Closes #213. Documentation
only — no code, config, script, CI or build file is touched.
1. Phishing blocklist attribution. The cited upstream AugurProject/eth-phishing-detect does not exist: the GitHub API returns 404
for it, so the vendored phishingBlocklist.json and the runtime refresh can
only have come from the live upstream that BLOCKLIST_URL
(src/shared/phishingDomains.js:17) points at. That upstream is hosted under a
competitor's org, and RULES.md bars naming competitors in code or
documentation, so the fix is to drop the dead link rather than replace it: the
license-table row now attributes the file to the eth-phishing-detect project
(copyright kumavis, DBAD) and a following sentence records why no repository
link is given and that the fetched URL lives in BLOCKLIST_URL. Attribution
and fetch URL now describe the same upstream.
2. Token auto-discovery.fetchTokenBalances() in src/shared/balances.js walks the Blockscout token-balances response and
keeps any ERC-20 with a nonzero balance that is in the bundled top-250 list, is
tracked by the user, or has >= 1,000 holders, then drops anything claiming a
bundled symbol from a different contract. Tokens therefore appear without the
user adding them, and that filter is unconditional — hideLowHolderTokens
gates only filterTransactions() (src/shared/transactions.js) and the send
screen's token selector (src/popup/views/send.js:135). The code is plainly
deliberate, so the description was the thing that was wrong: the Data Model
section now states the rule exactly, and the "user adds tokens manually"
phrasing under External Services, Supported Functionality and Non-Goals Forever
is corrected to match. Zero-balance tracked tokens are still listed while "Show
tracked tokens with zero balance" is on
(balanceLinesForAddress(), src/popup/views/helpers.js).
3. Navigation. AddWallet has three import tabs (tab-mnemonic, tab-privkey, tab-xprv), AddressDetail has a ··· dropdown
(btn-more-menu) holding Export Private Key, and navigation is the state.viewStack push/pop model the Screen Map already documents. The "flat …
no tabs, no hamburger menus" paragraph is replaced with the stack model plus
those two in-screen controls, and states what is genuinely absent: no hamburger
menu, no persistent tab bar, with the Settings gear as the only global control.
Three Screen Map lines said "tracked token" where the list is not
tracking-limited (Home total, Home balance lines, AddressDetail balance list);
those are wording fixes in place — the map's structure from #164 is untouched.
make fmt run; make check green (8 suites, 149 tests; prettier clean).
One code-level item found and deliberately not fixed here: BLOCKLIST_URL in src/shared/phishingDomains.js embeds the competitor's org name in the URL
string, against RULES.md "No competitor mentioned by name in code or
documentation" (the same name appears in a comment at tests/e2e/network.js:274). LICENSE:685 also still carries the dead AugurProject source URL. Both are outside this issue's scope.
Closes [#213](https://git.eeqj.de/sneak/AutistMask/issues/213). Documentation
only — no code, config, script, CI or build file is touched.
**1. Phishing blocklist attribution.** The cited upstream
`AugurProject/eth-phishing-detect` does not exist: the GitHub API returns 404
for it, so the vendored `phishingBlocklist.json` and the runtime refresh can
only have come from the live upstream that `BLOCKLIST_URL`
(`src/shared/phishingDomains.js:17`) points at. That upstream is hosted under a
competitor's org, and `RULES.md` bars naming competitors in code or
documentation, so the fix is to drop the dead link rather than replace it: the
license-table row now attributes the file to the `eth-phishing-detect` project
(copyright kumavis, DBAD) and a following sentence records why no repository
link is given and that the fetched URL lives in `BLOCKLIST_URL`. Attribution
and fetch URL now describe the same upstream.
**2. Token auto-discovery.** `fetchTokenBalances()` in
`src/shared/balances.js` walks the Blockscout `token-balances` response and
keeps any ERC-20 with a nonzero balance that is in the bundled top-250 list, is
tracked by the user, or has >= 1,000 holders, then drops anything claiming a
bundled symbol from a different contract. Tokens therefore appear without the
user adding them, and that filter is unconditional — `hideLowHolderTokens`
gates only `filterTransactions()` (`src/shared/transactions.js`) and the send
screen's token selector (`src/popup/views/send.js:135`). The code is plainly
deliberate, so the description was the thing that was wrong: the Data Model
section now states the rule exactly, and the "user adds tokens manually"
phrasing under External Services, Supported Functionality and Non-Goals Forever
is corrected to match. Zero-balance tracked tokens are still listed while "Show
tracked tokens with zero balance" is on
(`balanceLinesForAddress()`, `src/popup/views/helpers.js`).
**3. Navigation.** AddWallet has three import tabs (`tab-mnemonic`,
`tab-privkey`, `tab-xprv`), AddressDetail has a `···` dropdown
(`btn-more-menu`) holding Export Private Key, and navigation is the
`state.viewStack` push/pop model the Screen Map already documents. The "flat …
no tabs, no hamburger menus" paragraph is replaced with the stack model plus
those two in-screen controls, and states what is genuinely absent: no hamburger
menu, no persistent tab bar, with the Settings gear as the only global control.
Three Screen Map lines said "tracked token" where the list is not
tracking-limited (Home total, Home balance lines, AddressDetail balance list);
those are wording fixes in place — the map's structure from
[#164](https://git.eeqj.de/sneak/AutistMask/issues/164) is untouched.
`make fmt` run; `make check` green (8 suites, 149 tests; prettier clean).
One code-level item found and deliberately not fixed here: `BLOCKLIST_URL` in
`src/shared/phishingDomains.js` embeds the competitor's org name in the URL
string, against `RULES.md` "No competitor mentioned by name in code or
documentation" (the same name appears in a comment at
`tests/e2e/network.js:274`). `LICENSE:685` also still carries the dead
`AugurProject` source URL. Both are outside this issue's scope.
- Blocklist attribution: the cited AugurProject/eth-phishing-detect repository
no longer exists (GitHub returns 404), and the vendored list and the runtime
refresh both come from the live upstream that BLOCKLIST_URL points at. The
dead link is dropped, the project, copyright and license are kept, and a note
records why no repository link is given.
- Token display: balances.js shows any ERC-20 with a nonzero balance that is in
the bundled top-250 list, tracked, or has 1,000+ holders, so tokens do appear
without the user adding them. The Data Model section now states that rule,
including that it is unconditional while the 1,000-holder setting applies only
to transaction history and the send selector. The manual-only claims elsewhere
are corrected to match.
- Navigation: replaced the flat/no-tabs paragraph with the stack model the
Screen Map documents, naming the AddWallet import tabs and the AddressDetail
overflow menu.
clawbot
self-assigned this 2026-08-11 14:40:26 +02:00
clawbot
merged commit cf5f582be9 into next2026-08-11 14:41:16 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #213. Documentation
only — no code, config, script, CI or build file is touched.
1. Phishing blocklist attribution. The cited upstream
AugurProject/eth-phishing-detectdoes not exist: the GitHub API returns 404for it, so the vendored
phishingBlocklist.jsonand the runtime refresh canonly have come from the live upstream that
BLOCKLIST_URL(
src/shared/phishingDomains.js:17) points at. That upstream is hosted under acompetitor's org, and
RULES.mdbars naming competitors in code ordocumentation, so the fix is to drop the dead link rather than replace it: the
license-table row now attributes the file to the
eth-phishing-detectproject(copyright kumavis, DBAD) and a following sentence records why no repository
link is given and that the fetched URL lives in
BLOCKLIST_URL. Attributionand fetch URL now describe the same upstream.
2. Token auto-discovery.
fetchTokenBalances()insrc/shared/balances.jswalks the Blockscouttoken-balancesresponse andkeeps any ERC-20 with a nonzero balance that is in the bundled top-250 list, is
tracked by the user, or has >= 1,000 holders, then drops anything claiming a
bundled symbol from a different contract. Tokens therefore appear without the
user adding them, and that filter is unconditional —
hideLowHolderTokensgates only
filterTransactions()(src/shared/transactions.js) and the sendscreen's token selector (
src/popup/views/send.js:135). The code is plainlydeliberate, so the description was the thing that was wrong: the Data Model
section now states the rule exactly, and the "user adds tokens manually"
phrasing under External Services, Supported Functionality and Non-Goals Forever
is corrected to match. Zero-balance tracked tokens are still listed while "Show
tracked tokens with zero balance" is on
(
balanceLinesForAddress(),src/popup/views/helpers.js).3. Navigation. AddWallet has three import tabs (
tab-mnemonic,tab-privkey,tab-xprv), AddressDetail has a···dropdown(
btn-more-menu) holding Export Private Key, and navigation is thestate.viewStackpush/pop model the Screen Map already documents. The "flat …no tabs, no hamburger menus" paragraph is replaced with the stack model plus
those two in-screen controls, and states what is genuinely absent: no hamburger
menu, no persistent tab bar, with the Settings gear as the only global control.
Three Screen Map lines said "tracked token" where the list is not
tracking-limited (Home total, Home balance lines, AddressDetail balance list);
those are wording fixes in place — the map's structure from
#164 is untouched.
make fmtrun;make checkgreen (8 suites, 149 tests; prettier clean).One code-level item found and deliberately not fixed here:
BLOCKLIST_URLinsrc/shared/phishingDomains.jsembeds the competitor's org name in the URLstring, against
RULES.md"No competitor mentioned by name in code ordocumentation" (the same name appears in a comment at
tests/e2e/network.js:274).LICENSE:685also still carries the deadAugurProjectsource URL. Both are outside this issue's scope.