fix: mf-6842 replace dead Solana RPC and token list endpoints

[swkatmask]

Summary

Three issues were breaking Solana balance display; all verified against the live extension:

1. RPC endpoint (CORS preflight 403)

The Phantom app-key RPC (solana-mainnet.phantom.app, in use since mf-2236) returns 403 on the CORS preflight, so every Solana mainnet RPC request was blocked by the browser.

Replaced with an ordered failover chain — every Solana RPC call (raw requestRPC fetches and @solana/web3.js Connection calls, via the fetch option of ConnectionConfig) retries the next endpoint on HTTP-level failure:

Endpoint	preflight	getBalance	filtered getProgramAccounts (SPL token list, SNS domains)
public.rpc.solanavibestation.com	204 *	✅	✅ only endpoint that allows indexed requests → primary
solana-rpc.publicnode.com	204 *	✅	❌ "Indexed requests require a personal token"
solana.api.pocket.network	200	✅	❌ program excluded from account scan
solana.leorpc.com/?api_key=FREE	200	✅	❌ scan-size limit

Testnet/Devnet official endpoints still work and are unchanged.

2. Token list endpoint (dead domain)

getFungibleTokenList fetched three remote lists with Promise.all, one of which (tokens.jup.ag/tokens?tags=verified) was cut off by Jupiter in 2025 (domain no longer resolves). One dead feed rejected the whole Promise.all, so token-list-dependent queries never settled.

• Removed the dead Jupiter source (its replacement lite-api.jup.ag/tokens/v2/recent only serves 30 recent tokens, no lookup value)
• Promise.all → Promise.allSettled so a dead feed degrades gracefully instead of taking down every Solana balance fetch
• Remaining sources: Mask r2d2 curated list + Raydium full mint list (both verified live)

3. Shared hook disabled for non-EVM addresses (the - in the wallet account dialog)

useFungibleToken gated its react-query with the EVM isValidAddress, so Solana base58 addresses (e.g. the native So1111…112) always failed the check → the query was permanently enabled: false → useNativeToken stayed isPending forever → the wallet status box rendered - even though the balance query itself had resolved. Validate with the plugin-scoped useWeb3Utils().isValidAddress instead (EVM behavior unchanged).

Also fixes requestRPC error propagation (json.message → json.error.message) and updates security/content-security-policy.json (dev --csp builds) for the new RPC hosts.

Verification

• All 4 RPC endpoints live-tested (preflight + getBalance + filtered getProgramAccounts); matrix above
• From the extension's own MV3 service worker context: getBalance on the new primary → HTTP 200 with balance; old Phantom URL → TypeError: Failed to fetch (reproduces QA's report in-context)
• Token list sources curl-verified (r2d2 200, Raydium 200, tokens.jup.ag dead)
• Hook fix verified in the dev extension: with the EVM gate, the fungible-token query never appeared in the react-query cache; balance query resolved (640008010) while the dialog still showed -

Related Issue

Closes MF-6842

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
book	Ready	Preview	Sep 12, 2026 12:55pm UTC