From e10ecfc1dfd87b09f31517ea74795f28a46f8905 Mon Sep 17 00:00:00 2001
From: clawbot <clawbot@noreply.example.org>
Date: Fri, 27 Feb 2026 12:17:50 -0800
Subject: [PATCH] fix: add warning styling to contract address display

The contract address in AddressToken view was visually indistinguishable
from the wallet address, creating a risk of users sending funds to the
contract address. Changes:

- Red warning border around contract info section
- Warning icon and 'DO NOT send funds to this address' label
- Muted text color for the contract address itself
- Updated README.md with documentation on the safety treatment
---
 README.md                       | 8 ++++++++
 src/popup/index.html            | 2 +-
 src/popup/views/addressToken.js | 4 ++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 0030313..ed05ac1 100644
--- a/README.md
+++ b/README.md
@@ -335,6 +335,14 @@ transitions.
     - Full address (color dot, etherscan link, tap to copy)
     - USD total for this token
     - Single token balance line (4 decimal places)
+    - Token contract info (ERC-20 only): displayed for informational and
+      verification purposes only. Styled with a red warning border, ⚠️ icon, and
+      explicit "DO NOT send funds to this address" label to prevent users from
+      confusing the contract address with their wallet address. The contract
+      address itself is rendered in muted text. This distinction is critical
+      because funds sent to a token contract address are typically
+      irrecoverable. The Etherscan link and click-to-copy functionality are
+      preserved for verification use.
     - Send / Receive buttons
     - Token-filtered transaction list (only this token's transfers)
 - **Transitions**:
diff --git a/src/popup/index.html b/src/popup/index.html
index 889aa51..7f7fe7b 100644
--- a/src/popup/index.html
+++ b/src/popup/index.html
@@ -361,7 +361,7 @@
                 <!-- token contract details (ERC-20 only) -->
                 <div
                     id="address-token-contract-info"
-                    class="border-b border-border-light pb-2 mb-2 text-xs hidden"
+                    class="border-2 border-red-500 rounded p-2 mb-2 text-xs hidden"
                 ></div>
 
                 <!-- actions -->
diff --git a/src/popup/views/addressToken.js b/src/popup/views/addressToken.js
index 2701963..8d2fba1 100644
--- a/src/popup/views/addressToken.js
+++ b/src/popup/views/addressToken.js
@@ -143,9 +143,9 @@ function show() {
         const dot = addressDotHtml(tokenId);
         const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
         let infoHtml =
-            `<div class="font-bold mb-1">Token Contract</div>` +
+            `<div class="font-bold mb-1">\u26A0\uFE0F Token Contract \u2014 DO NOT send funds to this address</div>` +
             `<div class="flex items-center mb-1">${dot}` +
-            `<span class="break-all underline decoration-dashed cursor-pointer" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
+            `<span class="break-all underline decoration-dashed cursor-pointer text-gray-500" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
             `<a href="${tokenLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
             `</div>`;
         const details = [];
-- 
2.49.1