feat(transaction-pay-controller): support metamask pay alternate caveats - #32738
Conversation
PR template — items to address before "Ready for review"Warnings — informational, address before merging:
See docs/readme/ready-for-review.md for the full Definition of Ready for Review. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
matthewwalsh0
changed the title
matthewwalsh0
changed the title
matthewwalsh0
changed the title
metamask-ci
Bot
added
INVALID-PR-TEMPLATE
819af98 to
a499792
Compare
|
Warning MetaMask internal reviewing guidelines:
|
e8d1808 to
673a098
Compare
⚡ Performance Test Results
✅ All tests passed · 2 tests · 1 device 📱 Devices tested (1)Android: Google Pixel 8 Pro (v14.0) ✅ Passed Tests (2)
Branch: |
d83156c to
7d600a6
Compare
7d600a6 to
9f885d8
Compare
… delegation constraints
…-preview-8b02acdf0
…troller preview The previewBuilds plugin only rewrites descriptors during `yarn install` (via its validateProject hook). CI unit-test shards restore node_modules from the ci-js-deps artifact (which omits .yarn/install-state.gz) and re-resolve on `yarn test:unit` without the rewrite, failing with "^23.17.4 not present in lockfile". Resolutions are applied on every resolution pass, so the yarn test:unit pre-flight check resolves correctly.
… into mobile delegation signing Replace caveats parameter with isSubsidized flag on getDelegationTransaction callback. Mobile now builds the four subsidized caveats using native caveat builders with per-chain enforcer addresses from the delegation environment. Subsidized caveat set: - LimitedCallsCaveat(1) — only one call allowed - AllowedTargetsCaveat(token) — only to the token address - AllowedCalldataCaveat(selector, offset 0) — enforce transfer selector - AllowedCalldataCaveat(recipient+amount, offset 4) — enforce recipient+amount Split calldata enforcement prevents Relay post-deposit parser from misreading caveat terms as transfer missing its order ID. - Update getDelegationTransaction and buildDelegation signatures: caveats? → isSubsidized? - Add buildSubsidizedCaveats() with token/calldata validation - Update transaction-pay-controller-init.ts to forward isSubsidized flag - Add tests for subsidized caveat building and error cases - Remove old caveats-passing test
…538ab03c Preview build from MetaMask/core#9298 (feat/pay-subsidized-submit) for testing the isSubsidized delegation flag, executeVersion: 2 quote request, and signed metamask execute envelope end-to-end.
Reduce the AllowedCalldata caveat count for subsidized EIP-7702 batch delegations by splitting the pinned complement only after the selector of nested calls that contain an order-ID placeholder, folding the selector into the preceding segment. - Locate each nested call by its full calldata (not its selector) so selectors appearing coincidentally inside a call's arguments (e.g. approve selectors nested in a transferAndMulticall body) do not create spurious split points. - Split only at order-ID-bearing calls; order-ID-free calls (e.g. approve) need no boundary and merge into a neighbouring pinned run. Caveat partitioning is invisible to Relay, which reads the contiguous calls from the calldata itself. Every non-placeholder byte remains pinned byte-exact and all order-ID placeholder windows remain free.
…iew build 380bb5c
…er@24.0.1 released versions
202f0a6 to
6afc600
Compare
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsE2E Test Selection: Performance Test Selection: |
|
metamask-ci
Bot
added
the
release-8.4.0
2 participants
Description
What
Mobile now receives an optional
isSubsidizedflag from TransactionPayController instead of a caveats array. It builds the four subsidized delegation caveats using native caveat builders with per-chain enforcer addresses.How
isSubsidizedflag pass-through.TransactionPayControllerInitforwards core's optionalisSubsidizedargument into Mobile'sgetDelegationTransaction; when set, a subsidized caveat set is built instead of the default one.isSubsidizedstill use Mobile's existing default caveat builder.Changelog
CHANGELOG entry: null
Related issues
Refs: no public issue
Manual testing steps
N/A - internal plumbing covered by unit test:
yarn jest app/util/transactions/delegation.test.tsScreenshots/Recordings
N/A
Before
N/A
After
N/A
Pre-merge author checklist
Performance checks (if applicable)
Pre-merge reviewer checklist
Note
High Risk
Changes delegation signing constraints for subsidized MetaMask Pay flows; incorrect calldata segmentation could allow overly permissive or broken redemptions.
Overview
Adds an optional
isSubsidizedpath from Transaction Pay intogetDelegationTransaction. When set, mobile builds subsidized delegation caveats locally instead of the default exact-execution caveats.Subsidized delegations redeem the full 7702 batch (
txParams.to/txParams.data) in single execution mode. Caveats useallowedTargets,limitedCalls(1), and multipleallowedCalldatasegments that lock every byte except the Intents API order-ID placeholder, with splits only after selectors of nested calls that contain that placeholder (avoiding spurious splits from selectors embedded in other call args).Non-subsidized behavior is unchanged when the flag is omitted.
@metamask/transaction-pay-controlleris bumped to ^24.0.1 (withtransaction-controller68.4.0); coverage is indelegation.test.tssubsidized cases.Reviewed by Cursor Bugbot for commit 6afc600. Bugbot is set up for automated code reviews on this repo. Configure here.