Fix Blockaid destination-token fail-open on the swap flow

When a destination token was picked before its Blockaid scan landed and the
recovery scan then failed (transient error → scanAssetBulk returns null), the
hook bailed without dispatching, so securityLevel stayed undefined and the
review showed the token as clean with a normal confirm — the malicious/unable
warning never reached the user.

Drop the `|| !scan` early-return: a missing scan now flows through
getAssetSecurityLevel, which maps absent data to UNABLE_TO_SCAN on a
Blockaid-enabled network (matching the picker's unscanned-row handling), so the
review shows the 'couldn't be scanned' banner + 'Confirm anyway' gate. A
successful scan still flags malicious/suspicious; a superseded scan still
writes nothing.

Adds useSwapDestinationScan unit tests (fail-open, flagged, superseded).
Verified: test:ci passes (1345).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: CassioMG

extension/src/popup/components/swap/SwapAmount/hooks/__tests__/useSwapDestinationScan.test.ts

@@ -0,0 +1,99 @@
+import { renderHook, waitFor, act } from "@testing-library/react";
+
+// Keep the real verdict logic (getAssetSecurityLevel / isBlockaidEnabled) so we
+// exercise the actual UNABLE_TO_SCAN mapping; stub only the network scan.
+jest.mock("popup/helpers/blockaid", () => ({
+  ...jest.requireActual("popup/helpers/blockaid"),
+  scanAssetBulk: jest.fn(),
+}));
+// The hook reads the picker's in-session scan cache from this module.
+jest.mock("popup/components/swap/SwapAsset/hooks/useSwapTokenLookup", () => ({
+  getCachedAssetScan: jest.fn(),
+}));
+
+import { scanAssetBulk } from "popup/helpers/blockaid";
+import { getCachedAssetScan } from "popup/components/swap/SwapAsset/hooks/useSwapTokenLookup";
+import {
+  DestinationTokenDetails,
+  saveDestinationTokenDetails,
+} from "popup/ducks/transactionSubmission";
+import { SecurityLevel } from "popup/constants/blockaid";
+import { MAINNET_NETWORK_DETAILS } from "@shared/constants/stellar";
+import { AppDispatch } from "popup/App";
+import { useSwapDestinationScan } from "../useSwapDestinationScan";
+
+const details = {
+  tokenCode: "EVIL",
+  issuer: "GEVIL",
+  requiresTrustline: true,
+  decimals: 7,
+  securityLevel: undefined,
+} as DestinationTokenDetails;
+const id = "EVIL-GEVIL";
+
+const renderScan = (dispatch: jest.Mock) =>
+  renderHook(() =>
+    useSwapDestinationScan({
+      destinationTokenDetails: details,
+      networkDetails: MAINNET_NETWORK_DETAILS,
+      dispatch: dispatch as unknown as AppDispatch,
+    }),
+  );
+
+describe("useSwapDestinationScan", () => {
+  afterEach(() => jest.clearAllMocks());
+
+  it("resolves a failed recovery scan to UNABLE_TO_SCAN (no fail-open)", async () => {
+    (getCachedAssetScan as jest.Mock).mockReturnValue(undefined);
+    (scanAssetBulk as jest.Mock).mockResolvedValue(null);
+    const dispatch = jest.fn();
+
+    renderScan(dispatch);
+
+    await waitFor(() => expect(dispatch).toHaveBeenCalled());
+    expect(dispatch).toHaveBeenCalledWith(
+      saveDestinationTokenDetails({
+        ...details,
+        securityLevel: SecurityLevel.UNABLE_TO_SCAN,
+      }),
+    );
+  });
+
+  it("resolves a flagged recovery scan to MALICIOUS", async () => {
+    (getCachedAssetScan as jest.Mock).mockReturnValue(undefined);
+    (scanAssetBulk as jest.Mock).mockResolvedValue({
+      results: { [id]: { result_type: "Malicious" } },
+    });
+    const dispatch = jest.fn();
+
+    renderScan(dispatch);
+
+    await waitFor(() => expect(dispatch).toHaveBeenCalled());
+    expect(dispatch).toHaveBeenCalledWith(
+      saveDestinationTokenDetails({
+        ...details,
+        securityLevel: SecurityLevel.MALICIOUS,
+      }),
+    );
+  });
+
+  it("does not write a verdict for a superseded scan (unmounted mid-flight)", async () => {
+    (getCachedAssetScan as jest.Mock).mockReturnValue(undefined);
+    let resolveScan: (value: unknown) => void = () => {};
+    (scanAssetBulk as jest.Mock).mockReturnValue(
+      new Promise((resolve) => {
+        resolveScan = resolve;
+      }),
+    );
+    const dispatch = jest.fn();
+
+    const { unmount } = renderScan(dispatch);
+    unmount();
+
+    await act(async () => {
+      resolveScan({ results: { [id]: { result_type: "Malicious" } } });
+    });
+
+    expect(dispatch).not.toHaveBeenCalled();
+  });
+});

extension/src/popup/components/swap/SwapAmount/hooks/useSwapDestinationScan.ts

@@ -73,9 +73,14 @@ export const useSwapDestinationScan = ({
         );
         scan = bulk?.results?.[id];
       }
-      if (cancelled || !scan) {
+      if (cancelled) {
         return;
       }
+      // A missing scan (cache miss + failed/empty bulk scan) must NOT fail open:
+      // getAssetSecurityLevel maps absent data to UNABLE_TO_SCAN on a
+      // Blockaid-enabled network, matching the picker's unscanned-row handling,
+      // so the review shows the "couldn't be scanned" banner + acknowledgement
+      // gate instead of a clean confirm.
       const securityLevel = getAssetSecurityLevel({
         blockaidData: scan,
         blockaidOverrideState,