Conversation
| allTokens: updatedAllTokens, | ||
| })); | ||
| } | ||
| } |
There was a problem hiding this comment.
Async enrichment overwrites concurrent state mutations
Medium Severity
#enrichTokenMetadata clones allTokens at the start, then awaits network requests via #getTokenListForChain, and finally overwrites allTokens with the stale clone. Any tokens added or ignored by concurrent calls to addToken, addTokens, or addDetectedTokens during those awaits are silently lost. The old synchronous TokenListController:stateChange subscriber didn't have this problem because there was no await between reading and writing state. The risk is amplified because addToken and addTokens fire #enrichTokenMetadata as a non-awaited side effect immediately after mutating state.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 5ebba43. Configure here.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2c0fce8. Configure here.
| TokenListStateChange, | ||
| TokensChainsCache, | ||
| } from './TokenListController'; | ||
| import type { TokenListMap, TokensChainsCache } from './TokenListController'; |
There was a problem hiding this comment.
Unused mapChainIdWithTokenListMap function and lodash imports remain
Low Severity
mapChainIdWithTokenListMap was only used by the now-removed #compareTokensChainsCache method. It's no longer called in production code (not exported from index.ts), making it dead code. The TokensChainsCache type import and the lodash imports mapValues, isObject, and get are also only needed by this dead function.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2c0fce8. Configure here.
82519d6 to
a96ca4e
Compare


Explanation
References
Checklist
Note
Medium Risk
Refactors token detection and token metadata enrichment to use new API-backed caches and a new v3 verification endpoint; mistakes could impact token auto-detection results, caching staleness, or add/ignore behavior across networks.
Overview
Removes reliance on
TokenListController’stokensChainsCachefor both token detection and token metadata updates, switching to direct token-list fetching via a newfetchAndBuildTokenListMaphelper with an internal 4-hour cache and abort support.Token detection now fetches token lists on-demand (with mainnet preference-aware cache invalidation) and updates websocket/polling-based token additions to pull metadata from a new
tokens-api-v3verifier, filtering out likely-spam tokens byoccurrences < 3and returning early when token detection or external services are disabled.TokensController metadata updates are reworked: instead of reacting to
TokenListController:stateChange, it periodically enriches stored tokens’ missingname/rwaDatafrom the fetched token list, adds API-backed fallbacks inaddToken/addTokens, and ensuresdestroy()clears intervals and aborts in-flight fetches. Tests and ESLint suppression counts are updated accordingly.Reviewed by Cursor Bugbot for commit d04fb37. Bugbot is set up for automated code reviews on this repo. Configure here.