fix(security): replace simulated risk checks with honest unverified results

[amossamuel851-tech]

Summary

Closes #818

Replaces the fabricated wallet-security layer in src/utils/security/ with honest behavior: hex-derived risk scores, always-false scam checks, and a placeholder suspicious-address anomaly are gone, and every surface now reports verified: false with an explicit "unable to verify" result when no real screening provider produced a score. The transaction-confirmation UI surfaces an explicit "Not verified" state instead of presenting a guessed number as a real risk signal.

Why

The security layer presented fiction as fact. simulateAddressRiskCheck derived a deterministic score from the address's hex characters (parseInt(addressHash.slice(0, 8), 16) % 100), hasSimilarityToKnownAddresses always returned false, isKnownScamContract checked an empty hardcoded list, and isSuspiciousAddress was a permanent false placeholder that nonetheless fed a "flagged in security database" anomaly into TransactionMonitor. Users saw a "73/100 risk" badge and warnings that no screening had actually produced, creating false confidence right before transfer approval. The failure was silent by design: every call returned plausible-looking values, so nothing flagged the stubs.

Per the issue's out-of-scope note, integrating a real third-party risk API is a separate service decision. The correct, shippable behavior is to stop the simulation: report the honest unverified state and define the fallback contract, which is exactly what this PR does. Where real logic already existed (the RISKY_WALLETS blocklist), the placeholder checks were wired to it instead of being deleted.

What was built

File	What it contains
src/utils/security/blockchainSecurity.ts	simulateAddressRiskCheck and simulateTransactionRiskCheck deleted. AddressRiskScore/TransactionRisk/validateTransaction gain a verified field. checkAddressRisk returns the unable_to_verify default (verified: false) whenever the proxy is unconfigured, unreachable, or returns no numeric score. checkTransactionRisk no longer derives a score from the hash — it returns the honest default. Fixed the pre-existing logger is not defined reference (the file called logger.error without importing it).
src/utils/security/walletValidator.ts	Deleted the placeholder KNOWN_SCAM_ADDRESSES list containing a fake "example scam address". hasSimilarityToKnownAddresses now computes real edit-distance similarity against the RISKY_WALLETS blocklist (>0.8 threshold). isKnownScamContract now checks the blocklist directly. The RISKY_WALLETS entries are real addresses (e.g. the null address, 0x000...0001).
src/utils/security/transactionMonitor.ts	isSuspiciousAddress placeholder deleted, along with the fabricated "suspicious_recipient" anomaly that claimed "Address flagged in security database" — a claim no real check backed.
src/hooks/useSecurity.ts	TransactionValidation gains riskVerified. validateTransaction populates it from the blockchain service's verified flag and pushes an explicit warning ("Address risk screening unavailable - address could not be verified") when screening did not run.
src/components/TransactionConfirmation.tsx	When riskVerified is false, the Security Assessment panel shows a gray "Not verified" badge, a neutral icon, and the message "Address risk screening is unavailable, so no risk score is available. Verify the recipient address manually." — no fabricated number or color-coded risk level.
src/utils/security/__tests__/blockchainSecurity.test.ts	Rewritten: mocks @/utils/logger (fixing the pre-existing logger is not defined crash), and asserts the new honest behavior — unverified defaults on proxy failure/non-ok/missing-score/verified:false, verified results when a real score arrives, validateTransaction.verified propagation, and that the simulate methods no longer exist.
src/utils/security/__tests__/walletValidator.test.ts	Mocked @/utils/logger (same pre-existing crash), added blocklist state snapshot/restore for test isolation, and rewrote the placeholder tests: hasSimilarityToKnownAddresses returns true for a similar address, isKnownScamContract returns true for the null address.
src/utils/security/__tests__/transactionMonitor.test.ts	New regression test: isSuspiciousAddress no longer exists and no "flagged in security database" anomaly is ever fabricated, while normal transaction/metrics behavior still works.

The tests pin the acceptance criteria directly: the "no fabricated score" tests would fail against the old code (which returned deterministic values and exposed the simulate methods) and pass against the new behavior.

Integration changes outside src/utils/security/

• src/hooks/useSecurity.ts — TransactionValidation.riskVerified added; wired from the blockchain service's verified flag.
• src/components/TransactionConfirmation.tsx — explicit "Not verified" UI state replaces the unconditional risk badge when screening did not run.

src/components/security/WalletAddressInput.tsx (named in the issue) was audited: its risk score derives from real checks (EIP-55 checksum, blacklist, ENS resolution, address verification, repeated-character/similarity heuristics), not from address hex, so it needed no change.

Acceptance criteria coverage

• No code path derives a risk score from the address's hex characters; simulateAddressRiskCheck is either backed by a real check or removed. (blockchainSecurity.ts — both simulate methods deleted; checkAddressRisk/checkTransactionRisk return the honest default; test does not expose simulateAddressRiskCheck or simulateTransactionRiskCheck and should return an unverified default (no fabricated score from the hash))
• isKnownScamContract/hasSimilarityToKnownAddresses/isSuspiciousAddress either implement real screening or are removed, and no UI element claims to have performed those checks. (walletValidator.ts — real blocklist-backed checks; transactionMonitor.ts — isSuspiciousAddress and its fabricated anomaly removed; tests should return true for addresses similar to a known risky address, should return true for null address (in blocklist), no longer exposes the placeholder isSuspiciousAddress check)
• The UI shows an explicit "not verified" state where checks do not run, instead of a fabricated score. (TransactionConfirmation.tsx — "Not verified" badge + explanatory message; useSecurity.ts — riskVerified flag and screening-unavailable warning)
• Tests cover the new behavior (a real check's pass/fail, or the absence of the fake score in the UI state). (rewritten blockchainSecurity.test.ts, walletValidator.test.ts, new transactionMonitor.test.ts — 60 new/changed tests, all passing)
• npm run typecheck, npm test, and npm run lint pass — blocked by pre-existing failures on main, none caused by this PR (see Test plan for evidence).

Test plan

• npx jest src/utils/security/__tests__/{blockchainSecurity,walletValidator,transactionMonitor}.test.ts — 87/90 passing; the 3 failures (trim, ENS message wording, 0.0.0.0 domain) are pre-existing and unrelated, confirmed by stash comparison (they fail identically without my changes)
• npm test — 883/1019 passing vs baseline 820/959 without my changes: +63 net passing tests, 0 new failures (the 136 failures are pre-existing on main, e.g. missing defineChain in the viem mock; my changes actually fix 3 pre-existing logger is not defined crashes in the blockchain suite)
• npm run typecheck — 36 errors, all pre-existing in 8 untouched files (identical count with and without my changes, verified by stash)
• npx eslint <touched files> — 0 new errors from this PR (the +3 jsdoc/require-jsdoc errors my new code initially introduced were fixed; remaining 30 errors in these files are pre-existing in untouched code). Repo-wide npm run lint is broken on main itself: eslint.config.mjs imports eslint-plugin-jsdoc, which is declared nowhere in the dependency tree (~3555 baseline violations). Test-file as any warnings match the project's documented test-only convention (docs/as-any-survivors.md).
• npx next build — blocked by pre-existing Module not found: Can't resolve 'dns'/'fs'/'net' (ioredis/redis-client bundling) in untouched files; none of this PR's files appear in the failure trace
• Manual: run the app and view TransactionConfirmation without a screening provider to confirm the gray "Not verified" panel renders

Env vars / Notes

No new environment variables. The verified flag is additive and backward-compatible: consumers that ignore it see the same riskScore shape, and the unable_to_verify default was already the documented fallback for failed checks. The honest fallback contract (verified: false + unable_to_verify labels) is the integration seam a future real screening provider plugs into.

[drips-wave]

@amossamuel851-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

Nice work, thanks for getting this over the line!