AddressDetail and AddressToken, the balances of the ERC-20 tokens the user has
-        - the balances of the ERC-20 tokens the user has not tracked, for Home,
+  not tracked, token holder counts (for spam filtering), and a transaction's
-          AddressDetail, Send and DeleteAddress
+  block, network details and calldata for TransactionDetail. The default
-        - the names and decimals of those tokens, for TxApproval, SignApproval,
+  endpoint is `https://eth.blockscout.com/api/v2` (configurable by the user in
-          WaitTx, SuccessTx and ErrorTx
+  Settings). While the setting is off, those screens say in a plain line what is
-        - token holder counts, for spam filtering
+  not shown and that this setting turns it on, and only tracked tokens are
-        - a transaction's block, network details and calldata, for
+  listed, their balances read through the RPC endpoint. The endpoint check
-          TransactionDetail
+  Settings makes when the user presses "Save" beside the URL asks only for
-    - **Contacted**, while the setting is on:
+  `/stats` and carries no user data; it is made whether or not the setting is
-        - on every balance refresh, in the popup and in the background
+  on.
-        - when Home, AddressDetail or AddressToken loads its history
-        - when TransactionDetail opens
-    - **While the setting is off**: Each screen that would show Blockscout's
-      data says instead that the setting is off. Only tracked tokens are listed.
-    - **Saving the URL**: pressing "Save" beside the URL in Settings asks that
-      URL for `/stats`, whether or not the setting is on. This request carries
-      no user data.
     - **Data sent**: Ethereum addresses, and the hash of each transaction the
       user opens. Blockscout receives the user's addresses to query their
       transaction history and token balances. No private keys, passwords, or
       signing operations are sent.
 
-- **Etherscan address labels** ("Check recipients on Etherscan"): While the
+- **Etherscan address labels** ("Check recipients on Etherscan"): When
-  setting is on, ConfirmTx looks up the recipient's address on Etherscan each
+  confirming a transaction, the extension performs a best-effort lookup of the
-  time the screen is shown. The lookup checks for a phishing or scam label,
+  recipient address on Etherscan to check for phishing/scam labels. This is a
-  best-effort. This is a direct page fetch with no API key; the user's browser
+  direct page fetch with no API key; the user's browser makes the request. While
-  makes the request. While the setting is off, ConfirmTx says that no Etherscan
+  the setting is off, ConfirmTx says that no Etherscan check was made.
-  check was made.
+    - **Data sent**: the recipient address. The user's own addresses are not
-    - **Data sent**: the recipient's address and nothing else.
+      sent.
 
 The etherscan links on the screens open a page in the browser when the user
-clicks one. They are not requests the wallet makes.
+clicks one. They are not requests the wallet makes, and nothing is fetched from
+them until then.
 
 What the extension does NOT do:
 
@@ -2939,9 +2807,9 @@ What the extension does NOT do:
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
-Users who want maximum privacy can point the RPC URL at their own node. With
+Users who want maximum privacy can point the RPC URL at their own node, and,
-"Use Blockscout" on, they can point the Blockscout URL at their own instance
+when they turn Blockscout on, the Blockscout URL at their own instance (price
-too.
+fetching can be disabled in a future version).
 
 ### Dependencies
 
@@ -3068,13 +2936,14 @@ hardcoded test phrase.
 
 At the raised log level the console also shows the wallet's addresses with their
 balances and ENS names, the token contracts looked up, and a line for each
-request made through `debugFetch` in `src/shared/log.js` (the explorer, the RPC
+request made through `debugFetch` in `src/shared/log.js` (the explorer, the
-calls a site makes, and the endpoint checks in settings) and for its response. A
+price feed, the RPC calls a site makes, and the endpoint checks in settings) and
-request is logged by its HTTP method, the origin of its URL (scheme, host and
+for its response. A request is logged by its HTTP method, the origin of its URL
-port) and, for a JSON-RPC call, the method name; the balance refresh, the token
+(scheme, host and port) and, for a JSON-RPC call, the method name; the balance
-lookup and a failed endpoint check in settings name the endpoint by its origin
+refresh, the token lookup and a failed endpoint check in settings name the
-too. The URL's path and query string, where RPC providers put API keys, any user
+endpoint by its origin too. The URL's path and query string, where RPC providers
-name and password in it, and the request body are never logged.
+put API keys, any user name and password in it, and the request body are never
+logged.
 
 ### Key Decisions
 
@@ -3089,11 +2958,6 @@ name and password in it, and the request body are never logged.
     - The user's password is run through Argon2id (`crypto_pwhash`) to derive a
       256-bit encryption key. Argon2id is memory-hard, making GPU/ASIC brute
       force attacks expensive.
-    - Each use of the password runs one Argon2id derivation at libsodium's
-      interactive setting: `OPSLIMIT_INTERACTIVE` and `MEMLIMIT_INTERACTIVE`, 2
-      passes over 64 MiB. Every signature asks for the password, so a light
-      setting keeps signing quick. The password's length, not the derivation's
-      cost, is what protects the stored secret.
     - The derived key encrypts the secret material using XSalsa20-Poly1305
       (`crypto_secretbox`), which provides authenticated encryption (the
       ciphertext cannot be tampered with without detection).
@@ -3127,10 +2991,9 @@ name and password in it, and the request body are never logged.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
-- View ERC-20 token balances:
+- View ERC-20 token balances (tokens the user adds by contract address, and,
-    - tokens the user adds by contract address
+  while "Use Blockscout" is on, tokens on the bundled known-token list and
-    - while "Use Blockscout" is on, tokens on the bundled known-token list and
+  tokens with 1,000 or more holders)
-      tokens with 1,000 or more holders
 - View transaction history and transaction details, while "Use Blockscout" is on
 - Send ETH to an address
 - Send ERC-20 tokens to an address
@@ -3506,36 +3369,34 @@ Currently supported:
   the router take `Token In` (see below): a permit of 5,000 DAI to another
   address and then a V3 exact-in of 600 USDT read `Swap USDT → USDC` with
   `Amount 600.0000 USDT`, and so do that exact-in and then a permit of 5,000 DAI
-  to the router. A permit on the zero address never stands as the `Amount`
+  to the router. When a permit's amount stands and the step that sets the input
-  figure, because Permit2 has no allowance of ETH. When a permit's amount stands
+  side spends a token other than the permit's, or one the decoder does not know,
-  and the step that sets the input side spends a token other than the permit's,
+  that step's amount gets lines of its own, unless it states no amount and the
-  or one the decoder does not know, that step's amount gets lines of its own,
+  user pays it none of its input token. Each take the total does not count gives
-  unless it states no amount and the user pays it none of its input token. Each
+  three lines after the `Amount` line (after `Token In` when there is none): one
-  take the total does not count gives three lines after the `Amount` line (after
+  of a token other than `Token In`; one of `Token In` after an amount that is
-  `Token In` when there is none): one of a token other than `Token In`; one of
+  not a quantity (a V4 open delta, `ALREADY_PAID`, which keep their wording on
-  `Token In` after an amount that is not a quantity (a V4 open delta,
+  the `Amount` line, or no stated amount, as of a V4 exact-out step); and one
-  `ALREADY_PAID`, which keep their wording on the `Amount` line, or no stated
+  whose amount the decoder does not know. When there is no `Amount` line, each
-  amount, as of a V4 exact-out step); and one whose amount the decoder does not
+  take the total counts gets them too, so that every amount the decoder reads is
-  know. When there is no `Amount` line, each take the total counts gets them
+  shown: the amount the step that sets the input side states, when it is a
-  too, so that every amount the decoder reads is shown: the amount the step that
+  quantity and the user pays that step (a V2 or V3 step whose `payerIsUser` is
-  sets the input side states, when it is a quantity and the user pays that step
+  true, a V4 step the user pays some of its input token, or a `WRAP_ETH`, whose
-  (a V2 or V3 step whose `payerIsUser` is true, a V4 step the user pays some of
+  ETH comes from the transaction's value), and each later take of `Token In`
-  its input token, or a `WRAP_ETH`, whose ETH comes from the transaction's
+  added to it. A step that sets the input side and is paid from the router takes
-  value), and each later take of `Token In` added to it. A step that sets the
+  nothing from the user's wallet and gets none. A `PERMIT2_PERMIT` the decoder
-  input side and is paid from the router takes nothing from the user's wallet
+  cannot read, then V3 exact-ins of 600 USDT and 400 DAI paid by the user, give
-  and gets none. A `PERMIT2_PERMIT` the decoder cannot read, then V3 exact-ins
+  lines for both amounts. When the step that sets the input side states no
-  of 600 USDT and 400 DAI paid by the user, give lines for both amounts. When
+  amount, the user pays it some of its input token, and there is no `Amount`
-  the step that sets the input side states no amount, the user pays it some of
+  line, that step gets them too whenever another take's lines give a figure, or
-  its input token, and there is no `Amount` line, that step gets them too
+  a `PERMIT2_TRANSFER_FROM` of its token gives one, on the lines below or, into
-  whenever another take's lines give a figure, or a `PERMIT2_TRANSFER_FROM` of
+  the router, on its `Paid to` line, so that figure cannot read as all that
-  its token gives one, on the lines below or, into the router, on its `Paid to`
+  leaves. When it states no amount and the user pays it none of its input token,
-  line, so that figure cannot read as all that leaves. When it states no amount
+  as when the router pays it, that step takes none of that token from the user's
-  and the user pays it none of its input token, as when the router pays it, that
+  wallet and never gets them, with a permit or without. They come in step order,
-  step takes none of that token from the user's wallet and never gets them, with
+  except that the step that sets the input side comes first when it has them,
-  a permit or without. They come in step order, except that the step that sets
+  followed, when there is no `Amount` line, by the other takes the total counts:
-  the input side comes first when it has them, followed, when there is no
+  `Moved from the sender`, its amount, worded as the `Amount` line words one, or
-  `Amount` line, by the other takes the total counts: `Moved from the sender`,
-  its amount, worded as the `Amount` line words one, or
   `Unknown (could not be decoded)` when the decoder does not know it;
   `Token moved`, giving the token's address as the `Token In` line does; and
   `Moved to`, which reads `The swap step that spends it`. A token the decoder
@@ -3568,32 +3429,30 @@ Currently supported:
   amount stands gives none: the `Amount` line gives its amount, `Token In` its
   token, and its spender is the router. Each allowance a `PERMIT2_PERMIT_BATCH`
   grants, one for each token it names, all for its one spender, gives the same
-  three lines, in step order with those of each `PERMIT2_PERMIT`. For an
+  three lines, in step order with those of each `PERMIT2_PERMIT`. A
-  allowance of the zero address, `Permit2 allowance` gives the amount in base
+  `PERMIT2_PERMIT` or `PERMIT2_PERMIT_BATCH` whose input the decoder cannot
-  units and `Allowance token` gives the zero address. A `PERMIT2_PERMIT` or
+  read, such as one whose token or spender word has a nonzero top byte, may let
-  `PERMIT2_PERMIT_BATCH` whose input the decoder cannot read, such as one whose
+  any spender take any amount of any token: it gives one `Permit2 allowance`
-  token or spender word has a nonzero top byte, may let any spender take any
+  line alone, reading `Unknown (could not be decoded)`. These lines change no
-  amount of any token: it gives one `Permit2 allowance` line alone, reading
+  `Paid to` line: a permit or batch pays nobody. But code that a step runs, such
-  `Unknown (could not be decoded)`. These lines change no `Paid to` line: a
+  as a V4 pool's hook or a token's own code, can call a spender other than the
-  permit or batch pays nobody. But code that a step runs, such as a V4 pool's
+  router, which can then take up to its allowance from the user's wallet before
-  hook or a token's own code, can call a spender other than the router, which
+  the transaction ends. So an allowance to any spender but the router, or a
-  can then take up to its allowance from the user's wallet before the
+  permit or batch the decoder cannot read, makes the minimum read
-  transaction ends. So an allowance to any spender but the router, or a permit
+  `Min. paid out`, and when its token is `Token In`, or the decoder does not
-  or batch the decoder cannot read, makes the minimum read `Min. paid out`, and
+  know its token or `Token In`, it leaves no `Amount` line, whose figure might
-  when its token is `Token In`, or the decoder does not know its token or
+  be too low: a permit of 5,000 USDT to another address and then a V3 exact-in
-  `Token In`, it leaves no `Amount` line, whose figure might be too low: a
+  of 600 USDT read with no `Amount` line, and the 600 USDT gets lines of its
-  permit of 5,000 USDT to another address and then a V3 exact-in of 600 USDT
+  own. A step goes unread when its recipient does not decode as an address, when
-  read with no `Amount` line, and the 600 USDT gets lines of its own. A step
+  it is a V3 swap step whose path is shorter than one token address or has bytes
-  goes unread when its recipient does not decode as an address, when it is a V3
+  after its last hop, or when it is a command the decoder does not read: every
-  swap step whose path is shorter than one token address or has bytes after its
+  command other than `PERMIT2_PERMIT`, `PERMIT2_PERMIT_BATCH`,
-  last hop, or when it is a command the decoder does not read: every command
+  `PERMIT2_TRANSFER_FROM`, `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`,
-  other than `PERMIT2_PERMIT`, `PERMIT2_PERMIT_BATCH`, `PERMIT2_TRANSFER_FROM`,
+  `V3_SWAP_EXACT_IN`, `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`,
-  `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`, `V3_SWAP_EXACT_IN`,
+  `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`,
-  `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`, `PAY_PORTION`,
+  `WRAP_ETH`, `UNWRAP_WETH` and `BALANCE_CHECK_ERC20`
-  `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`, `WRAP_ETH`,
+  (`PERMIT2_TRANSFER_FROM_BATCH`, `EXECUTE_SUB_PLAN` and the NFT commands among
-  `UNWRAP_WETH` and `BALANCE_CHECK_ERC20` (`PERMIT2_TRANSFER_FROM_BATCH`,
+  them), or a type its release names no command for.
-  `EXECUTE_SUB_PLAN` and the NFT commands among them), or a type its release
-  names no command for.
 
 ### Non-Goals Forever
 

docs/README.md

@@ -58,7 +58,7 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
 - **No third-party token list APIs.** The balances of the tokens you track are
-  read from your RPC endpoint. While "Use Blockscout" is on, the other tokens
+  read from your RPC endpoint; while you have "Use Blockscout" on, the others
   come from the same block explorer you configure for transaction history. The
   extension ships its own hardcoded list of top ERC-20 contract addresses for
   symbol-spoofing detection. Any token you want tracked across all your
@@ -70,13 +70,11 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. Out of the box it contacts only the Ethereum RPC
+not have a backend server. Out of the box it sends your data only to the
-endpoint. USD prices are read from Chainlink price feed contracts through that
+Ethereum RPC endpoint, and asks the CoinDesk price API for prices with nothing
-endpoint.
+but token symbols. Blockscout and Etherscan are sent none of your data until you
-
+turn on "Use Blockscout" or "Check recipients on Etherscan", on the Welcome
-Blockscout and Etherscan are sent none of your data until you turn on a setting
+screen or later in Settings. Both are off in a new install.
-for each. The settings are "Use Blockscout" and "Check recipients on Etherscan".
-Both are off in a new install. Welcome and Settings both offer them.
 
 ### External Services
 
@@ -89,20 +87,11 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-On mainnet, AutistMask also reads USD prices through this endpoint. The prices
+When it is contacted: on every balance refresh (every 10 seconds while the popup
-come from Chainlink's price feed contracts. A token with no Chainlink feed shows
+is open, every 60 seconds in the background), when you type an ENS name into the
-no USD value.
+Send screen, when a send is prepared and broadcast, while a pending transaction
-
+is polled for its receipt, and for the reverse ENS lookups used to label
-When it is contacted:
+addresses (cached for 12 hours).
-
-- on every balance refresh (every 10 seconds while the popup is open, every 60
-  seconds in the background)
-- on mainnet, to read USD prices, at most every 5 minutes while the popup is
-  open
-- when you review a send to an ENS name
-- when a send is prepared and broadcast
-- while a pending transaction is polled for its receipt
-- for the reverse ENS lookups used to label addresses (cached for 12 hours)
 
 What gets sent: standard Ethereum JSON-RPC requests (balance queries,
 transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
@@ -111,49 +100,52 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
-Blockscout is an open-source blockchain explorer. AutistMask sends it your data
+Off until you turn on "Use Blockscout". Used to fetch transaction history, the
-only while "Use Blockscout" is on. AutistMask then asks Blockscout for:
+balances of the tokens you have not tracked, and the details of a transaction
+you open. Blockscout is an open-source blockchain explorer. AutistMask queries
+it for your ERC-20 token balances (including the holder counts used for spam
+filtering), your recent transactions and token transfers, and the block, fees
+and calldata of a transaction you open. You can change this in Settings to a
+self-hosted Blockscout instance. While it is off, the screens that would show
+history say so, and only the tokens you track are listed.
 
-- your recent transactions and token transfers
+When it is contacted: while "Use Blockscout" is on, on every balance refresh,
-- the balances of the tokens you have not tracked, with the holder counts used
+whenever a screen showing transaction history is opened, and when you open a
-  for spam filtering
+transaction. The one exception, whether or not the setting is on, is pressing
-- the block, fees and calldata of a transaction you open
+"Save" beside the Blockscout URL in Settings, which checks that URL by asking it
-
+for `/stats` and sends none of your data.
-You can change the endpoint in Settings to a self-hosted Blockscout instance.
-While the setting is off, each screen that would show Blockscout's data says
-instead that the setting is off. Only the tokens you track are listed. When you
-turn the setting off, every other token leaves the lists at once.
-
-When it is contacted, while "Use Blockscout" is on:
-
-- on every balance refresh
-- whenever a screen showing transaction history is opened
-- when you open a transaction
-
-Pressing "Save" beside the Blockscout URL in Settings checks the URL by asking
-it for `/stats`. That happens whether or not the setting is on. The request
-sends none of your data.
 
 What gets sent: your Ethereum addresses (to look up balances and transactions)
 and the hash of each transaction you open.
 
+**CoinDesk CADLI price API** (`data-api.coindesk.com`)
+
+Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
+cached for 5 minutes. No API key is required. This endpoint is not
+user-configurable, and it is not contacted at all while you are on a testnet,
+where no USD values are shown.
+
+When it is contacted: while the popup is open, at most once every 5 minutes.
+
+What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
+balances, no identifying information. As with any request, CoinDesk sees your IP
+address.
+
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
-While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
+Off until you turn on "Check recipients on Etherscan". When you review a send,
-public Etherscan address page when you review a send. AutistMask looks for a
+AutistMask fetches the recipient's public Etherscan address page and looks for a
 "Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
 it finds one. This is a plain page fetch with no API key, made by your browser.
 It is best-effort: if it fails, it is silently ignored. This endpoint is not
-user-configurable.
+user-configurable. While it is off, the confirmation screen says that no
-
+Etherscan check was made.
-The setting is off in a new install. While it is off, the confirmation screen
-says that no Etherscan check was made.
 
 When it is contacted: only while "Check recipients on Etherscan" is on, each
 time you reach the send confirmation screen.
 
-What gets sent: the recipient's address and nothing else. As with any request,
+What gets sent: the recipient address you are about to send to, and your IP
-Etherscan sees your IP address.
+address. Your own addresses are not sent.
 
 Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
 contracts) are ordinary links. They contact nothing until you click them.
@@ -201,18 +193,15 @@ password.
 3. Click "Load Temporary Add-on".
 4. Select `dist/firefox/manifest.json`.
 
-AutistMask does not work in Firefox private windows. If Firefox is set to "Never
-remember history", every window is private, so AutistMask does not work at all.
-
 ## Getting Started
 
 ### Creating a New Wallet
 
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
-   On first use, the screen with "Add wallet" also offers "Use Blockscout" and
+   On first use the same screen offers "Use Blockscout" and "Check recipients on
-   "Check recipients on Etherscan", both off. External Services above says what
+   Etherscan", both off; tick either if you want what it does (see External
-   each one does. You can change both later in Settings.
+   Services). You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
    recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -248,14 +237,11 @@ always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-The wallet looks for tokens you hold only while "Use Blockscout" is on. Even
+Tokens you hold show up automatically only while "Use Blockscout" is on, and
-then, a token shows up only if it is in the extension's bundled list of
+then only if they are in the extension's bundled list of well-known tokens or
-well-known tokens or has at least 1,000 holders. Everything else is treated as
+have at least 1,000 holders; everything else is treated as spam and hidden. To
-spam and hidden.
+track a token explicitly (which also shows it at zero balance, and shows it
-
+whether or not "Use Blockscout" is on), add it by contract address:
-The wallet shows every token you track, whether or not "Use Blockscout" is on.
-By default a tracked token is shown at zero balance too (see Display in
-Settings). To track a token, add it by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -269,12 +255,9 @@ screen. Tokens can also be added from Settings, under "Tracked Tokens".
 ## Sending
 
 1. Click "Send" from the home screen or an address detail view.
-2. Select what to send: ETH, or a token you track that this address holds. While
+2. Select what to send (ETH, or any ERC-20 token with a balance on this address
-   "Use Blockscout" is on, Send also offers other tokens with a balance on this
+   that survives the spam filters).
-   address that survive the spam filters.
+3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
-3. Enter the recipient address or ENS name (e.g. `vitalik.eth`). AutistMask does
-   not look up a name resolved off-chain. For such a name, enter the address
-   instead.
 4. Enter the amount, or click "Max" to fill it in: a token's balance, cut to 18
    decimal places, or your ETH balance minus the amount reserved for the network
    fee.
@@ -291,12 +274,8 @@ The confirmation screen shows:
   estimate, and below it the larger amount reserved until it confirms. The
   reserve is what the network requires up front and what the balance check gates
   on; the refund of the difference is why the two differ
-- **Warnings** if the recipient is:
+- **Warnings** if the recipient is a contract, a burn address, one of your own
-    - a contract
+  addresses, on the bundled scam-address list, or labelled as a phisher on
-    - a burn address
-    - one of your own addresses
-    - on the bundled scam-address list
-    - while "Check recipients on Etherscan" is on, labelled as a phisher on
   Etherscan
 
 After reviewing, enter your password and click "Sign & Send". The transaction
@@ -308,9 +287,8 @@ screen with the transaction hash and an Etherscan link.
 
 You can also send from a token-specific view: on the address detail screen,
 click any token balance row. This opens a focused view showing only that token's
-transactions. While "Use Blockscout" is off, the view says instead that no
+transactions. Clicking "Send" from here pre-selects and locks the token so you
-transaction history is shown. Clicking "Send" from here pre-selects and locks
+cannot accidentally switch to a different one.
-the token so you cannot accidentally switch to a different one.
 
 ## Receiving
 
@@ -346,13 +324,6 @@ enter your password and click "Confirm" to authorize it. Message and typed-data
 signature requests work the same way, with a "Sign" button, and also require
 your password.
 
-If a transaction or signature popup closes before you answer, for example when
-you click away to copy your password, the request stays open. Closing the popup
-does not turn the request down. Click the AutistMask icon in your browser
-toolbar to bring the request back. Until you answer, the icon opens the request
-instead of your wallet. If several requests are waiting this way, the oldest
-comes first.
-
 A connected site can also ask to switch the wallet's network. A popup shows the
 site's origin, the current network and the requested network. Nothing changes
 unless you click "Switch"; clicking "Reject" or closing the popup leaves
@@ -391,12 +362,11 @@ balances unless they are on the bundled known-token list or you added them
 yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
 for address poisoning typically have zero. When the explorer reports no holder
 count for a token, or reports something other than a whole number in plain
-digits (such as "1,000"), the count is unknown. While "Use Blockscout" is off,
+digits (such as "1,000"), the count is unknown. An unknown count does not hide a
-no holder count is known. An unknown count does not hide a token from your
+token from your transaction history or the send token list, and it does not get
-transaction history or the send token list, and it does not get a token into
+a token into your balances either: such a token is listed only if it is on the
-your balances either: such a token is listed only if it is on the bundled
+bundled known-token list or you added it yourself. The screen you reach by
-known-token list or you added it yourself. The screen you reach by clicking a
+clicking a token balance shows a "Holders:" line only when the count is known.
-token balance shows a "Holders:" line only when the count is known.
 
 **Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
 adds the contract address to a local blocklist. Future transactions from that
@@ -428,8 +398,6 @@ see everything unfiltered.
 Click the gear icon on the home screen to access settings:
 
 - **Wallets**: Your wallets, and "+ Add wallet".
-- **Passwords**: Tick "Allow weak passwords" to choose a password shorter than
-  12 characters when you add a wallet.
 - **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
   token".
 - **Display**: Toggle whether tracked tokens with zero balance are shown, switch
@@ -439,8 +407,9 @@ Click the gear icon on the home screen to access settings:
   that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
-- **Blockscout API**: the "Use Blockscout" checkbox, off until you tick it, and
+- **Blockscout API**: "Use Blockscout", off until you tick it, and the
-  the URL of the Blockscout instance. You can use a self-hosted instance.
+  Blockscout instance used for transaction history, the tokens you have not
+  tracked and transaction details. You can use a self-hosted instance.
 - **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.

manifest/firefox.json

@@ -4,7 +4,6 @@
     "version": "0.1.0",
     "description": "Minimal Ethereum wallet for Firefox",
     "permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
-    "incognito": "not_allowed",
     "content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
     "icons": {
         "16": "icons/icon16.png",

src/background/index.js

@@ -17,11 +17,7 @@ const { applyChainSwitchFields } = require("../shared/chainSwitchFields");
 // the same prohibition reported early, not the guarantee.
 const { getState, updateState } = require("./state");
 const { StateUnusableError } = require("../shared/stateSchema");
-const {
+const { refreshBalances, getProvider } = require("../shared/balances");
-    refreshBalances,
-    dropUntrackedTokens,
-    getProvider,
-} = require("../shared/balances");
 const { debugFetch, log } = require("../shared/log");
 const {
     verifySignedTx,
@@ -161,9 +157,9 @@ let txApprovalSlot = null;
 const APPROVAL_PENDING_CODE = -32002;
 
 // True at every moment this can be sent: the slot is taken immediately before
-// the transaction is populated, so the other request is being prepared, is on
+// the transaction is populated, so the other request is either being prepared
-// screen, or waits with its window closed. It does not claim the other one is
+// or on screen. It does not claim the other one is displayed yet, because for
-// displayed yet, because for the length of one network round trip it is not.
+// the length of one network round trip it is not.
 const TX_APPROVAL_PENDING_MESSAGE =
     "AutistMask handles one transaction at a time, and another one is" +
     " already in progress, so this one was not sent. Please finish that" +
@@ -383,26 +379,14 @@ async function proxyRpc(method, params) {
     return json.result;
 }
 
-// The approval the toolbar popup is set to open, or null while it opens the
+// The site-connection approval the toolbar popup is set to open, or null while
-// wallet. Set only by updateToolbarPopup() and showInToolbarPopup().
+// it opens the wallet. Set only by resetPopupUrl() and showInToolbarPopup().
 let toolbarPopupApprovalId = null;
 
-// Point the toolbar popup at the oldest pending approval whose window closed,
+function resetPopupUrl() {
-// or at the wallet when there is none. The user can then answer that approval
+    toolbarPopupApprovalId = null;
-// from the toolbar popup. pendingApprovals lists approvals in the order they
-// were added, so the first one found is the oldest. An approval held by a
-// running attempt is skipped until that attempt ends.
-function updateToolbarPopup() {
-    const closed = Object.values(pendingApprovals).find(
-        (approval) => approval.windowClosed && !approval.attemptInFlight,
-    );
-    toolbarPopupApprovalId = closed ? closed.id : null;
     if (actionNs && typeof actionNs.setPopup === "function") {
-        actionNs.setPopup({
+        actionNs.setPopup({ popup: "src/popup/index.html" });
-            popup: closed
-                ? "src/popup/index.html?approval=" + closed.id
-                : "src/popup/index.html",
-        });
     }
 }
 
@@ -432,16 +416,15 @@ function settleApproval(id, result, options) {
     // approval stops being alive.
     releaseTxApprovalSlotFor(id);
     approval.resolve(result);
-    updateToolbarPopup();
+    resetPopupUrl();
     return true;
 }
 
 // What a pending approval resolves to when it is given up on rather than
-// answered: a site-connection or network-switch window was closed, or the
+// answered: the window was closed, or could not be opened at all. A tx or sign
-// window could not be opened at all. An address switch in the wallet gives up
+// approval answers the requesting page in EIP-1193 shape; a site-connection or
-// pending approvals too. A tx or sign approval answers the requesting page in
+// network-switch approval answers its handler in the shape the popup's
-// EIP-1193 shape; a site-connection or network-switch approval answers its
+// decision has, as a refusal.
-// handler in the shape the popup's decision has, as a refusal.
 function abandonedResult(approval, code, message) {
     if (approval.type === "tx" || approval.type === "sign") {
         return { error: { code, message } };
@@ -449,9 +432,8 @@ function abandonedResult(approval, code, message) {
     return { approved: false, remember: false };
 }
 
-// A site-connection or network-switch window the user closed without answering
+// A window the user closed without answering is a refusal by the user, which
-// is a refusal by the user, which is 4001 and the wording every other rejection
+// is 4001 and the wording every other rejection path already uses.
-// path already uses.
 const APPROVAL_REJECTED_CODE = 4001;
 const APPROVAL_REJECTED_MESSAGE = "User rejected the request.";
 
@@ -479,16 +461,31 @@ const APPROVAL_WINDOW_FAILED_MESSAGE =
 function claimApproval(approval) {
     if (approval.attemptInFlight) return false;
     approval.attemptInFlight = true;
-    updateToolbarPopup();
     return true;
 }
 
 // Release an approval whose attempt failed in a way the user can retry.
-// Nothing was broadcast, so the next attempt may claim it. If the user closed
+// Nothing was broadcast, so the next attempt may claim it.
-// its window while the attempt ran, the toolbar popup opens it for that retry.
+//
+// Unless the window it would be retried in is already gone. The user closed it
+// while the attempt was running and settleApproval() declined then, correctly,
+// because the attempt still owned the approval; the attempt has now failed, so
+// nothing owns it and nothing can reach it. Left standing it would hold the
+// requesting page's promise open forever and, with it, the transaction
+// approval slot. It is settled here as the rejection the closed window
+// already meant.
 function releaseApproval(approval) {
     approval.attemptInFlight = false;
-    updateToolbarPopup();
+    if (approval.windowClosed) {
+        settleApproval(
+            approval.id,
+            abandonedResult(
+                approval,
+                APPROVAL_REJECTED_CODE,
+                APPROVAL_REJECTED_MESSAGE,
+            ),
+        );
+    }
 }
 
 // Open approval in a separate popup window, unless it is no longer pending.
@@ -711,7 +708,9 @@ function isExtensionSender(sender) {
 // had refused.
 //
 // TX and sign approvals do not decide here. They stay pending across a
-// disconnect, and across their window closing, until the user answers them.
+// disconnect. When their window closes, the windows.onRemoved listener below
+// rejects them, unless an approved attempt is still running, in which case
+// that attempt answers the page.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
@@ -739,7 +738,9 @@ runtime.onConnect.addListener((port) => {
             const approval = pendingApprovals[id];
             if (approval) {
                 if (approval.type === "tx" || approval.type === "sign") {
-                    // It stays pending until the user answers it.
+                    // When its window closes, windows.onRemoved rejects it,
+                    // unless an approved attempt is still running, in which
+                    // case that attempt answers the page.
                     return;
                 }
                 settleApproval(id, { approved: false, remember: false });
@@ -1292,7 +1293,7 @@ async function broadcastAccountsChanged() {
             windowsRemove(approval.windowId).catch(() => {});
         }
     }
-    updateToolbarPopup();
+    resetPopupUrl();
     // An address switch ends every connection allowed without "Remember". This
     // waits on storage, so it comes after the pending approvals above, which
     // are still rejected the moment the switch arrives.
@@ -1385,10 +1386,6 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
 // lastBalanceRefresh is left as the switch set it, so the next tick refreshes
 // the new network.
-//
-// Blockscout may have answered just before the user turned "Use Blockscout"
-// off. So the save reads the stored setting again, and drops every token the
-// user has not tracked if the setting is off.
 async function backgroundRefresh() {
     const s = await getState();
     const now = Date.now();
@@ -1400,6 +1397,7 @@ async function backgroundRefresh() {
         wallets,
         s.rpcUrl,
         s.blockscoutUrl,
+        s.useBlockscout,
         s.trackedTokens,
         s.networkId,
     );
@@ -1426,9 +1424,6 @@ async function backgroundRefresh() {
                 }
             }
         }
-        if (!fresh.useBlockscout) {
-            dropUntrackedTokens(fresh.wallets, fresh.trackedTokens);
-        }
         fresh.lastBalanceRefresh = now;
     });
 }
@@ -1484,44 +1479,36 @@ if (runtime.onStartup) {
 }
 startBackgroundJobs();
 
-// The toolbar popup keeps its URL when the worker stops. A worker that starts
+// When approval window is closed without a response, treat as rejection.
-// holds no approvals, so the toolbar popup is pointed back at the wallet.
+// "Without a response" is the operative part: the popup stays open across the
-updateToolbarPopup();
+// verify and broadcast it is waiting on, so a user closing an apparently-hung
-
+// window is an ordinary event with an attempt already in flight behind it.
-// A transaction or signature approval stays pending when its window closes.
+// settleApproval() refuses those, which leaves the attempt to report its real
-// The browser can close that window when the user clicks away from it, for
+// outcome to the page — and the window is recorded as gone, so that an attempt
-// example to copy the password from a password manager. The approval is marked
+// which then fails retryably settles instead of waiting in a window that no
-// as closed, so the toolbar popup can open it (see updateToolbarPopup()). An
+// longer exists.
-// attempt already running when the window closes goes on and reports its
-// outcome to the page.
 //
-// This listener rejects a site-connection or network-switch approval whose
+// A site-connection or network-switch approval whose popup connected its port
-// window closes before its popup connected its port. Once the port is
+// is not decided here. That popup approves and closes in the same breath, and
-// connected, the approval is left to the port. That popup approves and closes
+// this event races the decision on a channel of its own — the same race the
-// in the same breath, and this event races the decision on a channel of its
+// port exists to end. Its port disconnect says the same thing this event does,
-// own — the same race the port exists to end. Its port disconnect says the
+// in an order that is defined, so the disconnect is left to say it. The window
-// same thing this event does, in an order that is defined, so the disconnect is
+// closing before any port connected is the one case with nothing else to speak
-// left to say it. The window closing before any port connected is the one case
+// for it, and is rejected here so the dApp is not left waiting on a window that
-// with nothing else to speak for it, and is rejected here so the dApp is not
+// is gone.
-// left waiting on a window that is gone.
 if (windowsNs && windowsNs.onRemoved) {
     windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            if (approval.type === "tx" || approval.type === "sign") {
+            const decidedOnPort =
-                approval.windowClosed = true;
+                approval.type !== "tx" && approval.type !== "sign";
-                updateToolbarPopup();
+            if (decidedOnPort && approval.portConnected) continue;
-                continue;
+            const rejection = abandonedResult(
-            }
-            if (approval.portConnected) continue;
-            settleApproval(
-                id,
-                abandonedResult(
                 approval,
                 APPROVAL_REJECTED_CODE,
                 APPROVAL_REJECTED_MESSAGE,
-                ),
             );
+            if (!settleApproval(id, rejection)) approval.windowClosed = true;
         }
     });
 }
@@ -1666,9 +1653,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            // The popup waits for this answer before it closes its window.
+            return true;
-            sendResponse(null);
-            return false;
         }
 
         // The popup signs; it reports back here when it could not. Keep the
@@ -1868,8 +1853,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            sendResponse(null);
+            return true;
-            return false;
         }
 
         // The popup signs; it reports back here when it could not. Keep the

src/background/state.js

@@ -18,10 +18,11 @@
 //   updateState(fn)   read fresh, apply fn to that fresh record, write it
 //                     back — all holding the lock every write of the stored
 //                     record takes, so no other write lands in between, by
-//                     the background or by any page (README, "Stored state
+//                     the background or by any page except a page in a
-//                     and its version"). The read is one storage round trip
+//                     Firefox private window (README, "Stored state and its
-//                     ahead of the write rather than a page lifetime ahead of
+//                     version"). The read is one storage round trip ahead of
-//                     it (which is what made the popup's saveState() need a
+//                     the write rather than a page lifetime ahead of it
+//                     (which is what made the popup's saveState() need a
 //                     per-field merge against a baseline at all).
 //
 // A handler that must both read and write therefore does its network work
@@ -72,7 +73,8 @@ async function updateStateOnce(mutate) {
 // src/shared/browserApi.js) is held from the read to the write: two
 // background turns, or a turn and a page's save, never interleave
 // (https://git.eeqj.de/sneak/AutistMask/issues/641). Every page's save waits
-// while it is held (README, "Stored state and its version").
+// while it is held, except a page in a Firefox private window, which Firefox
+// gives locks of its own (README, "Stored state and its version").
 //
 // `mutate` must also not call updateState() itself, directly or through
 // anything it awaits: the inner turn waits for the lock the outer one holds,

src/popup/index.html

@@ -46,8 +46,8 @@
                 <div class="bg-well p-3 mx-1 mb-3">
                     <p class="text-xs mb-2">
                         This wallet sends your data only to the Ethereum RPC
-                        endpoint, unless you turn on one of these. You can
+                        endpoint, unless you turn on either of these, here or
-                        change them later in Settings.
+                        later in Settings.
                     </p>
                     <label
                         class="text-xs flex items-center gap-1 cursor-pointer mb-1"
@@ -56,10 +56,10 @@
                         Use Blockscout
                     </label>
                     <p class="text-xs text-muted mb-2">
-                        Shows transaction history, transaction details and the
+                        Sends your addresses, and the hash of each transaction
-                        tokens you have not tracked. Sends your addresses, and
+                        you open, to the Blockscout API, for transaction
-                        the hash of each transaction you open, to the Blockscout
+                        history, tokens you have not tracked, and transaction
-                        API.
+                        details.
                     </p>
                     <label
                         class="text-xs flex items-center gap-1 cursor-pointer mb-1"
@@ -71,8 +71,8 @@
                         Check recipients on Etherscan
                     </label>
                     <p class="text-xs text-muted">
-                        Sends each recipient's address to Etherscan to check it
+                        Sends the address you are about to send to, to
-                        for a phishing or scam label.
+                        Etherscan, to look for a phishing or scam label on it.
                     </p>
                 </div>
                 <button
@@ -569,23 +569,12 @@
                 </div>
                 <div class="mb-2">
                     <label class="block mb-1">What to send</label>
-                    <!-- The token dropdown and the line under it. Both are
-                    hidden when AddressToken opens Send for its own token. -->
-                    <div id="send-token-dropdown">
                     <select
                         id="send-token"
                         class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
                     >
                         <option value="ETH">ETH</option>
                     </select>
-                        <p
-                            id="send-tokens-note"
-                            class="text-xs text-muted hidden"
-                        >
-                            Only tracked tokens are listed, because "Use
-                            Blockscout" is off in Settings.
-                        </p>
-                    </div>
                     <div id="send-token-static" class="text-sm hidden"></div>
                 </div>
                 <div class="mb-2">
@@ -811,7 +800,6 @@
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="wait-tx-summary" class="font-bold"></div>
-                    <div id="wait-tx-token-note"></div>
                 </div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">To</div>
@@ -858,7 +846,6 @@
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">Amount</div>
                     <div id="error-tx-summary" class="font-bold"></div>
-                    <div id="error-tx-token-note"></div>
                 </div>
                 <div class="mb-3">
                     <div class="text-xs text-muted mb-1">To</div>
@@ -980,23 +967,6 @@
                     </button>
                 </div>
 
-                <div class="bg-well p-3 mx-1 mb-3">
-                    <h3 class="font-bold mb-1">Passwords</h3>
-                    <label
-                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
-                    >
-                        <input
-                            type="checkbox"
-                            id="settings-allow-weak-passwords"
-                        />
-                        Allow weak passwords
-                    </label>
-                    <p class="text-xs text-muted">
-                        Lets you choose a password shorter than 12 characters
-                        when you add a wallet.
-                    </p>
-                </div>
-
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Tracked Tokens</h3>
                     <p class="text-xs text-muted mb-2">
@@ -1089,14 +1059,13 @@
                         Use Blockscout
                     </label>
                     <p class="text-xs text-muted mb-2">
-                        Shows transaction history, transaction details and the
+                        Sends your addresses, and the hash of each transaction
-                        tokens you have not tracked. Sends your addresses, and
+                        you open, to the Blockscout API below, for transaction
-                        the hash of each transaction you open, to the Blockscout
+                        history, tokens you have not tracked, and transaction
-                        API below.
+                        details.
                     </p>
                     <p class="text-xs text-muted mb-1">
-                        Change the URL below if you run your own Blockscout
+                        Change this if you run your own Blockscout instance.
-                        instance.
                     </p>
                     <input
                         type="text"
@@ -1123,8 +1092,8 @@
                         Check recipients on Etherscan
                     </label>
                     <p class="text-xs text-muted">
-                        Sends each recipient's address to Etherscan to check it
+                        Sends the address you are about to send to, to
-                        for a phishing or scam label.
+                        Etherscan, to look for a phishing or scam label on it.
                     </p>
                 </div>
 
@@ -1400,13 +1369,6 @@
                 >
                     &nbsp;
                 </div>
-                <p
-                    id="delete-address-tokens-note"
-                    class="text-xs text-muted mb-2 hidden"
-                >
-                    Only tracked tokens are listed, because "Use Blockscout" is
-                    off in Settings.
-                </p>
                 <p class="text-xs text-muted mb-3">
                     A wallet always keeps at least one address. To remove the
                     last one, delete the whole wallet from Settings instead.
@@ -1626,8 +1588,8 @@
                     id="tx-detail-blockscout-note"
                     class="text-xs text-muted mx-1 mb-3 hidden"
                 >
-                    This screen shows no block, decoded details, network details
+                    No block, decoded details, network details or raw data are
-                    or raw data, because "Use Blockscout" is off in Settings.
+                    shown, because "Use Blockscout" is off in Settings.
                 </p>
 
                 <!-- ── Decoded details ── -->
@@ -1994,11 +1956,10 @@
                         >Erasing the saved data deletes every wallet stored in
                         this browser.</strong
                     >
-                    Nothing on the blockchain changes and no money is moved. If
+                    Nothing on the blockchain changes and no money is moved, but
-                    you kept a copy of a wallet's recovery phrase, private key
+                    without the exported copy above, or the recovery phrase for
-                    or extended private key, you can add that wallet again.
+                    each wallet written down, everything they hold is gone
-                    Without that copy or the exported copy above, everything the
+                    forever.
-                    wallet holds is gone forever.
                 </p>
                 <p class="text-xs mb-1">
                     To confirm, type

src/popup/index.js

@@ -11,7 +11,7 @@ const {
 const { StateUnusableError } = require("../shared/stateSchema");
 const { log, setRuntimeDebug } = require("../shared/log");
 const { refreshPrices } = require("../shared/prices");
-const { refreshBalances, dropUntrackedTokens } = require("../shared/balances");
+const { refreshBalances } = require("../shared/balances");
 const { clearPopupCaches } = require("../shared/chainSwitch");
 const {
     $,
@@ -71,36 +71,30 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 
-// The refresh first takes the stored network, "Use Blockscout" and "Check
-// recipients on Etherscan" (followStoredSettings() below). So the screens it
-// draws reflect any change saved elsewhere.
-//
 // The refresh writes into a copy of the wallets. Inside the save, under the
 // lock, its results are copied onto the address records in `state` only if the
 // network it ran on is still the active one, on this page and in the stored
 // record; the background's switch, after the user approves a site's request,
-// reaches this page only after the stored record (followStoredSettings()).
+// reaches this page only after the stored record (followNetworkSwitch() below).
 // A switch while the refresh ran cleared every address's balances
 // (applyChainSwitchFields() in src/shared/chainSwitchFields.js), and the
 // previous network's must not come back over them
 // (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped refresh is not
 // recorded as done. Results are copied by address, so an address added or
-// removed meanwhile is left as it is. Blockscout may have answered before the
+// removed meanwhile is left as it is.
-// user turned "Use Blockscout" off. So the save drops every token the user has
-// not tracked if the stored setting is off by then.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
-        await followStoredSettings();
         const networkId = state.networkId;
         const wallets = structuredClone(state.wallets);
         await Promise.all([
-            refreshPrices(pageClosed.signal),
+            refreshPrices(),
             refreshBalances(
                 wallets,
                 state.rpcUrl,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 state.trackedTokens,
                 networkId,
                 pageClosed.signal,
@@ -124,9 +118,6 @@ async function doRefreshAndRender() {
                     }
                 }
             }
-            if (!stored.useBlockscout) {
-                dropUntrackedTokens(state.wallets, stored.trackedTokens);
-            }
             state.lastBalanceRefresh = Date.now();
             return true;
         });
@@ -238,36 +229,17 @@ function fallbackView() {
 // src/shared/chainSwitch.js), so a record naming a network other than this
 // page's always holds a switch saved elsewhere, and a switch the user picks
 // here while this waits for the lock is made after it.
-//
+async function followNetworkSwitch() {
-// Another page may change "Use Blockscout" or "Check recipients on Etherscan".
+    let switched = false;
-// This page takes either change the same way and draws its screens again. This
-// page's own changes to the two settings are made under the lock too
-// (views/settings.js, views/welcome.js).
-async function followStoredSettings() {
-    let changed = false;
     // A failed save is reported by saveState() itself: see onSaveFailure().
     await saveState((stored) => {
-        if (stored.networkId !== state.networkId) {
+        if (stored.networkId === state.networkId) return false;
         settings.cutViewStack();
         takeStoredNetwork(stored);
         clearPopupCaches();
-            changed = true;
+        switched = true;
-        }
-        if (stored.useBlockscout !== state.useBlockscout) {
-            settings.setUseBlockscout(stored.useBlockscout);
-            changed = true;
-        }
-        if (
-            stored.checkRecipientsOnEtherscan !==
-            state.checkRecipientsOnEtherscan
-        ) {
-            state.checkRecipientsOnEtherscan =
-                stored.checkRecipientsOnEtherscan;
-            changed = true;
-        }
-        if (!changed) return false;
     }).catch(() => {});
-    if (changed) settings.showNewSettings();
+    if (switched) settings.showNewNetwork();
 }
 
 // The background opens the approval window as wide as the page, but the
@@ -281,9 +253,9 @@ async function followStoredSettings() {
 // zoom it reports, 170% among them, so once the page has its new width (its
 // resize event) it is measured again, and the window widened again while the
 // page still falls short, three times at most. A window that cannot grow sends
-// no resize event, and the page stops there. An approval can also show in the
+// no resize event, and the page stops there. The connection prompt can also
-// toolbar popup, whose window is the user's browser window; that one is left
+// show in the toolbar popup, whose window is the user's browser window; that
-// alone.
+// one is left alone.
 async function widenApprovalWindow() {
     const page = document.documentElement;
     if (page.scrollWidth <= page.clientWidth) return;
@@ -414,24 +386,16 @@ async function init() {
     settingsAddToken.init(ctx);
     deleteAddress.init(ctx);
 
-    // This page follows a record only when its network, "Use Blockscout" or
+    // Only a record naming a network other than this page's is followed: the
-    // "Check recipients on Etherscan" differs from this page's. A record
+    // one this page's own switch in Settings saves names the network it
-    // written by this page's own save matches this page. A record naming no
+    // already has, and a record naming none is no switch.
-    // network is no switch.
     onStorageChanged((changes) => {
         const written = changes.autistmask && changes.autistmask.newValue;
         if (!written || !written.networkId) return;
-        if (
+        if (written.networkId !== state.networkId) followNetworkSwitch();
-            written.networkId !== state.networkId ||
-            written.useBlockscout !== state.useBlockscout ||
-            written.checkRecipientsOnEtherscan !==
-                state.checkRecipientsOnEtherscan
-        ) {
-            followStoredSettings();
-        }
     });
-    // A change saved since loadState() above, before there was a listener.
+    // A switch saved since loadState() above, before there was a listener.
-    followStoredSettings();
+    followNetworkSwitch();
 
     if (!state.hasWallet) {
         welcome.show();

src/popup/viewRouter.js

@@ -38,16 +38,13 @@ function markViewRendered(view) {
     if (view) renderedViews.add(view);
 }
 
-// Begin a fresh page-load scope. The popup gets one by being loaded. It also
+// Begin a fresh page-load scope. The popup gets one by being loaded, and
-// asks for one when every screen on the page is out of date:
+// asks for one after a network switch, because every screen then on the page
-//
+// shows the previous network (showNewNetwork() in views/settings.js), and
-//   - after a network switch, since those screens show the previous network
+// after "Use Blockscout" or "Check recipients on Etherscan" changes in
-//     (showNewSettings() in views/settings.js)
+// Settings, because every screen then on the page was drawn under the old
-//   - after "Use Blockscout" or "Check recipients on Etherscan" changes, here
+// setting; the unit tests, which simulate several page loads against one
-//     or on another page, since those screens were drawn under the old setting
+// module instance, ask for one too.
-//
-// The unit tests ask for one too. They simulate several page loads against one
-// module instance.
 function resetRenderedViews() {
     renderedViews.clear();
 }

src/popup/views/addWallet.js

@@ -132,8 +132,7 @@ function validatePassword() {
         showError("add-wallet-password-error", "Please choose a password.");
         return null;
     }
-    // "Allow weak passwords" in Settings lifts the 12-character minimum.
+    if (pw.length < 12) {
-    if (!state.allowWeakPasswords && pw.length < 12) {
         showError(
             "add-wallet-password-error",
             "Password must be at least 12 characters.",

src/popup/views/addressDetail.js

@@ -84,7 +84,7 @@ function show() {
                 ctx.showAddressToken();
             });
         });
-    // Only Blockscout reports the tokens the user has not tracked.
+    // Tokens the user has not tracked are Blockscout's to report.
     $("address-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     renderSendTokenSelect(addr);
     $("tx-list").innerHTML =
@@ -102,6 +102,7 @@ async function loadTransactions(address) {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -236,7 +237,7 @@ function init(_ctx) {
         }
         $("send-to").value = "";
         $("send-amount").value = "";
-        $("send-token-dropdown").classList.remove("hidden");
+        $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         updateSendBalance();
         resetSendValidation();

src/popup/views/addressToken.js

@@ -69,7 +69,7 @@ function show() {
         // null when the scale is unknown: no quantity to show, and none to
         // price. balanceLine() states that rather than printing 0.0000.
         amount = tb ? unknownableAmount(tb.balance) : 0;
-        price = getPrice(tokenId);
+        price = getPrice(symbol);
     }
 
     currentSymbol = symbol;
@@ -174,6 +174,7 @@ async function loadTransactions(address, tokenId) {
         const rawTxs = await fetchRecentTransactions(
             address,
             state.blockscoutUrl,
+            state.useBlockscout,
             currentNetwork().chainId,
         );
         const result = filterTransactions(rawTxs, {
@@ -329,7 +330,7 @@ function init(_ctx) {
             $("send-token").value = tokenId;
         }
         // Hide dropdown, show static token display
-        $("send-token-dropdown").classList.add("hidden");
+        $("send-token").classList.add("hidden");
         let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
         if (tokenId !== "ETH") {
             staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;

src/popup/views/approval.js

@@ -11,7 +11,6 @@ const {
     onViewLeave,
     formatFee,
     tokenLabel,
-    blockscoutOffTokenNoteHtml,
     tokenSourcesByChainId,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
@@ -55,7 +54,7 @@ const {
 } = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
-const { runtimeApi, sendMessage } = require("../../shared/browserApi");
+const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
 
 const erc20Iface = new Interface(ERC20_ABI);
 
@@ -402,10 +401,6 @@ function showTxApproval(details) {
             if (d.address) {
                 if (d.isToken) {
                     detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address, approvedTx.chainId) || "Unknown token")}</div>`;
-                    detailsHtml += blockscoutOffTokenNoteHtml(
-                        d.address,
-                        approvedTx.chainId,
-                    );
                 }
                 detailsHtml += approvalAddressHtml(
                     d.address,
@@ -628,7 +623,10 @@ function permitWarningHtml(types, primaryType, domain, message) {
             return "";
     }
 
-    const sources = tokenSourcesByChainId();
+    const sources = {
+        trackedTokens: state.trackedTokens,
+        wallets: state.wallets,
+    };
     const spender = addressOrNull(
         declaredField(types, primaryType, message, "spender")?.value,
     );
@@ -657,7 +655,6 @@ function permitWarningHtml(types, primaryType, domain, message) {
         html += `<div class="mb-2"><div>Token</div>`;
         if (token) {
             html += `<div>${escapeHtml(tokenLabel(token) || "Unknown token")}</div>`;
-            html += blockscoutOffTokenNoteHtml(token);
             html += approvalAddressHtml(token);
         } else {
             html += `<div>Unknown</div>`;
@@ -1142,21 +1139,12 @@ function init(_ctx) {
         }
     });
 
-    // The window closes only once the background has the rejection. A message
+    $("btn-reject-tx").addEventListener("click", () => {
-    // sent as the window closes can be lost, and a closed window does not
+        notify({
-    // reject the request. After Confirm, the background refuses a rejection
-    // while the transaction is being sent. The window then stays open and
-    // shows the background's message.
-    $("btn-reject-tx").addEventListener("click", async () => {
-        const response = await sendMessage({
             type: "AUTISTMASK_TX_RESPONSE",
             id: approvalId,
             approved: false,
-        }).catch(() => null);
+        });
-        if (response && response.error) {
-            showError("approve-tx-error", response.error);
-            return;
-        }
         window.close();
     });
 
@@ -1279,18 +1267,12 @@ function init(_ctx) {
         if (outcome.retryable) setSignButtonBusy(false);
     });
 
-    // As for the transaction's Reject above. After Sign, the background
+    $("btn-reject-sign").addEventListener("click", () => {
-    // refuses a rejection while the signature is being checked.
+        notify({
-    $("btn-reject-sign").addEventListener("click", async () => {
-        const response = await sendMessage({
             type: "AUTISTMASK_SIGN_RESPONSE",
             id: approvalId,
             approved: false,
-        }).catch(() => null);
+        });
-        if (response && response.error) {
-            showError("approve-sign-error", response.error);
-            return;
-        }
         window.close();
     });
 }

src/popup/views/confirmTx.js

@@ -129,7 +129,7 @@ function renderAmount(txInfo) {
     const rawSymbol = isErc20
         ? txInfo.tokenSymbol || "?"
         : nativeCurrencyByChainId(txInfo.chainId);
-    const price = getPrice(txInfo.token, txInfo.chainId);
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const amountUsd = price ? parseFloat(txInfo.amount) * price : null;
     $("confirm-amount").textContent = valueWithUsd(
         shownAmount(txInfo) + " " + displaySymbol(rawSymbol),
@@ -157,7 +157,7 @@ function renderBalance(txInfo) {
         $("confirm-balance").textContent = "unknown (" + symbol + ")";
         return;
     }
-    const price = getPrice(txInfo.token, txInfo.chainId);
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const balUsd = price ? parseFloat(bal) * price : null;
     $("confirm-balance").textContent = valueWithUsd(
         truncateAmountNeverZero(bal) + " " + symbol,
@@ -334,8 +334,8 @@ function show(txInfo) {
     $("confirm-contract-warning").style.visibility = "hidden";
     $("confirm-burn-warning").style.visibility = "hidden";
     $("confirm-etherscan-warning").style.visibility = "hidden";
-    // While "Check recipients on Etherscan" is off, there is no Etherscan
+    // While "Check recipients on Etherscan" is off there is no Etherscan
-    // warning to reserve space for. A line in its place says the check is off.
+    // warning to reserve space for, and a line in its place says so.
     const etherscanOn = !!state.checkRecipientsOnEtherscan;
     $("confirm-etherscan-warning").classList.toggle("hidden", !etherscanOn);
     $("confirm-etherscan-note").classList.toggle("hidden", etherscanOn);
@@ -617,6 +617,7 @@ async function checkRecipientHistory(txInfo) {
         const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
             fromAddress: txInfo.from,
             chainId: txInfo.chainId,
+            checkRecipientsOnEtherscan: state.checkRecipientsOnEtherscan,
         });
         // The user may have left this transaction while the checks were in
         // flight; its warnings must not reach another recipient's screen.

src/popup/views/deleteAddress.js

@@ -119,11 +119,6 @@ function show(walletIdx, addrIdx) {
 
     $("delete-address-recovery").textContent = recoveryPathText(wallet);
     $("delete-address-balance").innerHTML = balanceWarningHtml(addr);
-    // Only Blockscout reports the tokens the user has not tracked.
-    $("delete-address-tokens-note").classList.toggle(
-        "hidden",
-        !!state.useBlockscout,
-    );
 
     setFlash("");
     showView("delete-address-confirm");

src/popup/views/helpers.js

@@ -21,10 +21,7 @@ const {
     truncateAmountNeverZero,
     isBelowOneMillionth,
 } = require("../../shared/amountDisplay");
-const {
+const { resolveTokenSymbol } = require("../../shared/approvalAmount");
-    resolveTokenDecimals,
-    resolveTokenSymbol,
-} = require("../../shared/approvalAmount");
 const { getProvider } = require("../../shared/balances");
 const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
@@ -309,16 +306,10 @@ function nativeCurrency() {
 // names a token on one network only, and every token balance held is the
 // active network's, so another network gets the tokens tracked on it
 // (state.networkTrackedTokens, see applyChainSwitchFields()) and no balances.
-//
-// The wallets' balances hold what Blockscout reported for each token. So the
-// wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
     const net = chainId ? networkByChainId(chainId) : currentNetwork();
     if (net && net.id === state.networkId) {
-        return {
+        return { trackedTokens: state.trackedTokens, wallets: state.wallets };
-            trackedTokens: state.trackedTokens,
-            wallets: state.useBlockscout ? state.wallets : [],
-        };
     }
     return {
         trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
@@ -326,39 +317,11 @@ function tokenSourcesByChainId(chainId) {
     };
 }
 
-// The line shown under a token while "Use Blockscout" is off. The token gets
+// The symbol shown for a token line on the network with `chainId`, or on the
-// the line only when the bundled list and the tracked tokens lack its name or
+// active network when none is given: from the bundled list, the tokens the
-// decimals. Otherwise this returns "". The token is a contract address on the
+// user tracks, and the explorer's report, the sources the amount line's scale
-// network with `chainId`, or on the active network when none is given. "ETH"
+// comes from. Null when no source names one, so the token lines keep saying
-// and null are no contract, and get "". A token that is not text also gets "":
+// `Unknown token` for a token nothing knows.
-// WaitTx and ErrorTx pass a token restored from storage unchecked.
-function blockscoutOffTokenNoteHtml(token, chainId) {
-    if (typeof token !== "string") return "";
-    if (state.useBlockscout || !token || token === "ETH") return "";
-    const sources = tokenSourcesByChainId(chainId);
-    if (
-        resolveTokenSymbol(token, sources) !== null &&
-        resolveTokenDecimals(token, sources) !== null
-    ) {
-        return "";
-    }
-    return (
-        '<div class="text-xs text-muted">Blockscout\'s report of your balances' +
-        ' is not used to name this token, because "Use Blockscout" is off in' +
-        " Settings.</div>"
-    );
-}
-
-// The symbol shown for a token line, from these sources in order:
-//
-// - the bundled list
-// - the tokens the user tracks
-// - the explorer's report, while "Use Blockscout" is on
-//
-// The network is the one with `chainId`, or the active network when none is
-// given. The amount line's scale comes from the same sources. Null when no
-// source names one, so the token lines keep saying `Unknown token` for a token
-// nothing knows.
 function tokenLabel(address, chainId) {
     return resolveTokenSymbol(address, tokenSourcesByChainId(chainId));
 }
@@ -439,7 +402,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
         html += balanceLine(
             t.symbol,
             bal,
-            getPrice(t.address),
+            getPrice(t.symbol),
             t.address.toLowerCase(),
         );
         seen.add(t.address.toLowerCase());
@@ -450,7 +413,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
             html += balanceLine(
                 t.symbol,
                 0,
-                getPrice(t.address),
+                getPrice(t.symbol),
                 t.address.toLowerCase(),
             );
         }
@@ -571,9 +534,8 @@ function addressTitle(address, wallets) {
 const CONTRACT_CREATION_TEXT =
     "This transaction creates a new contract. It has no recipient.";
 
-// The line shown in place of the transaction history on Home, AddressDetail and
+// What the transaction lists on Home, AddressDetail and AddressToken say while
-// AddressToken while "Use Blockscout" is off. That history comes from
+// the user has "Use Blockscout" off: the history comes from Blockscout alone.
-// Blockscout alone.
 const HISTORY_OFF_TEXT =
     'No transaction history is shown, because "Use Blockscout" is off in Settings.';
 
@@ -834,7 +796,6 @@ module.exports = {
     unknownableAmount,
     nativeCurrency,
     tokenSourcesByChainId,
-    blockscoutOffTokenNoteHtml,
     tokenLabel,
     formatFee,
     addressDotHtml,

src/popup/views/home.js

@@ -197,6 +197,7 @@ async function loadHomeTxs(ctx) {
             fetchRecentTransactions(
                 addr,
                 state.blockscoutUrl,
+                state.useBlockscout,
                 currentNetwork().chainId,
             ),
         );
@@ -305,7 +306,7 @@ function walletListHtml() {
 
 function render(ctx) {
     const container = $("wallet-list");
-    // Only Blockscout reports the tokens the user has not tracked.
+    // Tokens the user has not tracked are Blockscout's to report.
     $("home-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     if (state.wallets.length === 0) {
         container.innerHTML =
@@ -454,7 +455,7 @@ function init(ctx) {
         }
         $("send-to").value = "";
         $("send-amount").value = "";
-        $("send-token-dropdown").classList.remove("hidden");
+        $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         renderSendTokenSelect(addr);
         updateSendBalance();

src/popup/views/send.js

@@ -10,7 +10,6 @@ const {
     renderAddressHtml,
     attachCopyHandlers,
     goBack,
-    tokenSourcesByChainId,
 } = require("./helpers");
 const { state, currentAddress } = require("../../shared/state");
 let ctx;
@@ -142,8 +141,6 @@ function updateToValidation() {
 }
 
 function renderSendTokenSelect(addr) {
-    // Only Blockscout reports the tokens the user has not tracked.
-    $("send-tokens-note").classList.toggle("hidden", !!state.useBlockscout);
     const sel = $("send-token");
     sel.innerHTML = `<option value="ETH">${escapeHtml(nativeCurrency())}</option>`;
     const fraudSet = new Set(
@@ -188,9 +185,7 @@ function renderSendTokenSelect(addr) {
 // so the transfer is encoded with the number the user read rather than with
 // whatever the contract answers at signing time (see
 // src/shared/transferAmount.js). balances.js is formatting one explorer row at
-// fetch time and cannot consult a state it is in the middle of replacing. As on
+// fetch time and cannot consult a state it is in the middle of replacing.
-// the approval screens, tokenSourcesByChainId() gives the wallets only while
-// "Use Blockscout" is on.
 //
 // The two resolutions can therefore differ, and where they do, the stored
 // `balance` is a quantity computed at a scale this screen has just declined to
@@ -203,7 +198,10 @@ function tokenBalanceAndDecimals(addr, token) {
     const tb = (addr.tokenBalances || []).find(
         (t) => t.address.toLowerCase() === token.toLowerCase(),
     );
-    const tokenDecimals = resolveTokenDecimals(token, tokenSourcesByChainId());
+    const tokenDecimals = resolveTokenDecimals(token, {
+        trackedTokens: state.trackedTokens,
+        wallets: state.wallets,
+    });
     if (!tb) return { tokenBalance: "0", tokenDecimals };
     if (tokenDecimals === null) return { tokenBalance: null, tokenDecimals };
     return { tokenBalance: tb.balance ?? null, tokenDecimals };
@@ -403,11 +401,8 @@ function init(_ctx) {
             try {
                 const provider = getProvider(state.rpcUrl, state.networkId);
                 const resolved = await provider.resolveName(to);
-                // getProvider() does not look up a name resolved off-chain,
-                // so such a name comes back with no address too. The message
-                // covers both, in the one line the flash area shows.
                 if (!resolved) {
-                    showFlash("That ENS name has no on-chain address.");
+                    showFlash("That ENS name has no address.");
                     return;
                 }
                 resolvedTo = resolved;
@@ -431,7 +426,7 @@ function init(_ctx) {
     });
 
     $("btn-send-back").addEventListener("click", () => {
-        $("send-token-dropdown").classList.remove("hidden");
+        $("send-token").classList.remove("hidden");
         $("send-token-static").classList.add("hidden");
         goBack();
     });

src/popup/views/settings.js

@@ -17,7 +17,6 @@ const {
 const { state, saveState, currentNetwork } = require("../../shared/state");
 const { onChainSwitch } = require("../../shared/chainSwitch");
 const { restorableStack } = require("../../shared/persistedState");
-const { dropUntrackedTokens } = require("../../shared/balances");
 const { resetRenderedViews, markViewRendered } = require("../viewRouter");
 const {
     log,
@@ -252,20 +251,16 @@ async function renderSiteLists() {
 
 // A network switch, made by the user here or saved by the background once the
 // user approved a site's request (src/popup/index.js), leaves every screen on
-// the page showing the previous network. Two functions leave the page as
+// the page showing the previous network. These two leave the page as README's
-// README's Screen Map describes:
+// Screen Map describes, the first before the switch is saved, so that save
-//
+// keeps the cut for a popup closed straight after, the second once `state`
-// - cutViewStack(), before the switch is saved, so that save keeps the cut for
+// holds the new network.
-//   a popup closed straight after
-// - showNewSettings(), once `state` holds the new network
 //
 // The stack is cut at the first screen that cannot be rendered from saved
 // state, such as Send or AddToken, and at AddressToken unless it shows the
 // native token: any other token there was picked on the previous network, so
 // it is no longer selected either. Without a wallet the stack starts at
 // Welcome, which that cut would drop, and Welcome shows nothing from a network.
-// A change to "Use Blockscout" cuts the stack the same way (setUseBlockscout()
-// below).
 function cutViewStack() {
     if (!state.hasWallet) return;
     if (state.selectedToken !== "ETH") {
@@ -278,40 +273,18 @@ function cutViewStack() {
     state.viewStack = restorableStack(state.viewStack, state.currentView);
 }
 
-// Sets "Use Blockscout" to `on` on this page. It is called inside a save,
+// Every screen counts as not yet rendered, so "Back" renders the one it lands
-// holding the lock, for the user's change here or another page's
+// on for the new network. Settings on top is brought up to date in place;
-// (followStoredSettings() in src/popup/index.js).
+// any other screen is drawn again as a reopened popup draws it, which is Home
-//
+// for one that cannot be rendered from saved state. Without a wallet any other
-// Send's token dropdown was filled under the old setting, and Back cannot draw
+// screen is Welcome or AddWallet, which show nothing from a network.
-// Send again. So the stack is cut, as for a network switch. Turning the setting
+function showNewNetwork() {
-// off also drops every token the user has not tracked.
-function setUseBlockscout(on) {
-    state.useBlockscout = on;
-    cutViewStack();
-    if (!on) dropUntrackedTokens(state.wallets, state.trackedTokens);
-}
-
-// Draws the page again after a network switch, or after another page changed
-// "Use Blockscout" or "Check recipients on Etherscan". Every screen counts as
-// not yet rendered, so "Back" renders again any screen that a reopened popup
-// can render. Settings on top is brought up to date in place. Any other screen
-// is drawn again as a reopened popup draws it, which is Home for one that
-// cannot be rendered from saved state. Without a wallet any other screen is
-// Welcome or AddWallet. Back only unhides Welcome, so its two checkboxes are
-// set here.
-function showNewSettings() {
     resetRenderedViews();
-    $("welcome-use-blockscout").checked = state.useBlockscout;
-    $("welcome-check-recipients-on-etherscan").checked =
-        state.checkRecipientsOnEtherscan;
     if (state.currentView === "settings") {
         markViewRendered("settings");
         $("settings-network").value = state.networkId;
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
-        $("settings-use-blockscout").checked = state.useBlockscout;
-        $("settings-check-recipients-on-etherscan").checked =
-            state.checkRecipientsOnEtherscan;
         renderTrackedTokens();
     } else if (state.hasWallet) {
         ctx.restoreView();
@@ -394,32 +367,30 @@ function init(_ctx) {
         showFlash("Saved.");
     });
 
-    // Each change is made inside the save, holding the lock. So
+    // The screens under Settings were drawn under the old setting, so each
-    // followStoredSettings() in src/popup/index.js never mistakes this page's
-    // unsaved change for one that another page saved.
-    //
-    // The screens under Settings were drawn under the old setting. So each
     // change makes every screen but Settings count as not yet drawn, as a
-    // network switch does. Back then draws again any screen that a reopened
+    // network switch does, and Back draws the one it lands on again. Welcome
-    // popup can draw. Back only unhides Welcome, so its boxes are set here too.
+    // offers the same two settings and is only unhidden on Back, so its boxes
+    // are set here too.
     $("settings-use-blockscout").addEventListener("change", async () => {
-        const on = $("settings-use-blockscout").checked;
+        state.useBlockscout = $("settings-use-blockscout").checked;
-        await saveState(() => setUseBlockscout(on));
+        $("welcome-use-blockscout").checked = state.useBlockscout;
-        $("welcome-use-blockscout").checked = on;
         resetRenderedViews();
         markViewRendered("settings");
+        await saveState();
     });
 
     $("settings-check-recipients-on-etherscan").addEventListener(
         "change",
         async () => {
-            const on = $("settings-check-recipients-on-etherscan").checked;
+            state.checkRecipientsOnEtherscan = $(
-            await saveState(() => {
+                "settings-check-recipients-on-etherscan",
-                state.checkRecipientsOnEtherscan = on;
+            ).checked;
-            });
+            $("welcome-check-recipients-on-etherscan").checked =
-            $("welcome-check-recipients-on-etherscan").checked = on;
+                state.checkRecipientsOnEtherscan;
             resetRenderedViews();
             markViewRendered("settings");
+            await saveState();
         },
     );
 
@@ -436,7 +407,7 @@ function init(_ctx) {
         // Open pages are told by the background, as after a site's approved
         // switch request.
         notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
-        showNewSettings();
+        showNewNetwork();
         showFlash("Switched to " + net.name + ".");
     });
 
@@ -499,12 +470,6 @@ function init(_ctx) {
         await saveState();
     });
 
-    $("settings-allow-weak-passwords").checked = state.allowWeakPasswords;
-    $("settings-allow-weak-passwords").addEventListener("change", async () => {
-        state.allowWeakPasswords = $("settings-allow-weak-passwords").checked;
-        await saveState();
-    });
-
     $("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView);
 
     $("btn-settings-add-token").addEventListener(
@@ -582,6 +547,5 @@ module.exports = {
     show,
     renderSiteLists,
     cutViewStack,
-    setUseBlockscout,
+    showNewNetwork,
-    showNewSettings,
 };

src/popup/views/stateRecovery.js

@@ -143,6 +143,8 @@ async function resetProfile() {
     try {
         // Under the lock every write of the stored record takes, so the erase
         // cannot land between another write's read and its write and be undone.
+        // A page in a Firefox private window is the exception: Firefox gives
+        // it locks of its own (README, "Stored state and its version").
         await withLock("autistmask", () => storageRemove("autistmask"));
     } catch (e) {
         log.errorf("state recovery: reset failed:", e);

src/popup/views/transactionDetail.js

@@ -26,7 +26,6 @@ const { state } = require("../../shared/state");
 const { nativeCurrencyByChainId } = require("../../shared/networks");
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("../../shared/log");
-const { storedSettingIsOn } = require("../../shared/storedSettings");
 const { decodeCalldata } = require("./approval");
 
 /**
@@ -173,8 +172,7 @@ function render() {
         }
     }
 
-    // Hide the calldata and raw data sections. loadFullTxDetails() shows them
+    // Hide calldata and raw data sections; always fetch full tx details
-    // once it has their data.
     const calldataSection = $("tx-detail-calldata-section");
     if (calldataSection) calldataSection.classList.add("hidden");
     const rawDataSection = $("tx-detail-rawdata-section");
@@ -193,8 +191,7 @@ function render() {
         if (el) el.classList.add("hidden");
     }
 
-    // The block, network details, decoded details and raw data come from
+    // Those details are Blockscout's; this line says why there are none.
-    // Blockscout. While the setting is off, this line says why none is shown.
     $("tx-detail-blockscout-note").classList.toggle(
         "hidden",
         !!state.useBlockscout,
@@ -311,12 +308,11 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
-// Reads the block, network details and calldata from Blockscout, and decodes
+// The block, network details, calldata and its decoding, from Blockscout. While
-// the calldata. While the stored "Use Blockscout" is off, Blockscout is not
+// the user has "Use Blockscout" off, Blockscout is not asked and none of them
-// asked. An answer that lands after the setting went off is dropped
+// is shown.
-// (src/shared/storedSettings.js). Either way none of them is shown.
 async function loadFullTxDetails(txHash, chainId) {
-    if (!(await storedSettingIsOn("useBlockscout"))) return;
+    if (!state.useBlockscout) return;
     const section = $("tx-detail-calldata-section");
     const actionEl = $("tx-detail-calldata-action");
     const detailsEl = $("tx-detail-calldata-details");
@@ -332,7 +328,6 @@ async function loadFullTxDetails(txHash, chainId) {
         );
         if (!resp.ok) return;
         const txData = await resp.json();
-        if (!(await storedSettingIsOn("useBlockscout"))) return;
 
         // Populate on-chain detail fields (block, nonce, gas, fee)
         populateOnChainDetails(txData, chainId);

src/popup/views/txStatus.js

@@ -14,7 +14,6 @@ const {
     displaySymbol,
     clearViewStack,
     tokenLabel,
-    blockscoutOffTokenNoteHtml,
     reviewedNetworkProvider,
 } = require("./helpers");
 const { state } = require("../../shared/state");
@@ -109,10 +108,6 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
     }
     $("wait-tx-summary").textContent =
         txInfo.amount + (symbol ? " " + symbol : "");
-    $("wait-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
-        txInfo.token,
-        txInfo.chainId,
-    );
     $("wait-tx-to").innerHTML = toAddressHtml(txInfo.to, txInfo.chainId);
     $("wait-tx-hash").innerHTML = txHashHtml(txHash, txInfo.chainId);
     attachCopyHandlers("view-wait-tx");
@@ -220,10 +215,9 @@ function showWait(txInfo, txHash) {
 // init and leaving wait-tx on screen with no back control. A non-numeric
 // broadcastTime leaves an unexitable wait counting "NaNs". txInfo.chainId picks
 // the node the receipt is asked of and the explorer the links open, so it has
-// to name a network. txInfo.token and txInfo.tokenSymbol are not checked here.
+// to name a network. txInfo.token and txInfo.tokenSymbol are deliberately
-// blockscoutOffTokenNoteHtml() shows no line for a token that is not text.
+// unchecked: they are compared and coalesced rather than dereferenced, and
-// Everything else only compares and coalesces them, and tokenSymbol is null for
+// tokenSymbol is null for ETH.
-// ETH.
 function restoreWait() {
     const d = state.viewData;
     if (!d || !d.pendingWait) return false;
@@ -288,7 +282,6 @@ function decodedDetailsHtml(decoded, chainId) {
             if (d.isToken) {
                 const sym = tokenLabel(d.address, chainId) || "Unknown token";
                 html += `<div class="font-bold">${escapeHtml(sym)}</div>`;
-                html += blockscoutOffTokenNoteHtml(d.address, chainId);
                 html += toAddressHtml(d.address, chainId);
             } else {
                 html += toAddressHtml(d.address, chainId);
@@ -352,7 +345,6 @@ function showError(txInfo, txHash, message) {
     state.viewData = {
         amount: txInfo.amount,
         symbol: symbol,
-        token: txInfo.token,
         to: txInfo.to,
         hash: txHash || null,
         message: message,
@@ -366,10 +358,6 @@ function renderError() {
     if (!d || !d.message) return;
     $("error-tx-summary").textContent =
         d.amount + (d.symbol ? " " + d.symbol : "");
-    $("error-tx-token-note").innerHTML = blockscoutOffTokenNoteHtml(
-        d.token,
-        d.chainId,
-    );
     $("error-tx-to").innerHTML = toAddressHtml(d.to, d.chainId);
     $("error-tx-message").textContent = d.message;
 

src/popup/views/welcome.js

@@ -1,6 +1,6 @@
-// The first screen, shown while there is no wallet. It offers "Use Blockscout"
+// The first screen, shown while there is no wallet. It offers the two lookups
-// and "Check recipients on Etherscan", which Settings offers too. Both are off
+// at services other than the RPC endpoint, both off until the user ticks them,
-// until the user ticks them.
+// which Settings offers as well.
 
 const { $, showView } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
@@ -12,24 +12,21 @@ function show() {
     showView("welcome");
 }
 
-// Each change is made inside the save, holding the lock, as Settings makes it.
 function init(ctx) {
     $("btn-welcome-add").addEventListener("click", ctx.showAddWalletView);
 
     $("welcome-use-blockscout").addEventListener("change", async () => {
-        const on = $("welcome-use-blockscout").checked;
+        state.useBlockscout = $("welcome-use-blockscout").checked;
-        await saveState(() => {
+        await saveState();
-            state.useBlockscout = on;
-        });
     });
 
     $("welcome-check-recipients-on-etherscan").addEventListener(
         "change",
         async () => {
-            const on = $("welcome-check-recipients-on-etherscan").checked;
+            state.checkRecipientsOnEtherscan = $(
-            await saveState(() => {
+                "welcome-check-recipients-on-etherscan",
-                state.checkRecipientsOnEtherscan = on;
+            ).checked;
-            });
+            await saveState();
         },
     );
 }

src/shared/addressWarnings.js

@@ -60,6 +60,8 @@ function getLocalWarnings(address, options = {}) {
  * @param {string} [options.fromAddress] - Sender address (for self-send check).
  * @param {string} [options.chainId] - Chain id of the network whose explorer
  *   the Etherscan label check asks; the active network's when omitted.
+ * @param {boolean} [options.checkRecipientsOnEtherscan] - The user's setting
+ *   of that name. The Etherscan label check is made only while it is on.
  * @returns {Promise<Array<{type: string, message: string, severity: string}>>}
  */
 async function getFullWarnings(address, provider, options = {}) {
@@ -114,6 +116,7 @@ async function getFullWarnings(address, provider, options = {}) {
     try {
         const etherscanWarning = await checkEtherscanLabel(
             address,
+            options.checkRecipientsOnEtherscan,
             options.chainId,
         );
         if (etherscanWarning) {

src/shared/balances.js

@@ -1,10 +1,7 @@
-// Balance fetching:
+// Balance fetching: ETH balances and the balances of the tokens the user
-//
+// tracks via RPC, the other ERC-20 token balances and the holder counts via
-//   - ETH balances, and the balances of the tokens the user tracks, via RPC
+// Blockscout while the user has "Use Blockscout" on, ENS reverse lookup via
-//   - the other ERC-20 token balances and the holder counts via Blockscout,
+// RPC.
-//     while the user has "Use Blockscout" on. Those balances are dropped when
-//     the setting is off.
-//   - ENS reverse lookup via RPC
 
 const {
     JsonRpcProvider,
@@ -22,7 +19,6 @@ const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
 const { resolveTokenDecimals } = require("./approvalAmount");
-const { storedSettingIsOn } = require("./storedSettings");
 
 // Use a static network to skip auto-detection (which can fail and cause
 // "could not coalesce error" on some RPC endpoints like Cloudflare).
@@ -43,12 +39,12 @@ const { storedSettingIsOn } = require("./storedSettings");
 // is a caller bug and must not resolve to a working provider for some other
 // chain.
 //
-// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. A resolver can
+// `disableCcipRead` keeps every ENS lookup on the RPC endpoint. Left on, as
-// say a name is resolved off-chain and give a web address for it. By default
+// ethers has it, a resolver that says a name is resolved off-chain makes ethers
-// ethers then fetches that address straight from the browser, sending the name
+// fetch the web address the resolver gives, straight from the browser, with the
-// being looked up. For the reverse lookup of the user's addresses, the name sent
+// name being looked up; for the reverse lookup of the user's addresses that is
-// is the user's own (https://git.eeqj.de/sneak/AutistMask/issues/668). With the
+// the user's own name (https://git.eeqj.de/sneak/AutistMask/issues/668). Such a
-// flag set, such a name does not resolve.
+// name does not resolve.
 function getProvider(rpcUrl, networkId) {
     const net = Network.from(requireNetworkId(networkId).id);
     const provider = new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
@@ -96,10 +92,9 @@ function rawUnits(value) {
 // Fetch token balances for a single address from Blockscout.
 // Returns [{ address, name, symbol, decimals, balance, holders }].
 //
-// While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
-// that lands after the setting went off is dropped
+// Blockscout is not asked and the answer is an empty list: no token the user
-// (src/shared/storedSettings.js). Either way this returns an empty list, so
+// has not tracked is listed.
-// only tracked tokens are listed.
 //
 // Filters out spam: only shows tokens that are in the known token list,
 // explicitly tracked by the user, or have >= 1000 holders. A tracked token's
@@ -116,10 +111,11 @@ function rawUnits(value) {
 async function fetchTokenBalances(
     address,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     signal,
 ) {
-    if (!(await storedSettingIsOn("useBlockscout"))) return [];
+    if (!useBlockscout) return [];
     try {
         const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
@@ -129,7 +125,6 @@ async function fetchTokenBalances(
             return null;
         }
         const items = await resp.json();
-        if (!(await storedSettingIsOn("useBlockscout"))) return [];
         if (!Array.isArray(items)) return null;
 
         const trackedSet = new Set(
@@ -318,12 +313,13 @@ async function fetchTrackedTokenBalances(
 }
 
 // Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
-// `trackedTokens` are the tokens tracked on the active network. `signal` is as
+// `trackedTokens` are the tokens tracked on the active network.
-// for fetchTokenBalances().
+// `useBlockscout` and `signal` are as for fetchTokenBalances().
 async function refreshBalances(
     wallets,
     rpcUrl,
     blockscoutUrl,
+    useBlockscout,
     trackedTokens,
     networkId,
     signal,
@@ -384,14 +380,15 @@ async function refreshBalances(
             // ERC-20 token balances: the tracked tokens' through the RPC
             // endpoint, and from Blockscout the tokens the user has not
             // tracked. When Blockscout fails, the untracked rows from before
-            // this refresh stay. While "Use Blockscout" is off, there are no
+            // this refresh stay; while "Use Blockscout" is off there are none.
-            // untracked rows. The Blockscout request is started first and
+            // The Blockscout request is started first and handed to
-            // handed to fetchTrackedTokenBalances() too, which waits for it
+            // fetchTrackedTokenBalances() too, which waits for it after
-            // after sending its balanceOf reads, so the two run side by side.
+            // sending its balanceOf reads, so the two run side by side.
             const previous = addr.tokenBalances || [];
             const explorerRequest = fetchTokenBalances(
                 addr.address,
                 blockscoutUrl,
+                useBlockscout,
                 tracked,
                 signal,
             );
@@ -427,20 +424,6 @@ async function refreshBalances(
     log.debugf("refreshBalances done");
 }
 
-// Drops the balance of each token not in `trackedTokens` from every address.
-// Callers run it while "Use Blockscout" is off, since only Blockscout reports
-// those tokens.
-function dropUntrackedTokens(wallets, trackedTokens) {
-    const tracked = new Set(trackedTokens.map((t) => t.address.toLowerCase()));
-    for (const wallet of wallets) {
-        for (const addr of wallet.addresses || []) {
-            addr.tokenBalances = (addr.tokenBalances || []).filter((row) =>
-                tracked.has(String(row.address).toLowerCase()),
-            );
-        }
-    }
-}
-
 // Look up token metadata from its contract.
 // Calls symbol() and decimals() to verify it implements ERC-20.
 // `signal` is as for fetchTokenBalances().
@@ -559,7 +542,6 @@ async function scanForAddresses(xpub, rpcUrl, networkId, signal, gapLimit = 5) {
 module.exports = {
     fetchTokenBalances,
     refreshBalances,
-    dropUntrackedTokens,
     lookupTokenInfo,
     getProvider,
     scanForAddresses,

src/shared/chainSwitch.js

@@ -4,7 +4,7 @@
 //
 // - onChainSwitch() below makes the switch the user picks in Settings, with
 //   applyChainSwitchFields() (chainSwitchFields.js).
-// - followStoredSettings() in src/popup/index.js takes a switch the background
+// - followNetworkSwitch() in src/popup/index.js takes a switch the background
 //   or another popup page saved, from the stored record, with
 //   takeStoredNetwork() (state.js), which copies it with
 //   copyChainSwitchFields() (chainSwitchFields.js).
@@ -45,7 +45,7 @@ function clearPopupCaches() {
 //
 // `state` is switched inside the save that stores the switch, holding the
 // lock, so it is never switched while a follow of a switch saved elsewhere
-// waits for the lock (followStoredSettings() in src/popup/index.js): that
+// waits for the lock (followNetworkSwitch() in src/popup/index.js): that
 // follow runs first, and this switch is made after it.
 async function onChainSwitch(newNetworkId) {
     const { state, saveState } = require("./state");

src/shared/etherscanLabels.js

@@ -3,7 +3,6 @@
 // This is a best-effort enrichment: network failures return null silently.
 
 const { networkByChainId } = require("./networks");
-const { storedSettingIsOn } = require("./storedSettings");
 
 // Patterns in the page title that indicate a flagged address.
 // Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
@@ -79,19 +78,21 @@ function parseEtherscanPage(html) {
  * when it is omitted: etherscan.io on mainnet, sepolia.etherscan.io on
  * Sepolia.
  *
- * While the stored "Check recipients on Etherscan" is off, Etherscan is not
+ * While the user's "Check recipients on Etherscan" setting is off, Etherscan
- * asked. An answer that lands after the setting went off is dropped
+ * is not asked and the answer is null.
- * (src/shared/storedSettings.js). Either way the answer is null.
  *
  * @param {string} address - Ethereum address to check.
+ * @param {boolean} checkRecipientsOnEtherscan - The user's setting.
  * @param {string} [chainId] - Chain id of the network to look it up on.
  * @returns {Promise<{type: string, message: string, severity: string}|null>}
  */
-async function checkEtherscanLabel(address, chainId) {
+async function checkEtherscanLabel(
+    address,
+    checkRecipientsOnEtherscan,
+    chainId,
+) {
+    if (!checkRecipientsOnEtherscan) return null;
     try {
-        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
-            return null;
-        }
         // Lazy require to avoid pulling in chrome.storage at module scope
         // (which breaks unit tests that only exercise parseEtherscanPage).
         const { currentNetwork } = require("./state");
@@ -102,9 +103,6 @@ async function checkEtherscanLabel(address, chainId) {
         });
         if (!resp.ok) return null;
         const html = await resp.text();
-        if (!(await storedSettingIsOn("checkRecipientsOnEtherscan"))) {
-            return null;
-        }
         const result = parseEtherscanPage(html);
         if (result.isPhishing) {
             return {

src/shared/persistedState.js

@@ -48,17 +48,12 @@ const DEFAULT_STATE = {
     hideDustTransactions: true,
     dustThresholdGwei: 100000,
     utcTimestamps: false,
-    // "Use Blockscout" and "Check recipients on Etherscan" in Settings. Each
+    // "Use Blockscout" and "Check recipients on Etherscan" in Settings, one
-    // setting applies to every network. Both are off until the user turns them
+    // setting each for every network. Both off until the user turns them on:
-    // on. With "Use Blockscout" on, Blockscout is sent the user's addresses and
+    // the requests they allow send the user's addresses to a service other
-    // the hash of each transaction opened. With "Check recipients on
+    // than the RPC endpoint.
-    // Etherscan" on, Etherscan is sent the recipient's address and nothing
-    // else.
     useBlockscout: false,
     checkRecipientsOnEtherscan: false,
-    // "Allow weak passwords" in Settings. While it is off, AddWallet refuses a
-    // password shorter than 12 characters.
-    allowWeakPasswords: false,
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
@@ -417,13 +412,12 @@ function normalizePersisted(saved) {
             : 100000;
     out.utcTimestamps =
         saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
-    // Anything but true is off: each setting lets a request reach another
+    out.useBlockscout =
-    // service.
+        saved.useBlockscout !== undefined ? saved.useBlockscout : false;
-    out.useBlockscout = saved.useBlockscout === true;
+    out.checkRecipientsOnEtherscan =
-    out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true;
+        saved.checkRecipientsOnEtherscan !== undefined
-    // Anything but true is off: the setting lets AddWallet accept a short
+            ? saved.checkRecipientsOnEtherscan
-    // password.
+            : false;
-    out.allowWeakPasswords = saved.allowWeakPasswords === true;
     // A list of contract addresses, floored the same way: send.js builds its
     // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
     // and filterTransactions() maps the same list through normalizeAddress(),

src/shared/prices.js

@@ -1,105 +1,31 @@
-// USD prices, read from Chainlink price feeds on Ethereum mainnet, with USD
+// Price fetching with 5-minute cache, USD formatting, value aggregation.
-// formatting and value aggregation. The feeds are in src/shared/tokenList.js.
 
-const { Contract } = require("ethers");
+const { getTopTokenPrices } = require("./tokenList");
-const { ETH_USD_FEED, PRICE_FEED_BY_ADDRESS } = require("./tokenList");
-const { getProvider } = require("./balances");
 const { isBelowOneMillionth } = require("./amountDisplay");
 const { networkByChainId } = require("./networks");
-const { log } = require("./log");
 
 const PRICE_CACHE_TTL = 300000; // 5 minutes
 
-// A reading older than its feed's heartbeat plus this many seconds is no price.
-const STALE_MARGIN = 1800; // 30 minutes
-
-const FEED_ABI = [
-    "function latestRoundData() view returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound)",
-];
-
-// USD prices: ether's under "ETH", each token's under its lowercased contract
-// address.
 const prices = {};
 let lastFetchedAt = 0;
 
-// Reads the price of ether and of each token any address holds or the user
+async function refreshPrices() {
-// tracks, when that token has a feed. Mainnet only. The reads go to the RPC
+    // Testnet tokens have no real market value — skip price fetching
-// endpoint as one batched request, at most every 5 minutes. A failed read is
+    // and clear any stale mainnet prices so the UI shows no USD values.
-// logged, and that token then has no price.
+    const { currentNetwork } = require("./state");
-//
+    if (currentNetwork().isTestnet) {
-// `signal`, passed by the popup, is aborted when the popup closes. A read that
-// fails once `signal` is aborted is not logged, because closing the popup
-// cancelled it.
-async function refreshPrices(signal) {
-    const { state, currentNetwork } = require("./state");
-    if (currentNetwork().id !== "mainnet") {
         clearPrices();
         return;
     }
     const now = Date.now();
     if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
-    const feeds = new Map([["ETH", ETH_USD_FEED]]);
-    for (const address of heldOrTrackedTokens(state)) {
-        const feed = PRICE_FEED_BY_ADDRESS.get(address);
-        if (feed) feeds.set(address, feed);
-    }
-    // ethers sends calls made together on one provider as one batch.
-    const provider = getProvider(state.rpcUrl, state.networkId);
-    const read = {};
-    await Promise.all(
-        [...feeds].map(async ([key, feed]) => {
     try {
-                const contract = new Contract(feed.address, FEED_ABI, provider);
+        const fetched = await getTopTokenPrices(25);
-                const round = await contract.latestRoundData();
+        Object.assign(prices, fetched);
-                const price = priceFromRound(round, feed, now);
-                if (price === null) {
-                    log.warnf(
-                        "price feed reading is stale or not positive",
-                        key,
-                    );
-                    return;
-                }
-                read[key] = price;
-            } catch (e) {
-                if (signal?.aborted) return;
-                log.errorf(
-                    "price feed read failed",
-                    key,
-                    e.shortMessage || e.message,
-                );
-            }
-        }),
-    );
-    clearPrices();
-    Object.assign(prices, read);
         lastFetchedAt = now;
-}
+    } catch {
-
+        // prices stay stale on error
-// The lowercased contract address of each token that any address holds or
-// that the user tracks.
-function heldOrTrackedTokens(state) {
-    const addresses = new Set();
-    for (const wallet of state.wallets) {
-        for (const addr of wallet.addresses) {
-            for (const token of addr.tokenBalances || []) {
-                addresses.add(token.address.toLowerCase());
     }
-        }
-    }
-    for (const token of state.trackedTokens || []) {
-        addresses.add(token.address.toLowerCase());
-    }
-    return addresses;
-}
-
-// The USD price in a feed's latestRoundData() result, or null when the answer
-// is not positive or was written longer ago than the feed's heartbeat plus
-// STALE_MARGIN. `now` is in milliseconds.
-function priceFromRound(round, feed, now) {
-    const ageSeconds = now / 1000 - Number(round.updatedAt);
-    if (ageSeconds > feed.heartbeat + STALE_MARGIN) return null;
-    if (round.answer <= 0n) return null;
-    return Number(round.answer) / 10 ** feed.decimals;
 }
 
 // Clear all cached prices and reset the fetch timestamp so the
@@ -111,15 +37,14 @@ function clearPrices() {
     lastFetchedAt = 0;
 }
 
-// Return the USD price of the token at the contract address `token`, or of
+// Return the USD price for a symbol on the network with `chainId`, or on the
-// ether when `token` is "ETH". The price is for the network with `chainId`, or
+// active network when no chain id is given; null on testnet, on a chain id
-// for the active network when no chain id is given. Returns null on testnet,
+// that names no network, or for a symbol with no price.
-// on a chain id that names no network, and for a token with no price.
+function getPrice(symbol, chainId) {
-function getPrice(token, chainId) {
     const { currentNetwork } = require("./state");
     const network = chainId ? networkByChainId(chainId) : currentNetwork();
     if (!network || network.isTestnet) return null;
-    return prices[token === "ETH" ? "ETH" : token.toLowerCase()] || null;
+    return prices[symbol] || null;
 }
 
 function formatUsd(amount) {
@@ -137,7 +62,7 @@ function formatUsd(amount) {
 
 // What an address is worth, as { usd, partial }.
 //
-// Only a token with a price feed has a price, so an address can hold real
+// Prices are fetched for the top 25 tokens only, so an address can hold real
 // assets this code has no price for. Adding up the priced ones and calling the
 // result the total states a number the holdings do not support: an address
 // holding nothing but unpriced tokens comes out at $0.00, which tells the user
@@ -174,9 +99,8 @@ function getAddressValue(addr) {
         // nor make it incomplete. Anything that is not a number at all is not
         // a holding this can price either, and is left to the same rule.
         if (!(tokenBal > 0)) continue;
-        const price = prices[token.address.toLowerCase()];
+        if (prices[token.symbol]) {
-        if (price) {
+            usd += tokenBal * prices[token.symbol];
-            usd += tokenBal * price;
         } else {
             partial = true;
         }

src/shared/state.js

@@ -469,11 +469,9 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // exists to remove, just delayed and confined to one page instead of two
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
-// before this fix; only the persisted record is guaranteed current. Three
+// before this fix; only the persisted record is guaranteed current. The
-// fields are the exceptions: the network, "Use Blockscout" and "Check
+// network is the exception: the popup takes a switch another context saved
-// recipients on Etherscan". Through `beforeWrite`, the popup takes a change to
+// through `beforeWrite` (followNetworkSwitch() in src/popup/index.js).
-// any of them that another context saved (followStoredSettings() in
-// src/popup/index.js).
 async function saveStateOnce(beforeWrite) {
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written
@@ -581,7 +579,9 @@ function reportSaveFailure(err) {
 // Each save runs start to finish holding the lock every write of the stored
 // record takes (withLock() in src/shared/browserApi.js), so no write by
 // another page or the background lands between its read and its write and is
-// lost (https://git.eeqj.de/sneak/AutistMask/issues/641).
+// lost (https://git.eeqj.de/sneak/AutistMask/issues/641). A page in a Firefox
+// private window is the exception: Firefox gives it locks of its own (README,
+// "Stored state and its version").
 //
 // The same lock orders this page's own saves. showView() calls saveState() on
 // every navigation without awaiting it, so two saves from one page can be
@@ -603,7 +603,7 @@ function saveState(beforeWrite) {
 }
 
 // Give this page the network switch held by `stored`, a record a save of this
-// page has just read (followStoredSettings() in src/popup/index.js calls this
+// page has just read (followNetworkSwitch() in src/popup/index.js calls this
 // from `beforeWrite`), in `state` and in `baseline` alike, as loadState() does
 // with a whole record. The switch is then not this page's own change, even when
 // that save fails to write: a later switch back to the previous network still

src/shared/storedSettings.js

@@ -1,27 +0,0 @@
-// Reads "Use Blockscout" or "Check recipients on Etherscan" from the stored
-// profile.
-//
-// Before each request that sends the user's data to Blockscout or Etherscan, the
-// wallet reads that service's setting from storage. The wallet reads the setting
-// again when the answer lands. While the setting is off, no such request is
-// made, and an answer that lands after the setting went off is dropped. A page's
-// own copy of the setting is not used, because another page may have just
-// changed it.
-
-const { storageGet } = require("./browserApi");
-const { normalizePersisted } = require("./persistedState");
-
-// Whether the setting `name` is on in the stored profile. `name` is
-// "useBlockscout" or "checkRecipientsOnEtherscan". The profile is read through
-// normalizePersisted(), as a load reads it, so only a stored true is on. A
-// failed read counts as off.
-async function storedSettingIsOn(name) {
-    try {
-        const { autistmask } = await storageGet("autistmask");
-        return normalizePersisted(autistmask)[name];
-    } catch {
-        return false;
-    }
-}
-
-module.exports = { storedSettingIsOn };

src/shared/tokenList.js

@@ -4,12 +4,12 @@
 // Addresses are EIP-55 checksummed.
 //
 // 511 tokens.
-//
-// Below the list, USD_PRICE_FEEDS gives the Chainlink USD price feed of each
-// token that has one.
 
+const { debugFetch } = require("./log");
 const { NETWORKS } = require("./networks");
 
+const COINDESK_API = "https://data-api.coindesk.com/index/cc/v1/latest/tick";
+
 const TOKENS = [
     {
         address: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
@@ -3597,351 +3597,6 @@ const TOKENS = [
     },
 ];
 
-// Chainlink price feeds on Ethereum mainnet. Each feed is a contract whose
-// latestRoundData() returns a USD price and the time the price was written.
-// The fields of a feed:
-//
-//   - address: the feed's contract
-//   - heartbeat: the most seconds the feed goes without a new price
-//   - decimals: the number of decimal places in the price
-//
-// Each feed's address and heartbeat come from Chainlink's published list of
-// mainnet feeds. Each feed was checked on mainnet by reading its description()
-// and decimals().
-
-// The ETH/USD feed, which prices ether and WETH.
-const ETH_USD_FEED = {
-    address: "0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419",
-    heartbeat: 3600,
-    decimals: 8,
-};
-
-// The USD feed of each token in TOKENS that has one, keyed by the token's
-// contract address as TOKENS spells it. A token is paired with its feed by its
-// address alone, so a token that copies a listed token's symbol gets no feed.
-const USD_PRICE_FEEDS = {
-    // WETH
-    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": ETH_USD_FEED,
-    // USDT
-    "0xdAC17F958D2ee523a2206206994597C13D831ec7": {
-        address: "0x3E7d1eAB13ad0104d2750B8863b489D65364e32D",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // BNB
-    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": {
-        address: "0x14e613AC84a31f709eadbdF89C6CC390fDc9540A",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDC
-    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": {
-        address: "0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // USDS
-    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": {
-        address: "0xfF30586cD0F29eD462364C7e81375FC0C71219b1",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // LINK
-    "0x514910771AF9Ca656af840dff83E8264EcF986CA": {
-        address: "0x2c1d072e956AFFC0D435Cb7AC38EF18d24d9127c",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // USDE
-    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": {
-        address: "0xa569d910839Ae8865Da8F8e70FfFb0cBA869F961",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // USD1
-    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d": {
-        address: "0xF0d9bb015Cd7BfAb877B7156146dc09Bf461370d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // DAI
-    "0x6B175474E89094C44Da98b954EedeAC495271d0F": {
-        address: "0xAed0c38402a5d19df6E4c03F4E2DceD6e29c1ee9",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // PYUSD
-    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8": {
-        address: "0x8f1dF6D7F2db73eECE86a18b4381F4707b918FB1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // WLFI
-    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6": {
-        address: "0x14E5FC91Ddb3f97C33013Cc9fA74F54062Ad1Aa1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // UNI
-    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": {
-        address: "0x553303d460EE0afB37EdFf9bE42922D8FF63220e",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // PAXG
-    "0x45804880De22913dAFE09f4980848ECE6EcbAf78": {
-        address: "0x9944D86CEB9160aF5C5feB251FD671923323f8C3",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // AAVE
-    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": {
-        address: "0x547a514d5e3769680Ce22B2361c10Ea13619e8a9",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // USDF
-    "0xFa2B947eEc368f42195f24F36d2aF29f7c24CeC2": {
-        address: "0xb177857a1799aA5F7fEb5799Fdf12CbE8fdF78B1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDG
-    "0xe343167631d89B6Ffc58B88d6b7fB0228795491D": {
-        address: "0x14f0737d6b705259e521EA6E9E3506AC78dBd311",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SKY
-    "0x56072C95FAA701256059aa122697B133aDEd9279": {
-        address: "0xee10fE5E7aa92dd7b136597449c3d5813cFC5F18",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RLUSD
-    "0x8292Bb45bf1Ee4d140127049757C2E0fF06317eD": {
-        address: "0x26C46B7aD0012cA71F2298ada567dC9Af14E7f2A",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDTB
-    "0xC139190F447e929f090Edeb554D95AbB8b18aC1C": {
-        address: "0x66704DAD467A7cA508B3be15865D9B9F3E186c90",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // ARB
-    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": {
-        address: "0x31697852a68433DbCc2Ff612c516d69E3D9bd08F",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USD0
-    "0x73A15FeD60Bf67631dC6cd7Bc5B6e8da8190aCF5": {
-        address: "0x7e891DEbD8FA0A4Cf6BE58Ddff5a8ca174FebDCB",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // GHO
-    "0x40D16FC0246aD3160Ccc09B8D0D3A2cD28aE6C2f": {
-        address: "0x3f12643D3f6f874d39C2a4c9f2Cd6f2DbAC877FC",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // TUSD
-    "0x0000000000085d4780B73119b644AE5ecd22b376": {
-        address: "0xec746eCF986E2927Abd291a2A1716c940100f8Ba",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // EURC
-    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": {
-        address: "0x04F84020Fdf10d9ee64D1dcC2986EDF2F556DA11",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FDUSD
-    "0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409": {
-        address: "0xfAA9147190c2C2cc5B8387B4f49016bDB3380572",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CRV
-    "0xD533a949740bb3306d119CC777fa900bA034cd52": {
-        address: "0xCd627aA160A6fA45Eb793D19Ef54f5062F20f33f",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // GRT
-    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": {
-        address: "0x86cF33a451dE9dc61a2862FD94FF4ad4Bd65A5d2",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CRVUSD
-    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": {
-        address: "0xEEf0C605546958c1f899b6fB336C20671f9cD49F",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRAX, the Legacy Frax Dollar, priced by Chainlink's FRAX / USD feed
-    "0x853d955aCEf822Db058eb8505911ED77F175b99e": {
-        address: "0xB9E1E3A9feFf48998E45Fa90847ed4D467E8BcfD",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // ENS
-    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": {
-        address: "0x5C00128d4d1c2F4f652C267d7bcdD7aC99C16E16",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SAND
-    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": {
-        address: "0x35E3f7E558C04cE7eEE1629258EcbbA03B36Ec56",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // AUSD
-    "0x00000000eFE302BEAA2b3e6e1b18d08D69a9012a": {
-        address: "0xB00341502DfEA6Ced8A5786b4059d29dA5E4D1FD",
-        heartbeat: 86400,
-        decimals: 18,
-    },
-    // COMP
-    "0xc00e94Cb662C3520282E6f5717214004A7f26888": {
-        address: "0xdbd020CAeF83eFd542f4De03e3cF0C28A4428bd5",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // XCN
-    "0xA2cd3D43c775978A96BdBf12d733D5A1ED94fb18": {
-        address: "0xeb988B77b94C186053282BfcD8B7ED55142D3cAB",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CVX
-    "0x4e3FBD56CD56c3e72c1403e103b45Db9da5B9D2B": {
-        address: "0xd962fC30A72A84cE50161031391756Bf2876Af5D",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // IMX
-    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": {
-        address: "0xBAEbEFc1D023c0feCcc047Bff42E75F15Ff213E6",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // 1INCH
-    "0x111111111117dC0aa78b770fA6A738034120C302": {
-        address: "0xc929ad75B72593967DE83E7F7Cda0493458261D9",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SNX
-    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": {
-        address: "0xDC3EA94CD0AC27d9A86C180091e7f78C683d3699",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // DOLA
-    "0x865377367054516e17014CcdED1e7d814EDC9ce4": {
-        address: "0xE33592594f72Cc7ec8a05788be8E8455746C3a32",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRXUSD
-    "0xCAcd6fd266aF91b8AeD52aCCc382b4e165586E29": {
-        address: "0x9B4a96210bc8D9D55b1908B465D8B0de68B7fF83",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // YFI
-    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": {
-        address: "0xA027702dbb89fbd58938e4324ac03B58d812b0E1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RSR
-    "0x320623b8E4fF03373931769A31Fc52A4E78B5d70": {
-        address: "0x759bBC1be8F90eE6457C44abc7d443842a976d02",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // ZRX
-    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": {
-        address: "0x2885d15b8Af22648b98B122b22FDF4D2a56c6023",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRAX, formerly FXS, priced by Chainlink's FXS / USD feed
-    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": {
-        address: "0x6Ebc52C8C1089be9eB3945C4350B68B8E4C2233f",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SXT
-    "0xE6Bfd33F52d82Ccb5b37E16D3dD81f9FFDAbB195": {
-        address: "0x2D27d9e1b74936D8E83c4BA118F09A4c4a897f62",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SUSHI
-    "0x6B3595068778DD592e39A122f4f5a5cF09C90fE2": {
-        address: "0xCc70F09A6CC17553b2E31954cD36E4A2d89501f7",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RPL
-    "0xD33526068D116cE69F19A9ee46F0bd304F21A51f": {
-        address: "0x4E155eD98aFE9034b7A5962f6C84c86d869daA9d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDP
-    "0x8E870D67F660D95d5be530380D0eC0bd388289E1": {
-        address: "0x09023c0DA49Aaf8fc3fA3ADF34C6A7016D38D5e3",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SPELL
-    "0x090185f2135308BaD17527004364eBcC2D37e5F6": {
-        address: "0x8c110B94C5f1d347fAcF5E1E938AB2db60E3c9a8",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // LUSD
-    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": {
-        address: "0x3D7aE7E594f2f2091Ad8798313450130d0Aba3a0",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // STG
-    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": {
-        address: "0x7A9f34a0Aa917D438e9b6E630067062B7F8f6f3d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // KNC
-    "0xdeFA4e8a7bcBA345F687a2f1456F5Edd9CE97202": {
-        address: "0xf8fF43E991A81e6eC886a3D281A2C6cC19aE70Fc",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // MUSD (the other MUSD in TOKENS has no feed)
-    "0xacA92E438df0B2401fF60dA7E4337B687a2435DA": {
-        address: "0xc90E3460424fb8ea79775089E9053113FEE34Ed0",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-};
-
-// Build a map of token address (lowercased) -> its USD price feed.
-const PRICE_FEED_BY_ADDRESS = new Map();
-for (const [address, feed] of Object.entries(USD_PRICE_FEEDS)) {
-    PRICE_FEED_BY_ADDRESS.set(address.toLowerCase(), feed);
-}
-
 // Return the top N tokens from the list.
 function getTopTokens(n) {
     return TOKENS.slice(0, n);
@@ -3988,6 +3643,33 @@ for (const t of TOKENS) {
     }
 }
 
+// Fetch USD prices for the top N tokens from CoinDesk.
+// Also always includes ETH. Returns { ETH: 1234.56, LINK: 8.60, ... }.
+// n must be <= 30 (API and sanity limit).
+async function getTopTokenPrices(n) {
+    if (n > 30) {
+        throw new Error("getTopTokenPrices: n must be <= 30, got " + n);
+    }
+    const symbols = ["ETH", ...TOKENS.slice(0, n).map((t) => t.symbol)];
+    const unique = [...new Set(symbols)];
+    const instruments = unique.map((s) => s + "-USD").join(",");
+    const url =
+        COINDESK_API +
+        "?market=cadli&instruments=" +
+        instruments +
+        "&apply_mapping=true";
+    const resp = await debugFetch(url);
+    const json = await resp.json();
+    const prices = {};
+    for (const [instrument, data] of Object.entries(json.Data || {})) {
+        const symbol = instrument.split("-")[0];
+        if (data.VALUE !== undefined) {
+            prices[symbol] = data.VALUE;
+        }
+    }
+    return prices;
+}
+
 // Resolve a token symbol from multiple sources, never returning "?".
 function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
     const lower = (tokenAddress || "").toLowerCase();
@@ -4008,9 +3690,7 @@ module.exports = {
     TOKENS,
     TOKEN_BY_ADDRESS,
     KNOWN_SYMBOLS,
-    ETH_USD_FEED,
-    USD_PRICE_FEEDS,
-    PRICE_FEED_BY_ADDRESS,
     getTopTokens,
+    getTopTokenPrices,
     resolveSymbol,
 };

src/shared/transactions.js

@@ -21,7 +21,6 @@ const { toDecimals } = require("./transferAmount");
 // detail view is the authoritative record and already shows exact precision.
 const { truncateAmount: formatTxValue } = require("./amountDisplay");
 const { routerRelease } = require("./uniswap");
-const { storedSettingIsOn } = require("./storedSettings");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.  Every address comparison in
@@ -237,16 +236,17 @@ function mergeTransactions(txs, tokenTransfers) {
 // carries it, and a native entry is labelled with that network's
 // `nativeCurrency` from networks.js (`ETH`, `SepoliaETH`).
 //
-// While the stored "Use Blockscout" is off, Blockscout is not asked. An answer
+// `useBlockscout` is the user's "Use Blockscout" setting. While it is off,
-// that lands after the setting went off is dropped
+// Blockscout is not asked and there is no history: the answer is an empty
-// (src/shared/storedSettings.js). Either way the answer is an empty list.
+// list.
 async function fetchRecentTransactions(
     address,
     blockscoutUrl,
+    useBlockscout,
     chainId,
     count = 25,
 ) {
-    if (!(await storedSettingIsOn("useBlockscout"))) return [];
+    if (!useBlockscout) return [];
     log.debugf("fetchRecentTransactions", address);
     const addrLower = normalizeAddress(address);
 
@@ -277,7 +277,6 @@ async function fetchRecentTransactions(
 
     const txJson = txResp.ok ? await txResp.json() : {};
     const ttJson = ttResp.ok ? await ttResp.json() : {};
-    if (!(await storedSettingIsOn("useBlockscout"))) return [];
 
     const txs = mergeTransactions(
         (txJson.items || []).map((tx) => parseTx(tx, addrLower, chainId)),

src/shared/uniswap.js

@@ -2032,14 +2032,12 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // it may take more. A later permit or batch, or a later step this
         // decoder did not read, may raise what Permit2 lets the router take.
         // Every other PERMIT2_PERMIT leaves Token In and the Amount line as
-        // they read with no permit, and gets lines of its own below. A permit
+        // they read with no permit, and gets lines of its own below. A step
-        // on the zero address never stands as the Amount figure, because
+        // that may take from the sender what this decoder did not read leaves
-        // Permit2 has no allowance of ETH. A step that may take from the
+        // no figure, permit or not (see spentUnread()), and so do a permit
-        // sender what this decoder did not read leaves no figure, permit or
+        // or batch whose input it cannot read (see permitUnread()) and an
-        // not (see spentUnread()), and so do a permit or batch whose input it
+        // allowance of Token In to another spender (see toAnotherSpender). An
-        // cannot read (see permitUnread()) and an allowance of Token In to
+        // EXECUTE_SUB_PLAN step leaves both sides unknown (below).
-        // another spender (see toAnotherSpender). An EXECUTE_SUB_PLAN step
-        // leaves both sides unknown (below).
         const stepCommands = Array.from(
             commandsBytes,
             (b) => commands[b & commandTypeMask],
@@ -2049,7 +2047,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             stepCommands.filter((c) => c === "PERMIT2_PERMIT").length === 1 &&
             !stepCommands.includes("PERMIT2_PERMIT_BATCH") &&
             sameAddress(permit.spender, toAddress) &&
-            permit.token !== "0x0000000000000000000000000000000000000000" &&
             !permit.allowedToFail &&
             permit.beforeEveryTake &&
             !stepsUnread.some((step) => step > permit.step);
@@ -2237,19 +2234,17 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // A null token in `spentFromSender`, a step this decoder did not read
         // or a token it does not know, and an allowance to another spender
         // that may be of Token In, leave no Amount figure, which may then be
-        // too low. An allowance of the zero address is never one of Token In,
+        // too low. With no Amount line, each take the total adds up gets
-        // because Permit2 has no allowance of ETH. With no Amount line, each
+        // lines of its own, first, so that every amount this decoder read is
-        // take the total adds up gets lines of its own, first, so that every
+        // shown.
-        // amount this decoder read is shown.
         if (
             present(inputAmount) &&
             spentFromSender.every((s) => present(s.token)) &&
             toAnotherSpender.every(
                 (p) =>
-                    p.token === "0x0000000000000000000000000000000000000000" ||
+                    present(p.token) &&
-                    (present(p.token) &&
                     present(inputToken) &&
-                        !sameAddress(p.token, inputToken)),
+                    !sameAddress(p.token, inputToken),
             )
         ) {
             const amount = spentText(inputAmount, inInfo);
@@ -2320,24 +2315,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 });
                 continue;
             }
-            // Permit2 has no allowance of ETH. An allowance of the zero
-            // address reads as one of a token nothing knows: its amount in
-            // base units, and the zero address as its token.
-            if (p.token === "0x0000000000000000000000000000000000000000") {
-                details.push({
-                    label: "Permit2 allowance",
-                    value:
-                        p.amount >= MAX_UINT160
-                            ? "Unlimited"
-                            : unknownDecimalsAmount(p.amount),
-                });
-                details.push({
-                    label: "Allowance token",
-                    value: p.token,
-                    address: p.token,
-                    isToken: true,
-                });
-            } else {
             details.push({
                 label: "Permit2 allowance",
                 value:
@@ -2346,10 +2323,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         : amountText(p.amount, tokenInfo(p.token, sources))
                               .display,
             });
-                details.push(
+            details.push(tokenMovedLine("Allowance token", p.token, sources));
-                    tokenMovedLine("Allowance token", p.token, sources),
-                );
-            }
             details.push({
                 label: "Allowance spender",
                 value: p.spender,

tests/addressValue.test.js

@@ -1,9 +1,9 @@
 // The USD total of an address that holds something this build cannot price
 // (issue #261).
 //
-// Only a token with a price feed has a price, so an address can hold real
+// Prices exist for the top 25 tokens only, so an address can hold real assets
-// assets with no price attached. Summing what is priced and printing the result
+// with no price attached. Summing what is priced and printing the result as
-// as the total says "$0.00" for an address holding nothing but unpriced tokens —
+// the total says "$0.00" for an address holding nothing but unpriced tokens —
 // worth-nothing and worth-an-unknown-amount collapsed into one number, in the
 // direction that matters. The two are separate facts here, the same way an
 // absent holders_count is not a count of zero.
@@ -63,7 +63,7 @@ const PARTLY_PRICED = {
 beforeEach(() => {
     clearPrices();
     prices.ETH = 2000;
-    prices[USDC] = 1;
+    prices.USDC = 1;
     state.wallets = [];
     state.trackedTokens = [];
     state.showZeroBalanceTokens = false;

tests/alarms.test.js

@@ -41,8 +41,6 @@ jest.mock("../src/shared/balances", () => ({
     refreshBalances: jest.fn(async () => {
         mockBalanceRefreshAt.push(Date.now());
     }),
-    dropUntrackedTokens: jest.requireActual("../src/shared/balances")
-        .dropUntrackedTokens,
     getProvider: jest.fn(() => ({})),
 }));
 

tests/allowWeakPasswords.test.js

@@ -1,87 +0,0 @@
-// "Allow weak passwords" in Settings is off until the user ticks it. While it
-// is off, AddWallet refuses a password shorter than 12 characters. While it is
-// on, AddWallet accepts any password that is not empty
-// (https://git.eeqj.de/sneak/AutistMask/issues/674). These boot the real popup,
-// set the checkbox in Settings as the user does, and then add a wallet.
-
-jest.mock("../src/shared/vault", () => ({
-    decryptWithPassword: jest.fn(),
-    encryptWithPassword: jest.fn(async () => ({
-        salt: "salt",
-        nonce: "nonce",
-        ciphertext: "ciphertext",
-    })),
-}));
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-const CHECKBOX = "settings-allow-weak-passwords";
-const ERROR = "add-wallet-password-error";
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// Boots a popup that holds one wallet and opens Settings, where the checkbox
-// starts unticked. Ticks it when `allow` is true. Then opens AddWallet and
-// presses the die for a recovery phrase.
-async function openAddWallet(allow) {
-    const page = await bootPopup(unversionedValidProfile());
-    await page.click("btn-settings");
-    const checkbox = page.node(CHECKBOX);
-    expect(checkbox.checked).toBe(false);
-    if (allow) {
-        checkbox.checked = true;
-        for (const fn of checkbox.listeners.change) await fn();
-        expect(page.storage.read("autistmask").allowWeakPasswords).toBe(true);
-    }
-    await page.click("btn-main-add-wallet");
-    await page.click("btn-generate-phrase");
-    return page;
-}
-
-// Types `password` into both password fields and presses Import.
-async function importWith(page, password) {
-    page.node("add-wallet-password").value = password;
-    page.node("add-wallet-password-confirm").value = password;
-    await page.click("btn-add-wallet-confirm");
-}
-
-function storedWalletCount(page) {
-    return page.storage.read("autistmask").wallets.length;
-}
-
-describe("Allow weak passwords", () => {
-    test("unticked: a password shorter than 12 characters is refused", async () => {
-        const page = await openAddWallet(false);
-        await importWith(page, "short");
-        expect(page.text(ERROR)).toBe(
-            "Password must be at least 12 characters.",
-        );
-        expect(storedWalletCount(page)).toBe(1);
-        expect(page.visibleViews()).toEqual(["add-wallet"]);
-    });
-
-    test("ticked: a password shorter than 12 characters is accepted", async () => {
-        const page = await openAddWallet(true);
-        await importWith(page, "short");
-        expect(page.text(ERROR)).toBe("");
-        expect(storedWalletCount(page)).toBe(2);
-        expect(page.visibleViews()).toEqual(["main"]);
-    });
-
-    test.each([false, true])(
-        "an empty password is refused (ticked: %s)",
-        async (allow) => {
-            const page = await openAddWallet(allow);
-            await importWith(page, "");
-            expect(page.text(ERROR)).toBe("Please choose a password.");
-            expect(storedWalletCount(page)).toBe(1);
-            expect(page.visibleViews()).toEqual(["add-wallet"]);
-        },
-    );
-});

tests/approvalAmount.test.js

@@ -84,9 +84,6 @@ function walletsHolding(token, decimals) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
-    // The approval screen reads the explorer's report only while "Use
-    // Blockscout" is on.
-    state.useBlockscout = true;
 });
 
 describe("resolveTokenDecimals", () => {

tests/approvalUseBlockscoutOff.test.js

@@ -1,308 +0,0 @@
-// While "Use Blockscout" is off, the approval screens, and the screens that
-// follow TxApproval, take a token's name and scale from the bundled list and
-// the tracked tokens alone (https://git.eeqj.de/sneak/AutistMask/issues/668).
-// A token missing from both gets a line under it. The line says Blockscout's
-// report of the user's balances is not used to name the token. While the
-// setting is on, Blockscout's report of the user's holding is a source too, as
-// before.
-//
-// Booted through the real popup entry point, as the approval window or as a
-// popup reopened onto SuccessTx, WaitTx or ErrorTx. The vault is mocked so that
-// no password has to be hashed: the stored secret decrypts to the test key
-// below.
-
-jest.mock("../src/shared/vault", () => ({
-    decryptWithPassword: jest.fn(),
-    encryptWithPassword: jest.fn(),
-}));
-
-const { Interface, Wallet } = require("ethers");
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-// A published test key, never used for real funds.
-const SIGNER_KEY =
-    "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
-const signer = new Wallet(SIGNER_KEY);
-const ORIGIN = "https://dapp.example";
-const RECIPIENT = "0x2222222222222222222222222222222222222222";
-const TX_HASH = "0x" + "ab".repeat(32);
-// Outside the bundled list, and not tracked.
-const TOKEN = "0xE2E0000000000000000000000000000000000E2e";
-// In the bundled list, at 6 decimals.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-
-const LINE =
-    'Blockscout\'s report of your balances is not used to name this token, because "Use Blockscout" is off in Settings.';
-
-// TOKEN as Blockscout reports the user's holding of it.
-const TOKEN_ROW = {
-    address: TOKEN,
-    name: "Novel",
-    symbol: "NOVEL",
-    decimals: "6",
-    balance: "5000.0",
-    holders: 5000,
-};
-
-// A transfer of 5,000 of a 6-decimal token to RECIPIENT.
-const TRANSFER_DATA = new Interface([
-    "function transfer(address to, uint256 amount)",
-]).encodeFunctionData("transfer", [RECIPIENT, 5000000000n]);
-
-// An EIP-2612 permit letting RECIPIENT take 5,000 of TOKEN.
-const PERMIT = {
-    types: {
-        EIP712Domain: [
-            { name: "name", type: "string" },
-            { name: "chainId", type: "uint256" },
-            { name: "verifyingContract", type: "address" },
-        ],
-        Permit: [
-            { name: "owner", type: "address" },
-            { name: "spender", type: "address" },
-            { name: "value", type: "uint256" },
-            { name: "nonce", type: "uint256" },
-            { name: "deadline", type: "uint256" },
-        ],
-    },
-    primaryType: "Permit",
-    domain: { name: "Novel", chainId: 1, verifyingContract: TOKEN },
-    message: {
-        owner: signer.address,
-        spender: RECIPIENT,
-        value: "5000000000",
-        nonce: "0",
-        deadline: "1790000000",
-    },
-};
-
-// The stored profile: the user's one address holds `tokenBalances`.
-function profile(useBlockscout, tokenBalances, extra) {
-    return unversionedValidProfile({
-        useBlockscout,
-        wallets: [
-            {
-                type: "key",
-                name: "Wallet 1",
-                encryptedSecret: "encrypted-key",
-                addresses: [
-                    {
-                        address: signer.address,
-                        balance: "1.0",
-                        tokenBalances,
-                    },
-                ],
-            },
-        ],
-        activeAddress: signer.address,
-        allowedSites: { [signer.address]: [ORIGIN] },
-        ...extra,
-    });
-}
-
-// The approval window for the site's request. The request is a transfer sent to
-// `token`, or a signature request when `signParams` is given. The background
-// answers the signed transaction with `txResponse`.
-function bootApproval(stored, { token = TOKEN, signParams, txResponse } = {}) {
-    return bootPopup(stored, {
-        search: "?approval=approval-1",
-        runtime: {
-            connect: () => ({ postMessage: () => {} }),
-            sendMessage: (msg, reply) => {
-                if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                    reply({
-                        type: signParams ? "sign" : "tx",
-                        origin: ORIGIN,
-                        isPhishingDomain: false,
-                        approvedFrom: signer.address,
-                        signParams,
-                        approvedTx: {
-                            type: 2,
-                            from: signer.address,
-                            chainId: "0x1",
-                            nonce: "0x7",
-                            gasLimit: "0x30d40",
-                            maxPriorityFeePerGas: "0x3b9aca00",
-                            maxFeePerGas: "0x77359400",
-                            to: token,
-                            value: "0x0",
-                            data: TRANSFER_DATA,
-                            accessList: [],
-                        },
-                    });
-                } else if (msg.type === "AUTISTMASK_TX_RESPONSE") {
-                    reply(txResponse);
-                } else {
-                    reply(undefined);
-                }
-            },
-        },
-    });
-}
-
-beforeEach(() => {
-    // The page logs its failed RPC reads; the stub node in popupBoot.js
-    // answers none.
-    jest.spyOn(console, "error").mockImplementation(() => {});
-});
-
-afterEach(() => {
-    cleanupPopup();
-    jest.restoreAllMocks();
-});
-
-describe("TxApproval", () => {
-    test("has the line under a token it cannot name while Use Blockscout is off", async () => {
-        const page = await bootApproval(profile(false, []));
-        const details = page.node("approve-tx-decoded-details").innerHTML;
-        expect(details).toContain("Unknown token");
-        expect(details).toContain(LINE);
-        expect(details).toContain("5000000000 base units (decimals unknown)");
-        cleanupPopup();
-
-        // The bundled list names USDC, so there is nothing to say.
-        const bundled = await bootApproval(profile(false, []), {
-            token: USDC,
-        });
-        expect(
-            bundled.node("approve-tx-decoded-details").innerHTML,
-        ).not.toContain(LINE);
-        cleanupPopup();
-
-        const on = await bootApproval(profile(true, [TOKEN_ROW]));
-        const named = on.node("approve-tx-decoded-details").innerHTML;
-        expect(named).toContain("5000.0000 NOVEL");
-        expect(named).not.toContain(LINE);
-    });
-
-    test("names nothing from a Blockscout entry still in the balances while Use Blockscout is off", async () => {
-        const page = await bootApproval(profile(false, [TOKEN_ROW]));
-        const details = page.node("approve-tx-decoded-details").innerHTML;
-        expect(details).not.toContain("NOVEL");
-        expect(details).toContain("Unknown token");
-        expect(details).toContain(LINE);
-    });
-
-    test.each([
-        ["WaitTx", { txHash: TX_HASH }, "wait-tx"],
-        [
-            "ErrorTx",
-            { error: "The transaction could not be sent.", retryable: false },
-            "error-tx",
-        ],
-    ])(
-        "%s after it says so under the amount while Use Blockscout is off",
-        async (_name, txResponse, view) => {
-            const page = await bootApproval(profile(false, []), {
-                txResponse,
-            });
-            const { decryptWithPassword } = require("../src/shared/vault");
-            decryptWithPassword.mockResolvedValue(SIGNER_KEY);
-            page.node("approve-tx-password").value = "any password";
-            await page.click("btn-approve-tx");
-            expect(page.visibleViews()).toEqual([view]);
-            expect(page.node(view + "-token-note").innerHTML).toBe(
-                `<div class="text-xs text-muted">${LINE}</div>`,
-            );
-        },
-    );
-});
-
-test("SuccessTx says so under the decoded token while Use Blockscout is off", async () => {
-    const page = await bootPopup(
-        profile(false, [], {
-            currentView: "success-tx",
-            viewStack: ["main"],
-            viewData: {
-                amount: "5000000000 base units (decimals unknown)",
-                symbol: "?",
-                to: RECIPIENT,
-                hash: TX_HASH,
-                blockNumber: 21000000,
-                chainId: "0x1",
-                decoded: {
-                    name: "Token Transfer",
-                    description: "Transfer ERC-20 token",
-                    details: [
-                        {
-                            label: "Token",
-                            value: TOKEN,
-                            address: TOKEN,
-                            isToken: true,
-                        },
-                    ],
-                },
-            },
-        }),
-    );
-    expect(page.visibleViews()).toEqual(["success-tx"]);
-    const decoded = page.node("success-tx-decoded").innerHTML;
-    expect(decoded).toContain("Unknown token");
-    expect(decoded).toContain(LINE);
-});
-
-test.each([
-    [
-        "wait-tx",
-        {
-            pendingWait: {
-                hash: TX_HASH,
-                txInfo: {
-                    to: RECIPIENT,
-                    amount: "1",
-                    token: 42,
-                    chainId: "0x1",
-                },
-                broadcastTime: Date.now(),
-            },
-        },
-    ],
-    [
-        "error-tx",
-        {
-            amount: "1",
-            symbol: "?",
-            token: 42,
-            to: RECIPIENT,
-            hash: TX_HASH,
-            message: "The transaction failed.",
-            chainId: "0x1",
-        },
-    ],
-])(
-    "a popup reopened onto %s shows no line for a stored token that is not text",
-    async (view, viewData) => {
-        const page = await bootPopup(
-            profile(false, [], {
-                currentView: view,
-                viewStack: ["main"],
-                viewData,
-            }),
-        );
-        expect(page.pageErrors).toEqual([]);
-        expect(page.visibleViews()).toEqual([view]);
-        expect(page.node(view + "-token-note").innerHTML).toBe("");
-    },
-);
-
-test("SignApproval says so under a permit's token while Use Blockscout is off", async () => {
-    const signParams = {
-        method: "eth_signTypedData_v4",
-        typedData: JSON.stringify(PERMIT),
-        from: signer.address,
-    };
-    const page = await bootApproval(profile(false, []), { signParams });
-    const message = page.node("approve-sign-message").innerHTML;
-    expect(message).toContain("Unknown token");
-    expect(message).toContain(LINE);
-    cleanupPopup();
-
-    const on = await bootApproval(profile(true, [TOKEN_ROW]), { signParams });
-    const named = on.node("approve-sign-message").innerHTML;
-    expect(named).toContain("5000.0000 NOVEL");
-    expect(named).not.toContain(LINE);
-});

tests/approvalWindow.test.js

@@ -12,7 +12,6 @@ const {
     cleanupPopup,
     settle,
     unversionedValidProfile,
-    ADDRESS,
 } = require("./support/popupBoot");
 
 afterEach(cleanupPopup);
@@ -175,136 +174,3 @@ test("a connection prompt in the toolbar popup leaves the browser window alone",
     expect(windows.updates).toEqual([]);
     expect(env.pageErrors).toEqual([]);
 });
-
-// Each row holds a transaction or signature approval as the background
-// describes it, plus the element ids of the screen that shows it. `refusal` is
-// the message the background refuses a Reject with.
-const TX_AND_SIGN_APPROVALS = [
-    {
-        kind: "transaction",
-        view: "approve-tx",
-        reject: "btn-reject-tx",
-        error: "approve-tx-error",
-        type: "AUTISTMASK_TX_RESPONSE",
-        refusal: "This transaction is already being sent.",
-        approval: {
-            type: "tx",
-            approvedFrom: ADDRESS,
-            approvedTx: {
-                chainId: 1,
-                to: ADDRESS,
-                value: "0",
-                data: "0x",
-                gasLimit: "21000",
-                maxFeePerGas: "1000000000",
-                maxPriorityFeePerGas: "1000000000",
-                nonce: 0,
-            },
-        },
-    },
-    {
-        kind: "signature",
-        view: "approve-sign",
-        reject: "btn-reject-sign",
-        error: "approve-sign-error",
-        type: "AUTISTMASK_SIGN_RESPONSE",
-        refusal: "This request is already being signed.",
-        approval: {
-            type: "sign",
-            approvedFrom: ADDRESS,
-            signParams: {
-                method: "personal_sign",
-                message: "0x48656c6c6f",
-                from: ADDRESS,
-            },
-        },
-    },
-];
-
-// A closed transaction or signature window leaves its request pending
-// (https://git.eeqj.de/sneak/AutistMask/issues/673). So Reject closes the
-// window only once the background has the rejection. A message sent as the
-// window closes can be lost, and the request would stay pending although the
-// user rejected it.
-test.each(TX_AND_SIGN_APPROVALS)(
-    "Reject on a $kind approval closes the window only once the background has answered",
-    async ({ view, reject, type, approval }) => {
-        let describeApproval = null;
-        let answerReject = null;
-        const sent = [];
-        const env = await bootPopup(unversionedValidProfile(), {
-            search: "?approval=approval-1",
-            runtime: {
-                connect: () => ({ postMessage: () => {} }),
-                sendMessage: (msg, reply) => {
-                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                        describeApproval = reply;
-                    }
-                    if (msg.type === type) {
-                        sent.push(msg);
-                        answerReject = reply;
-                    }
-                },
-            },
-        });
-        describeApproval({
-            ...approval,
-            origin: "https://dapp.example",
-            isPhishingDomain: false,
-        });
-        await settle();
-        expect(env.visibleViews()).toEqual([view]);
-        const close = jest.fn();
-        globalThis.window.close = close;
-
-        const clicked = env.click(reject);
-        await settle();
-        expect(sent).toEqual([{ type, id: "approval-1", approved: false }]);
-        expect(close).not.toHaveBeenCalled();
-
-        answerReject(null);
-        await clicked;
-        expect(close).toHaveBeenCalledTimes(1);
-        expect(env.pageErrors).toEqual([]);
-    },
-);
-
-// After Confirm or Sign, the background refuses a Reject while the transaction
-// is being sent or the signature checked. The request is not rejected then, so
-// the window stays open and shows the background's message.
-test.each(TX_AND_SIGN_APPROVALS)(
-    "Reject on a $kind approval that the background refuses shows the background's message and keeps the window open",
-    async ({ view, reject, error, type, refusal, approval }) => {
-        let describeApproval = null;
-        let answerReject = null;
-        const env = await bootPopup(unversionedValidProfile(), {
-            search: "?approval=approval-1",
-            runtime: {
-                connect: () => ({ postMessage: () => {} }),
-                sendMessage: (msg, reply) => {
-                    if (msg.type === "AUTISTMASK_GET_APPROVAL") {
-                        describeApproval = reply;
-                    }
-                    if (msg.type === type) answerReject = reply;
-                },
-            },
-        });
-        describeApproval({
-            ...approval,
-            origin: "https://dapp.example",
-            isPhishingDomain: false,
-        });
-        await settle();
-        const close = jest.fn();
-        globalThis.window.close = close;
-
-        const clicked = env.click(reject);
-        await settle();
-        answerReject({ error: refusal, retryable: false });
-        await clicked;
-        expect(close).not.toHaveBeenCalled();
-        expect(env.visibleViews()).toEqual([view]);
-        expect(env.text(error)).toBe(refusal);
-        expect(env.pageErrors).toEqual([]);
-    },
-);

tests/backgroundApproval.test.js

@@ -241,11 +241,10 @@ function loadBackground(options) {
     let connectListener = null;
     const created = [];
     const removed = [];
-    // Every URL the background put on the browser action. When a test gives
+    // Every URL the background put on the browser action. A site approval
-    // the URL the action holds before the worker starts, that URL comes
+    // raised through action.openPopup() opens no window at all, so this is
-    // first. A site approval raised through action.openPopup() opens no
+    // the only place its id appears.
-    // window at all, so this is the only place its id appears.
+    const actionPopups = [];
-    const actionPopups = opts.toolbarPopup ? [opts.toolbarPopup] : [];
     const openPopup = jest.fn(() => Promise.resolve());
 
     global.chrome = {
@@ -775,9 +774,10 @@ describe("one transaction approval at a time", () => {
 
     // The user closes an approval window that looks hung while the attempt
     // behind it is still running, and that attempt then fails in a way that
-    // leaves the approval standing for a retry. The toolbar popup opens it, so
+    // would normally leave the approval standing for a retry. There is no
-    // the user can still retry it, and answering it frees the slot.
+    // window left to retry in, so leaving it standing answers the requesting
-    test("an approval whose window closed under a failed attempt is retried from the toolbar popup, and frees the next request", async () => {
+    // page never — and holds the slot for the life of the worker with it.
+    test("an approval whose window closed under a failed attempt is answered, and frees the next request", async () => {
         const stalled = deferred();
         const bg = loadBackground();
 
@@ -808,28 +808,11 @@ describe("one transaction approval at a time", () => {
 
         stalled.resolve();
         await settle();
-        expect(first.result()).toBeNull();
+        expect(first.result()).toEqual({
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            error: { code: 4001, message: "User rejected the request." },
-            "src/popup/index.html?approval=" + first.id(),
+        });
-        );
 
         bg.setStateReadHook(null);
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: first.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(first.result()).toEqual({ result: "0xfeed" });
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
-            "src/popup/index.html",
-        );
-
         const second = bg.requestTx();
         await settle();
         expect(second.result()).toBeNull();
@@ -870,10 +853,8 @@ describe("one transaction approval at a time", () => {
         const first = bg.requestTx();
         await settle();
 
-        bg.send(
+        // The user closes the approval window, which rejects it.
-            { type: "AUTISTMASK_TX_RESPONSE", id: first.id(), approved: false },
+        bg.closeWindow(1);
-            { url: bg.fromPopup.url },
-        );
         await settle();
         expect(first.result()).toEqual({
             error: { code: 4001, message: "User rejected the request." },
@@ -916,7 +897,7 @@ describe("the worker keeps running while an approval is pending", () => {
         try {
             const bg = loadBackground();
             const calls = global.chrome.runtime.getPlatformInfo;
-            const pending = bg.requestTx();
+            bg.requestTx();
             await settle();
             expect(startTimer).toHaveBeenCalledTimes(1);
             expect(startTimer.mock.calls[0][1]).toBe(20000);
@@ -925,23 +906,11 @@ describe("the worker keeps running while an approval is pending", () => {
             tick();
             expect(calls).toHaveBeenCalledTimes(1);
 
-            // A closed window leaves the approval pending, so the calls go on.
+            // The user closes the approval window, which rejects it.
             bg.closeWindow(1);
             await settle();
             tick();
-            expect(calls).toHaveBeenCalledTimes(2);
+            expect(calls).toHaveBeenCalledTimes(1);
-
-            bg.send(
-                {
-                    type: "AUTISTMASK_TX_RESPONSE",
-                    id: pending.id(),
-                    approved: false,
-                },
-                { url: bg.fromPopup.url },
-            );
-            await settle();
-            tick();
-            expect(calls).toHaveBeenCalledTimes(2);
             expect(stopTimer).toHaveBeenCalledWith(1);
         } finally {
             startTimer.mockRestore();
@@ -1872,237 +1841,6 @@ describe("the interlock releases a failed attempt", () => {
     });
 });
 
-// A transaction or signature approval stays pending when its window closes.
-// The browser can close that window when the user clicks away from it, for
-// example to copy the password from a password manager. The toolbar popup then
-// opens the approval, and the user answers it there
-// (https://git.eeqj.de/sneak/AutistMask/issues/673).
-describe("a closed approval window leaves the request pending", () => {
-    // The URL the toolbar popup opens now.
-    function toolbarPopup(bg) {
-        return bg.actionPopups[bg.actionPopups.length - 1];
-    }
-
-    // The timer that keeps the worker running while an approval is pending is
-    // stubbed, so no test here leaves that timer running when it ends.
-    let keepRunningTimer;
-    beforeEach(() => {
-        keepRunningTimer = jest
-            .spyOn(global, "setInterval")
-            .mockImplementation(() => 1);
-    });
-    afterEach(() => {
-        keepRunningTimer.mockRestore();
-    });
-
-    test("the toolbar popup opens a closed transaction approval, and approving it there sends", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        bg.broadcastTransaction.mockResolvedValue({ hash: "0xfeed" });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("Reject in the toolbar popup answers 4001, and the toolbar popup opens the wallet again", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestSign();
-        await settle();
-
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        const reject = bg.send(
-            {
-                type: "AUTISTMASK_SIGN_RESPONSE",
-                id: pending.id(),
-                approved: false,
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        // The popup closes its window only once this answer arrives.
-        expect(reject.sendResponse).toHaveBeenCalledWith(null);
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("with two closed, the toolbar popup opens the older one first, then the other", async () => {
-        const bg = loadBackground();
-        const sign = bg.requestSign();
-        await settle();
-        const signId = sign.id();
-        const tx = bg.requestTx();
-        await settle();
-
-        // The signature request is in window 1 and the transaction in window
-        // 2. The newer window is closed first.
-        bg.closeWindow(2);
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + signId,
-        );
-
-        bg.send(
-            { type: "AUTISTMASK_SIGN_RESPONSE", id: signId, approved: false },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + tx.id(),
-        );
-
-        const reject = bg.send(
-            { type: "AUTISTMASK_TX_RESPONSE", id: tx.id(), approved: false },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(tx.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        expect(reject.sendResponse).toHaveBeenCalledWith(null);
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    // The user can close the window while the attempt after Confirm runs. That
-    // attempt answers the request, so meanwhile the toolbar popup opens the
-    // wallet. Opened from the toolbar, the approval would look unanswered.
-    test("when the window closes during an attempt that sends, the toolbar popup keeps opening the wallet", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        const inFlight = deferred();
-        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        inFlight.resolve({ hash: "0xfeed" });
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("when the window closes during an attempt that fails retryably, the toolbar popup opens the wallet until the attempt ends, then the approval", async () => {
-        const stalled = deferred();
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-
-        bg.setStateReadHook(async () => {
-            await stalled.promise;
-            throw new Error("The wallet data could not be read.");
-        });
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        stalled.resolve();
-        await settle();
-        expect(pending.result()).toBeNull();
-        expect(toolbarPopup(bg)).toBe(
-            "src/popup/index.html?approval=" + pending.id(),
-        );
-
-        // A retry from the toolbar popup holds the approval again, so the
-        // toolbar popup opens the wallet while that retry runs.
-        bg.setStateReadHook(null);
-        const inFlight = deferred();
-        bg.broadcastTransaction.mockReturnValue(inFlight.promise);
-        bg.send(
-            {
-                type: "AUTISTMASK_TX_RESPONSE",
-                id: pending.id(),
-                approved: true,
-                rawSignedTx: await signedAtNonce(NONCE),
-            },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-
-        inFlight.resolve({ hash: "0xfeed" });
-        await settle();
-        expect(pending.result()).toEqual({ result: "0xfeed" });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    test("an address switch still rejects a closed approval", async () => {
-        const bg = loadBackground();
-        const pending = bg.requestTx();
-        await settle();
-        bg.closeWindow(1);
-        await settle();
-        expect(pending.result()).toBeNull();
-
-        bg.send(
-            { type: "AUTISTMASK_ACTIVE_CHANGED" },
-            { url: bg.fromPopup.url },
-        );
-        await settle();
-        expect(pending.result()).toEqual({
-            error: { code: 4001, message: "User rejected the request." },
-        });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-
-    // The worker can stop while an approval waits with its window closed. The
-    // approval is lost with the worker, but the toolbar popup keeps its URL.
-    // The next worker points the toolbar popup back at the wallet.
-    test("a worker that starts points the toolbar popup back at the wallet", () => {
-        const bg = loadBackground({
-            toolbarPopup: "src/popup/index.html?approval=lost-approval",
-        });
-        expect(toolbarPopup(bg)).toBe("src/popup/index.html");
-    });
-});
-
 // The claim is what makes one approval one broadcast, so it has to hold
 // against everything else that retires an approval, not just against a second
 // AUTISTMASK_TX_RESPONSE. Each of these paths used to resolve the waiting
@@ -2223,6 +1961,20 @@ describe("a claimed approval outlives every other retirement path", () => {
     });
 
     // The refusals above must not cost the rejection its ordinary meaning.
+    test("with no attempt running, closing the window still rejects", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTx();
+        await settle();
+
+        bg.closeWindow(1);
+        await settle();
+
+        expect(pending.result()).toEqual({
+            error: { code: 4001, message: "User rejected the request." },
+        });
+        expect(bg.broadcastTransaction).not.toHaveBeenCalled();
+    });
+
     test("with no attempt running, an active-address switch still rejects and closes", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();
@@ -2832,12 +2584,15 @@ describe("a site connection decided as the popup closes", () => {
         });
     });
 
-    // That skip must not reach a tx or sign approval. The popup connects its
+    // The `isSite &&` half of that skip, which is what keeps it from reaching
-    // port in show() before it knows the approval's type, and the background
+    // a tx or sign approval. The popup connects its port in show() before it
-    // sets portConnected without looking at the type either, so a tx approval
+    // knows the approval's type, and the background sets portConnected without
-    // carries the flag too. If the window event skipped it, windowClosed would
+    // looking at the type either, so a tx approval in the fallback window
-    // never be set, and the toolbar popup would never open the approval.
+    // carries the flag too. Without the conjunct the window event would skip
-    test("a tx window closed with the port connected is still opened by the toolbar popup", async () => {
+    // it, windowClosed would never be set, releaseApproval() would never settle
+    // it, and the page would hang — the #271 regression this guard is written
+    // around.
+    test("a tx window closed with the port connected still rejects", async () => {
         const bg = loadBackground();
         const pending = bg.requestTx();
         await settle();
@@ -2845,10 +2600,9 @@ describe("a site connection decided as the popup closes", () => {
         await settle();
         bg.closeWindow(1);
         await settle();
-        expect(pending.result()).toBeNull();
+        expect(pending.result()).toEqual({
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            error: { code: 4001, message: "User rejected the request." },
-            "src/popup/index.html?approval=" + pending.id(),
+        });
-        );
     });
 });
 
@@ -3240,14 +2994,13 @@ describe("where an approval window opens", () => {
         expect(bg.created[1].left).toBeUndefined();
         expect(bg.created[1].top).toBeUndefined();
 
-        // The request waits on the second window rather than failing. Once
+        // The request waits on the second window rather than failing:
-        // that window closes, the toolbar popup opens the request.
+        // closing that window is refusing the prompt.
         expect(sign.result()).toBeNull();
         bg.closeWindow(2);
         await settle();
-        expect(sign.result()).toBeNull();
+        expect(sign.result()).toEqual({
-        expect(bg.actionPopups[bg.actionPopups.length - 1]).toBe(
+            error: { code: 4001, message: "User rejected the request." },
-            "src/popup/index.html?approval=" + sign.id(),
+        });
-        );
     });
 });

tests/backgroundStateIsolation.test.js

@@ -142,8 +142,6 @@ function loadWorker(networkId, opts) {
         },
         refreshBalances:
             options.refreshBalances || jest.fn(async () => undefined),
-        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
-            .dropUntrackedTokens,
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
         isPhishingDomain: () => false,
@@ -412,7 +410,14 @@ describe("a balance refresh under a network switch", () => {
         const ranOn = [];
 
         const bg = loadWorker("sepolia", {
-            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
+            refreshBalances: async (
+                wallets,
+                rpcUrl,
+                explorer,
+                useBlockscout,
+                tokens,
+                id,
+            ) => {
                 ranOn.push(id);
                 reachedNetwork.resolve();
                 await roundTrip.promise;
@@ -445,54 +450,3 @@ describe("a balance refresh under a network switch", () => {
         );
     });
 });
-
-describe("a balance refresh under a change of Use Blockscout", () => {
-    // Turning "Use Blockscout" off drops the tokens the user has not tracked
-    // (src/popup/views/settings.js). Blockscout may have answered a refresh
-    // just before. That refresh still saves its balances when it returns, but
-    // not those tokens. The same refresh in the popup is in
-    // tests/blockscoutEtherscanSettings.test.js.
-    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
-        const roundTrip = deferred();
-        const started = deferred();
-
-        const bg = loadWorker("mainnet", {
-            refreshBalances: async (wallets) => {
-                started.resolve();
-                await roundTrip.promise;
-                wallets[0].addresses[0].balance = "7.0";
-                wallets[0].addresses[0].tokenBalances = [
-                    {
-                        address: "0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-                        name: "Test Token",
-                        symbol: "TST",
-                        decimals: 18,
-                        balance: "5.0",
-                        holders: 50000,
-                    },
-                ];
-            },
-        });
-        global.chrome.storage.write("autistmask", {
-            ...bg.persisted(),
-            useBlockscout: true,
-        });
-
-        const refresh = bg.fireBalanceAlarm();
-        await started.promise;
-
-        // The user unticks "Use Blockscout" in Settings while the round trip
-        // is out.
-        global.chrome.storage.write("autistmask", {
-            ...bg.persisted(),
-            useBlockscout: false,
-        });
-
-        roundTrip.resolve();
-        await refresh;
-
-        const after = bg.persisted();
-        expect(after.wallets[0].addresses[0].balance).toBe("7.0");
-        expect(after.wallets[0].addresses[0].tokenBalances).toEqual([]);
-    });
-});

tests/balanceRefreshCancelled.test.js

@@ -24,12 +24,6 @@ const TRACKED = {
     decimals: 6,
 };
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
-const { makeStorageStub } = require("./support/storageStub");
-globalThis.chrome = {
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-};
-
 const realFetch = globalThis.fetch;
 let logged;
 
@@ -60,6 +54,7 @@ function refresh(signal) {
         wallets,
         RPC_URL,
         EXPLORER_URL,
+        true,
         [TRACKED],
         "mainnet",
         signal,

tests/balanceRefreshNetworkSwitch.test.js

@@ -91,7 +91,7 @@ test("a refresh that returns after a switch in Settings writes nothing, and the
 
     await page.tick();
 
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
     expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
         0,
     );

tests/blockscoutEtherscanSettings.test.js

@@ -1,26 +1,17 @@
 // Blockscout and Etherscan are sent none of the user's data until the user
-// turns on a setting for each
+// turns them on (https://git.eeqj.de/sneak/AutistMask/issues/668). A new
-// (https://git.eeqj.de/sneak/AutistMask/issues/668). A new profile has "Use
+// profile has "Use Blockscout" and "Check recipients on Etherscan" both off.
-// Blockscout" and "Check recipients on Etherscan" both off. While a setting is
+// Each request to either service is skipped where it is made while its setting
-// off, no request sends its service the user's data.
+// is off, and made while it is on; the popup and the background hand the
-//
+// stored setting to the code that makes the request. The one exception is the
-// One request still reaches Blockscout while "Use Blockscout" is off: the check
+// endpoint check Settings makes when the user presses "Save" beside the
-// behind "Save" beside the Blockscout URL in Settings. That check asks the URL
+// Blockscout URL. It asks only for `/stats` and carries no user data; it is
-// only for `/stats` and sends none of the user's data.
+// made whether or not the setting is on.
-//
-// Before any other request to Blockscout or Etherscan, the wallet reads that
-// service's setting from storage, not the page's copy. The wallet reads the
-// setting again when the answer lands. So a change saved by another page
-// applies at once. An open page also takes such a change and draws its screens
-// again.
-//
-// Only Blockscout reports the tokens the user has not tracked. While "Use
-// Blockscout" is off, no address keeps them and no screen lists them.
 //
 // The functions that make the requests are driven directly, against a fetch()
 // that records every URL it is asked for. The screens are driven through the
-// real popup over a stored profile (tests/support/popupBoot.js). The fetch()
+// real popup over a stored profile (tests/support/popupBoot.js), whose fetch()
-// stub in popupBoot.js records the same way.
+// stub records the same way.
 
 "use strict";
 
@@ -30,7 +21,6 @@ const {
     cleanupPopup,
     unversionedValidProfile,
     ADDRESS,
-    TOKEN_ADDRESS,
 } = require("./support/popupBoot");
 const { makeStorageStub } = require("./support/storageStub");
 const {
@@ -43,7 +33,6 @@ const {
 } = require("../src/shared/balances");
 const { fetchRecentTransactions } = require("../src/shared/transactions");
 const { getFullWarnings } = require("../src/shared/addressWarnings");
-const { checkEtherscanLabel } = require("../src/shared/etherscanLabels");
 const { HISTORY_OFF_TEXT, escapeHtml } = require("../src/popup/views/helpers");
 
 const RPC_URL = "https://rpc.example.invalid";
@@ -65,25 +54,6 @@ const USDC_ROW = {
     },
 };
 
-// A transfer of 1 ETH from RECIPIENT to ADDRESS, as Blockscout lists it in
-// ADDRESS's history.
-const HISTORY_ITEM = {
-    hash: TX_HASH,
-    block_number: 21000000,
-    timestamp: "2026-02-27T12:00:00.000Z",
-    from: { hash: RECIPIENT },
-    to: { hash: ADDRESS, is_contract: false },
-    value: "1000000000000000000",
-    method: null,
-    status: "ok",
-};
-
-// Etherscan's page for RECIPIENT, which labels it a phishing address.
-const PHISHING_PAGE =
-    "<html><head><title>Fake_Phishing1 | Address: " +
-    RECIPIENT +
-    " | Etherscan</title></head><body></body></html>";
-
 const realFetch = globalThis.fetch;
 
 afterEach(() => {
@@ -111,58 +81,36 @@ describe("a new profile", () => {
 });
 
 describe("where each request is made", () => {
-    // Every URL that fetch() was asked for, in order.
+    // Every URL fetch() was asked for, in order.
     let asked;
 
-    // What Blockscout and Etherscan answer: USDC among ADDRESS's tokens,
-    // HISTORY_ITEM in its history, and PHISHING_PAGE for RECIPIENT.
-    function answer(url) {
-        return {
-            ok: true,
-            status: 200,
-            json: async () => {
-                if (url.endsWith("/token-balances")) return [USDC_ROW];
-                if (url.endsWith("/transactions")) {
-                    return { items: [HISTORY_ITEM] };
-                }
-                return { items: [] };
-            },
-            text: async () => PHISHING_PAGE,
-        };
-    }
-
-    async function recordAndAnswer(url) {
-        asked.push(String(url));
-        return answer(String(url));
-    }
-
     beforeEach(() => {
         asked = [];
-        globalThis.fetch = jest.fn(recordAndAnswer);
+        globalThis.fetch = jest.fn(async (url) => {
+            asked.push(String(url));
+            return {
+                ok: true,
+                status: 200,
+                json: async () =>
+                    String(url).endsWith("/token-balances")
+                        ? [USDC_ROW]
+                        : { items: [] },
+                text: async () => "<html><body></body></html>",
+            };
+        });
     });
 
     afterEach(() => {
         globalThis.fetch = realFetch;
-        delete globalThis.chrome;
     });
 
-    // Storage holds `profile` as the stored profile, or nothing when it is
-    // undefined.
-    function storing(profile) {
-        globalThis.chrome = {
-            storage: makeStorageStub(
-                profile === undefined ? {} : { autistmask: profile },
-            ),
-        };
-    }
-
     test("Blockscout's token balances are asked for only while Use Blockscout is on", async () => {
-        storing({ useBlockscout: false });
+        expect(
-        expect(await fetchTokenBalances(ADDRESS, BLOCKSCOUT, [])).toEqual([]);
+            await fetchTokenBalances(ADDRESS, BLOCKSCOUT, false, []),
+        ).toEqual([]);
         expect(asked).toEqual([]);
 
-        storing({ useBlockscout: true });
+        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, true, []);
-        const rows = await fetchTokenBalances(ADDRESS, BLOCKSCOUT, []);
         expect(rows.map((row) => row.symbol)).toEqual(["USDC"]);
         expect(asked).toEqual([
             BLOCKSCOUT + "/addresses/" + ADDRESS + "/token-balances",
@@ -170,14 +118,12 @@ describe("where each request is made", () => {
     });
 
     test("the transaction history is asked for only while Use Blockscout is on", async () => {
-        storing({ useBlockscout: false });
         expect(
-            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
+            await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, false, "0x1"),
         ).toEqual([]);
         expect(asked).toEqual([]);
 
-        storing({ useBlockscout: true });
+        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, true, "0x1");
-        await fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1");
         expect(asked.sort()).toEqual([
             BLOCKSCOUT +
                 "/addresses/" +
@@ -187,91 +133,29 @@ describe("where each request is made", () => {
         ]);
     });
 
-    test("the Etherscan label check is made only while the stored profile has Check recipients on Etherscan on", async () => {
+    test("the Etherscan label check is made only while Check recipients on Etherscan is on", async () => {
         const provider = {
             getCode: async () => "0x",
             getTransactionCount: async () => 1,
             getBalance: async () => 0n,
         };
-        const checkWith = async (profile) => {
-            storing(profile);
         await getFullWarnings(RECIPIENT, provider, { chainId: "0x1" });
-        };
+        await getFullWarnings(RECIPIENT, provider, {
-
+            chainId: "0x1",
-        await checkWith(undefined);
+            checkRecipientsOnEtherscan: false,
-        await checkWith({ checkRecipientsOnEtherscan: false });
+        });
-        // Only a stored true is on, as when the profile is loaded.
-        await checkWith({ checkRecipientsOnEtherscan: "true" });
-        await checkWith({ checkRecipientsOnEtherscan: 42 });
         expect(asked).toEqual([]);
 
-        await checkWith({ checkRecipientsOnEtherscan: true });
+        await getFullWarnings(RECIPIENT, provider, {
+            chainId: "0x1",
+            checkRecipientsOnEtherscan: true,
+        });
         expect(asked).toEqual(["https://etherscan.io/address/" + RECIPIENT]);
     });
 
-    // Asks with `setting` on in storage. Once every request is out, storage
-    // holds `after` for the setting, as when the user changes it here or on
-    // another page. Only then does each request get its answer.
-    async function answeredAfter(setting, after, ask) {
-        storing({ [setting]: true });
-        let release;
-        const held = new Promise((resolve) => {
-            release = resolve;
-        });
-        let requested;
-        const out = new Promise((resolve) => {
-            requested = resolve;
-        });
-        globalThis.fetch = jest.fn(async (url) => {
-            requested();
-            await held;
-            return recordAndAnswer(url);
-        });
-        const result = ask();
-        await out;
-        globalThis.chrome.storage.write("autistmask", { [setting]: after });
-        release();
-        return result;
-    }
-
-    // One row per request, giving:
-    //
-    //   - its name
-    //   - the setting that gates it
-    //   - how to make it
-    //   - its answer while that setting is off
-    test.each([
-        [
-            "Blockscout's token balances",
-            "useBlockscout",
-            () => fetchTokenBalances(ADDRESS, BLOCKSCOUT, []),
-            [],
-        ],
-        [
-            "the transaction history",
-            "useBlockscout",
-            () => fetchRecentTransactions(ADDRESS, BLOCKSCOUT, "0x1"),
-            [],
-        ],
-        [
-            "the Etherscan label check",
-            "checkRecipientsOnEtherscan",
-            () => checkEtherscanLabel(RECIPIENT, "0x1"),
-            null,
-        ],
-    ])(
-        "%s keeps an answer that lands while its setting is on, and drops one that lands after it went off",
-        async (_what, setting, ask, dropped) => {
-            expect(await answeredAfter(setting, true, ask)).not.toEqual(
-                dropped,
-            );
-            expect(await answeredAfter(setting, false, ask)).toEqual(dropped);
-        },
-    );
-
     describe("a balance refresh", () => {
-        // The RPC endpoint answers every balance with zero. The ENS reverse
+        // The RPC endpoint answers every balance with zero, and every other
-        // lookup makes the only other calls, and it finds no resolver.
+        // call, the ENS reverse lookup's, with no resolver.
         beforeEach(() => {
             FetchRequest.registerGetUrl(async (req) => {
                 const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
@@ -296,8 +180,8 @@ describe("where each request is made", () => {
             FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
         });
 
-        // An address refreshed while "Use Blockscout" was on. It holds the USDC
+        // An address that was refreshed while Use Blockscout was on, and holds
-        // that Blockscout reported then.
+        // the USDC Blockscout reported then.
         function addressWithUsdc() {
             return {
                 address: ADDRESS,
@@ -315,11 +199,11 @@ describe("where each request is made", () => {
         }
 
         async function refresh(addr, useBlockscout) {
-            storing({ useBlockscout });
             await refreshBalances(
                 [{ addresses: [addr] }],
                 RPC_URL,
                 BLOCKSCOUT,
+                useBlockscout,
                 [],
                 "mainnet",
             );
@@ -361,6 +245,29 @@ describe("the popup", () => {
         jest.spyOn(console, "error").mockImplementation(() => {});
     });
 
+    test("hands its balance refresh and Home's history the stored Use Blockscout setting", async () => {
+        await bootPopup(unversionedValidProfile());
+        const {
+            refreshBalances: popupRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: popupHistory,
+        } = require("../src/shared/transactions");
+        expect(popupRefresh.mock.calls[0][3]).toBe(false);
+        expect(popupHistory.mock.calls[0][2]).toBe(false);
+        cleanupPopup();
+
+        await bootPopup(unversionedValidProfile({ useBlockscout: true }));
+        const {
+            refreshBalances: onRefresh,
+        } = require("../src/shared/balances");
+        const {
+            fetchRecentTransactions: onHistory,
+        } = require("../src/shared/transactions");
+        expect(onRefresh.mock.calls[0][3]).toBe(true);
+        expect(onHistory.mock.calls[0][2]).toBe(true);
+    });
+
     test("Home says why there is no history and only tracked tokens while Use Blockscout is off", async () => {
         const page = await bootPopup(unversionedValidProfile());
         expect(page.node("home-tx-list").innerHTML).toContain(
@@ -421,51 +328,6 @@ describe("the popup", () => {
         expect(on.hidden("tx-detail-blockscout-note")).toBe(true);
     });
 
-    // Another page turns "Use Blockscout" off while TransactionDetail's request
-    // to Blockscout is out. This page draws TransactionDetail again with its
-    // line, and only then does Blockscout answer.
-    test("TransactionDetail shows nothing from an answer that lands after another page turned Use Blockscout off", async () => {
-        const page = await bootPopup(
-            onTransactionScreen({ useBlockscout: true }),
-        );
-        let release;
-        const held = new Promise((resolve) => {
-            release = resolve;
-        });
-        globalThis.fetch = jest.fn(async () => {
-            await held;
-            return {
-                ok: true,
-                status: 200,
-                json: async () => ({
-                    block_number: 21000000,
-                    fee: { value: "21000000000000" },
-                    raw_input: "0x12345678",
-                    method: "doSomething",
-                }),
-            };
-        });
-        require("../src/popup/views/transactionDetail").render();
-        await page.settle();
-        expect(fetched()).toEqual([BLOCKSCOUT + "/transactions/" + TX_HASH]);
-
-        await anotherPageAnnounces(page, { useBlockscout: false });
-        release();
-        await page.settle();
-
-        expect(page.visibleViews()).toEqual(["transaction"]);
-        expect(page.hidden("tx-detail-blockscout-note")).toBe(false);
-        for (const id of [
-            "tx-detail-block-section",
-            "tx-detail-network-section",
-            "tx-detail-calldata-section",
-            "tx-detail-rawdata-section",
-        ]) {
-            expect(page.hidden(id)).toBe(true);
-        }
-        expect(fetched()).toHaveLength(1);
-    });
-
     // The confirmation screen for a send of 0.1 ETH to RECIPIENT, as a
     // reopened popup draws it.
     function onConfirmScreen(extra) {
@@ -505,10 +367,10 @@ describe("the popup", () => {
         expect(on.hidden("confirm-etherscan-warning")).toBe(false);
     });
 
-    // Ticks or unticks a checkbox on the page, as the user does.
+    // Ticks a checkbox on the page, as the user does.
-    async function setBox(page, id, checked) {
+    async function tick(page, id) {
         const box = page.node(id);
-        box.checked = checked;
+        box.checked = true;
         for (const fn of box.listeners.change) await fn();
         await page.settle();
     }
@@ -521,9 +383,9 @@ describe("the popup", () => {
             false,
         );
 
-        await setBox(page, "welcome-use-blockscout", true);
+        await tick(page, "welcome-use-blockscout");
         expect(page.storage.read("autistmask").useBlockscout).toBe(true);
-        await setBox(page, "welcome-check-recipients-on-etherscan", true);
+        await tick(page, "welcome-check-recipients-on-etherscan");
         expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
             true,
         );
@@ -537,312 +399,72 @@ describe("the popup", () => {
             page.node("settings-check-recipients-on-etherscan").checked,
         ).toBe(false);
 
-        await setBox(page, "settings-use-blockscout", true);
+        await tick(page, "settings-use-blockscout");
         expect(page.storage.read("autistmask").useBlockscout).toBe(true);
-        await setBox(page, "settings-check-recipients-on-etherscan", true);
+        await tick(page, "settings-check-recipients-on-etherscan");
         expect(page.storage.read("autistmask").checkRecipientsOnEtherscan).toBe(
             true,
         );
     });
+});
 
-    // A token the user tracks, and an untracked one that Blockscout reported.
+describe("the background", () => {
-    // Both are written in lower case, because the balance rows' and the
+    afterEach(() => {
-    // dropdown's token ids are compared in lower case below.
+        delete globalThis.chrome;
-    const TRACKED = "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+        jest.dontMock("../src/shared/balances");
-    const UNTRACKED = TOKEN_ADDRESS.toLowerCase();
+    });
-    const SECOND_ADDRESS = "0x3333333333333333333333333333333333333333";
 
-    function tokenRow(address, symbol) {
+    // Starts the background over `profile`, fires its balance alarm, and
-        return {
+    // answers with the Use Blockscout setting its refresh was handed.
-            address,
+    async function settingTheRefreshIsHanded(profile) {
-            name: symbol,
+        jest.resetModules();
-            symbol,
+        let handed;
-            decimals: 18,
+        const called = new Promise((resolve) => {
-            balance: "5.0",
+            handed = resolve;
-            holders: 50000,
+        });
+        jest.doMock("../src/shared/balances", () => ({
+            getProvider: () => ({}),
+            refreshBalances: async (...args) => handed(args[3]),
+        }));
+        let onAlarm = null;
+        globalThis.chrome = {
+            storage: makeStorageStub({ autistmask: profile }),
+            alarms: {
+                create: () => {},
+                get: async () => undefined,
+                clear: async () => false,
+                onAlarm: {
+                    addListener: (fn) => {
+                        onAlarm = fn;
+                    },
+                },
+            },
+            runtime: {
+                onMessage: { addListener: () => {} },
+                onConnect: { addListener: () => {} },
+                onInstalled: { addListener: () => {} },
+                onStartup: { addListener: () => {} },
+                getURL: (p) => "chrome-extension://test/" + p,
+                lastError: null,
+            },
+            windows: { onRemoved: { addListener: () => {} } },
+            tabs: { query: () => {}, sendMessage: () => {} },
+            action: { setPopup: () => {} },
         };
+        require("../src/background/index");
+        const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
+        onAlarm({ name: BALANCE_REFRESH_ALARM });
+        return called;
     }
 
-    // AddressDetail of the first of two addresses, as a reopened popup draws
+    test("hands its balance refresh the stored Use Blockscout setting", async () => {
-    // it. Both addresses hold the tracked token. While "Use Blockscout" is on,
+        const profile = { ...unversionedValidProfile(), lastBalanceRefresh: 0 };
-    // both hold the untracked one too.
+        expect(await settingTheRefreshIsHanded(profile)).toBe(false);
-    function onAddressDetail(useBlockscout) {
-        const profile = unversionedValidProfile({
-            useBlockscout,
-            currentView: "address",
-            viewStack: ["main"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            trackedTokens: [
-                { address: TRACKED, name: "TRK", symbol: "TRK", decimals: 18 },
-            ],
-        });
-        const wallet = profile.wallets[0];
-        wallet.nextIndex = 2;
-        wallet.addresses.push({ address: SECOND_ADDRESS, balance: "0.0" });
-        for (const addr of wallet.addresses) {
-            addr.tokenBalances = useBlockscout
-                ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
-                : [tokenRow(TRACKED, "TRK")];
-        }
-        return profile;
-    }
-
-    // The token ids of the options created after the first `from` elements.
-    // The page stub keeps no children, so this reads the options for Send's
-    // dropdown from the elements the page created.
-    function optionsSince(page, from) {
-        return page.document.created
-            .slice(from)
-            .filter((el) => el.tagName === "OPTION")
-            .map((el) => el.value.toLowerCase());
-    }
-
-    test("unticking Use Blockscout from AddressDetail's gear takes the untracked token off AddressDetail, Send's dropdown and Home on Back", async () => {
-        const page = await bootPopup(onAddressDetail(true));
-        expect(page.visibleViews()).toEqual(["address"]);
-        expect(page.node("address-balances").innerHTML).toContain(UNTRACKED);
-
-        await page.click("btn-settings");
-        await setBox(page, "settings-use-blockscout", false);
-        const from = page.document.created.length;
-        await page.click("btn-settings-back");
-
-        expect(page.visibleViews()).toEqual(["address"]);
-        const balances = page.node("address-balances").innerHTML;
-        expect(balances).toContain(TRACKED);
-        expect(balances).not.toContain(UNTRACKED);
-        expect(page.hidden("address-tokens-note")).toBe(false);
-        expect(optionsSince(page, from)).toEqual([TRACKED]);
-
-        await page.click("btn-send");
-        expect(page.visibleViews()).toEqual(["send"]);
-        expect(page.hidden("send-token-dropdown")).toBe(false);
-        expect(page.hidden("send-tokens-note")).toBe(false);
-
-        await page.click("btn-send-back");
-        await page.click("btn-address-back");
-        expect(page.visibleViews()).toEqual(["main"]);
-        const home = page.node("wallet-list").innerHTML;
-        expect(home).toContain(TRACKED);
-        expect(home).not.toContain(UNTRACKED);
-
-        const stored = page.storage.read("autistmask");
-        for (const addr of stored.wallets[0].addresses) {
         expect(
-                addr.tokenBalances.map((row) => row.address.toLowerCase()),
+            await settingTheRefreshIsHanded({
-            ).toEqual([TRACKED]);
+                ...profile,
-        }
+                useBlockscout: true,
-    });
+            }),
-
+        ).toBe(true);
-    // Send's dropdown was filled under the old setting, and Back cannot draw
-    // Send again. So Back lands on the screen under it.
-    test.each([
-        ["unticking", true],
-        ["ticking", false],
-    ])(
-        "%s Use Blockscout from Send's gear lands Back on AddressDetail",
-        async (_how, before) => {
-            const page = await bootPopup(onAddressDetail(before));
-            await page.click("btn-send");
-            expect(page.visibleViews()).toEqual(["send"]);
-
-            await page.click("btn-settings");
-            await setBox(page, "settings-use-blockscout", !before);
-            await page.click("btn-settings-back");
-            expect(page.visibleViews()).toEqual(["address"]);
-            expect(page.hidden("address-tokens-note")).toBe(!before);
-        },
-    );
-
-    test("Send says under its token dropdown that only tracked tokens are listed while Use Blockscout is off", async () => {
-        const off = await bootPopup(onAddressDetail(false));
-        await off.click("btn-send");
-        expect(off.hidden("send-token-dropdown")).toBe(false);
-        expect(off.hidden("send-tokens-note")).toBe(false);
-        cleanupPopup();
-
-        const on = await bootPopup(onAddressDetail(true));
-        await on.click("btn-send");
-        expect(on.hidden("send-token-dropdown")).toBe(false);
-        expect(on.hidden("send-tokens-note")).toBe(true);
-    });
-
-    test("Send opened from AddressToken shows neither the dropdown nor its line", async () => {
-        const page = await bootPopup({
-            ...onAddressDetail(false),
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedToken: "ETH",
-        });
-        expect(page.visibleViews()).toEqual(["address-token"]);
-        await page.click("btn-address-token-send");
-        expect(page.visibleViews()).toEqual(["send"]);
-        expect(page.hidden("send-token-dropdown")).toBe(true);
-        expect(page.hidden("send-token-static")).toBe(false);
-    });
-
-    test("DeleteAddress says only tracked tokens are listed while Use Blockscout is off", async () => {
-        for (const useBlockscout of [false, true]) {
-            const page = await bootPopup(onAddressDetail(useBlockscout));
-            require("../src/popup/views/deleteAddress").show(0, 1);
-            expect(page.visibleViews()).toEqual(["delete-address-confirm"]);
-            expect(page.hidden("delete-address-tokens-note")).toBe(
-                useBlockscout,
-            );
-            cleanupPopup();
-        }
-    });
-
-    // The token ids of the first address's balances in the stored profile.
-    function storedTokens(page) {
-        return page.storage
-            .read("autistmask")
-            .wallets[0].addresses[0].tokenBalances.map((row) =>
-                row.address.toLowerCase(),
-            );
-    }
-
-    // Turning the setting off dropped the untracked token. A refresh that
-    // started while the setting was on still saves its balances when it
-    // returns, but not that token. The same refresh in the background is in
-    // tests/backgroundStateIsolation.test.js.
-    test("a refresh that returns after Use Blockscout was turned off saves its balances without the untracked token", async () => {
-        const page = await bootPopup(onAddressDetail(true));
-        const { refreshBalances: held } = require("../src/shared/balances");
-        let answer;
-        held.mockImplementationOnce(async (wallets) => {
-            await new Promise((resolve) => {
-                answer = resolve;
-            });
-            wallets[0].addresses[0].balance = "7.0";
-            wallets[0].addresses[0].tokenBalances = [
-                tokenRow(TRACKED, "TRK"),
-                tokenRow(UNTRACKED, "TST"),
-            ];
-        });
-        const ticking = page.tick();
-        await page.settle();
-
-        await page.click("btn-settings");
-        await setBox(page, "settings-use-blockscout", false);
-        answer();
-        await ticking;
-
-        expect(
-            page.storage.read("autistmask").wallets[0].addresses[0].balance,
-        ).toBe("7.0");
-        expect(storedTokens(page)).toEqual([TRACKED]);
-        await page.click("btn-settings-back");
-        expect(page.node("address-balances").innerHTML).not.toContain(
-            UNTRACKED,
-        );
-    });
-
-    // Another page saves `change` over the stored profile. The browser is not
-    // made to tell this page, so this page sees the change only by reading the
-    // stored profile.
-    function anotherPageSaves(page, change) {
-        page.storage.write("autistmask", {
-            ...page.storage.read("autistmask"),
-            ...change,
-        });
-    }
-
-    test.each([
-        ["off", true, false],
-        ["on", false, true],
-    ])(
-        "after another page turns Use Blockscout %s, this page takes the change and its next refresh is saved",
-        async (_how, before, after) => {
-            const page = await bootPopup(onAddressDetail(before));
-            // The refresh answers as it does under the stored setting.
-            const { refreshBalances: held } = require("../src/shared/balances");
-            held.mockImplementationOnce(async (wallets) => {
-                const addr = wallets[0].addresses[0];
-                addr.balance = "7.0";
-                addr.tokenBalances = after
-                    ? [tokenRow(TRACKED, "TRK"), tokenRow(UNTRACKED, "TST")]
-                    : [tokenRow(TRACKED, "TRK")];
-            });
-
-            anotherPageSaves(page, { useBlockscout: after });
-            await page.tick();
-
-            expect(
-                page.storage.read("autistmask").wallets[0].addresses[0].balance,
-            ).toBe("7.0");
-            expect(storedTokens(page)).toEqual(
-                after ? [TRACKED, UNTRACKED] : [TRACKED],
-            );
-            expect(page.hidden("address-tokens-note")).toBe(after);
-        },
-    );
-
-    test.each([
-        ["off", true, false],
-        ["on", false, true],
-    ])(
-        "after another page turns Check recipients on Etherscan %s, this page's next Etherscan check follows the stored setting",
-        async (_how, before, after) => {
-            const page = await bootPopup(
-                onConfirmScreen({ checkRecipientsOnEtherscan: before }),
-            );
-            anotherPageSaves(page, { checkRecipientsOnEtherscan: after });
-            const from = fetched().length;
-            require("../src/popup/views/confirmTx").show({
-                token: "ETH",
-                from: ADDRESS,
-                to: RECIPIENT,
-                amount: "0.1",
-                chainId: "0x1",
-            });
-            await page.settle();
-
-            // The page also takes the change and draws ConfirmTx again, which
-            // checks once more. So the test counts each URL once, however often
-            // it was asked for.
-            const asked = new Set(
-                fetched().slice(from).filter(blockscoutOrEtherscan),
-            );
-            expect([...asked]).toEqual(
-                after ? ["https://etherscan.io/address/" + RECIPIENT] : [],
-            );
-        },
-    );
-
-    // Another page's save of the whole profile with `change`, which the
-    // browser announces to this page as it announces any write.
-    async function anotherPageAnnounces(page, change) {
-        await page.storage.local.set({
-            autistmask: { ...page.storage.read("autistmask"), ...change },
-        });
-        await page.settle();
-    }
-
-    test("a page open on AddressDetail draws it again when another page turns Use Blockscout off", async () => {
-        const page = await bootPopup(onAddressDetail(true));
-        expect(page.hidden("address-tokens-note")).toBe(true);
-
-        await anotherPageAnnounces(page, { useBlockscout: false });
-
-        expect(page.visibleViews()).toEqual(["address"]);
-        expect(page.hidden("address-tokens-note")).toBe(false);
-        expect(page.node("address-balances").innerHTML).not.toContain(
-            UNTRACKED,
-        );
-        expect(storedTokens(page)).toEqual([TRACKED]);
-    });
-
-    test("a page open on ConfirmTx draws it again when another page turns Check recipients on Etherscan off", async () => {
-        const page = await bootPopup(
-            onConfirmScreen({ checkRecipientsOnEtherscan: true }),
-        );
-        expect(page.hidden("confirm-etherscan-note")).toBe(true);
-
-        await anotherPageAnnounces(page, { checkRecipientsOnEtherscan: false });
-
-        expect(page.visibleViews()).toEqual(["confirm-tx"]);
-        expect(page.hidden("confirm-etherscan-note")).toBe(false);
     });
 });

tests/coldWorkerChainId.test.js

@@ -73,8 +73,6 @@ function loadColdWorker(networkId, opts) {
     jest.doMock("../src/shared/balances", () => ({
         getProvider: () => ({}),
         refreshBalances: options.refreshBalances || jest.fn(async () => {}),
-        dropUntrackedTokens: jest.requireActual("../src/shared/balances")
-            .dropUntrackedTokens,
     }));
     jest.doMock("../src/shared/phishingDomains", () => ({
         isPhishingDomain: () => false,

tests/confirmTxAmount.test.js

@@ -108,10 +108,7 @@ global.fetch = jest.fn(() => {
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = {
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-    runtime: { sendMessage() {} },
-};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -246,14 +243,11 @@ async function openSend(token, tokenUnits = null) {
     ];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
-    // Blockscout is asked only while the stored "Use Blockscout" is on. The
-    // screens save this page's copy of "Use Blockscout" over the stored one. So
-    // the page's copy is turned on here too.
-    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/confirmTxNetworkSwitch.test.js

@@ -226,7 +226,6 @@ const PRIVATE_KEY = "0x" + "11".repeat(32);
 const HOLDER = new Wallet(PRIVATE_KEY).address;
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const TOKEN = "0x7070707070707070707070707070707070707070";
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
 const PASSWORD = "correct horse battery staple";
 
 function el(id) {
@@ -319,7 +318,7 @@ async function switchReopenAndGoBack(reviewedOn, switchedTo) {
     setBackRenderer(makeBackRenderer(state, { confirmTx }));
     confirmTx.init({});
     prices.ETH = 2000;
-    prices[USDC] = 1;
+    prices.USDC = 1;
     mockNode.asked = [];
     global.fetch.mockClear();
     goBack();
@@ -642,7 +641,7 @@ describe.each([
         test("of an ERC-20 token, links the token contract to that network's explorer and prices the token by that network", async () => {
             mockNode.tokenUnits[reviewedOn] = 50000000n;
             await review(reviewedOn, {
-                token: USDC,
+                token: TOKEN,
                 tokenSymbol: "USDC",
                 tokenDecimals: 6,
                 amount: "10",
@@ -653,7 +652,7 @@ describe.each([
                 "ERC-20 token transfer (USDC)",
             );
             expect(el("confirm-token-contract").innerHTML).toContain(
-                `href="${explorerUrl}/address/${USDC}"`,
+                `href="${explorerUrl}/address/${TOKEN}"`,
             );
             expect(el("confirm-amount").textContent).toBe(
                 "10.0000 USDC" + usdOn(reviewedOn, "$10.00"),

tests/deleteAddress.test.js

@@ -153,7 +153,7 @@ describe("the balance warning on the removal confirmation", () => {
 
     test("the USD total is shown when prices are known", () => {
         prices.ETH = 2000;
-        prices[USDC] = 1;
+        prices.USDC = 1;
         expect(balanceWarningHtml(TOKEN_ONLY)).toContain("Total: $2,500.00");
         expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
     });

tests/e2e/dapp.js

@@ -43,15 +43,12 @@ const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI;
 
 const STUB_BLOCK_NUMBER = 21000000;
 
-// A 32-byte zero word, returned for every eth_call but a price feed's
+// A 32-byte zero word, returned for every eth_call. It is what makes ethers'
-// latestRoundData() (see rpcResult() below). It is what makes ethers'
 // ENS reverse lookup resolve to "no resolver set" instead of throwing, and a
 // throw there reaches the console through src/shared/log.js, which fails the
 // run on its own.
 const ZERO_WORD = "0x" + "0".repeat(64);
 
-const SELECTOR_LATEST_ROUND_DATA = "0xfeaf968c";
-
 // One ETH, so the popup's balance lines render something and the wallet does
 // not look empty on the approval screen.
 const STUB_BALANCE_WEI = 10n ** 18n;
@@ -114,15 +111,6 @@ function rpcResult(req, state) {
         return latestBlock();
     }
 
-    // A price feed's latestRoundData() gets five zero words, as in network.js:
-    // a price of zero, which the wallet counts as no price.
-    const data = String(
-        (req.params && req.params[0] && req.params[0].data) || "",
-    );
-    if (method === "eth_call" && data.startsWith(SELECTOR_LATEST_ROUND_DATA)) {
-        return "0x" + "0".repeat(64 * 5);
-    }
-
     if (Object.prototype.hasOwnProperty.call(RPC_RESULTS, method)) {
         return RPC_RESULTS[method];
     }

tests/e2e/firefox/run.js

@@ -1035,14 +1035,11 @@ step(
     },
 );
 
-// A closed approval window leaves its request pending, and the toolbar button
-// opens it (https://git.eeqj.de/sneak/AutistMask/issues/673). WebDriver cannot
-// see the toolbar popup, so its page is opened in a tab, at the URL the
-// extension put on the button.
 step(
-    "a closed approval window leaves the request pending until it is rejected",
+    "closing an approval window rejects the request with 4001",
     async (env) => {
         const d = env.driver;
+        const before = env.server.broadcast.length;
 
         await d.switchToWindow(env.dappWindow);
         await startRequest(d, "sign-closed", "personal_sign", [
@@ -1056,45 +1053,15 @@ step(
 
         // Closed, not rejected: this is the windows.onRemoved path, which can
         // only fire if windows.create() handed back a window id for the
-        // approval to be matched against. Without that id the toolbar button
+        // approval to be matched against — call site 4 in the issue, and the
-        // never opens the approval, and this step fails.
+        // reason suppressing that write-back turns this step red.
         await d.closeWindow(env.dappWindow);
-        const outcome = await settleRequest(d, "sign-closed", 2000);
+
+        await assertUserRejection(d, "sign-closed", "a closed approval window");
         assert(
-            outcome.settled === "pending",
+            env.server.broadcast.length === before,
-            "closing the approval window answered the page: " +
+            "a closed approval window still put a transaction on the node",
-                JSON.stringify(outcome),
         );
-
-        await d.switchToWindow(env.popupWindow);
-        const url = await d.executeAsync(
-            `const done = arguments[arguments.length - 1];
-             browser.browserAction.getPopup({}).then(done, (e) => done(String(e)));`,
-        );
-        assert(
-            url.includes("?approval="),
-            "the toolbar button does not open the pending approval: " + url,
-        );
-        const reopened = await d.newWindow("tab");
-        await d.switchToWindow(reopened);
-        await d.navigate(url);
-        await d.waitVisible("#view-approve-sign");
-        await d.click("#btn-reject-sign");
-
-        await d.switchToWindow(env.dappWindow);
-        await assertUserRejection(
-            d,
-            "sign-closed",
-            "the signature request rejected from the toolbar button",
-        );
-
-        // A page may close only a window a script opened, so the tab can
-        // still be open.
-        const left = await d.findWindow((u) => u.includes("?approval="));
-        if (left) {
-            await d.switchToWindow(left);
-            await d.closeWindow(env.dappWindow);
-        }
     },
 );
 

tests/e2e/network.js

@@ -251,13 +251,8 @@ const SELECTOR_DECIMALS = "0x313ce567";
 const SELECTOR_SYMBOL = "0x95d89b41";
 const SELECTOR_NAME = "0x06fdde03";
 const SELECTOR_BALANCE_OF = "0x70a08231";
-const SELECTOR_LATEST_ROUND_DATA = "0xfeaf968c";
 
-// On any contract, a latestRoundData() call is answered with five zero words.
+// Every eth_call still answers with a zero word except decimals(), symbol(),
-// That is a round with a price of zero, which the wallet counts as no
-// price. So no screen shows a USD value beside the amounts the tests compare.
-//
-// Every other eth_call answers with a zero word except decimals(), symbol(),
 // name() and balanceOf() on the stub token. The wallet reads decimals() back
 // at signing time to compare with the scale the confirmation screen rendered
 // (issue #305). Adding the token by its contract address reads the first three
@@ -278,9 +273,6 @@ function ethCallResult(req, opts) {
     if (!call || typeof call !== "object") return ZERO_WORD;
     const data = String(call.data || call.input || "").toLowerCase();
     const to = String(call.to || "").toLowerCase();
-    if (data.startsWith(SELECTOR_LATEST_ROUND_DATA)) {
-        return "0x" + "0".repeat(64 * 5);
-    }
     if (to !== STUB_TOKEN.address) return ZERO_WORD;
     if (data.startsWith(SELECTOR_DECIMALS)) {
         return word(opts.tokenDecimalsOverride ?? STUB_TOKEN.decimals);
@@ -664,9 +656,9 @@ function traceEnabled(raw) {
  * @param {string} [opts.etherscanLabel]  the label Etherscan's page gives the
  *   address asked about, such as "Fake_Phishing1"; none when unset. Read at
  *   request time.
- * @param {object[]} [opts.requests]  a list for the requests this handler
+ * @param {object[]} [opts.requests]  every request this handler sees, from the
- *   sees. Each is appended in order as { method, url, fromWorker }, whether it
+ *   popup's pages and the background worker alike, appended in order as
- *   came from a popup page or the background worker.
+ *   { method, url, fromWorker }.
  * @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
  *   Promise<string|null>}>}
  */
@@ -772,6 +764,11 @@ async function installNetworkStubs(ctx, opts) {
             }
         }
 
+        // CoinDesk price tick
+        if (url.hostname.endsWith("coindesk.com")) {
+            return jsonResponse(route, { Data: {} });
+        }
+
         // The interception canary's own request. Answered with nothing: what
         // is being observed is that it arrived here at all.
         if (url.href === WORKER_PROBE_URL) {

tests/e2e/run.js

@@ -272,30 +272,23 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
 // ------------------ Blockscout and Etherscan are sent no user data (#668)
 //
 // A fresh install sends Blockscout and Etherscan none of the user's data until
-// the user turns on "Use Blockscout" or "Check recipients on Etherscan". One
+// the user turns on "Use Blockscout" or "Check recipients on Etherscan". The
-// request still reaches Blockscout while "Use Blockscout" is off: pressing
+// endpoint check Settings makes when the user presses "Save" beside the
-// "Save" beside the Blockscout URL asks that URL for `/stats`. That request
+// Blockscout URL asks only for `/stats` and carries no user data; it is made
-// carries no user data.
+// whether or not the setting is on. The route handler in tests/e2e/network.js
-//
+// records every request the extension makes, from its pages and its background
-// The route handler in tests/e2e/network.js records in env.routeOpts.requests
+// worker, in env.routeOpts.requests. Recording starts when launch() in
-// every request the extension makes, from its pages and its background worker.
+// tests/e2e/harness.js installs that handler, before the first popup page
-// Recording starts when launch() in tests/e2e/harness.js installs that handler,
+// opens; a request the background worker makes while it starts up, before
-// before the first popup page opens. The background worker starts earlier, but
+// then, is not recorded. These tests drive Home, AddressDetail, AddressToken
-// it makes no request while it starts up.
+// and ConfirmTx, and the background's own balance refresh, before either
-//
+// setting is changed, then turn each on and watch its requests start.
-// Before either setting is changed, these tests drive:
+// TransactionDetail, which also asks Blockscout, is left to the unit tests in
-//
+// tests/blockscoutEtherscanSettings.test.js.
-//   - Home, AddressDetail, AddressToken and ConfirmTx
-//   - the background's own balance refresh
-//
-// Then they turn each setting on and watch its requests start. "Use Blockscout"
-// is also turned off once and on again, to see an untracked token leave every
-// list. TransactionDetail, which also asks Blockscout, is left to the unit
-// tests in tests/blockscoutEtherscanSettings.test.js.
 
-// The line shown in place of the three transaction histories while "Use
+// What the three transaction lists say while Use Blockscout is off. Written
-// Blockscout" is off. Written out here rather than imported, so the assertion
+// out here rather than imported, so the assertion does not compare the popup
-// does not compare the popup with itself.
+// with itself.
 const HISTORY_OFF =
     'No transaction history is shown, because "Use Blockscout" is off in Settings.';
 
@@ -307,7 +300,7 @@ function explorerRequests(env) {
     });
 }
 
-// Waits until the list `listId` shows the line saying "Use Blockscout" is off.
+// Waits until the list `listId` says what Use Blockscout being off leaves out.
 async function waitForHistoryOff(page, listId) {
     await page.waitForFunction(
         ([id, want]) => document.getElementById(id).textContent.trim() === want,
@@ -402,11 +395,11 @@ test("with neither setting changed, Home, AddressDetail, AddressToken and Confir
     }
 });
 
-// The background refreshes balances on its alarm, once a minute. It skips a
+// The background refreshes balances on its alarm, once a minute, and skips a
-// refresh when the stored record says one ran in the last 30 seconds. The open
+// refresh when the stored record says one ran in the last 30 seconds, which
-// popup's own refresh runs every 10. So the popup is closed first. The test then
+// the open popup's own refresh does every 10. So the popup is closed, and that
-// has the background worker set the stored time of the last refresh to 0, so
+// record is written back to say no refresh has run, from the background
-// its next alarm runs a refresh.
+// worker, as another extension page saving it would.
 test("with neither setting changed, nothing has reached Blockscout or Etherscan, the background's refresh included (#668)", async (env) => {
     await waitForPersisted(
         env.page,
@@ -439,7 +432,7 @@ test("with neither setting changed, nothing has reached Blockscout or Etherscan,
         );
         await sleep(250);
     }
-    // The refresh's RPC reads and any Blockscout request start together.
+    // Its RPC reads and any Blockscout request start together.
     await sleep(3000);
 
     const seen = explorerRequests(env);
@@ -453,7 +446,7 @@ test("with neither setting changed, nothing has reached Blockscout or Etherscan,
         env.routeOpts.requests.some((r) => !r.fromWorker),
         "no request from the popup was recorded",
     );
-    // The popup reopens on the address screen the test above left it on.
+    // It reopens on the address screen the test above left it on.
     env.page = await openPopup(env.ctx, env.popupUrl);
     await visible(env.page, "#view-address");
 });
@@ -507,68 +500,9 @@ test("turning on Use Blockscout from AddressDetail's gear asks Blockscout for th
     );
 });
 
-// Unticked from AddressDetail's gear while the address holds the stub token,
-// which the user has not tracked and only Blockscout reports. Ticked again at
-// the end, so the rest of the run has Blockscout as before.
-test("turning off Use Blockscout from AddressDetail's gear takes an untracked token off AddressDetail, Send and Home on Back (#668)", async (env) => {
-    env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
-    env.routeOpts.seedTokenBalance = true;
-    const tokenRow = '[data-token="' + STUB_TOKEN.address + '"]';
-    try {
-        await settleOnMain(env, { ethWei: FUNDED_ETH_WEI, expectToken: true });
-        await openAddressDetail(env.page);
-        await visible(env.page, "#address-balances " + tokenRow);
-
-        await openSettings(env.page);
-        await env.page.uncheck("#settings-use-blockscout");
-        await waitForPersisted(
-            env.page,
-            "useBlockscout",
-            false,
-            "once unticked",
-        );
-        await env.page.click("#btn-settings-back");
-        await visible(env.page, "#view-address");
-        await visible(env.page, "#address-tokens-note");
-        assert(
-            (await env.page
-                .locator("#address-balances " + tokenRow)
-                .count()) === 0,
-            "AddressDetail still lists the untracked token",
-        );
-
-        await env.page.click("#btn-send");
-        await visible(env.page, "#view-send");
-        await visible(env.page, "#send-tokens-note");
-        const offered = await env.page.$$eval("#send-token option", (opts) =>
-            opts.map((opt) => opt.value.toLowerCase()),
-        );
-        assert(
-            !offered.includes(STUB_TOKEN.address),
-            "Send's dropdown still offers the untracked token",
-        );
-        await env.page.click("#btn-send-back");
-        await visible(env.page, "#view-address");
-
-        await goHome(env.page);
-        await visible(env.page, "#home-tokens-note");
-        assert(
-            (await env.page.locator("#wallet-list " + tokenRow).count()) === 0,
-            "Home still lists the untracked token",
-        );
-    } finally {
-        await openSettings(env.page);
-        await env.page.check("#settings-use-blockscout");
-        await waitForPersisted(env.page, "useBlockscout", true, "ticked again");
-        await env.page.click("#btn-settings-back");
-        env.routeOpts.ethBalanceWei = null;
-        env.routeOpts.seedTokenBalance = false;
-    }
-});
-
 // Ticked from ConfirmTx's gear, so Back lands on the screen that said no
-// Etherscan check was made. Left on for the rest of the run, so the later
+// Etherscan check was made. Left on for the rest of the run, as the check was
-// confirmation screens are driven with the check made.
+// always made before #668.
 test("turning on Check recipients on Etherscan from ConfirmTx's gear has ConfirmTx ask Etherscan on Back and show its label (#668)", async (env) => {
     env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
     env.routeOpts.etherscanLabel = "Fake_Phishing668";
@@ -4110,12 +4044,11 @@ async function waitForApprovalWindow(ctx, timeout = 30000) {
 // reservation exists.
 // How long the tab creation above is given to take effect before the request
 // that raises the next prompt is issued. Dismissing a browser-action popup
-// disconnects its port, and src/background/index.js calls
+// disconnects its port, and src/background/index.js calls resetPopupUrl() on
-// updateToolbarPopup() on that disconnect; issued too early, the next
+// that disconnect; issued too early, the next request's setPopup() is undone
-// request's setPopup() is undone by the previous popup's teardown,
+// by the previous popup's teardown, chrome.action.openPopup() then rejects,
-// chrome.action.openPopup() then rejects, and the fallback window it opens
+// and the fallback window it opens dismisses the popup that was just raised —
-// dismisses the popup that was just raised — which settles the fresh approval
+// which settles the fresh approval as a rejection before it can be seen.
-// as a rejection before it can be seen.
 // Every one of those steps was observed. 1.5s is comfortably past it.
 const APPROVAL_TAB_SETTLE_MS = 1500;
 
@@ -4141,17 +4074,6 @@ async function reserveApprovalTab(env) {
     return env.approvalTab;
 }
 
-// The URL the extension has put on the action: the page the toolbar button
-// opens.
-function toolbarPopupUrl(env) {
-    return env.page.evaluate(
-        () =>
-            new Promise((resolve) => {
-                chrome.action.getPopup({}, (u) => resolve(String(u)));
-            }),
-    );
-}
-
 // The site-connection prompt: the window the extension opened if it managed
 // to open one, and the reserved tab at the action's approval URL otherwise.
 async function openSiteApprovalPopup(env, timeout = 30000) {
@@ -4162,7 +4084,12 @@ async function openSiteApprovalPopup(env, timeout = 30000) {
             .find((p) => !p.isClosed() && p.url().includes("?approval="));
         if (existing) return existing;
 
-        const url = await toolbarPopupUrl(env);
+        const url = await env.page.evaluate(
+            () =>
+                new Promise((resolve) => {
+                    chrome.action.getPopup({}, (u) => resolve(String(u)));
+                }),
+        );
         if (url.includes("?approval=")) {
             await env.approvalTab.goto(url);
             return env.approvalTab;
@@ -5034,116 +4961,6 @@ test("eth_sendTransaction rejected broadcasts nothing (#183)", async (env) => {
     );
 });
 
-// A transaction or signature approval stays pending when its window closes.
-// The browser can close that window when the user clicks away from it, for
-// example to copy the password from a password manager. The toolbar button then
-// opens the approval, and the user answers it there
-// (https://git.eeqj.de/sneak/AutistMask/issues/673).
-//
-// This closes the approval window of request `key` and checks that the page
-// has no answer. It then opens the approval again from the toolbar button.
-// Playwright cannot click that button, so its page is opened in a tab, at the
-// URL the extension put on the button.
-async function closeAndReopen(env, key, view) {
-    const approvalWindow = await waitForApprovalWindow(env.ctx);
-    await visible(approvalWindow, view);
-    await approvalWindow.close();
-
-    const outcome = await settleRequest(env.dapp, key, 2000);
-    assert(
-        outcome.settled === "pending",
-        "closing the approval window answered the page: " +
-            JSON.stringify(outcome),
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        url.includes("?approval="),
-        "the toolbar button does not open the pending approval: " + url,
-    );
-    const reopened = await env.ctx.newPage();
-    await reopened.goto(url);
-    await visible(reopened, view);
-    return reopened;
-}
-
-// The stub node answers every nonce request with 0, and the wallet refuses a
-// nonce it has already broadcast. A run can therefore approve one dApp
-// transaction only, so here the signature is approved and the transaction
-// rejected.
-test("a closed signature approval is signed from the toolbar button (#673)", async (env) => {
-    await startRequest(env.dapp, "sign-closed", "personal_sign", [
-        SIGN_HEX,
-        env.expectedAddress,
-    ]);
-    const popup = await closeAndReopen(
-        env,
-        "sign-closed",
-        "#view-approve-sign",
-    );
-    let outcome;
-    try {
-        await popup.fill("#approve-sign-password", PASSWORD);
-        await clickAndClose(popup, "#btn-approve-sign");
-        outcome = await settleRequest(env.dapp, "sign-closed");
-    } finally {
-        await closeApprovalPages(env.ctx);
-    }
-    assert(
-        outcome.settled === "resolved",
-        "personal_sign did not resolve: " + JSON.stringify(outcome),
-    );
-    const recovered = getAddress(
-        verifyMessage(getBytes(SIGN_HEX), outcome.result),
-    );
-    assert(
-        recovered === env.expectedAddress,
-        "the personal_sign signature recovers to " +
-            recovered +
-            ", not to the approved address " +
-            env.expectedAddress,
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        !url.includes("?approval="),
-        "the toolbar button still opens the answered approval: " + url,
-    );
-});
-
-test("a closed transaction approval is rejected from the toolbar button (#673)", async (env) => {
-    const before = env.routeOpts.broadcastTransactions.length;
-    await startRequest(env.dapp, "tx-closed", "eth_sendTransaction", [
-        {
-            from: env.expectedAddress,
-            to: STUB_COUNTERPARTY,
-            value: toQuantity(TX_VALUE_WEI),
-            data: TX_DATA,
-        },
-    ]);
-    const popup = await closeAndReopen(env, "tx-closed", "#view-approve-tx");
-    try {
-        await clickAndClose(popup, "#btn-reject-tx");
-        await assertUserRejection(
-            env.dapp,
-            "tx-closed",
-            "the transaction rejected from the toolbar button",
-        );
-    } finally {
-        await closeApprovalPages(env.ctx);
-    }
-    assert(
-        env.routeOpts.broadcastTransactions.length === before,
-        "a rejected transaction still reached the RPC",
-    );
-
-    const url = await toolbarPopupUrl(env);
-    assert(
-        !url.includes("?approval="),
-        "the toolbar button still opens the answered approval: " + url,
-    );
-});
-
 // The extension used to centre every approval window on the last focused
 // window. Centred on another approval window, the new one landed where the
 // browser refused to create it, and the request failed with no window at all
@@ -5187,8 +5004,8 @@ test("a prompt raised while another approval window has focus opens its own (#29
     });
     await visible(txWindow, "#view-approve-tx");
 
-    await clickAndClose(txWindow, "#btn-reject-tx");
+    // Closing a window is refusing its prompt, so both answer 4001.
-    await clickAndClose(signWindow, "#btn-reject-sign");
+    await closeApprovalPages(env.ctx);
     await assertUserRejection(env.dapp, "focus-tx", "the transaction prompt");
     await assertUserRejection(env.dapp, "focus-sign", "the sign prompt");
 });
@@ -5795,11 +5612,9 @@ async function main() {
         // for the new one. After a test that passed, its windows get five
         // seconds to close, and one still open then fails the test: it should
         // have closed itself, and closing it here unreported would hide that.
-        // After a test that already failed, they are closed unreported. That
+        // After a test that already failed, they are closed unreported, so
-        // rejects a site-connection or network-switch prompt it left
+        // that a prompt it left unanswered does not refuse the next one from
-        // unanswered, so the prompt does not refuse the next one from its
+        // its site.
-        // site. A transaction or signature approval stays pending, and can
-        // fail the tests after it.
         if (!failure) {
             const deadline = Date.now() + 5000;
             let open;

tests/ensOffchainLookup.test.js

@@ -1,14 +1,13 @@
 // ENS lookups ask nothing but the RPC endpoint. A resolver can answer that a
-// name is resolved off-chain, naming a web address to fetch the answer from.
+// name is resolved off-chain, naming a web address to fetch the answer from;
-// ethers fetches that address unless the provider has `disableCcipRead` set.
+// ethers fetches it unless the provider has `disableCcipRead` set, and that
-// That request would carry the name to a server other than the RPC endpoint
+// request would carry the name to a server other than the RPC endpoint
-// (https://git.eeqj.de/sneak/AutistMask/issues/668). With the flag set, such a
+// (https://git.eeqj.de/sneak/AutistMask/issues/668). With it set, such a name
-// name does not resolve.
+// does not resolve.
 //
-// The test builds its provider with getProvider() and runs it against a fake
+// The provider getProvider() builds runs against a fake JSON-RPC node,
-// JSON-RPC node. The fake node answers through ethers' own request hook. The
+// answered through ethers' own request hook, which also records the address of
-// hook also records the address of every request ethers makes, the off-chain
+// every request ethers makes, the off-chain fetch included.
-// fetch included.
 
 const { FetchRequest, Interface } = require("ethers");
 const { getProvider } = require("../src/shared/balances");
@@ -18,13 +17,11 @@ const RESOLVER = "0x5555555555555555555555555555555555555555";
 const USER = "0x1111111111111111111111111111111111111111";
 const NAME = "offchain.eth";
 
-// The ENS registry's resolver(), and the resolver's functions ethers calls:
+// The ENS registry's resolver(), and the resolver's functions ethers calls: the
-//
+// registry names RESOLVER for every name, the resolver says it resolves names
-//   - the registry names RESOLVER for every name
+// through resolve(), gives NAME as the reverse record of any address, and
-//   - the resolver says it resolves names through resolve()
+// answers resolve() with the OffchainLookup error that says the name is
-//   - it gives NAME as the reverse record of any address
+// resolved off-chain.
-//   - it answers resolve() with the OffchainLookup error, which says the name
-//     is resolved off-chain
 const ens = new Interface([
     "function resolver(bytes32) view returns (address)",
     "function supportsInterface(bytes4) view returns (bool)",

tests/fabricatedDecimals.test.js

@@ -35,11 +35,8 @@ global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = {
+global.chrome = { storage: makeStorageStub() };
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-};
 
 const { AbiCoder, Interface } = require("ethers");
 const { ERC20_ABI } = require("../src/shared/constants");
@@ -117,6 +114,7 @@ async function fetchOnto(items, trackedTokens = []) {
     const balances = await fetchTokenBalances(
         HOLDER,
         BLOCKSCOUT,
+        true,
         trackedTokens,
     );
     state.trackedTokens = trackedTokens;
@@ -168,9 +166,6 @@ beforeEach(() => {
     debugFetch.mockReset();
     state.trackedTokens = [];
     state.wallets = [];
-    // The approval screens read the explorer's report only while the page's
-    // "Use Blockscout" is on.
-    state.useBlockscout = true;
 });
 
 describe("what fetchTokenBalances stores for an absent scale", () => {

tests/holders.test.js

@@ -21,11 +21,7 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
-// Blockscout is asked only while the stored "Use Blockscout" is on.
+global.chrome = { storage: { local: {} } };
-const { makeStorageStub } = require("./support/storageStub");
-global.chrome = {
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-};
 
 const {
     LOW_HOLDER_THRESHOLD,
@@ -154,19 +150,23 @@ describe("the balance-list spam gate", () => {
 
     test("a token with plenty of reported holders is listed", async () => {
         respondWith([item()]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBe(50000);
     });
 
     test("a token reporting zero holders is still excluded", async () => {
         respondWith([item({ token: { holders_count: "0" } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("an unknown holder count does not admit an unvouched token", async () => {
         respondWith([item({ token: { holders_count: null } })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The path that reaches the send selector and the history filter: a token
@@ -175,7 +175,7 @@ describe("the balance-list spam gate", () => {
     // zero that would then hide it downstream.
     test("a tracked token with an unknown count is listed with holders null", async () => {
         respondWith([item({ token: { holders_count: undefined } })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: NOVEL_TOKEN.toUpperCase() },
         ]);
         expect(balances).toHaveLength(1);
@@ -192,7 +192,7 @@ describe("the balance-list spam gate", () => {
                 },
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBeNull();
     });

tests/manifest.test.js

@@ -165,15 +165,6 @@ describe("declared icons", () => {
     });
 });
 
-// Firefox gives a page in a private window locks of its own, so that page's
-// save could land between the background's read and its write (README,
-// "Stored state and its version").
-describe("private windows", () => {
-    test("a page in a firefox private window cannot read or write extension storage", () => {
-        expect(readManifest("firefox").incognito).toBe("not_allowed");
-    });
-});
-
 describe("shipped Content Security Policy", () => {
     // MV3 takes an object and applies extension_pages to the popup and the
     // background service worker, which is where libsodium runs.

tests/nativeCurrency.test.js

@@ -436,13 +436,8 @@ describe.each([
         });
 
         test("the transaction detail screen's type line and fee", async () => {
-            // The fee is Blockscout's, asked for only while the stored "Use
+            // The fee is Blockscout's.
-            // Blockscout" is on.
             state.useBlockscout = true;
-            global.chrome.storage.write("autistmask", {
-                ...global.chrome.storage.read("autistmask"),
-                useBlockscout: true,
-            });
             debugFetch.mockImplementationOnce(async () => ({
                 ok: true,
                 status: 200,

tests/persistedEntryFloors.test.js

@@ -286,12 +286,8 @@ describe("a malformed fraudContracts", () => {
     function stubSendDocument() {
         const select = { innerHTML: "", children: [] };
         select.appendChild = (child) => select.children.push(child);
-        const elements = {
-            "send-token": select,
-            "send-tokens-note": { classList: { toggle: () => {} } },
-        };
         globalThis.document = {
-            getElementById: (id) => elements[id] || null,
+            getElementById: (id) => (id === "send-token" ? select : null),
             createElement: () => ({ value: "", textContent: "" }),
         };
         return select;

tests/persistedFieldContract.test.js

@@ -618,6 +618,8 @@ const CONTRACT = [
         "hideFraudContracts",
         "hideDustTransactions",
         "utcTimestamps",
+        "useBlockscout",
+        "checkRecipientsOnEtherscan",
         "debugMode",
     ].map((field) => ({
         field,
@@ -625,25 +627,11 @@ const CONTRACT = [
         // A flag: only ever tested for truthiness, and written back verbatim.
         hostile: [42, "notabool", { a: 1 }],
         // Both answers to that truthiness test have to be driven, and 0 is a
-        // value src/ never writes for a flag. For utcTimestamps and debugMode
+        // value src/ never writes for a flag. For utcTimestamps,
-        // the falsy answer is also the DEFAULT_STATE default.
+        // useBlockscout, checkRecipientsOnEtherscan and debugMode the falsy
+        // answer is also the DEFAULT_STATE default.
         falsy: [0],
     })),
-    // Anything but true is off for these three settings:
-    // - useBlockscout and checkRecipientsOnEtherscan let a request reach
-    //   another service.
-    // - allowWeakPasswords lets AddWallet accept a short password.
-    ...[
-        "useBlockscout",
-        "checkRecipientsOnEtherscan",
-        "allowWeakPasswords",
-    ].map((field) => ({
-        field,
-        kind: KIND.SCALAR,
-        hostile: [42, "notabool", { a: 1 }],
-        floorOnly: [0, null, "true"],
-        holds: (v) => v === false,
-    })),
 ];
 
 function siteMapHolds(v) {

tests/popupBoot.test.js

@@ -44,9 +44,8 @@ test("a flash message's timer does not fire after cleanupPopup()", async () => {
 
 // A boot onto a screen that sends a request no mocked module answers: that
 // request reaches the boot's fetch() stub, never the internet
-// (https://git.eeqj.de/sneak/AutistMask/issues/559). TransactionDetail asks
+// (https://git.eeqj.de/sneak/AutistMask/issues/559). Both requests are made
-// Blockscout only while "Use Blockscout" is on. ConfirmTx asks Etherscan only
+// only while the user has the setting for them on.
-// while "Check recipients on Etherscan" is on. So the profile turns both on.
 function restoringOnto(view, viewData) {
     return unversionedValidProfile({
         currentView: view,

tests/popupFollowsNetworkSwitch.test.js

@@ -87,7 +87,7 @@ test("the popup open on AddressDetail shows the new network and its balances", a
     // Its next refresh runs on Sepolia, and what it fetched is stored.
     await page.tick();
     const { refreshBalances } = require("../src/shared/balances");
-    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    expect(refreshBalances.mock.lastCall[5]).toBe("sepolia");
     const stored = page.storage.read("autistmask");
     expect(stored.networkId).toBe("sepolia");
     expect(stored.lastBalanceRefresh).toBeGreaterThan(0);

tests/priceFeeds.test.js

@@ -1,272 +0,0 @@
-// USD prices are read from Chainlink price feeds on mainnet, through the RPC
-// endpoint (https://git.eeqj.de/sneak/AutistMask/issues/525).
-//
-// The real refreshPrices() runs against a fake JSON-RPC node, answered through
-// ethers' own request hook. The hook also records the body of every HTTP
-// request, so a test can count them.
-
-// prices.js pulls in state.js, which reads chrome.storage.local at load.
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { AbiCoder, FetchRequest } = require("ethers");
-const {
-    prices,
-    refreshPrices,
-    clearPrices,
-    getPrice,
-    getAddressValue,
-} = require("../src/shared/prices");
-const { state } = require("../src/shared/state");
-const {
-    TOKENS,
-    ETH_USD_FEED,
-    USD_PRICE_FEEDS,
-    PRICE_FEED_BY_ADDRESS,
-} = require("../src/shared/tokenList");
-
-const RPC_URL = "https://rpc.example.invalid";
-const NOW = Date.UTC(2026, 9, 27, 12, 0, 0);
-const NOW_SECONDS = NOW / 1000;
-
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
-const LINK = "0x514910771af9ca656af840dff83e8264ecf986ca";
-const DAI = "0x6b175474e89094c44da98b954eedeac495271d0f";
-// A token at an address of its own that calls itself USDC.
-const FAKE_USDC = "0x9999999999999999999999999999999999999999";
-
-const ETH_FEED = ETH_USD_FEED.address.toLowerCase();
-const USDC_FEED = PRICE_FEED_BY_ADDRESS.get(USDC).address.toLowerCase();
-const LINK_FEED = PRICE_FEED_BY_ADDRESS.get(LINK).address.toLowerCase();
-const DAI_FEED = PRICE_FEED_BY_ADDRESS.get(DAI).address.toLowerCase();
-
-// What each feed answers, by its lowercased address: the price in the feed's
-// own units and the time it was written. A feed that is not here makes the
-// call fail.
-let rounds;
-// The parsed body of every HTTP request the node received.
-let requests;
-let logged;
-
-function round(answer, updatedAt = NOW_SECONDS) {
-    return { answer, updatedAt };
-}
-
-// One JSON-RPC answer, to a latestRoundData() call.
-function reply(req) {
-    const envelope = { jsonrpc: "2.0", id: req.id };
-    const answer = rounds[req.params[0].to.toLowerCase()];
-    if (!answer) {
-        return {
-            ...envelope,
-            error: { code: -32000, message: "fixture: read failed" },
-        };
-    }
-    return {
-        ...envelope,
-        result: AbiCoder.defaultAbiCoder().encode(
-            ["uint80", "int256", "uint256", "uint256", "uint80"],
-            [1, answer.answer, answer.updatedAt, answer.updatedAt, 1],
-        ),
-    };
-}
-
-// The feed addresses one HTTP request read, sorted.
-function feedsRead(body) {
-    return [body]
-        .flat()
-        .map((req) => req.params[0].to.toLowerCase())
-        .sort();
-}
-
-// One address that holds `held`, a list of [contract address, symbol].
-function holdTokens(held) {
-    state.wallets = [
-        {
-            addresses: [
-                {
-                    address: "0x" + "a".repeat(40),
-                    balance: "1.0",
-                    tokenBalances: held.map(([address, symbol]) => ({
-                        address,
-                        symbol,
-                        balance: "10.0",
-                    })),
-                },
-            ],
-        },
-    ];
-}
-
-beforeEach(() => {
-    clearPrices();
-    state.networkId = "mainnet";
-    state.rpcUrl = RPC_URL;
-    state.wallets = [];
-    state.trackedTokens = [];
-    rounds = { [ETH_FEED]: round(2000n * 10n ** 8n) };
-    requests = [];
-    logged = [];
-    jest.spyOn(Date, "now").mockReturnValue(NOW);
-    for (const level of ["error", "warn"]) {
-        jest.spyOn(console, level).mockImplementation((...args) => {
-            logged.push(args.map(String).join(" "));
-        });
-    }
-    FetchRequest.registerGetUrl(async (req) => {
-        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
-        requests.push(body);
-        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
-        return {
-            statusCode: 200,
-            statusMessage: "OK",
-            headers: { "content-type": "application/json" },
-            body: Buffer.from(JSON.stringify(answer)),
-        };
-    });
-});
-
-afterEach(() => {
-    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
-    jest.restoreAllMocks();
-    clearPrices();
-});
-
-describe("refreshPrices", () => {
-    test("reads ETH and each held or tracked token that has a feed in one HTTP request", async () => {
-        holdTokens([
-            [USDC, "USDC"],
-            [LINK, "LINK"],
-        ]);
-        state.trackedTokens = [{ address: DAI, symbol: "DAI", decimals: 18 }];
-        rounds[USDC_FEED] = round(10n ** 8n);
-        rounds[LINK_FEED] = round(1150000000n);
-        rounds[DAI_FEED] = round(99990000n);
-
-        await refreshPrices();
-
-        expect(requests).toHaveLength(1);
-        expect(feedsRead(requests[0])).toEqual(
-            [ETH_FEED, USDC_FEED, LINK_FEED, DAI_FEED].sort(),
-        );
-        expect(getPrice("ETH")).toBe(2000);
-        expect(getPrice(USDC)).toBe(1);
-        expect(getPrice(LINK)).toBe(11.5);
-        expect(getPrice(DAI)).toBe(0.9999);
-    });
-
-    test("reads again only once 5 minutes have passed", async () => {
-        await refreshPrices();
-        Date.now.mockReturnValue(NOW + 299999);
-        await refreshPrices();
-        expect(requests).toHaveLength(1);
-
-        Date.now.mockReturnValue(NOW + 300000);
-        rounds[ETH_FEED] = round(2100n * 10n ** 8n, NOW_SECONDS + 300);
-        await refreshPrices();
-        expect(requests).toHaveLength(2);
-        expect(getPrice("ETH")).toBe(2100);
-    });
-
-    test("on Sepolia, reads nothing and keeps no price", async () => {
-        await refreshPrices();
-        expect(getPrice("ETH")).toBe(2000);
-
-        state.networkId = "sepolia";
-        await refreshPrices();
-        expect(requests).toHaveLength(1);
-        expect(Object.keys(prices)).toEqual([]);
-    });
-});
-
-describe("pairing by contract address", () => {
-    test("a token that copies a bundled token's symbol gets no price", async () => {
-        holdTokens([
-            [USDC, "USDC"],
-            [FAKE_USDC, "USDC"],
-        ]);
-        rounds[USDC_FEED] = round(10n ** 8n);
-
-        await refreshPrices();
-
-        expect(feedsRead(requests[0])).toEqual([ETH_FEED, USDC_FEED].sort());
-        expect(getPrice(USDC)).toBe(1);
-        expect(getPrice(FAKE_USDC)).toBeNull();
-        // 1 ETH and 10 real USDC are priced; the 10 look-alikes are not.
-        expect(getAddressValue(state.wallets[0].addresses[0])).toEqual({
-            usd: 2010,
-            partial: true,
-        });
-    });
-});
-
-describe("freshness", () => {
-    test("a reading older than its feed's heartbeat plus 30 minutes is no price", async () => {
-        const heartbeatAgo =
-            NOW_SECONDS - PRICE_FEED_BY_ADDRESS.get(USDC).heartbeat;
-        holdTokens([[USDC, "USDC"]]);
-
-        rounds[USDC_FEED] = round(10n ** 8n, heartbeatAgo - 1800 - 1);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBeNull();
-
-        clearPrices();
-        rounds[USDC_FEED] = round(10n ** 8n, heartbeatAgo - 1800);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBe(1);
-    });
-
-    test.each([0n, -1n])("an answer of %s is no price", async (answer) => {
-        rounds[ETH_FEED] = round(answer);
-        await refreshPrices();
-        expect(getPrice("ETH")).toBeNull();
-    });
-});
-
-describe("a failed read", () => {
-    test("leaves the token with no price and is logged with its error", async () => {
-        holdTokens([[USDC, "USDC"]]);
-        rounds[USDC_FEED] = round(10n ** 8n);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBe(1);
-
-        Date.now.mockReturnValue(NOW + 300000);
-        delete rounds[USDC_FEED];
-        await refreshPrices();
-
-        expect(getPrice(USDC)).toBeNull();
-        expect(getPrice("ETH")).toBe(2000);
-        expect(
-            logged.some(
-                (line) =>
-                    line.includes("price feed read failed") &&
-                    line.includes(USDC),
-            ),
-        ).toBe(true);
-    });
-
-    test("an HTTP error is logged with its status", async () => {
-        FetchRequest.registerGetUrl(async () => ({
-            statusCode: 401,
-            statusMessage: "Unauthorized",
-            headers: { "content-type": "text/plain" },
-            body: Buffer.from("API key required"),
-        }));
-
-        await refreshPrices();
-
-        expect(getPrice("ETH")).toBeNull();
-        expect(logged.some((line) => line.includes("401"))).toBe(true);
-    });
-});
-
-describe("the feed table", () => {
-    test("names each token by its address as the bundled list spells it", () => {
-        const listed = new Set(TOKENS.map((t) => t.address));
-        const unlisted = Object.keys(USD_PRICE_FEEDS).filter(
-            (address) => !listed.has(address),
-        );
-        expect(unlisted).toEqual([]);
-    });
-});

tests/rpcErrorLog.test.js

@@ -88,6 +88,7 @@ test("the balance refresh", async () => {
         wallets,
         RPC_URL,
         "https://explorer.example.invalid/api/v2",
+        true,
         [],
         "mainnet",
     );

tests/sendDisplayFloor.test.js

@@ -90,7 +90,7 @@ let approvalDetails = null;
 
 const { makeStorageStub } = require("./support/storageStub");
 global.chrome = {
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
+    storage: makeStorageStub(),
     runtime: {
         connect: () => ({
             postMessage() {},
@@ -220,14 +220,11 @@ async function refreshWith(balanceWei, tokenItems = []) {
     state.wallets = [{ name: "Wallet 1", addresses: [{ address: HOLDER }] }];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
-    // Blockscout is asked only while the stored "Use Blockscout" is on. The
-    // screens save this page's copy of "Use Blockscout" over the stored one. So
-    // the page's copy is turned on here too.
-    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/sendMax.test.js

@@ -100,10 +100,7 @@ global.fetch = jest.fn(() => {
 });
 
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = {
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-    runtime: { sendMessage() {} },
-};
 
 // A stub DOM: every id resolves to a recording element.
 const elements = new Map();
@@ -216,14 +213,11 @@ async function refreshWith(balanceWei, tokenItems = []) {
     ];
     state.selectedWallet = 0;
     state.selectedAddress = 0;
-    // Blockscout is asked only while the stored "Use Blockscout" is on. The
-    // screens save this page's copy of "Use Blockscout" over the stored one. So
-    // the page's copy is turned on here too.
-    state.useBlockscout = true;
     await refreshBalances(
         state.wallets,
         "https://rpc.example.invalid",
         "https://blockscout.example/api/v2",
+        true,
         state.trackedTokens,
         "mainnet",
     );

tests/sendTokenSelect.test.js

@@ -27,12 +27,8 @@ let select;
 function installStubDocument() {
     select = { innerHTML: "", children: [] };
     select.appendChild = (child) => select.children.push(child);
-    const elements = {
-        "send-token": select,
-        "send-tokens-note": { classList: { toggle: () => {} } },
-    };
     globalThis.document = {
-        getElementById: (id) => elements[id] || null,
+        getElementById: (id) => (id === "send-token" ? select : null),
         createElement: () => ({ value: "", textContent: "" }),
     };
 }

tests/stateRecovery.test.js

@@ -23,9 +23,6 @@
 // version field, and showing those users a wipe prompt would be a worse defect
 // than the one being fixed. It is migrated in place and keeps working.
 
-const fs = require("fs");
-const path = require("path");
-
 const {
     bootPopup,
     cleanupPopup,
@@ -151,29 +148,6 @@ describe("the destructive reset on the recovery screen", () => {
     });
 });
 
-// A key or xprv wallet has no recovery phrase, so the erase warning names all
-// three backups (https://git.eeqj.de/sneak/AutistMask/issues/593). The boot
-// harness holds no static text, so this reads the markup itself.
-describe("the erase warning on the recovery screen", () => {
-    test("names the recovery phrase, the private key and the extended private key", () => {
-        const html = fs.readFileSync(
-            path.join(__dirname, "..", "src", "popup", "index.html"),
-            "utf8",
-        );
-        const start = html.indexOf('id="view-state-recovery"');
-        const end = html.indexOf('id="btn-state-recovery-reset"', start);
-        const screenText = html
-            .slice(start, end)
-            .replace(/<[^>]*>/g, " ")
-            .replace(/\s+/g, " ");
-
-        expect(screenText).toContain(
-            "If you kept a copy of a wallet's recovery phrase, private key or " +
-                "extended private key, you can add that wallet again.",
-        );
-    });
-});
-
 describe("a popup already open when the stored profile becomes unreadable", () => {
     // https://git.eeqj.de/sneak/AutistMask/issues/373. The popup used to stay
     // on the wallet list with the last good balances, and only a reopen
@@ -549,16 +523,13 @@ describe("a garbage value in a field the gate does not check", () => {
     });
 
     test("a malformed tokenBalances entry is dropped, and the wallet and its address survive", async () => {
-        // "Use Blockscout" is on. Otherwise the boot's balance refresh would
+        const env = await bootPopup(
-        // drop the well-formed entry too, since the user has not tracked its
+            profileWithTokenBalances([
-        // token.
-        const profile = profileWithTokenBalances([
                 null,
                 42,
                 { address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
-        ]);
+            ]),
-        profile.useBlockscout = true;
+        );
-        const env = await bootPopup(profile);
 
         const stored = env.storage.read("autistmask");
         expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");

tests/stateWriteLock.test.js

@@ -6,8 +6,9 @@
 // now holds a lock from its read to its write.
 //
 // The popup and the background run here as the real modules over one shared
-// storage stub, and share the lock the way the background and its pages share
+// storage stub, and share the lock the way the background and a page outside
-// the browser's (tests/support/navigatorLocks.js).
+// a Firefox private window share the browser's
+// (tests/support/navigatorLocks.js).
 
 const { makeStorageStub } = require("./support/storageStub");
 

tests/support/navigatorLocks.js

@@ -4,8 +4,9 @@
 // the callback settles, whether it resolved or rejected. That is what the
 // browser's own does for the one call the extension makes,
 // `navigator.locks.request(name, callback)`. Every module a test file loads
-// shares it, as the extension's background and its pages share the browser's
+// shares it, as the extension's background and its pages share the browser's,
-// (README, "Stored state and its version").
+// except a page in a Firefox private window (README, "Stored state and its
+// version").
 //
 // Run before each test file by `setupFiles` in package.json.
 

tests/support/popupBoot.js

@@ -283,8 +283,6 @@ async function bootPopup(stored, options) {
     jest.doMock("../../src/shared/balances", () => ({
         fetchTokenBalances: jest.fn(async () => []),
         refreshBalances: jest.fn(async () => {}),
-        dropUntrackedTokens: jest.requireActual("../../src/shared/balances")
-            .dropUntrackedTokens,
         lookupTokenInfo: jest.fn(async () => null),
         getProvider: () => ({}),
         scanForAddresses: jest.fn(async () => ({

tests/symbolSpoof.test.js

@@ -52,14 +52,8 @@ jest.mock("../src/shared/log", () => ({
 global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 global.chrome = {
-    storage: {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
-        local: {
-            get: async () => ({ autistmask: { useBlockscout: true } }),
-            set: async () => {},
-        },
-    },
 };
 
 const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
@@ -491,12 +485,8 @@ describe("surface 2: the Send token selector", () => {
     function render(tokenBalances) {
         select = { innerHTML: "", children: [] };
         select.appendChild = (child) => select.children.push(child);
-        const elements = {
-            "send-token": select,
-            "send-tokens-note": { classList: { toggle: () => {} } },
-        };
         globalThis.document = {
-            getElementById: (id) => elements[id] || null,
+            getElementById: (id) => (id === "send-token" ? select : null),
             createElement: () => ({ value: "", textContent: "" }),
         };
         renderSendTokenSelect({
@@ -592,12 +582,14 @@ describe("surface 3: the balance list", () => {
     // 1,000-holder floor and was listed as a holding named ETH.
     test("a fake ETH token clearing the holder floor is filtered", async () => {
         respondWith([fakeEthItem()]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("tracking the fake token manually does not admit it either", async () => {
         respondWith([fakeEthItem({ holders_count: "0" })]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [
             { address: FAKE_ETH_CONTRACT },
         ]);
         expect(balances).toEqual([]);
@@ -607,12 +599,16 @@ describe("surface 3: the balance list", () => {
     // their belief about what they own, and it renders the symbol into HTML.
     test("a padded fake ETH token is filtered too", async () => {
         respondWith([fakeEthItem({ symbol: " ETH " })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     test("a fake ETH token padded with a no-break space is filtered", async () => {
         respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The false-positive direction on the surface that matters most: a real
@@ -627,7 +623,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -641,7 +637,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
@@ -652,7 +648,9 @@ describe("surface 3: the balance list", () => {
     // before the symbol rule is consulted.
     test("a non-ERC-20 row claiming ETH never reaches the symbol rule", async () => {
         respondWith([fakeEthItem({ type: "ERC-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The adjacent finding from the same review as issue #260: the type gate
@@ -670,16 +668,20 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
     test("case insensitivity does not admit another token type", async () => {
         respondWith([fakeEthItem({ type: "erc-721" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
         respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
-        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
+        expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, [])).toEqual(
+            [],
+        );
     });
 
     // The money test: the user holds real ETH and has been airdropped a fake
@@ -692,6 +694,7 @@ describe("surface 3: the balance list", () => {
             [{ addresses: [addr] }],
             "https://rpc.example.invalid",
             BLOCKSCOUT,
+            true,
             [],
             "mainnet",
         );

tests/tokenTransferDetail.test.js

@@ -38,14 +38,8 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
-        local: {
-            get: async () => ({ autistmask: { useBlockscout: true } }),
-            set: async () => {},
-        },
-    },
 };
 
 const { state } = require("../src/shared/state");
@@ -184,6 +178,7 @@ test("a token transfer's decoded details name the token contract and the amount
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.mainnet.chainId,
     );
     expect(row.to).toBe(RECIPIENT);
@@ -216,6 +211,7 @@ test("with mainnet active, a Sepolia transaction is read from Sepolia's Blocksco
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
 
@@ -244,6 +240,7 @@ test("with mainnet active and no Blockscout remembered for Sepolia, a Sepolia tr
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
     mockAsked.length = 0;
@@ -265,6 +262,7 @@ async function showSepoliaTransferWithMainnetActive() {
     const [row] = await fetchRecentTransactions(
         HOLDER,
         EXPLORER,
+        true,
         NETWORKS.sepolia.chainId,
     );
     transactionDetail.show(row);

tests/trackedTokenBalances.test.js

@@ -9,12 +9,6 @@
 
 const { AbiCoder, FetchRequest } = require("ethers");
 const { refreshBalances } = require("../src/shared/balances");
-const { makeStorageStub } = require("./support/storageStub");
-
-// Blockscout is asked only while the stored "Use Blockscout" is on.
-globalThis.chrome = {
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-};
 
 const RPC_URL = "https://rpc.example.invalid";
 const EXPLORER_URL = "https://explorer.example.invalid/api/v2";
@@ -138,6 +132,7 @@ async function refresh(addresses, trackedTokens) {
         [{ addresses }],
         RPC_URL,
         EXPLORER_URL,
+        true,
         trackedTokens,
         "mainnet",
         new AbortController().signal,

tests/transactions.test.js

@@ -1215,13 +1215,11 @@ function respondWith(txItems, tokenTransferItems) {
 describe("fetchRecentTransactions merge and dedup", () => {
     beforeEach(() => {
         debugFetch.mockReset();
-        // Blockscout is asked only while the stored "Use Blockscout" is on.
-        global.chrome.storage.write("autistmask", { useBlockscout: true });
     });
 
     test("queries only the two Blockscout endpoints for the address", async () => {
         respondWith([], []);
-        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        await fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1");
         expect(debugFetch).toHaveBeenCalledTimes(2);
         const urls = debugFetch.mock.calls.map((c) => c[0]);
         expect(urls).toContain(
@@ -1285,7 +1283,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         const merged = txs[0];
         // The received leg (the swap output) supplies the display amount.
@@ -1322,7 +1325,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].value).toBe("1500.5000");
@@ -1348,7 +1356,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([], [leg("1000000"), leg("2000000")]);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         // Keyed by hash plus contract, so the later leg wins.
         expect(txs[0].exactValue).toBe("2.0");
@@ -1388,7 +1401,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs.map((t) => t.symbol).sort()).toEqual(["USDC", "WETH"]);
     });
 
@@ -1429,7 +1447,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].symbol).toBe("USDC");
         expect(txs[0].exactValue).toBe("1.0");
@@ -1455,7 +1478,13 @@ describe("fetchRecentTransactions merge and dedup", () => {
         });
         respondWith([item(6), item(8), item(7)], []);
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1", 2);
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+            2,
+        );
         expect(txs.map((t) => t.blockNumber)).toEqual([21000008, 21000007]);
     });
 
@@ -1481,6 +1510,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const sepolia = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0xaa36a7",
         );
         expect(sepolia[0].symbol).toBe("SepoliaETH");
@@ -1489,6 +1519,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
         const mainnet = await fetchRecentTransactions(
             VICTIM,
             BLOCKSCOUT,
+            true,
             "0x1",
         );
         expect(mainnet[0].symbol).toBe("ETH");
@@ -1515,7 +1546,12 @@ describe("fetchRecentTransactions merge and dedup", () => {
             ],
         );
 
-        const txs = await fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1");
+        const txs = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            true,
+            "0x1",
+        );
         expect(txs).toHaveLength(1);
         expect(txs[0].contractAddress).toBe(FAKE_ETH_CONTRACT);
         expect(txs[0].holders).toBe(0);
@@ -1557,6 +1593,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1567,6 +1604,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBeNull();
@@ -1577,6 +1615,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(filterTransactions(txs, filters()).transactions).toEqual(
@@ -1593,6 +1632,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             const txs = await fetchRecentTransactions(
                 VICTIM,
                 BLOCKSCOUT,
+                true,
                 "0x1",
             );
             expect(txs[0].holders).toBe(0);
@@ -1610,7 +1650,7 @@ describe("fetchRecentTransactions merge and dedup", () => {
             },
         }));
         await expect(
-            fetchRecentTransactions(VICTIM, BLOCKSCOUT, "0x1"),
+            fetchRecentTransactions(VICTIM, BLOCKSCOUT, true, "0x1"),
         ).resolves.toEqual([]);
     });
 

tests/uniswap.test.js

@@ -3310,135 +3310,6 @@ describe("uniswap decoder", () => {
 
             expect(detail(result, "Amount").value).toBe("Up to 1000.0000 USDT");
         });
-
-        // https://git.eeqj.de/sneak/AutistMask/issues/660 — Permit2 has no
-        // allowance of ETH, so a permit on the zero address reads as one on a
-        // token nothing knows. On next at 53551c6 such a permit's Allowance
-        // token line read ETH. A permit of 1 wei of the zero address before a
-        // V4 step of 5 ETH made the Amount line read 0.000000000000000001 ETH.
-        // With that permit to another spender and a SETTLE the router pays, no
-        // line gave the 5 ETH.
-        describe("a permit on the zero address", () => {
-            const FIVE_ETH = 5000000000000000000n;
-            // The lines of a permit of `amount` base units of the zero
-            // address for `spender`.
-            const zeroAddressLines = (amount, spender) => [
-                [
-                    "Permit2 allowance",
-                    amount + " base units (decimals unknown)",
-                ],
-                ["Allowance token", ZERO_ADDR],
-                ["Allowance spender", getAddress(spender)],
-            ];
-            // A V4 swap of 5 ETH for USDC. The user pays its SETTLE when
-            // `payerIsUser` is true; otherwise the router pays it from the
-            // transaction's value.
-            const v4FiveEth = (payerIsUser) =>
-                encodeV4Swap(
-                    new Uint8Array([
-                        V4_SWAP_EXACT_IN_SINGLE_ID,
-                        V4_SETTLE_ID,
-                        V4_TAKE_ALL_ID,
-                    ]),
-                    [
-                        encodeV4ExactInSingle(
-                            ZERO_ADDR,
-                            USDC_ADDR,
-                            FIVE_ETH,
-                            1n,
-                        ),
-                        settle(ZERO_ADDR, FIVE_ETH, payerIsUser),
-                        encodeV4TakeAll(USDC_ADDR, 1n),
-                    ],
-                );
-
-            test("a PERMIT2_PERMIT on the zero address names the address", () => {
-                const result = decodeSteps(
-                    [0x00, 0x0a],
-                    [
-                        V3_600,
-                        encodePermit2(
-                            ZERO_ADDR,
-                            1000000000000000000n,
-                            ROUTER_ADDR,
-                        ),
-                    ],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "600.0000 USDT"],
-                    ...zeroAddressLines("1000000000000000000", ROUTER_ADDR),
-                ]);
-                expect(detail(result, "Allowance token").address).toBe(
-                    ZERO_ADDR,
-                );
-            });
-
-            test("a PERMIT2_PERMIT_BATCH entry on the zero address names the address", () => {
-                const result = decodeSteps(
-                    [0x03, 0x00],
-                    [
-                        encodePermit2Batch(
-                            [
-                                [USDT_ADDR, USDT_600],
-                                [ZERO_ADDR, 1000000000000000000n],
-                            ],
-                            ROUTER_ADDR,
-                        ),
-                        V3_600,
-                    ],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "600.0000 USDT"],
-                    ...USDT_600_LINES,
-                    ...zeroAddressLines("1000000000000000000", ROUTER_ADDR),
-                ]);
-            });
-
-            test("a PERMIT2_PERMIT of 1 wei of the zero address, then a V4 step of 5 ETH the user settles, shows the 5 ETH", () => {
-                const result = decodeSteps(
-                    [0x0a, 0x10],
-                    [
-                        encodePermit2(ZERO_ADDR, 1n, ROUTER_ADDR),
-                        v4FiveEth(true),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", ROUTER_ADDR),
-                ]);
-            });
-
-            test("a PERMIT2_PERMIT of 1 wei of the zero address to another spender, then a V4 step of 5 ETH the router settles, shows the 5 ETH", () => {
-                const result = decodeSteps(
-                    [0x0a, 0x10],
-                    [
-                        encodePermit2(ZERO_ADDR, 1n, OTHER_ADDR),
-                        v4FiveEth(false),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", OTHER_ADDR),
-                ]);
-            });
-
-            test("a PERMIT2_PERMIT_BATCH entry of 1 wei of the zero address to another spender, then a V4 step of 5 ETH the router settles, shows the 5 ETH", () => {
-                const result = decodeSteps(
-                    [0x03, 0x10],
-                    [
-                        encodePermit2Batch([[ZERO_ADDR, 1n]], OTHER_ADDR),
-                        v4FiveEth(false),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", OTHER_ADDR),
-                ]);
-            });
-        });
     });
 
     // https://git.eeqj.de/sneak/AutistMask/issues/359 — the output half, in

tests/uniswapRecipient.test.js

@@ -42,14 +42,8 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
-        local: {
-            get: async () => ({ autistmask: { useBlockscout: true } }),
-            set: async () => {},
-        },
-    },
 };
 
 const uniswap = require("../src/shared/uniswap");

tests/uniswapRouterAddress.test.js

@@ -34,14 +34,8 @@ jest.mock("../src/shared/log", () => ({
     isDebug: () => false,
 }));
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 globalThis.chrome = {
-    storage: {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
-        local: {
-            get: async () => ({ autistmask: { useBlockscout: true } }),
-            set: async () => {},
-        },
-    },
 };
 
 const { state } = require("../src/shared/state");
@@ -294,6 +288,7 @@ async function historyRow(method, sentTo, chainId) {
     const rows = await fetchRecentTransactions(
         RECIPIENT,
         "https://explorer.example/api/v2",
+        true,
         chainId,
     );
     return rows[0];

tests/uniswapUnknownDecimals.test.js

@@ -90,9 +90,6 @@ function swapDetail(data, label) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
-    // The approval screen reads the explorer's report only while "Use
-    // Blockscout" is on.
-    state.useBlockscout = true;
 });
 
 describe("a swap of a token outside the bundled list", () => {

tests/unknownScaleDisplay.test.js

@@ -103,7 +103,7 @@ describe("balanceLine", () => {
     });
 
     test("an unknown quantity produces no fiat figure, a zero one does", () => {
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         const unknown = balanceLine("NOVEL", null, 3, NOVEL);
         const zero = balanceLine("NOVEL", 0, 3, NOVEL);
         // A price times an unknown quantity is not $0.00: that is the same
@@ -162,7 +162,7 @@ describe("getAddressValue", () => {
     // make it incomplete.
     test("an unknown balance makes the total partial, a zero balance does not", () => {
         prices.ETH = 2000;
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         const unknown = getAddressValue(address(null));
         const zero = getAddressValue(address("0.0"));
         expect(unknown).not.toEqual(zero);
@@ -172,7 +172,7 @@ describe("getAddressValue", () => {
 
     test("an unknown balance is not priced as zero of the token", () => {
         prices.ETH = 2000;
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         // The same row with a real quantity of 10 is worth $30. Neither that
         // figure nor a confident $0.00 may be stated for the unknown one.
         expect(getAddressValue(address("10.0"))).toEqual({

tests/unknownScaleSend.test.js

@@ -72,12 +72,8 @@ global.fetch = jest.fn(() => {
     throw new Error("tests must not perform network requests");
 });
 
-// Blockscout is asked only while the stored "Use Blockscout" is on.
 const { makeStorageStub } = require("./support/storageStub");
-global.chrome = {
+global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-    storage: makeStorageStub({ autistmask: { useBlockscout: true } }),
-    runtime: { sendMessage() {} },
-};
 
 // A stub DOM. Every id in index.html that these two views touch resolves to a
 // fresh recording element; nothing here depends on layout, only on what the
@@ -176,7 +172,7 @@ async function fetchOnto(items) {
         statusText: "OK",
         json: async () => items,
     }));
-    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",
@@ -201,14 +197,14 @@ async function fetchOntoBoth(itemsA, itemsB) {
         statusText: "OK",
         json: async () => itemsA,
     }));
-    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
+    const a = await fetchTokenBalances(HOLDER, BLOCKSCOUT, true, []);
     debugFetch.mockImplementation(async () => ({
         ok: true,
         status: 200,
         statusText: "OK",
         json: async () => itemsB,
     }));
-    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, []);
+    const b = await fetchTokenBalances(SECOND_HOLDER, BLOCKSCOUT, true, []);
     state.wallets = [
         {
             name: "Wallet 1",
@@ -272,9 +268,6 @@ beforeEach(() => {
     state.fraudContracts = [];
     state.hideLowHolderTokens = false;
     state.currentView = null;
-    // The screens save this page's copy of "Use Blockscout" over the stored
-    // one. So the page's copy is turned on here too.
-    state.useBlockscout = true;
 });
 
 describe("the Send screen resolves the scale rather than reading the stored one", () => {