getTopTokenPrices() in src/shared/tokenList.js (lines 3648-3671), called by refreshPrices() in src/shared/prices.js. It requests https://data-api.coindesk.com/index/cc/v1/latest/tick with no key.
What happens
On 2026-10-14, every request the wallet makes there is answered HTTP 401 with "API key required". Reproduced from inside the browser container and from the host, for the wallet's own 26-instrument request and for ETH-USD alone. The code reads json.Data, gets an empty object, and stores no prices without saying so.
On next (8e52528), release build, Chrome, with Ethereum Mainnet active: Home's ETH/USD price line stays blank after the refresh.
What should happen
README, opening section and External Services: the wallet uses "a public CoinDesk API (no API key) for realtime price information", and Supported Functionality lists "ETH/USD and token/USD price display". Either prices load again from a source that needs no key, or the README says how prices are now obtained or that they are gone. Which of those is the owner's call.
Severity: major
Definition of done
On mainnet, Home shows the ETH/USD price and USD values again, or the README and the screens stop promising them.
A failed price request is logged with its HTTP status instead of passing silently as "no prices".
Model: opus-5-5
## Where
`getTopTokenPrices()` in `src/shared/tokenList.js` (lines 3648-3671), called by `refreshPrices()` in `src/shared/prices.js`. It requests `https://data-api.coindesk.com/index/cc/v1/latest/tick` with no key.
## What happens
On 2026-10-14, every request the wallet makes there is answered HTTP 401 with "API key required". Reproduced from inside the browser container and from the host, for the wallet's own 26-instrument request and for `ETH-USD` alone. The code reads `json.Data`, gets an empty object, and stores no prices without saying so.
On `next` (8e52528), release build, Chrome, with Ethereum Mainnet active: Home's ETH/USD price line stays blank after the refresh.
## What should happen
README, opening section and External Services: the wallet uses "a public CoinDesk API (no API key) for realtime price information", and Supported Functionality lists "ETH/USD and token/USD price display". Either prices load again from a source that needs no key, or the README says how prices are now obtained or that they are gone. Which of those is the owner's call.
Severity: major
## Definition of done
- [ ] On mainnet, Home shows the ETH/USD price and USD values again, or the README and the screens stop promising them.
- [ ] A failed price request is logged with its HTTP status instead of passing silently as "no prices".
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 04:49:26 +02:00
Confirmed today: every CoinDesk price endpoint, including the older CryptoCompare ones, answers 401 "API key required", so mainnet shows no USD values at all. Replacing it changes which outside service the wallet talks to, which RULES.md fixes by name, so this one is yours.
Ask: where should the wallet get USD prices now?
(a) From the chain, through the RPC endpoint the user already set (recommended): ETH/USD and the tokens that have one from the Chainlink price feeds on mainnet, with no new outside service and no key; tokens without a feed show no USD value. Moderate work.
(b) CoinGecko's public API (answers today without a key, rate-limited): a small swap of one URL for another, but a new third party sees the user's IP and token list.
(c) Drop USD display for 1.0 and say so in README.md.
Model: opus-5-5
Confirmed today: every CoinDesk price endpoint, including the older CryptoCompare ones, answers 401 "API key required", so mainnet shows no USD values at all. Replacing it changes which outside service the wallet talks to, which `RULES.md` fixes by name, so this one is yours.
Ask: where should the wallet get USD prices now?
- **(a) From the chain, through the RPC endpoint the user already set** (recommended): ETH/USD and the tokens that have one from the Chainlink price feeds on mainnet, with no new outside service and no key; tokens without a feed show no USD value. Moderate work.
- (b) CoinGecko's public API (answers today without a key, rate-limited): a small swap of one URL for another, but a new third party sees the user's IP and token list.
- (c) Drop USD display for 1.0 and say so in `README.md`.
Model: opus-5-5
clawbot
removed their assignment 2026-10-14 05:02:42 +02:00
sneak
was assigned by clawbot2026-10-14 05:02:42 +02:00
What they are. On Ethereum mainnet, Chainlink keeps one small contract per price pair (ETH/USD, USDC/USD, and so on). A group of independent operators writes the market price into it, and anyone can read it free with an ordinary eth_call. Nothing is signed, no transaction is sent, no key is needed.
What the wallet would read. One contract per asset, its address bundled into the build next to the bundled token list: ETH/USD (0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, also used for WETH) and the USD feed of each bundled token that has one. Of the 512 bundled tokens, about 55 do, including USDT, USDC, DAI, USDS, USDe, PYUSD, LINK, UNI, AAVE, BNB, PAXG, CRV, ARB, ENS and COMP. Each read returns the price and the time it was last written. Each feed is paired with its token by contract address, checked by hand when added, so a look-alike token never borrows a real token's price (today prices are matched by symbol).
How fresh. A feed is rewritten when the price moves past a set step, or at a fixed interval if it does not: ETH/USD at 0.5% or hourly; LINK, UNI, AAVE, DAI at 0.25 to 1% or hourly; the stablecoins, BNB and PAXG at 0.25 to 1% or daily (USDT's reading was 19 hours old today, still the right price for a stablecoin). A shown price can be off by up to that step. A reading older than its feed's interval plus a margin is treated as no price, so nothing stale is shown.
Cost to the user. On mainnet only, read-only calls to their own RPC endpoint for ETH and the tokens they hold, sent as one batched request at most every 5 minutes while the popup is open. No gas, no fee. The endpoint already sees those tokens through the balance reads, so it learns nothing new, and CoinDesk, which sees the user's IP today, goes away.
A token with no feed (among the top 30: LEO, TON, CRO, DOT, MNT, OKB, PEPE, BGB, SHIB, among others) shows no USD value, and an address total that includes it reads "plus unpriced tokens", as unpriced tokens do today.
RULES.md names CoinDesk among the outside services. Once you confirm, the PR will propose that line's edit to you and not make it.
Model: opus-5-5
Chainlink price feeds, in plain terms:
- **What they are.** On Ethereum mainnet, Chainlink keeps one small contract per price pair (ETH/USD, USDC/USD, and so on). A group of independent operators writes the market price into it, and anyone can read it free with an ordinary `eth_call`. Nothing is signed, no transaction is sent, no key is needed.
- **What the wallet would read.** One contract per asset, its address bundled into the build next to the bundled token list: ETH/USD (`0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419`, also used for WETH) and the USD feed of each bundled token that has one. Of the 512 bundled tokens, about 55 do, including USDT, USDC, DAI, USDS, USDe, PYUSD, LINK, UNI, AAVE, BNB, PAXG, CRV, ARB, ENS and COMP. Each read returns the price and the time it was last written. Each feed is paired with its token by contract address, checked by hand when added, so a look-alike token never borrows a real token's price (today prices are matched by symbol).
- **How fresh.** A feed is rewritten when the price moves past a set step, or at a fixed interval if it does not: ETH/USD at 0.5% or hourly; LINK, UNI, AAVE, DAI at 0.25 to 1% or hourly; the stablecoins, BNB and PAXG at 0.25 to 1% or daily (USDT's reading was 19 hours old today, still the right price for a stablecoin). A shown price can be off by up to that step. A reading older than its feed's interval plus a margin is treated as no price, so nothing stale is shown.
- **Cost to the user.** On mainnet only, read-only calls to their own RPC endpoint for ETH and the tokens they hold, sent as one batched request at most every 5 minutes while the popup is open. No gas, no fee. The endpoint already sees those tokens through the balance reads, so it learns nothing new, and CoinDesk, which sees the user's IP today, goes away.
- **A token with no feed** (among the top 30: LEO, TON, CRO, DOT, MNT, OKB, PEPE, BGB, SHIB, among others) shows no USD value, and an address total that includes it reads "plus unpriced tokens", as unpriced tokens do today.
`RULES.md` names CoinDesk among the outside services. Once you confirm, the PR will propose that line's edit to you and not make it.
Model: opus-5-5
Plan, now that option (a) is approved: one PR to next that replaces CoinDesk with the Chainlink price feeds, read through the user's RPC endpoint.
Feeds. Each bundled token that has a Chainlink USD feed on mainnet gets the feed's address and update interval next to it in the bundled list (src/shared/tokenList.js). ETH/USD is a constant, and WETH uses it too. Each pairing is checked against Chainlink's published list, and on chain by reading the feed's own description. A test checks that every feed sits on a bundled token by contract address.
Reading. On mainnet only, while the popup is open, refreshPrices() in src/shared/prices.js reads latestRoundData() of ETH/USD and of the feeds of the tokens the user holds or tracks. It does this in one batched request, at most every 5 minutes.
Freshness. A reading older than its feed's interval plus 30 minutes counts as no price, and so does an answer that is not positive.
Pairing by address.getPrice() takes the token's contract address, not its symbol, so a look-alike token never gets a real token's price. Every caller passes the address.
No feed, no price. A token with no feed shows no USD value, and an address total that includes one reads "plus unpriced tokens", as it does today.
CoinDesk removed.getTopTokenPrices() and COINDESK_API go. README's External Services lists only the RPC endpoint as contacted by default.
Tests. Freshness, the single batch, no prices on a testnet, and a look-alike token getting no price.
RULES.md. The PR body proposes the edit to the CoinDesk line and does not make it.
Model: opus-5-5
Plan, now that option (a) is approved: one PR to `next` that replaces CoinDesk with the Chainlink price feeds, read through the user's RPC endpoint.
- **Feeds.** Each bundled token that has a Chainlink USD feed on mainnet gets the feed's address and update interval next to it in the bundled list (`src/shared/tokenList.js`). ETH/USD is a constant, and WETH uses it too. Each pairing is checked against Chainlink's published list, and on chain by reading the feed's own description. A test checks that every feed sits on a bundled token by contract address.
- **Reading.** On mainnet only, while the popup is open, `refreshPrices()` in `src/shared/prices.js` reads `latestRoundData()` of ETH/USD and of the feeds of the tokens the user holds or tracks. It does this in one batched request, at most every 5 minutes.
- **Freshness.** A reading older than its feed's interval plus 30 minutes counts as no price, and so does an answer that is not positive.
- **Pairing by address.** `getPrice()` takes the token's contract address, not its symbol, so a look-alike token never gets a real token's price. Every caller passes the address.
- **No feed, no price.** A token with no feed shows no USD value, and an address total that includes one reads "plus unpriced tokens", as it does today.
- **CoinDesk removed.** `getTopTokenPrices()` and `COINDESK_API` go. README's External Services lists only the RPC endpoint as contacted by default.
- **Tests.** Freshness, the single batch, no prices on a testnet, and a look-alike token getting no price.
- **`RULES.md`.** The PR body proposes the edit to the CoinDesk line and does not make it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where
getTopTokenPrices()insrc/shared/tokenList.js(lines 3648-3671), called byrefreshPrices()insrc/shared/prices.js. It requestshttps://data-api.coindesk.com/index/cc/v1/latest/tickwith no key.What happens
On 2026-10-14, every request the wallet makes there is answered HTTP 401 with "API key required". Reproduced from inside the browser container and from the host, for the wallet's own 26-instrument request and for
ETH-USDalone. The code readsjson.Data, gets an empty object, and stores no prices without saying so.On
next(8e52528), release build, Chrome, with Ethereum Mainnet active: Home's ETH/USD price line stays blank after the refresh.What should happen
README, opening section and External Services: the wallet uses "a public CoinDesk API (no API key) for realtime price information", and Supported Functionality lists "ETH/USD and token/USD price display". Either prices load again from a source that needs no key, or the README says how prices are now obtained or that they are gone. Which of those is the owner's call.
Severity: major
Definition of done
Model: opus-5-5
Confirmed today: every CoinDesk price endpoint, including the older CryptoCompare ones, answers 401 "API key required", so mainnet shows no USD values at all. Replacing it changes which outside service the wallet talks to, which
RULES.mdfixes by name, so this one is yours.Ask: where should the wallet get USD prices now?
README.md.Model: opus-5-5
option a provisionally approved, tell me more about the chainlink on chain price feed please.
Chainlink price feeds, in plain terms:
eth_call. Nothing is signed, no transaction is sent, no key is needed.0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, also used for WETH) and the USD feed of each bundled token that has one. Of the 512 bundled tokens, about 55 do, including USDT, USDC, DAI, USDS, USDe, PYUSD, LINK, UNI, AAVE, BNB, PAXG, CRV, ARB, ENS and COMP. Each read returns the price and the time it was last written. Each feed is paired with its token by contract address, checked by hand when added, so a look-alike token never borrows a real token's price (today prices are matched by symbol).RULES.mdnames CoinDesk among the outside services. Once you confirm, the PR will propose that line's edit to you and not make it.Model: opus-5-5
clawbot referenced this issue2026-10-21 12:15:24 +02:00
a approved
Plan, now that option (a) is approved: one PR to
nextthat replaces CoinDesk with the Chainlink price feeds, read through the user's RPC endpoint.src/shared/tokenList.js). ETH/USD is a constant, and WETH uses it too. Each pairing is checked against Chainlink's published list, and on chain by reading the feed's own description. A test checks that every feed sits on a bundled token by contract address.refreshPrices()insrc/shared/prices.jsreadslatestRoundData()of ETH/USD and of the feeds of the tokens the user holds or tracks. It does this in one batched request, at most every 5 minutes.getPrice()takes the token's contract address, not its symbol, so a look-alike token never gets a real token's price. Every caller passes the address.getTopTokenPrices()andCOINDESK_APIgo. README's External Services lists only the RPC endpoint as contacted by default.RULES.md. The PR body proposes the edit to the CoinDesk line and does not make it.Model: opus-5-5