sneak 67a036fc6f fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705) ...

The balance list gave a tracked token a zero row while "Show tracked
tokens with zero balance" was on, even when the spoof rule refuses the
token. balanceLinesForAddress() now asks isSpoofedSymbol() before it adds
that row.

AddToken and SettingsAddToken now refuse such a token after the contract
lookup, with a flash message that says why. The bundled-list buttons on
SettingsAddToken need no check, because the rule never refuses a bundled
token.

The README and docs/README.md now say that the balance list drops such a
token whatever the settings.

Model: opus-5-5

2026-11-02 04:03:46 +00:00

..

e2e

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

support

fix: AutistMask does not work in Firefox private windows (closes #646)

2026-10-26 23:51:22 +01:00

accountsChangedOpaqueOrigin.test.js

fix: a page whose origin has no host is never told an address by accountsChanged (closes #564)

2026-10-19 00:59:39 +02:00

addressKey.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

addressScanCancelled.test.js

fix: a popup that opened on Welcome keeps refreshing once the first wallet is added (closes #530)

2026-10-19 03:19:53 +02:00

addressValue.test.js

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

addressWarnings.test.js

fix: the recipient warning says what it checked and skips addresses that have received ETH (closes #528)

2026-10-19 02:34:13 +02:00

addTokenLateAnswer.test.js

fix: a token lookup that answers after the user left AddToken no longer changes the screen (closes #603)

2026-10-27 23:16:10 +01:00

addWalletSeparatePassword.test.js

fix: say a second wallet's password is separate when one is chosen (closes #374)

2026-09-21 21:11:09 +02:00

alarms.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

allowWeakPasswords.test.js

feat: an "Allow weak passwords" setting lets a new wallet have a short password (closes #674)

2026-10-26 22:35:02 +01:00

applyEnrichment.test.js

chore: bring the token-list enrichment tooling into script/lib (closes #495)

2026-10-14 20:10:30 +02:00

approvalAmount.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

approvalDisplayFloor.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

approvalNonce.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

approvalOrigin.test.js

fix: only the user switches the wallet's network (closes #408)

2026-10-08 07:30:16 +02:00

approvalTokenNetwork.test.js

fix: TxApproval links addresses to the explorer of the transaction's network (closes #631)

2026-10-20 07:01:41 +02:00

approvalTx.test.js

fix: estimate a request even when the site sends its gas limit (closes #554)

2026-10-14 19:46:01 +02:00

approvalUseBlockscoutOff.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

approvalValueUsd.test.js

fix: TxApproval prices a site's ETH send from its exact amount on its own network (closes #614)

2026-10-20 09:21:11 +02:00

approvalVerify.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

approvalWindow.test.js

fix: closing a transaction or signature approval window leaves the request pending (closes #673)

2026-10-27 00:56:36 +01:00

backgroundApproval.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

backgroundStateIsolation.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

backgroundStateLintRule.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backNavigation.test.js

fix: TransactionDetail reads a transaction from the Blockscout of the network it was sent on (closes #623)

2026-10-20 03:10:30 +02:00

balanceLineEscaping.test.js

chore: re-vendor canonical files from prompts at dd4027b (closes #472)

2026-10-06 15:59:21 +02:00

balanceRefreshCancelled.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

balanceRefreshNetworkSwitch.test.js

fix: a network switch in Settings leaves no balance from the previous network stored (closes #653)

2026-10-27 10:14:06 +01:00

blockscoutEtherscanSettings.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

buildForbiddenInputs.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

buildWatch.test.js

fix: make dev rebuilds dist/ on source changes (closes #332)

2026-10-06 03:43:18 +02:00

chainSwitchGate.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

coldWorkerChainId.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

coldWorkerChainSwitch.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

coldWorkerSendTransaction.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

confirmTxAmount.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

confirmTxFeeBound.test.js

fix: a send the confirmation screen refuses moves nothing on it (closes #583)

2026-10-19 14:45:01 +02:00

confirmTxLateResult.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

confirmTxNetworkSwitch.test.js

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

connectedSitesWorkerRestart.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

constants.test.js

build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

2026-08-10 16:15:22 +02:00

contractCreation.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

debugBanner.test.js

chore: keep the internal view id out of the release banner (closes #375)

2026-09-22 00:45:06 +02:00

debugFetch.test.js

harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

2026-10-04 21:09:04 +02:00

deleteAddress.test.js

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

deleteWalletLostPassword.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

dustThreshold.test.js

fix: the Chrome layout tests and popup comments use the popup's real 396x600 size (closes #556)

2026-10-20 16:02:09 +02:00

ensOffchainLookup.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

etherscanLabels.test.js

feat: expand confirm-tx warnings — closes #114 (#118)

2026-03-01 19:34:54 +01:00

ethSign.test.js

fix: eth_sign's warning and the README say what it signs (closes #409)

2026-10-14 15:41:22 +02:00

exportPrivkey.test.js

fix: show every password error in its own fixed-height line (closes #493)

2026-10-07 10:59:16 +02:00

extensionId.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

fabricatedDecimals.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

firstWalletActiveAddress.test.js

fix: the first wallet's first address is active as soon as it is added (closes #512)

2026-10-16 07:15:29 +02:00

firstWalletRefresh.test.js

test: no timer a popup test started fires after cleanupPopup() (closes #578)

2026-10-19 04:06:24 +02:00

flashLine.test.js

fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

2026-10-19 11:50:39 +02:00

holders.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

htmlEscape.test.js

chore: escape every value the views write as markup, and cut symbols on code points (closes #329)

2026-10-05 10:43:06 +02:00

icons.test.js

chore: draw the toolbar icons in-tree with make icons (closes #378)

2026-10-07 06:43:08 +02:00

inpageErrors.test.js

fix: refuse an unsupported method with EIP-1193 code 4200 (closes #279)

2026-10-04 09:24:41 +02:00

inpageProviderUuid.test.js

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-10-03 16:26:39 +02:00

manifest.test.js

fix: AutistMask does not work in Firefox private windows (closes #646)

2026-10-26 23:51:22 +01:00

nativeCurrency.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

networkEndpoints.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

packaging.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

passwordErrorLines.test.js

fix: show every password error in its own fixed-height line (closes #493)

2026-10-07 10:59:16 +02:00

passwordMessages.test.js

fix: one wording for an empty password field on every screen (closes #265)

2026-08-17 08:59:59 +02:00

persistedEntryFloors.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

persistedFieldContract.test.js

feat: an "Allow weak passwords" setting lets a new wallet have a short password (closes #674)

2026-10-26 22:35:02 +01:00

personalSignDisplay.test.js

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

2026-10-04 22:09:07 +02:00

phishingDomains.test.js

fix: a listed site ending in a dot gets the phishing warning (closes #534)

2026-10-14 10:48:41 +02:00

popupBoot.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

popupElementIds.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

popupFollowsNetworkSwitch.test.js

fix: Settings refuses an endpoint URL whose network changed before it was stored (closes #663)

2026-10-27 07:27:15 +01:00

priceFeeds.test.js

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

proxyMethods.test.js

chore: drop eth_chainId and net_version from PROXY_METHODS (closes #326)

2026-10-06 00:48:45 +02:00

refreshDuringRefresh.test.js

fix: a refresh asked for while another runs is no longer dropped (closes #581)

2026-10-27 20:14:09 +01:00

resolveTokenSymbol.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

rpcErrorCodes.test.js

fix: failed requests reach the page with an error code and the node's data (closes #533)

2026-10-18 22:12:10 +02:00

rpcErrorLog.test.js

fix: the recipient warning says what it checked and skips addresses that have received ETH (closes #528)

2026-10-19 02:34:13 +02:00

rpcOrigin.test.js

fix: a request whose origin has no host is refused, not treated as a site (closes #527)

2026-10-16 04:44:49 +02:00

sendAmountRule.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

sendDisplayFloor.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

sendMax.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

sendTokenSelect.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

settingsEndpointCheck.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

settingsEndpointSave.test.js

fix: Settings never shows "Saved." for a URL the input no longer shows (closes #695)

2026-10-27 14:34:50 +01:00

settingsUtcTimestamps.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

showPhrase.test.js

fix: Back from Settings never lands on Settings itself (closes #481)

2026-10-07 05:26:06 +02:00

spoofedTrackedToken.test.js

fix: the balance list and the add-token screens apply the spoof rule to tracked tokens (closes #705)

2026-11-02 04:03:46 +00:00

state.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateMerge.test.js

fix: a popup save no longer undoes a network switch the background saved during it (closes #641)

2026-10-20 20:13:19 +02:00

stateRecovery.test.js

fix: the StateRecovery erase warning names every kind of wallet backup (closes #593)

2026-10-27 03:46:17 +01:00

stateSchema.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateUnusableRpc.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateWriteLock.test.js

fix: AutistMask does not work in Firefox private windows (closes #646)

2026-10-26 23:51:22 +01:00

swapStatusAmount.test.js

fix: a V4 swap action not in the deployed shape is shown as not decoded (closes #358)

2026-10-16 03:00:32 +02:00

symbolSpoof.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

timestampDisplay.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

tokenLookupCancelled.test.js

fix: a popup reload no longer logs the requests it cancels on most screens (closes #475)

2026-10-06 22:09:08 +02:00

tokenLookupTruncation.test.js

fix: a token symbol read off a contract is never stored cut mid-emoji (closes #458)

2026-10-06 23:59:21 +02:00

tokenTransferDetail.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

trackedTokenBalances.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

trackedTokensPerNetwork.test.js

fix: a network switch in Settings keeps another page's token on the network it was added on (closes #692)

2026-10-27 18:05:01 +01:00

transactionDetailLateAnswer.test.js

fix: TransactionDetail drops a Blockscout answer for another transaction (closes #675)

2026-10-27 15:30:40 +01:00

transactionListCancelled.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

transactions.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

transferAmount.test.js

fix: Send refuses every amount the confirmation screen would refuse (closes #532)

2026-10-18 22:46:07 +02:00

txStatus.test.js

fix: transaction screens name a token from the tokens of the transaction's network (closes #629)

2026-10-20 04:16:04 +02:00

txValidation.test.js

fix: Send refuses every amount the confirmation screen would refuse (closes #532)

2026-10-18 22:46:07 +02:00

typedDataPermit.test.js

fix: typed data with a missing field or a bool that is not true or false is refused (closes #552)

2026-10-16 03:33:39 +02:00

uniswap.test.js

fix: a zero-minimum balance check never sets the output side (closes #649)

2026-10-27 08:57:59 +01:00

uniswapRecipient.test.js

fix: a zero-minimum balance check never sets the output side (closes #649)

2026-10-27 08:57:59 +01:00

uniswapRouterAddress.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

uniswapTokenOut.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

uniswapUndeterminedTokenIn.test.js

fix: a balance check of another address sets no swap minimum (closes #600)

2026-10-19 16:27:41 +02:00

uniswapUndeterminedTokenOut.test.js

fix: the approval screen names the address a swap's output is paid to (closes #594)

2026-10-19 11:33:54 +02:00

uniswapUnknownDecimals.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

unknownScaleDisplay.test.js

fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

2026-10-27 04:23:17 +01:00

unknownScaleSend.test.js

fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

2026-10-26 21:38:29 +01:00

vault.test.js

chore: re-vendor canonical files from prompts at dd4027b (closes #472)

2026-10-06 15:59:21 +02:00

vaultBackend.test.js

fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00

version.test.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00

wallet.test.js

fix: sign and export with each address's own derivation index (closes #510)

2026-10-14 18:22:12 +02:00

walletDefects.test.js

test: the test suite exits on its own, without --forceExit (closes #585)

2026-10-28 01:09:12 +01:00

walletDelete.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00