fix(icons): show USDT0's icon, for new and existing users

USDT0 is carried by two of the default asset lists: Soroswap, with a direct
https icon, and LOBSTR, with an ipfs.io gateway url. That gateway serves the
image to curl but returns 403 to a browser User-Agent, so an <img> can never
load it.

Two things then went wrong.

Icon lookup only broke out of its inner record loop, so the outer loop ran to
completion and the LAST matching list won — handing the browser the one url it
cannot fetch. The lists arrive in the user's configured order, which is meant to
be a priority order, so the first match should win.

When that image failed, the retry recorded "no icon" in the cache as a null, and
lookup reads a null as "already tried, don't look again". That was only ever
meant to last a session, but the cache is on disk, so the verdict outlived it:
the asset stayed iconless for good, with no way back — no icon means no <img>,
so nothing fires the error handler that would have retried. Reading the cache
now skips nulls, which turns them into ordinary cache misses and lets the fresh
lookup overwrite the stale entry. Users already stuck recover on first load.

The in-session memo is untouched: it lives in Redux, which is where the comment
in getAssetIcons always said it lived.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: piyalbasu

@shared/api/helpers/getIconFromTokenList.ts

@@ -20,7 +20,11 @@ export const getIconFromTokenLists = async ({
 }) => {
   let verifiedToken = {} as AssetListReponseItem;
   let canonicalAsset = undefined as string | undefined;
-  for (const data of assetsListsData) {
+  // The lists arrive in the user's configured order, which is a priority order:
+  // the first list carrying the asset wins. Without the labeled break below the
+  // outer loop runs to completion and the LAST matching list silently overwrites
+  // earlier, higher-priority entries.
+  listLoop: for (const data of assetsListsData) {
     const list = data.assets;
     if (list) {
       for (const record of list) {
@@ -29,7 +33,7 @@ export const getIconFromTokenLists = async ({
           if (record.contract && record.contract.match(regex) && record.icon) {
             verifiedToken = record;
             canonicalAsset = getCanonicalFromAsset(code, contractId);
-            break;
+            break listLoop;
           }
         }
 
@@ -42,7 +46,7 @@ export const getIconFromTokenLists = async ({
         ) {
           verifiedToken = record;
           canonicalAsset = getCanonicalFromAsset(code, issuerId);
-          break;
+          break listLoop;
         }
       }
     }

extension/src/background/messageListener/handlers/__tests__/getCachedAssetIconList.test.ts

@@ -0,0 +1,45 @@
+import { getCachedAssetIconList } from "../getCachedAssetIconList";
+
+const USDT0 = "USDT0:GATISXX6BZ6NC7IKQBY37CJD4SOZL3CYZJWXEDG6JVIY4WBS6KXJHN6Q";
+const USDC = "USDC:GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335X2KGX3IHOJAPP5RE34K4KZVN";
+const USDC_ICON = "https://centre.io/usdc.png";
+
+const makeLocalStore = (assetIconCache: unknown) =>
+  ({
+    getItem: jest.fn(async () => assetIconCache),
+    setItem: jest.fn(),
+    remove: jest.fn(),
+    clear: jest.fn(),
+  }) as any;
+
+describe("getCachedAssetIconList", () => {
+  it("returns the icons it has", async () => {
+    const result = await getCachedAssetIconList({
+      localStore: makeLocalStore({ [USDC]: USDC_ICON }),
+    });
+
+    expect(result.icons).toEqual({ [USDC]: USDC_ICON });
+  });
+
+  it("leaves out assets recorded as having no icon", async () => {
+    // A null here means an earlier lookup came up empty, and getAssetIcons
+    // reads it as "already tried, don't look again". Because this cache is on
+    // disk that verdict outlived the session, so an asset whose icon failed
+    // once — USDT0, whose LOBSTR url 403s browsers — stayed iconless forever.
+    // Dropping nulls turns it back into an ordinary cache miss, and the fresh
+    // lookup overwrites the stale entry.
+    const result = await getCachedAssetIconList({
+      localStore: makeLocalStore({ [USDC]: USDC_ICON, [USDT0]: null }),
+    });
+
+    expect(result.icons).toEqual({ [USDC]: USDC_ICON });
+  });
+
+  it("returns an empty map when nothing is cached", async () => {
+    const result = await getCachedAssetIconList({
+      localStore: makeLocalStore(undefined),
+    });
+
+    expect(result.icons).toEqual({});
+  });
+});

extension/src/background/messageListener/handlers/getCachedAssetIconList.ts

@@ -10,6 +10,15 @@ export const getCachedAssetIconList = async ({
     (await localStore.getItem(CACHED_ASSET_ICONS_ID)) || {};
 
   return {
-    icons: assetIconCache,
+    // A null entry records that a lookup came up empty, and getAssetIcons reads
+    // one as "already tried, don't look again". That was only ever meant to
+    // last a session, but this cache is on disk, so the verdict outlived it: an
+    // asset whose icon failed once stayed iconless for good, with no way back —
+    // no icon means no <img>, so nothing fires the error handler that would
+    // have retried. Leaving nulls out makes them ordinary cache misses, and the
+    // fresh lookup overwrites the stale entry.
+    icons: Object.fromEntries(
+      Object.entries(assetIconCache).filter(([, iconUrl]) => iconUrl),
+    ),
   };
 };

extension/src/popup/helpers/__tests__/getIconFromTokenLists.test.js

@@ -11,7 +11,7 @@ const VERIFIED_TOKEN_ISSUER = validAssetList.assets[0].issuer;
 const VERIFIED_TOKEN_CODE = validAssetList.assets[0].code;
 const EXPECTED_ICON_URL = validAssetList.assets[0].icon;
 
-jest
+(jest
   .spyOn(ExtensionMessaging, "sendMessageToBackground")
   .mockImplementation(() =>
     Promise.resolve({
@@ -20,7 +20,7 @@ jest
   ),
   jest
     .spyOn(TokenListHelpers, "getCombinedAssetListData")
-    .mockImplementation(() => Promise.resolve([validAssetList]));
+    .mockImplementation(() => Promise.resolve([validAssetList])));
 
 describe("getIconFromTokenLists", () => {
   it("should return an icon if an asset is in a token list by contract ID", async () => {
@@ -55,3 +55,40 @@ describe("getIconFromTokenLists", () => {
     expect(canonicalAsset).toBeUndefined();
   });
 });
+
+describe("getIconFromTokenLists list priority", () => {
+  // USDT0 is on the Soroswap list with a direct https icon and on the LOBSTR
+  // list with an ipfs.io gateway url. That gateway answers curl but returns 403
+  // to a browser User-Agent, so an <img> can never load it. Keeping whichever
+  // list was read last handed the browser the one url it cannot fetch.
+  const laterList = {
+    ...validAssetList,
+    provider: "Later Provider",
+    assets: [
+      {
+        ...validAssetList.assets[0],
+        icon: "https://later-list.example/icon.png",
+      },
+    ],
+  };
+
+  it("uses the icon from the first matching list, matched by issuer", async () => {
+    const { icon } = await getIconFromTokenLists({
+      issuerId: VERIFIED_TOKEN_ISSUER,
+      code: VERIFIED_TOKEN_CODE,
+      assetsListsData: [validAssetList, laterList],
+    });
+
+    expect(icon).toEqual(EXPECTED_ICON_URL);
+  });
+
+  it("uses the icon from the first matching list, matched by contract ID", async () => {
+    const { icon } = await getIconFromTokenLists({
+      contractId: VERIFIED_TOKEN_CONTRACT,
+      code: VERIFIED_TOKEN_CODE,
+      assetsListsData: [validAssetList, laterList],
+    });
+
+    expect(icon).toEqual(EXPECTED_ICON_URL);
+  });
+});