Two pages switching networks can lose tracked tokens #701

Open
opened 2026-10-27 18:05:14 +01:00 by clawbot · 1 comment
Collaborator

Found by the second review of #700, outside its scope. Both cases are on next without that PR.

Where

Network switches with two popup pages open: onChainSwitch() in src/shared/chainSwitch.js, followStoredSettings() in src/popup/index.js, and the tracked-token save in saveState() (src/shared/state.js).

What happens

  1. This page's switch to Sepolia is stored. Before the other page takes that switch, it adds or removes a token. Its save then writes its Ethereum Mainnet list as Sepolia's list, and Sepolia's own tracked tokens are lost.
  2. The other page tracks a token and then switches to Sepolia. If this page switches before it has taken that switch, the token is lost from Ethereum Mainnet's list.

Read from the code; not run in a browser.

What should happen

No tracked token is lost, and none is filed under a network it was not added on, whatever order two pages' switches and token changes land in.

Severity: minor

Definition of done

  • Both orders above keep every tracked token under the network it was added on.
  • A test for each, failing on next.

Model: opus-5-5

Found by the second review of https://git.eeqj.de/sneak/AutistMask/pulls/700, outside its scope. Both cases are on `next` without that PR. ## Where Network switches with two popup pages open: `onChainSwitch()` in `src/shared/chainSwitch.js`, `followStoredSettings()` in `src/popup/index.js`, and the tracked-token save in `saveState()` (`src/shared/state.js`). ## What happens 1. This page's switch to Sepolia is stored. Before the other page takes that switch, it adds or removes a token. Its save then writes its Ethereum Mainnet list as Sepolia's list, and Sepolia's own tracked tokens are lost. 2. The other page tracks a token and then switches to Sepolia. If this page switches before it has taken that switch, the token is lost from Ethereum Mainnet's list. Read from the code; not run in a browser. ## What should happen No tracked token is lost, and none is filed under a network it was not added on, whatever order two pages' switches and token changes land in. Severity: minor ## Definition of done - [ ] Both orders above keep every tracked token under the network it was added on. - [ ] A test for each, failing on `next`. Model: opus-5-5
clawbot self-assigned this 2026-10-27 18:05:14 +01:00
Author
Collaborator

Plan: one PR to next. The tracked-token save in saveState() (src/shared/state.js) already reads the stored record under the lock. It refuses to write this page's active tracked tokens over the stored ones when the stored record names another network than this page, so a page that has not yet taken a switch cannot write its old network's list as the new network's. In onChainSwitch() (src/shared/chainSwitch.js), a switch that finds the stored record already on another network first takes that switch, as followStoredSettings() does, before switching again, so a token the other page tracked before its own switch is kept. Jest tests for both orders in the issue, each failing on next.

Model: opus-5-5

Plan: one PR to `next`. The tracked-token save in `saveState()` (`src/shared/state.js`) already reads the stored record under the lock. It refuses to write this page's active tracked tokens over the stored ones when the stored record names another network than this page, so a page that has not yet taken a switch cannot write its old network's list as the new network's. In `onChainSwitch()` (`src/shared/chainSwitch.js`), a switch that finds the stored record already on another network first takes that switch, as `followStoredSettings()` does, before switching again, so a token the other page tracked before its own switch is kept. Jest tests for both orders in the issue, each failing on `next`. Model: opus-5-5
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#701