feat: add trust signal awareness to enforced simulations eligibility#41126
feat: add trust signal awareness to enforced simulations eligibility#41126matthewwalsh0 merged 11 commits intomainfrom
Conversation
✨ Files requiring CODEOWNER review ✨✅ @MetaMask/confirmations (8 files, +283 -196)
|
Builds ready [b17f953]
⚡ Performance Benchmarks
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs
|
Builds ready [b0dea41]
⚡ Performance Benchmarks
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [bca8b0c]
⚡ Performance Benchmarks
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
bca8b0c to
ed1c8db
Compare
ed1c8db to
20a20e5
Compare
Consolidate enforced simulations eligibility into a single function in transaction-controller-init.ts with access to AppStateController via messenger. When the to address trust signal is Trusted, enforced simulations default OFF (user can still opt-in via checkbox). - Move all eligibility checks (env flag, origin, delegation, balance changes, trust signal) into getIsEnforcedSimulationsEligible - Expose isEnforcedSimulationsEligible via getApi for UI consumption - Refactor EnforceSimulationHook to accept isDefaultEnabled callback - Update UI row to call background async via submitRequestToBackground - Remove isEnforcedSimulationsEligible from shared (keep only slippage)
Move default-on decision from background to UI hook. The hook now checks that the trust signal cache entry exists before enabling the default, preventing the checkbox from auto-checking during the loading phase. - Add useIsEnforcedSimulationsEligible hook with inline loaded check - Background hook only checks eligibility, never auto-applies - Remove isTrustSignalLoaded from shared (UI-only concern) - Trusted addresses: row shows, checkbox unchecked (user opt-in)
… and simplify hooks - Check trust signals for all to addresses including nested transactions - Add wallet_sendCalls support to trust signals middleware - Remove afterSimulate hook; only beforeSign needed for container application - Simplify enforced simulations row to always-on-by-default when eligible - Remove debug console.logs and forced untrusted address override
20a20e5 to
0483516
Compare
Builds ready [e3cc0e0] [reused from 0483516]
⚡ Performance Benchmarks (Total: 🟢 2 pass · 🟡 3 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [5848952] [reused from 0483516]
⚡ Performance Benchmarks (Total: 🟢 2 pass · 🟡 3 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [202f787]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
205ea58 to
e9695ee
Compare
e9695ee to
f4fe3fa
Compare
f4fe3fa to
b2a26e8
Compare
Builds ready [b2a26e8]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b2a26e8. Configure here.
|
Builds ready [70f3d05]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|




Description
Adds trust signal awareness to enforced simulations. The enforced simulations row only appears when at least one transaction recipient is not trusted by the security alerts API. When shown, it defaults ON but the user can opt out.
Key changes:
toaddresses including those fromwallet_sendCallsbatchestxParamsOriginal.toto check the real recipient, not the delegation manager address after container wrappingbeforeSignonly — simulation skip moved to core viacontainerTypesdatafield when reverting to original paramsChangelog
CHANGELOG entry: null
Related issues
Fixes: CONF-1078
Manual testing steps
ENABLE_ENFORCED_SIMULATIONSenv flag and buildPre-merge author checklist
Pre-merge reviewer checklist
Note
Medium Risk
Updates transaction pre-sign hooking and eligibility logic for enforced simulations, affecting when simulations are enforced during signing and when the opt-out UI appears. Moderate risk due to changes in transaction-flow gating and reliance on trust-signal cache/state.
Overview
Enforced simulations eligibility is now trust-signal aware.
isEnforcedSimulationsEligibleaccepts optional trust-signal state and only returns eligible (on supported chains) when at least one recipient (txParamsOriginal.to,txParams.to, ornestedTransactions[].to) is loaded and notTrusted; unsupported chains bypass the trust check.Transaction flow enforcement is simplified to
beforeSign. TheEnforceSimulationHookdrops theafterSimulatepath, takes an injectedisEligiblepredicate, and only applies containers whencontainerTypesexplicitly includeTransactionContainerType.EnforcedSimulations.Confirmation UI now uses a dedicated hook and auto-enables once. Adds
useIsEnforcedSimulationsEligible(wired tometamask.addressSecurityAlertResponses) and updatesEnforcedSimulationsRowto (a) render based on eligibility, (b) default ON by writingcontainerTypesonce when unset, and (c) show a loading spinner during initialization/toggles.Fixes a container unwrap edge case.
applyTransactionContainersExistingnow defaultstxParams.datato0xwhen unwrapping leaves it undefined, with added unit coverage; tests and console baselines are updated accordingly.Reviewed by Cursor Bugbot for commit 70f3d05. Bugbot is set up for automated code reviews on this repo. Configure here.