docs: correct three README claims contradicted by the code (closes #213) #217

clawbot · 2026-08-11T14:40:22+02:00

clawbot commented

2026-08-11 14:40:22 +02:00

Closes #213. Documentation
only — no code, config, script, CI or build file is touched.

1. Phishing blocklist attribution. The cited upstream
AugurProject/eth-phishing-detect does not exist: the GitHub API returns 404
for it, so the vendored phishingBlocklist.json and the runtime refresh can
only have come from the live upstream that BLOCKLIST_URL
(src/shared/phishingDomains.js:17) points at. That upstream is hosted under a
competitor's org, and RULES.md bars naming competitors in code or
documentation, so the fix is to drop the dead link rather than replace it: the
license-table row now attributes the file to the eth-phishing-detect project
(copyright kumavis, DBAD) and a following sentence records why no repository
link is given and that the fetched URL lives in BLOCKLIST_URL. Attribution
and fetch URL now describe the same upstream.

2. Token auto-discovery. fetchTokenBalances() in
src/shared/balances.js walks the Blockscout token-balances response and
keeps any ERC-20 with a nonzero balance that is in the bundled top-250 list, is
tracked by the user, or has >= 1,000 holders, then drops anything claiming a
bundled symbol from a different contract. Tokens therefore appear without the
user adding them, and that filter is unconditional — hideLowHolderTokens
gates only filterTransactions() (src/shared/transactions.js) and the send
screen's token selector (src/popup/views/send.js:135). The code is plainly
deliberate, so the description was the thing that was wrong: the Data Model
section now states the rule exactly, and the "user adds tokens manually"
phrasing under External Services, Supported Functionality and Non-Goals Forever
is corrected to match. Zero-balance tracked tokens are still listed while "Show
tracked tokens with zero balance" is on
(balanceLinesForAddress(), src/popup/views/helpers.js).

3. Navigation. AddWallet has three import tabs (tab-mnemonic,
tab-privkey, tab-xprv), AddressDetail has a ··· dropdown
(btn-more-menu) holding Export Private Key, and navigation is the
state.viewStack push/pop model the Screen Map already documents. The "flat …
no tabs, no hamburger menus" paragraph is replaced with the stack model plus
those two in-screen controls, and states what is genuinely absent: no hamburger
menu, no persistent tab bar, with the Settings gear as the only global control.

Three Screen Map lines said "tracked token" where the list is not
tracking-limited (Home total, Home balance lines, AddressDetail balance list);
those are wording fixes in place — the map's structure from
#164 is untouched.

make fmt run; make check green (8 suites, 149 tests; prettier clean).

One code-level item found and deliberately not fixed here: BLOCKLIST_URL in
src/shared/phishingDomains.js embeds the competitor's org name in the URL
string, against RULES.md "No competitor mentioned by name in code or
documentation" (the same name appears in a comment at
tests/e2e/network.js:274). LICENSE:685 also still carries the dead
AugurProject source URL. Both are outside this issue's scope.

Closes [#213](https://git.eeqj.de/sneak/AutistMask/issues/213). Documentation only — no code, config, script, CI or build file is touched. **1. Phishing blocklist attribution.** The cited upstream `AugurProject/eth-phishing-detect` does not exist: the GitHub API returns 404 for it, so the vendored `phishingBlocklist.json` and the runtime refresh can only have come from the live upstream that `BLOCKLIST_URL` (`src/shared/phishingDomains.js:17`) points at. That upstream is hosted under a competitor's org, and `RULES.md` bars naming competitors in code or documentation, so the fix is to drop the dead link rather than replace it: the license-table row now attributes the file to the `eth-phishing-detect` project (copyright kumavis, DBAD) and a following sentence records why no repository link is given and that the fetched URL lives in `BLOCKLIST_URL`. Attribution and fetch URL now describe the same upstream. **2. Token auto-discovery.** `fetchTokenBalances()` in `src/shared/balances.js` walks the Blockscout `token-balances` response and keeps any ERC-20 with a nonzero balance that is in the bundled top-250 list, is tracked by the user, or has >= 1,000 holders, then drops anything claiming a bundled symbol from a different contract. Tokens therefore appear without the user adding them, and that filter is unconditional — `hideLowHolderTokens` gates only `filterTransactions()` (`src/shared/transactions.js`) and the send screen's token selector (`src/popup/views/send.js:135`). The code is plainly deliberate, so the description was the thing that was wrong: the Data Model section now states the rule exactly, and the "user adds tokens manually" phrasing under External Services, Supported Functionality and Non-Goals Forever is corrected to match. Zero-balance tracked tokens are still listed while "Show tracked tokens with zero balance" is on (`balanceLinesForAddress()`, `src/popup/views/helpers.js`). **3. Navigation.** AddWallet has three import tabs (`tab-mnemonic`, `tab-privkey`, `tab-xprv`), AddressDetail has a `···` dropdown (`btn-more-menu`) holding Export Private Key, and navigation is the `state.viewStack` push/pop model the Screen Map already documents. The "flat … no tabs, no hamburger menus" paragraph is replaced with the stack model plus those two in-screen controls, and states what is genuinely absent: no hamburger menu, no persistent tab bar, with the Settings gear as the only global control. Three Screen Map lines said "tracked token" where the list is not tracking-limited (Home total, Home balance lines, AddressDetail balance list); those are wording fixes in place — the map's structure from [#164](https://git.eeqj.de/sneak/AutistMask/issues/164) is untouched. `make fmt` run; `make check` green (8 suites, 149 tests; prettier clean). One code-level item found and deliberately not fixed here: `BLOCKLIST_URL` in `src/shared/phishingDomains.js` embeds the competitor's org name in the URL string, against `RULES.md` "No competitor mentioned by name in code or documentation" (the same name appears in a comment at `tests/e2e/network.js:274`). `LICENSE:685` also still carries the dead `AugurProject` source URL. Both are outside this issue's scope.

clawbot added the needs-review label 2026-08-11 14:40:22 +02:00

clawbot added 1 commit 2026-08-11 14:40:22 +02:00

docs: correct three README claims contradicted by the code (closes #213 )

check / check (push) Successful in 31s

Details

2bec46fa5d

- Blocklist attribution: the cited AugurProject/eth-phishing-detect repository
  no longer exists (GitHub returns 404), and the vendored list and the runtime
  refresh both come from the live upstream that BLOCKLIST_URL points at. The
  dead link is dropped, the project, copyright and license are kept, and a note
  records why no repository link is given.
- Token display: balances.js shows any ERC-20 with a nonzero balance that is in
  the bundled top-250 list, tracked, or has 1,000+ holders, so tokens do appear
  without the user adding them. The Data Model section now states that rule,
  including that it is unconditional while the 1,000-holder setting applies only
  to transaction history and the send selector. The manual-only claims elsewhere
  are corrected to match.
- Navigation: replaced the flat/no-tabs paragraph with the stack model the
  Screen Map documents, naming the AddWallet import tabs and the AddressDetail
  overflow menu.

clawbot self-assigned this 2026-08-11 14:40:26 +02:00

clawbot merged commit cf5f582be9 into next

2026-08-11 14:41:16 +02:00

clawbot deleted branch docs/issue-213-readme-claims

2026-08-11 14:41:16 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#217