This website requires JavaScript.
1197d2171b
fix: give every address a row of its own, so none wraps or is shortened (closes #380 ) (#381 )
clawbot
2026-08-30 05:25:00 +02:00
23817de7d3
milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverage (#190 )
Jeffrey Paul
2026-08-30 04:11:51 +02:00
a098bb0c32
fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362 )
clawbot
2026-08-23 23:06:17 +02:00
45500e66cf
fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371 )
clawbot
2026-08-23 21:26:14 +02:00
1b52aa1723
fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349 )
clawbot
2026-08-23 21:19:04 +02:00
75a5fa9891
harden: gate swap amounts on presence, not truthiness, so a figure always matches its token (closes #359 )
clawbot
2026-08-23 20:45:58 +02:00
c9ebac822a
harden: state an undetermined swap input token as undetermined, not as ETH (closes #357 )
clawbot
2026-08-23 20:23:05 +02:00
ad6aa7b20d
fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311 )
clawbot
2026-08-23 20:04:00 +02:00
28a527295a
harden: state an undetermined V4 output token as undetermined, not as ETH (closes #353 )
clawbot
2026-08-23 18:13:20 +02:00
bd0a626e7b
harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324 )
clawbot
2026-08-23 17:57:30 +02:00
36bc6bee0e
fix: always name a swap's output token, by address when no symbol is known (closes #346 )
clawbot
2026-08-23 16:31:02 +02:00
43784cab3f
harden: resolve or refuse the swap token scale instead of guessing 18 (closes #340 )
clawbot
2026-08-23 16:20:22 +02:00
769f6a5289
release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310 )
clawbot
2026-08-23 16:13:22 +02:00
669c443bf9
fix: never render a nonzero approval amount as zero (closes #322 )
clawbot
2026-08-23 15:43:04 +02:00
12b0c4d1c6
build: remove dist/ when a release build fails (closes #333 )
clawbot
2026-08-23 15:39:04 +02:00
c36d8b6ddf
docs: state the enforced dist/ verification scope precisely (closes #331 )
clawbot
2026-08-23 15:33:58 +02:00
cef6aaab11
fix: merge state per field instead of overwriting the whole blob (closes #304 )
clawbot
2026-08-20 16:41:19 +02:00
20e911059a
fix: give a wallet whose password is lost a way out, and say the password cannot be reset (closes #312 )
clawbot
2026-08-20 15:12:28 +02:00
61e0cad31f
fix: let a user who lost the password delete the wallet, and warn before they can (closes #312 )
2026-08-20 12:40:15 +00:00
aea999db85
build: make verify-build take an explicit expectation and a build receipt (closes #309 )
clawbot
2026-08-20 14:24:55 +02:00
9f3cc05985
fix: verify the build against its own receipt, with the expected mode as an argument (closes #309 )
clawbot
2026-08-20 12:10:37 +00:00
c8c2af0c6b
harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307 )
clawbot
2026-08-20 13:47:28 +02:00
ada41bf5e1
fix: render a hostile token symbol as text, and put a floor under the CSP (closes #307 )
clawbot
2026-08-20 11:34:41 +00:00
59f68b8859
fix: answer eth_chainId and net_version from loaded state (closes #317 )
clawbot
2026-08-20 13:11:48 +02:00
5c4a671d4a
fix: answer eth_chainId and net_version from loaded state (closes #317 )
clawbot
2026-08-20 10:47:18 +00:00
50078b3566
fix: resolve approval-screen token decimals, and refuse to format an unknown scale (closes #306 )
clawbot
2026-08-20 12:57:38 +02:00
0710de92f4
fix: show the true token amount on the approval screen, or none at all (closes #306 )
clawbot
2026-08-20 10:49:08 +00:00
6350aad591
fix: gate the chain switch and remember endpoints per network (closes #308 )
clawbot
2026-08-20 12:42:01 +02:00
211ac4779b
fix: gate the chain switch and remember endpoints per network (closes #308 )
clawbot
2026-08-20 10:10:43 +00:00
2f80a9bdb4
fix: sign the ERC-20 amount the confirmation screen displayed (closes #305 )
clawbot
2026-08-20 12:31:28 +02:00
8fadc4107f
fix: sign the ERC-20 amount the send screen displayed (closes #305 )
sneak
2026-08-20 10:14:55 +00:00
ff3387d8cf
feat: vendor and censor the phishing blocklist at build time (closes #219 )
clawbot
2026-08-17 10:05:56 +02:00
8fcdd8a053
fix: settle a site approval on the port that carries its teardown (closes #275 )
clawbot
2026-08-17 09:34:07 +02:00
7690fe6429
fix: answer the page when a background handler throws (closes #280 )
clawbot
2026-08-17 09:16:21 +02:00
a60c4a616a
test: drive the Settings screen in a browser and guard every popup element id (closes #229 )
clawbot
2026-08-17 09:14:59 +02:00
47bf38644d
build: add ESLint to script/lint and containerize linting (closes #152 )
clawbot
2026-08-17 09:10:03 +02:00
4b7a678a9b
refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153 )
clawbot
2026-08-17 09:06:13 +02:00
ab1c1846a7
fix: one wording for an empty password field on every screen (closes #265 )
clawbot
2026-08-17 08:59:59 +02:00
743b1962a5
build: run the browser e2e suites in CI (closes #259 )
clawbot
2026-08-17 08:52:26 +02:00
c06765ef8f
fix: one transaction approval at a time, and honest copy for a nonce collision (closes #271 )
clawbot
2026-08-17 08:38:26 +02:00
e07efb710a
fix: an address holding only unpriced tokens is no longer totalled at $0.00 (closes #261 )
clawbot
2026-08-17 08:38:10 +02:00
d9d50f05d2
test: assert the #150 and #151 items the harness did not cover (closes #188 )
clawbot
2026-08-17 08:10:37 +02:00
51e84aefa6
docs: drop the README limit that #274 fixed (closes #285 )
clawbot
2026-08-17 08:03:02 +02:00
0be20d7270
fix: render the view "Back" lands on after the popup is reopened (closes #268 )
clawbot
2026-08-14 06:14:09 +02:00
9dcd875dd4
fix: carry EIP-1193 error codes through to the page (closes #274 )
clawbot
2026-08-12 13:47:33 +02:00
c755a5e944
fix: a shared ticker no longer hides one of its two real tokens (closes #276 )
clawbot
2026-08-12 13:31:55 +02:00
d5595c0151
test: drive the EIP-1193 dApp approval round trips in the browser (closes #183 )
clawbot
2026-08-12 13:23:57 +02:00
e4c3708b84
fix: fold invisible characters before the known-symbol spoof check (closes #260 )
clawbot
2026-08-12 13:06:54 +02:00
52c7c1b060
test: containerized Firefox end-to-end harness (closes #184 )
clawbot
2026-08-12 12:20:14 +02:00
918e581ef3
harden: verify the signed transaction against what the popup displayed (closes #216 )
clawbot
2026-08-12 12:15:25 +02:00
a08ba6a66d
fix: filter the restored view stack against RESTORABLE_VIEWS (closes #224 )
clawbot
2026-08-12 12:07:48 +02:00
09b602579a
fix: one password-failure message across every screen (closes #172 )
clawbot
2026-08-12 12:03:39 +02:00
18b47cd579
test: close the empty-batch hole in the e2e unstubbed-request guard (closes #187 )
clawbot
2026-08-12 11:50:38 +02:00
5af89a1b63
test: drive ConfirmTx in the e2e suite, gate assertion included (closes #238 )
clawbot
2026-08-12 11:35:20 +02:00
c6a1f97247
fix: explain a rejected dust threshold instead of silently snapping back (closes #233 )
clawbot
2026-08-12 11:29:09 +02:00
0a1786b406
harden: verify all approval fields and make failed signing retryable (closes #174 )
clawbot
2026-08-12 11:21:02 +02:00
937f699fb1
feat: remove an address from an HD wallet, behind a confirmation (closes #162 )
clawbot
2026-08-12 11:16:29 +02:00
1f41a07df2
fix: filter a fake ETH token from the balance list too (closes #235 )
clawbot
2026-08-12 11:10:38 +02:00
78a1cb067e
test: commit a verify-build failure-mode battery and run it from make check (closes #227 )
clawbot
2026-08-12 11:05:08 +02:00
afe6ddaea0
fix: WaitTx timeout no longer overwrites a rendered success screen (closes #155 )
clawbot
2026-08-12 10:58:36 +02:00
23712b53cb
fix: wipe the exported private key from the DOM on any view leave (closes #221 )
clawbot
2026-08-12 10:54:37 +02:00
bd4bdcafc7
fix: explain a stored non-master xprv wallet instead of throwing at signing time (closes #234 )
clawbot
2026-08-12 10:41:49 +02:00
ce4a0d7b8d
fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230 )
clawbot
2026-08-12 10:34:45 +02:00
bf1dbec87c
fix: run libsodium on WebAssembly under the extension CSP (closes #182 )
clawbot
2026-08-12 10:30:15 +02:00
ba35282092
docs: describe the bundled token list by its criterion, not a drifting count (closes #239 )
clawbot
2026-08-12 10:20:40 +02:00
158278d251
fix: count the network fee in the confirm-screen balance check (closes #154 )
clawbot
2026-08-11 15:41:37 +02:00
6f6bc2e7b5
fix: drive background refresh and phishing update from alarms (closes #158 )
clawbot
2026-08-11 15:38:28 +02:00
74c137dadf
fix: add a Settings toggle for known-symbol spoof verification (closes #176 )
clawbot
2026-08-11 15:38:05 +02:00
edea22f7ed
fix: move the UTC Timestamps checkbox into the Display well (closes #212 )
clawbot
2026-08-11 15:34:16 +02:00
b155c0fcd6
fix: enforce the base58 checksum and reject non-master extended keys (closes #210 )
clawbot
2026-08-11 15:31:50 +02:00
fb9e8f5542
fix: NUL-delimit verify-build's dist walk so no path escapes the check (closes #223 )
clawbot
2026-08-11 15:26:43 +02:00
3e5d6323ce
feat: password-gated recovery phrase display for HD wallets (closes #161 )
clawbot
2026-08-11 15:25:17 +02:00
12acf4dc8c
fix: honour a dust threshold of 0 and compare addresses case-insensitively (closes #179 )
clawbot
2026-08-11 15:16:48 +02:00
f455b0ae7f
test: known-answer coverage for HD derivation and the vault (closes #159 )
clawbot
2026-08-11 15:06:35 +02:00
86cdea5e4e
chore: repo policy compliance sweep — test rerun, frozen lockfile, documented targets (closes #166 )
clawbot
2026-08-11 14:57:51 +02:00
f271bcd7b4
fix: one transaction history row per value movement (closes #177 )
clawbot
2026-08-11 14:56:30 +02:00
93e3f6e4e2
fix: correct verify-build diagnostics and close two robustness gaps (closes #180 )
clawbot
2026-08-11 14:55:06 +02:00
9b957ffd69
fix: derive hasWallet from the wallet list on load (closes #195 )
clawbot
2026-08-11 14:51:22 +02:00
cf5f582be9
docs: correct three README claims contradicted by the code (closes #213 )
clawbot
2026-08-11 14:41:16 +02:00
b9bc226ae1
docs: rebuild the README Screen Map from the code (closes #164 )
clawbot
2026-08-11 14:31:45 +02:00
19cb1ca1b0
docs: correct docs/README.md external services and remove competitor names (closes #163 )
clawbot
2026-08-11 14:25:57 +02:00
b882cede9f
fix: repair wallet state on delete (closes #156 )
clawbot
2026-08-11 14:23:06 +02:00
d93eda31a0
docs: rewrite TODO.md workflow for the branch-per-issue model on next (closes #191 )
clawbot
2026-08-11 14:15:05 +02:00
e9fa8bec47
build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170 )
clawbot
2026-08-10 16:15:22 +02:00
ad9162d057
security: decrypt and sign dApp approvals in the popup (closes #157 )
clawbot
2026-08-10 15:59:30 +02:00
188882d635
test: cover the address-poisoning filters in transactions.js (closes #160 )
clawbot
2026-08-10 15:53:15 +02:00
e8ad8325c8
test: containerized Chrome end-to-end harness that drives the real popup (closes #181 )
clawbot
2026-08-10 15:49:32 +02:00
f7f141a757
security: make DEBUG a build-time flag defaulting to off (closes #149 ) (#169 )
clawbot
2026-08-09 16:19:09 +02:00
23aeae4841
feat: add About well to settings with build info and debug easter egg (#145 )
clawbot
2026-07-26 18:39:09 +02:00
f7a24374ae
Add token-list enrichment tooling (scripts/)
sneak
2026-07-25 17:40:48 +07:00
d046a24115
scripts-to-rule-them-all (#148 )
sneak
2026-07-07 02:14:26 +02:00
3ffc0bec80
TODO (#147 )
sneak
2026-07-06 21:36:13 +02:00
a22f33d511
fix: implement proper view navigation stack (#146 )
clawbot
2026-03-02 00:15:01 +01:00
39db06c83d
feat: show debug banner on testnet or debug mode, add TESTNET tag (#143 )
clawbot
2026-03-01 21:55:36 +01:00
df031fd07d
fix: unify address display with shared renderAddressHtml utility (#129 )
clawbot
2026-03-01 21:54:38 +01:00
a138a36710
fix: suppress USD display on testnet networks (#142 )
clawbot
2026-03-01 20:31:45 +01:00
6b40fa8836
feat: show estimated USD value for ETH in approve-tx view (#141 )
clawbot
2026-03-01 20:16:00 +01:00
bc2aedaab6
fix: etherscan link on address-token page goes to token-specific URL (#136 )
clawbot
2026-03-01 20:13:55 +01:00
e53420f2e2
feat: add Sepolia testnet support (#137 )
clawbot
2026-03-01 20:11:22 +01:00
d35bfb7d23
feat: expand confirm-tx warnings — closes #114 (#118 )
clawbot
2026-03-01 19:34:54 +01:00
clawbot
Jeffrey Paul
clawbot