fix: etherscan urls

[kvhnuke]

Summary by CodeRabbit

• New Features
  • None
• Bug Fixes
  • Corrected Etherscan API URL construction to prevent request failures and ensure reliable transaction history retrieval.
• Refactor
  • Standardized explorer endpoints across many networks to use API-style routes, improving consistency and reducing edge-case errors when fetching activity.
• Chores
  • Updated network configurations to align with Etherscan-like APIs, enhancing compatibility for Ethereum, Binance, Polygon, Arbitrum, Moonbeam, Skale, and others.

[coderabbitai]

Walkthrough

Updated Etherscan provider configuration to use API-style endpoints across multiple networks and corrected txlist URL construction by removing a redundant "api?" segment. No public APIs changed.

Changes

Cohort / File(s)	Summary of Changes
Etherscan Config Endpoints packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts	Replaced explorer base URLs with API-form endpoints (e.g., '/api?', '/api/api?'), adding chain ID parameters where applicable across numerous networks, including Ethereum, BSC, Polygon, Arbitrum, Moonbeam, Skale, Conflux, EthereumClassic, TAC, and others.
Etherscan Tx URL Builder packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/index.ts	Corrected txlist API URL composition by removing an extra 'api?' path segment. No other logic changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat: add derive network #680: Adjusts Etherscan provider endpoints, including Derive network API URL—overlaps with config endpoint updates.
• Add AppLayer Testnet Network #735: Adds AppLayerTestnet API endpoint in the same Etherscan configs mapping.
• Add Cytonic Testnet network #686: Modifies Etherscan endpoint mappings for Cytonic/CytonicTestnet, aligning with similar config changes.

Suggested reviewers

• SemajaM
• SemajaM8
• NickKelly1

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.
Title Check	✅ Passed	The title “fix: etherscan urls” clearly and concisely summarizes the main change of correcting and standardizing Etherscan API endpoints across networks, matching the primary updates in the code without extraneous detail. It follows a conventional commit style and accurately reflects the fixes implemented.

✨ Finishing touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch devop/migrate-etherscan-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

💼 Build Files
chrome: enkrypt-chrome-c8edc6e6.zip
firefox: enkrypt-firefox-c8edc6e6.zip

💉 Virus total analysis
chrome: c8edc6e6
firefox: c8edc6e6

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/index.ts (1)

61-67: Hardcoded OKLink API key in client code.

Shipping a live key inside the extension is a security/compliance risk (client‑side exposure, easy scraping, rate‑limit bleed). Move this to a server proxy, remote config, or build‑time secret injection with per‑env rotation.

Example (build‑time injection):

-      headers = { 'OK-ACCESS-KEY': 'df87e7eb-061f-44b1-84bc-83722fad717c' };
+      const oklinkKey = process.env.OKLINK_API_KEY ?? import.meta.env.VITE_OKLINK_API_KEY;
+      if (oklinkKey) headers = { 'OK-ACCESS-KEY': oklinkKey };

Also consider gating XLayer support when no key is provided to avoid silent 401s.

🧹 Nitpick comments (7)

packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/index.ts (4)

21-27: Build URLs via URL/URLSearchParams to avoid delimiter fragility.

Relying on endpoints to end with ? or & is brittle across mixed providers (Etherscan v2, Blockscout, OKLink). Safer to append params programmatically and preserve any pre‑existing ones (e.g., chainid).

Apply:

   return cacheFetch(
     {
-      // Note: would like to add offset=50 (i.e. results per page) but it seems to cause polygon API to hang
-      url: `${endpoint}module=account&action=txlist&address=${address}&sort=desc`,
+      // Note: would like to add offset=50 (i.e. results per page) but it seems to cause polygon API to hang
+      url: (() => {
+        const u = new URL(endpoint);
+        u.searchParams.set('module', 'account');
+        u.searchParams.set('action', 'txlist');
+        u.searchParams.set('address', address);
+        u.searchParams.set('sort', 'desc');
+        return u.toString();
+      })(),
       headers,
     },
     TTL,
   ).then(res => {

---

29-31: Harden Etherscan/Blockscout response handling.

Some Blockscout instances don’t return isError; many use txreceipt_status. Current logic would mark such entries as failed.

Apply:

-    if (res.status === '0') return [];
+    if (res?.status === '0' || res?.message === 'No transactions found') return [];
@@
-        status: tx.isError === '0' ? true : false,
+        status:
+          (tx as any).isError !== undefined
+            ? (tx as any).isError === '0'
+            : (tx as any).txreceipt_status === '1',

Also applies to: 43-47

---

68-70: Nit: typo and naming.

enpoint → endpoint for clarity.

-  const enpoint =
-    NetworkEndpoints[network.name as keyof typeof NetworkEndpoints];
-  const activities = await getAddressActivity(address, enpoint, headers);
+  const endpoint =
+    NetworkEndpoints[network.name as keyof typeof NetworkEndpoints];
+  const activities = await getAddressActivity(address, endpoint, headers);

---

71-99: Nit: variable casing.

Prefer promises (lowercase) for local arrays of promises.

-  const Promises = activities.map(activity => {
+  const promises = activities.map(activity => {
@@
-  return Promise.all(Promises);
+  return Promise.all(promises);

packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts (3)

4-7: Confirm intent: Ethereum now points to Blockscout, not Etherscan v2.

This can alter fields (e.g., presence/absence of isError). If the switch is intentional, ensure index.ts has the fallback logic for status derivation.

If the goal is to fully consolidate on Etherscan v2, change to:

-  [NetworkNames.Ethereum]: 'https://eth.blockscout.com/api?',
+  [NetworkNames.Ethereum]: 'https://api.etherscan.io/v2/api?chainid=1&',

Otherwise, keep Blockscout but ensure consumers handle its nuances (see index.ts suggestion).

---

34-37: Etherscan v2 aggregator endpoints: consider API key support.

Calls to api.etherscan.io/v2/api?chainid=... are typically key‑gated/rate‑limited. If we expect real traffic, plumb an optional apikey query param or X-API-Key header from config.

Propose adding an optional per‑network apiKeyProvider (or global) and appending apikey in index.ts when available.

Also applies to: 41-43, 48-51, 62-63

---

3-73: Future‑proofing: move from stringly URLs to structured config.

To avoid trailing delimiter errors and to support provider‑specific auth, consider:

• Store baseUrl without query delimiters.
• Store static params (e.g., { chainid: '56' }).
• Optional headers/authStrategy.

High‑level sketch:

// configs.ts
type EndpointCfg = { baseUrl: string; params?: Record<string,string>; headers?: Record<string,string> };
const NetworkEndpoints: Record<NetworkNames, EndpointCfg> = {
  [NetworkNames.Binance]: { baseUrl: 'https://api.etherscan.io/v2/api', params: { chainid: '56' } },
  // ...
};

// index.ts
const cfg = NetworkEndpoints[network.name];
const u = new URL(cfg.baseUrl);
Object.entries(cfg.params ?? {}).forEach(([k,v]) => u.searchParams.set(k, v));
// then set module/action/address/sort; pass cfg.headers if any

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a3f5aab and c8edc6e.

📒 Files selected for processing (2)

• packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts (1 hunks)
• packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/index.ts (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: buildAll
• GitHub Check: test
• GitHub Check: test

🔇 Additional comments (2)

packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/index.ts (1)

24-24: Good catch: removed duplicate api? segment.

This fixes double-api? constructions when paired with new endpoints that already include query scaffolding.

packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts (1)

65-66: No change required — /api/api? is valid for these explorers.

Smoke tests: Cytonic testnet returned JSON with message "OK" and a non-empty result; AppLayer testnet returned JSON "No transactions found" (status "0") — both accept /api/api?. Keep entries in packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts (lines 65–66 and 69–71) unchanged.

[coderabbitai]

⚠️ Potential issue

🧩 Analysis chain

Endpoint normalization looks coherent; verify provider mix and trailing delimiters.

• Trailing ? vs & is consistent with the new URL builder in this PR, but becomes unnecessary if we adopt URLSearchParams in index.ts.
• Mixed providers: some networks moved to Blockscout (e.g., Ethereum, Polygon), others to Etherscan v2 aggregator with chainid, and several custom explorers. This can change payload nuances.

Run this to sanity‑check all endpoints end with ? or & and to flag any double /api/api?:

If adopting URLSearchParams in index.ts, consider dropping the trailing delimiters entirely in this map to reduce config footguns.

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
F="packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts"
python - <<'PY' "$F"
import re,sys,json
t=open(sys.argv[1]).read()
urls=re.findall(r'["\'](https?://[^"\']+)["\']',t)
bad=[u for u in urls if not (u.endswith('?') or u.endswith('&'))]
double=[u for u in urls if '/api/api?' in u]
print(json.dumps({"total":len(urls),"bad_endings":bad,"double_api":double},indent=2))
PY

Length of output: 175

---

Fix duplicated /api/api? entries & consider removing trailing delimiters

• Sanity check: 58 endpoints; all end with ? or &. Two entries contain a duplicated /api/api? in packages/extension/src/providers/ethereum/libs/activity-handlers/providers/etherscan/configs.ts:
  • "https://explorer-api.evm.testnet.cytonic.com/api/api?"
  • "https://testnet-explorer.applayer.com/api/api?"
• Action: replace the above with the correct path (e.g., /api?) or the provider's canonical base URL.
• Optional: if index.ts will use URLSearchParams, remove trailing ?/& from this map to avoid config footguns.