Remove fn references to TransactionController in favor of messenger #534

mcmire · 2025-09-17T13:56:52Z

Currently, the constructor takes getNonceLock, confirmExternalTransaction, getTransactions, and updateTransaction options. In practice these are references to methods within TransactionController. This commit removes these options and calls the TransactionController methods via the messenger instead.

As this requires that consumers include more actions in the SmartTransactionControllerMessenger allowlist, this is a breaking change.

socket-security · 2025-09-17T13:58:54Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

mcmire · 2025-09-17T14:14:13Z

@SocketSecurity ignore npm/@metamask/phishing-controller@13.1.0

This is our package. The network access makes sense, we hit an API to pull various lists.

mcmire · 2025-09-17T14:25:29Z

@SocketSecurity ignore npm/@metamask/snaps-utils@11.5.0

This is our package.

mcmire · 2025-09-17T14:25:53Z

@SocketSecurity ignore npm/keccak@3.0.4

Native code makes sense.

mcmire · 2025-09-17T14:26:04Z

@SocketSecurity ignore npm/secp256k1@4.0.4

Native code makes sense.

mcmire · 2025-09-17T14:28:57Z

@SocketSecurity ignore npm/@metamask/snaps-sdk@9.3.0

This is our package.

mcmire · 2025-09-17T14:37:05Z

Tested using MetaMask/core#6640.

mcmire · 2025-09-17T14:40:47Z

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2

We will fix this later.

mcmire · 2025-09-17T15:09:01Z

@SocketSecurity ignore npm/sha.js@2.4.12

New author is OK, they are a known member of the community.

mcmire · 2025-09-17T15:09:29Z

@SocketSecurity ignore npm/pbkdf2@3.1.3

New author is OK, they are a known member of the community.

mcmire · 2025-09-17T15:11:42Z

@SocketSecurity ignore npm/bs58@4.0.1

New author is OK, they are dcousens on GitHub.

mcmire · 2025-09-17T15:12:33Z

@SocketSecurity ignore npm/md5.js@1.3.5

New author is OK, they are calvinmetcalf on GitHub.

mcmire · 2025-09-17T15:13:07Z

@SocketSecurity ignore npm/ripemd160@2.0.2

New author is OK, they are dcousens on GitHub.

mcmire · 2025-09-17T15:13:50Z

@SocketSecurity ignore npm/ulid@2.4.0

New author is OK, they are perry-mitchell on GitHub.

mcmire · 2025-09-17T15:15:35Z

@SocketSecurity ignore npm/rlp@2.2.7

New author is OK, they are ryanio on GitHub.

Currently, the constructor takes `getNonceLock`, `confirmExternalTransaction`, `getTransactions`, and `updateTransaction` options. In practice these are references to methods within TransactionController. This commit removes these options and calls the TransactionController methods via the messenger.

src/SmartTransactionsController.ts

Gudahtt · 2025-09-17T16:35:59Z

src/SmartTransactionsController.ts

+  | TransactionControllerGetNonceLockAction
+  | TransactionControllerConfirmExternalTransactionAction
+  | TransactionControllerGetTransactionsAction
+  | TransactionControllerUpdateTransactionAction;


😬 This action (and the method it calls) represents an inherent stability/security risk. I guess it was already used, just differently. It's extremely overdue for us to remove this though.

socket-security · 2025-09-17T16:36:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@metamask/messenger@0.2.0 ⏵ 0.3.0	⁺¹	⁺¹	⁺³
@metamask/base-controller@8.3.0 ⏵ 8.4.0			⁺²
@metamask/controller-utils@11.12.0 ⏵ 11.14.0	⁺¹	⁺¹	⁺⁴
@types/lodash@4.14.194 ⏵ 4.17.20
@metamask/transaction-controller@60.3.0 ⏵ 60.4.0	⁺¹	⁺²	⁺¹
@metamask/utils@11.4.2 ⏵ 11.8.0	⁺¹	⁺¹	⁺¹

View full report

Gudahtt · 2025-09-17T16:37:26Z

CHANGELOG.md


+### Removed
+
+- Remove `getNonceLock` constructor option ([#534](https://github.com/MetaMask/smart-transactions-controller/pull/534))


These should be listed as breaking, and also probably in the "Changed" section (these are not "removed features", it's an API change).

Good call. Updated in 6e99652.

src/utils.ts

package.json

mcmire · 2025-09-17T18:19:47Z

This is ready for review again.

Gudahtt

LGTM!

…20152)  ## **Description**  Bumping `@metamask/smart-transactions-controller`: ```markdown ## [19.2.0] ### Added - Add missing constants and helpers exports ([#538](MetaMask/smart-transactions-controller#538)) - `MetaMetricsEventCategory` - `MetaMetricsEventName` - `getSmartTransactionMetricsProperties` - `getSmartTransactionMetricsSensitiveProperties` ## [19.1.0] ### Added - Add missing exports for types ([#537](MetaMask/smart-transactions-controller#537)) - `Fee` - `Fees` - `IndividualTxFees` - `FeatureFlags` - `SmartTransactionMinedTx` - `SmartTransaction` - `SmartTransactionCancellationReason` - `SmartTransactionStatuses` - `ClientId` ## [19.0.0] ### Added - This package can now be used in ESM environments as well as CommonJS ([#469](MetaMask/smart-transactions-controller#469)) - Add two new controller state metadata properties: `includeInStateLogs` and `usedInUi` ([#531](MetaMask/smart-transactions-controller#531)) ### Changed - **BREAKING:** Disallow subpath exports ([#469](MetaMask/smart-transactions-controller#469)) - **BREAKING:** Upgrade peer dependency `@metamask/transaction-controller` from `^58.0.0` to `^60.4.0` ([#532](MetaMask/smart-transactions-controller#532), [#534](MetaMask/smart-transactions-controller#534)) - **BREAKING:** Remove `getNonceLock`, `confirmExternalTransaction`, `getTransactions`, and `updateTransaction` constructor option in favor of messenger actions ([#534](MetaMask/smart-transactions-controller#534)) - The messenger is now used to access TransactionController; you must add these actions to the SmartTransactionController messenger allowlist: - `TransactionController:getNonceLock` - `TransactionController:confirmExternalTransaction` - `TransactionController:getTransactions` - `TransactionController:updateTransaction` - Upgrade `@metamask/base-controller` from `^7.0.1` to `^8.3.0` ([#529](MetaMask/smart-transactions-controller#529)) - Upgrade `@metamask/polling-controller` from `^12.0.0` to `^14.0.0` ([#529](MetaMask/smart-transactions-controller#529)) ### Removed - **BREAKING:** Remove default export ([#535](MetaMask/smart-transactions-controller#535)) - Use `import { SmartTransactionsController } from '@metamask/smart-transactions-controller'` instead. ``` ## **Changelog**  CHANGELOG entry: null ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: my feature name Scenario: user [verb for user action] Given [describe expected initial app state] When user [verb for user action] Then [describe expected outcome] ``` ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [ ] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > Upgrades Smart Transactions to ^19.2.1 and Transaction Controller to ^60.4.0, replaces subpath/type imports, migrates Engine/messaging integration, and updates related hooks, views, selectors, and tests. > > - **Dependencies**: > - Bump `@metamask/smart-transactions-controller` to `^19.2.1` and `@metamask/transaction-controller` to `^60.4.0` (lockfile updated). > - **Engine/Controllers**: > - Switch to named exports from `@metamask/smart-transactions-controller`; remove default export usage. > - Migrate STX controller constructor to use messenger actions (`TransactionController:getNonceLock`, `confirmExternalTransaction`, `getTransactions`, `updateTransaction`) instead of direct callbacks; add MetaMetrics constants/util imports from root. > - Transaction Controller init: use `SmartTransactionStatuses` from root; wire STX hooks (single/batch) and metrics/notification handlers; keep pending resubmit disabled. > - **App code updates**: > - Replace all `@metamask/smart-transactions-controller/dist/...` imports with root package exports (types, enums like `SmartTransaction`, `SmartTransactionStatuses`, `Fee/Fees`). > - Update Swaps (QuotesView, useSwapsSmartTransaction), UnifiedTransactionsView, SmartTransactionStatus components/tests, NotificationsManager, selectors, migrations, and smart-transactions utils/hooks to new exports. > - **Tests**: > - Adapt tests to new controller exports and messenger permissions for STX hooks; minor Hex import fixes. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 3c62faf. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Mark Stacey <markjstacey@gmail.com>

## **Description**  Bumping `@metamask/smart-transactions-controller`: ```markdown ## [19.2.0] ### Added - Add missing constants and helpers exports ([#538](MetaMask/smart-transactions-controller#538)) - `MetaMetricsEventCategory` - `MetaMetricsEventName` - `getSmartTransactionMetricsProperties` - `getSmartTransactionMetricsSensitiveProperties` ## [19.1.0] ### Added - Add missing exports for types ([#537](MetaMask/smart-transactions-controller#537)) - `Fee` - `Fees` - `IndividualTxFees` - `FeatureFlags` - `SmartTransactionMinedTx` - `SmartTransaction` - `SmartTransactionCancellationReason` - `SmartTransactionStatuses` - `ClientId` ## [19.0.0] ### Added - This package can now be used in ESM environments as well as CommonJS ([#469](MetaMask/smart-transactions-controller#469)) - Add two new controller state metadata properties: `includeInStateLogs` and `usedInUi` ([#531](MetaMask/smart-transactions-controller#531)) ### Changed - **BREAKING:** Disallow subpath exports ([#469](MetaMask/smart-transactions-controller#469)) - **BREAKING:** Upgrade peer dependency `@metamask/transaction-controller` from `^58.0.0` to `^60.4.0` ([#532](MetaMask/smart-transactions-controller#532), [#534](MetaMask/smart-transactions-controller#534)) - **BREAKING:** Remove `getNonceLock`, `confirmExternalTransaction`, `getTransactions`, and `updateTransaction` constructor option in favor of messenger actions ([#534](MetaMask/smart-transactions-controller#534)) - The messenger is now used to access TransactionController; you must add these actions to the SmartTransactionController messenger allowlist: - `TransactionController:getNonceLock` - `TransactionController:confirmExternalTransaction` - `TransactionController:getTransactions` - `TransactionController:updateTransaction` - Upgrade `@metamask/base-controller` from `^7.0.1` to `^8.3.0` ([#529](MetaMask/smart-transactions-controller#529)) - Upgrade `@metamask/polling-controller` from `^12.0.0` to `^14.0.0` ([#529](MetaMask/smart-transactions-controller#529)) ### Removed - **BREAKING:** Remove default export ([#535](MetaMask/smart-transactions-controller#535)) - Use `import { SmartTransactionsController } from '@metamask/smart-transactions-controller'` instead. ``` [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/36167?quickstart=1) ## **Changelog**  CHANGELOG entry: null ## **Related issues** Fixes: ## **Manual testing steps** 1. Checkout this branch 2. Try submitting a smart transaction ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [ ] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > Upgrades `@metamask/smart-transactions-controller` to v19.2.1, replaces deprecated default/subpath imports, and shifts TransactionController integration to messenger-based actions with updated allowlists and tests. > > - **Smart Transactions Controller upgrade** > - Bump `@metamask/smart-transactions-controller` to `^19.2.1` and align with ESM/no-default export (remove subpath imports like `dist/types`). > - **Messenger-based integration** > - Add TransactionController actions to `SmartTransactionsController` messenger allowlist: `getNonceLock`, `confirmExternalTransaction`, `getTransactions`, `updateTransaction` in `controller-init/messengers/smart-transactions-controller-messenger.ts`. > - Refactor `SmartTransactionsControllerInit` to stop passing `getNonceLock`, `confirmExternalTransaction`, `getTransactions`, `updateTransaction` via constructor; rely on messenger; update constructor typing to use restricted `messenger` directly. > - Remove/adjust related unit tests that asserted constructor-wired functions; keep MetaMetrics wiring tests. > - **Import and type updates** > - Switch all imports to named exports from `@metamask/smart-transactions-controller` (e.g., `SmartTransactionsController`, `SmartTransactionStatuses`, `SmartTransaction`, `ClientId`, `IndividualTxFees`, etc.). > - **Policy updates** > - Update LavaMoat policies to reflect new polling-controller pathing and minor globals; adjust dependencies accordingly. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 74fa4dd. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Mark Stacey <mark.stacey@consensys.net> Co-authored-by: MetaMask Bot <metamaskbot@users.noreply.github.com>

mcmire force-pushed the bump-tx-controller branch from 5f0de01 to 5d56b30 Compare September 17, 2025 13:58

mcmire force-pushed the bump-tx-controller branch from 5d56b30 to 40c0fa0 Compare September 17, 2025 14:00

mcmire force-pushed the bump-tx-controller branch from 40c0fa0 to f17432e Compare September 17, 2025 14:24

mcmire force-pushed the bump-tx-controller branch from f17432e to 775a386 Compare September 17, 2025 16:25

mcmire changed the title ~~WIP - Bump transaction-controller to next version with more messenger actions~~ Remove fn references to TransactionController in favor of messenger Sep 17, 2025

mcmire marked this pull request as ready for review September 17, 2025 16:31

mcmire requested a review from a team as a code owner September 17, 2025 16:31

Gudahtt reviewed Sep 17, 2025

View reviewed changes

src/SmartTransactionsController.ts Show resolved Hide resolved

Gudahtt reviewed Sep 17, 2025

View reviewed changes

src/utils.ts Outdated Show resolved Hide resolved

Gudahtt reviewed Sep 17, 2025

View reviewed changes

package.json Show resolved Hide resolved

Move changelog entries to Changed; consolidate

6e99652

mcmire added 3 commits September 17, 2025 12:05

Don't have markRegularTransactionsAsFailed take a messenger

6250974

Bump peer dep again

d804f8b

Update lockfile

55aee3c

Gudahtt approved these changes Sep 17, 2025

View reviewed changes

mcmire merged commit 12f152b into main Sep 17, 2025
18 checks passed

mcmire deleted the bump-tx-controller branch September 17, 2025 18:26


		### Removed

		- Remove `getNonceLock` constructor option ([#534](https://github.com/MetaMask/smart-transactions-controller/pull/534))

Uh oh!

Remove fn references to TransactionController in favor of messenger #534

Remove fn references to TransactionController in favor of messenger #534

Uh oh!

Conversation

mcmire commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

Uh oh!

Gudahtt Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gudahtt Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

mcmire Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mcmire commented Sep 17, 2025

Uh oh!

Gudahtt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mcmire commented Sep 17, 2025 •

edited

Loading

socket-security bot commented Sep 17, 2025 •

edited

Loading

socket-security bot commented Sep 17, 2025 •

edited

Loading