feat: cp-7.60.0 validate source amount in metamask pay

[matthewwalsh0]

Description

Validate the raw source amount in MetaMask Pay after quotes are retrieved.

Also validate the source network fee using the max raw amount, rather than the estimated USD value.

Changelog

CHANGELOG entry: null

Related issues

Fixes: #6263 #22722

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Validates MetaMask Pay source amounts and max network fees using new totals fields, consolidates insufficient-fee alerts, updates fee displays/metrics, and bumps transaction-pay-controller to v7.

• Confirmations / Pay:
  • Validation & totals: Use totals.fees.sourceNetwork.estimate.usd for displayed network fees and validate fees with raw amounts (sourceAmount.raw + fees.sourceNetwork.max.*).
  • Alerts: Add AlertKeys.InsufficientPayTokenFees; fold native-fee checks into useInsufficientPayTokenBalanceAlert; remove useInsufficientPayTokenNativeAlert; update alert metrics mapping and alert filtering; rename prop to pendingAmountUsd.
  • UI: BridgeFeeRow sums provider + source network estimate + target network; tooltip network fee uses estimate.
• Metrics: mm_pay_network_fee_usd now from fees.sourceNetwork.estimate.usd; strategy/quote metrics unchanged.
• Tokens: useTokenWithBalance now exposes balanceRaw.
• Selectors: Default selectTransactionPayTokensByTransactionId to [].
• I18n: Update insufficient_pay_token_balance_fees.message copy.
• Dependencies: Bump @metamask/transaction-pay-controller to ^7.0.0.
• Tests: Update/add tests for new fee fields, alerts, metrics, and token balance raw support.

^{Written by Cursor Bugbot for commit 7a2c188. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​transaction-pay-controller@​6.0.0 ⏵ 7.0.0	+1		+1	+1

View full report

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeConfirmationsRedesigned, SmokePerps, SmokePredictions
• Risk Level: medium
• AI Confidence: 85%

click to see 🤖 AI reasoning details

After thorough investigation of the changed files, I've identified the following:

Nature of Changes:

1. Transaction Pay Controller Selector (CRITICAL): New selector file app/selectors/transactionPayController.ts that exports selectors for transaction pay state including totals, loading status, quotes, tokens, payment token, and source amounts.

2. Confirmation Alert System Updates: Multiple alert hooks have been modified/created:

   • useInsufficientPayTokenBalanceAlert: Handles insufficient balance alerts for transaction pay tokens, including checks for input amount, fees, and source network native token
   • useInsufficientPayTokenNativeAlert: Alert for insufficient native token for fees
   • usePendingAmountAlerts: Aggregates multiple alert types for pending amounts
   • useConfirmationAlerts: Main aggregator that includes the new transaction pay alerts
   • useConfirmationAlertMetrics: Updated to track metrics for the new alert types

3. Bridge Fee Display: Updated bridge-fee-row component to show transaction fees with proper tooltip and alert integration

4. Token Balance Utilities: useTokenWithBalance hook for fetching token balances with fiat conversion

5. Transaction Pay Metrics: useTransactionPayMetrics tracks MetaMask Pay usage, strategy, fees, etc.

6. Locale Updates: English locale file updated with new alert messages for insufficient pay token balances (various scenarios)

7. Constants: alerts.ts updated with new AlertKeys for transaction pay flows

8. Package Dependencies: package.json and yarn.lock changes indicate potential dependency updates

Impact Assessment:
This is a focused change primarily affecting:

• Confirmation flows: All confirmation screens that use the alert system and transaction pay
• Transaction Pay feature: Core functionality for paying with different tokens across chains
• Perps deposits: Uses transaction pay for deposits with specific tokens
• Predictions deposits: Uses transaction pay for market deposits
• The infrastructure for displaying fees, checking balances, and showing appropriate alerts

Test Tags Rationale:

1. SmokeConfirmationsRedesigned: PRIMARY - These changes directly modify the confirmation alert system, fee display components, and confirmation hooks. Any confirmation flow that might use transaction pay needs testing.

2. SmokePerps: CRITICAL - Perps deposits explicitly use transaction pay functionality (confirmed by reviewing perps test specs). The insufficient balance alerts and fee calculations are essential for perps flows.

3. SmokePredictions: CRITICAL - Predictions deposits also use transaction pay (similar to perps). The alert system and balance checks are crucial for prediction market deposits.

Why not other tags:

• Not selecting SmokeCore/SmokeWalletPlatform as changes are specific to confirmation/transaction pay flows
• Not selecting SmokeSwaps/SmokeTrade as this is specifically about transaction pay, not regular swaps
• Not selecting SmokeAssets as asset display itself isn't changed
• Other tags don't directly use transaction pay functionality

Risk Level: Medium

• Changes are to a specific feature area (transaction pay in confirmations)
• Affects multiple user-facing flows (perps, predictions, potentially bridges)
• New alert logic and selector could impact user experience if bugs exist
• Not high risk because it's contained to specific features, not core engine/controller changes

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
84.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud