sneak 786613ce2d harden: warn for token-permission typed data and show the primary type ethers signs (closes #400) ...

The typed-data screen listed a Permit or Permit2 signature as plain
key/value lines, exactly like a sign-in message. For EIP-2612's Permit and
Permit2's signature types it now shows a red warning naming the spender and
each token and amount, Unlimited for the field's largest value.

The screen printed the page's primaryType, but ethers signs the type it
derives from types. It now shows the derived type, and typed data whose
stated type is missing or differs is refused: error line, Sign disabled,
and checked again where signing starts.

Deviation: the warning names no deadline or expiry; see the issue.
Judgement call: DAI's older permit and Permit2's batch and witness transfer
types are recognised too.

Model: opus-5-5

2026-10-03 12:50:26 +00:00

..

e2e

fix: give every address a row of its own, so none wraps or is shortened (closes #380) (#381)

2026-08-30 05:25:00 +02:00

support

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

addressValue.test.js

fix: an address holding only unpriced tokens is no longer totalled at $0.00 (closes #261)

2026-08-17 08:38:10 +02:00

addWalletSeparatePassword.test.js

fix: say a second wallet's password is separate when one is chosen (closes #374)

2026-09-21 21:11:09 +02:00

alarms.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

approvalAmount.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

approvalDisplayFloor.test.js

fix: never render a nonzero approval amount as zero (closes #322)

2026-08-23 15:43:04 +02:00

approvalTx.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

approvalVerify.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

backgroundApproval.test.js

fix: honour a transaction response only for a transaction approval (closes #262)

2026-09-21 09:54:40 +02:00

backgroundStateIsolation.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backgroundStateLintRule.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backNavigation.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

balanceLineEscaping.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

buildForbiddenInputs.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

chainSwitchGate.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

coldWorkerChainId.test.js

fix: answer eth_chainId and net_version from loaded state (closes #317)

2026-08-20 13:11:48 +02:00

coldWorkerChainSwitch.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

coldWorkerSendTransaction.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

confirmTxFeeBound.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

constants.test.js

build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

2026-08-10 16:15:22 +02:00

debugBanner.test.js

chore: keep the internal view id out of the release banner (closes #375)

2026-09-22 00:45:06 +02:00

deleteAddress.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

deleteWalletLostPassword.test.js

fix: re-enable Confirm Delete after a delete, so a second one needs no reopen (closes #335)

2026-09-22 01:28:02 +02:00

dustThreshold.test.js

fix: explain a rejected dust threshold instead of silently snapping back (closes #233)

2026-08-12 11:29:09 +02:00

etherscanLabels.test.js

feat: expand confirm-tx warnings — closes #114 (#118)

2026-03-01 19:34:54 +01:00

exportPrivkey.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

extensionId.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

fabricatedDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

holders.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

htmlEscape.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

inpageErrors.test.js

fix: carry EIP-1193 error codes through to the page (closes #274)

2026-08-12 13:47:33 +02:00

manifest.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

networkEndpoints.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

packaging.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

passwordMessages.test.js

fix: one wording for an empty password field on every screen (closes #265)

2026-08-17 08:59:59 +02:00

persistedEntryFloors.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

persistedFieldContract.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

phishingDomains.test.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

popupElementIds.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

resolveTokenSymbol.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

sendTokenSelect.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

settingsUtcTimestamps.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

showPhrase.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

state.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateMerge.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

stateRecovery.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

stateSchema.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateUnusableRpc.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

symbolSpoof.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transactions.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transferAmount.test.js

fix: sign the ERC-20 amount the confirmation screen displayed (closes #305)

2026-08-20 12:31:28 +02:00

txStatus.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

txValidation.test.js

fix: count the network fee in the confirm-screen balance check (closes #154)

2026-08-11 15:41:37 +02:00

typedDataPermit.test.js

harden: warn for token-permission typed data and show the primary type ethers signs (closes #400)

2026-10-03 12:50:26 +00:00

uniswap.test.js

harden: gate swap amounts on presence, not truthiness, so a figure always matches its token (closes #359)

2026-08-23 20:45:58 +02:00

uniswapTokenOut.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

uniswapUndeterminedTokenIn.test.js

harden: state an undetermined swap input token as undetermined, not as ETH (closes #357)

2026-08-23 20:23:05 +02:00

uniswapUndeterminedTokenOut.test.js

harden: state an undetermined V4 output token as undetermined, not as ETH (closes #353)

2026-08-23 18:13:20 +02:00

uniswapUnknownDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

unknownScaleDisplay.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

unknownScaleSend.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

vault.test.js

test: known-answer coverage for HD derivation and the vault (closes #159)

2026-08-11 15:06:35 +02:00

vaultBackend.test.js

fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00

version.test.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00

wallet.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

walletDefects.test.js

fix: explain a stored non-master xprv wallet instead of throwing at signing time (closes #234)

2026-08-12 10:41:49 +02:00

walletDelete.test.js

feat: remove an address from an HD wallet, behind a confirmation (closes #162)

2026-08-12 11:16:29 +02:00