metamask-extension icon indicating copy to clipboard operation
metamask-extension copied to clipboard

chore: scan delegation delegate address in trust middleware

Open MoMannn opened this issue 1 month ago • 2 comments

Description

This PR extends the trust signals middleware to scan delegate addresses when processing delegation signatures (EIP-7710 Delegations).

Reason for the change: When a user signs a delegation, the delegate address is a critical security parameter—it determines who will have delegated authority over the user's account. Currently, the trust signals middleware scans verifying contracts and spender addresses (for permits), but does not scan the delegate address in delegation signatures. This leaves a gap in our security scanning coverage.

Improvement/solution:

  • Extended handleEthSignTypedData in the trust signals middleware to detect delegation signatures (via PRIMARY_TYPE_DELEGATION) and scan the delegate address using the existing scanAddressAndAddToCache mechanism
  • Exported PRIMARY_TYPE_DELEGATION constant from delegation.ts to enable reuse across modules
  • Added comprehensive test coverage for the new functionality, including:
    • Verifying both the verifying contract and delegate addresses are scanned
    • Graceful error handling when delegate scanning fails
    • Edge case handling when delegate address is not present

The implementation follows the existing patterns established for permit signature scanning.

Open in GitHub Codespaces

Changelog

CHANGELOG entry: null

Manual testing steps

  1. Create a new permission and sign it.
  2. In the signing step delegate scan should be triggered.

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[!NOTE] Scan delegate addresses for delegation typed-data signatures and export PRIMARY_TYPE_DELEGATION, with comprehensive tests and error handling.

  • Trust Signals Middleware:
    • Scan delegate address for EIP-712 delegation signatures (primaryType: "Delegation") alongside the verifyingContract.
    • Leverages PRIMARY_TYPE_DELEGATION for detection and adds graceful error handling on delegate scan failures.
  • Transactions/Delegation:
    • Export PRIMARY_TYPE_DELEGATION from app/scripts/lib/transaction/delegation.ts for cross-module use.
  • Tests:
    • Add tests to verify scanning of both verifyingContract and delegate, error handling on delegate scan failures, and no-scan when delegate is absent.
    • Introduce DELEGATE test address constant.

Written by Cursor Bugbot for commit 80403528581456031b2d522ea83ce9245cd6a359. This will update automatically on new commits. Configure here.

MoMannn avatar Dec 10 '25 12:12 MoMannn

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

github-actions[bot] avatar Dec 10 '25 12:12 github-actions[bot]

Builds ready [8040352]
UI Startup Metrics (1261 ± 102 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup12611059153610213211428
load103486412908910821218
domContentLoaded102685812838610721200
domInteractive2515117202082
firstPaint50978124240410011167
backgroundConnect21419828014218242
firstReactRender4931235245481
getState43181402747125
initialActions104112
loadScripts820660108285864996
setupStore1362951623
numNetworkReqs1468920675
BrowserifyPower User HomeuiStartup------
load------
domContentLoaded------
domInteractive------
firstPaint------
backgroundConnect------
firstReactRender------
getState------
initialActions------
loadScripts------
setupStore------
numNetworkReqs------
WebpackStandard HomeuiStartup819680123094871954
load657572102087705796
domContentLoaded651569101686700789
domInteractive261593182384
firstPaint243851009175229647
backgroundConnect1168091228
firstReactRender54332142967118
getState281463113747
initialActions104112
loadScripts648566101485696780
setupStore1245771327
numNetworkReqs1367919668
WebpackPower User HomeuiStartup14251086205319915841744
load74160498598830904
domContentLoaded73459897598824896
domInteractive32171312627108
firstPaint27284867181287680
backgroundConnect84771616947583
firstReactRender51407265464
getState19413769963205276
initialActions103112
loadScripts73059697397817894
setupStore1774691636
numNetworkReqs72562142567135
FirefoxBrowserifyStandard HomeuiStartup13481072229919214181696
load1086907203014011431277
domContentLoaded1086907203014011431277
domInteractive75319589786139
firstPaint------
backgroundConnect56202634666169
firstReactRender39296783960
getState13790111236
initialActions102122
loadScripts1055892192812811141205
setupStore155151211340
numNetworkReqs1568221876
BrowserifyPower User HomeuiStartup26381678340251630483311
load1642936250450221242391
domContentLoaded1641936250350221222390
domInteractive1723199028395979
firstPaint------
backgroundConnect176201187205185467
firstReactRender6636973936096
getState1226534645138219
initialActions203123
loadScripts1552921248847420092236
setupStore4344677343223
numNetworkReqs74541311979117
WebpackStandard HomeuiStartup16031300284219517111899
load13201112259015913821465
domContentLoaded13201107259015913821464
domInteractive782823140106144
firstPaint------
backgroundConnect57222043666149
firstReactRender433398104756
getState178114181460
initialActions103122
loadScripts12901098256915813541433
setupStore186145241578
numNetworkReqs1567920872
WebpackPower User HomeuiStartup28301732445557132653592
load19261096281646423182624
domContentLoaded19261096281646423182623
domInteractive17932988276127918
firstPaint------
backgroundConnect183271162233196887
firstReactRender6242133156697
getState1396789592161231
initialActions3140537
loadScripts18301080271444422162504
setupStore62747010061351
numNetworkReqs71471462565125
📊 Page Load Benchmark Results

Current Commit: 8040352 | Date: 12/10/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.03s (±39ms) 🟡 | historical mean value: 1.04s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 719ms (±37ms) 🟢 | historical mean value: 721ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±14ms) 🟢 | historical mean value: 79ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.03s 39ms 1.00s 1.32s 1.08s 1.32s
domContentLoaded 719ms 37ms 692ms 990ms 739ms 990ms
firstPaint 77ms 14ms 60ms 200ms 84ms 200ms
firstContentfulPaint 77ms 14ms 60ms 200ms 84ms 200ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 3.08 KiB (0.06%)
  • ui: -2.55 KiB (-0.03%)
  • common: -739 Bytes (-0.01%)

metamaskbot avatar Dec 10 '25 12:12 metamaskbot

Builds ready [8040352]
UI Startup Metrics (1261 ± 102 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup12611059153610213211428
load103486412908910821218
domContentLoaded102685812838610721200
domInteractive2515117202082
firstPaint50978124240410011167
backgroundConnect21419828014218242
firstReactRender4931235245481
getState43181402747125
initialActions104112
loadScripts820660108285864996
setupStore1362951623
numNetworkReqs1468920675
BrowserifyPower User HomeuiStartup19051637223514019812156
load1060885133511911531264
domContentLoaded1051872131711911431257
domInteractive2917125222589
firstPaint53310013484179981231
backgroundConnect256198677105238567
firstReactRender473810784957
getState18613735331199244
initialActions108112
loadScripts84067411191189361058
setupStore1576481535
numNetworkReqs72571371970133
WebpackStandard HomeuiStartup819680123094871954
load657572102087705796
domContentLoaded651569101686700789
domInteractive261593182384
firstPaint243851009175229647
backgroundConnect1168091228
firstReactRender54332142967118
getState281463113747
initialActions104112
loadScripts648566101485696780
setupStore1245771327
numNetworkReqs1367919668
WebpackPower User HomeuiStartup14251086205319915841744
load74160498598830904
domContentLoaded73459897598824896
domInteractive32171312627108
firstPaint27284867181287680
backgroundConnect84771616947583
firstReactRender51407265464
getState19413769963205276
initialActions103112
loadScripts73059697397817894
setupStore1774691636
numNetworkReqs72562142567135
FirefoxBrowserifyStandard HomeuiStartup13481072229919214181696
load1086907203014011431277
domContentLoaded1086907203014011431277
domInteractive75319589786139
firstPaint------
backgroundConnect56202634666169
firstReactRender39296783960
getState13790111236
initialActions102122
loadScripts1055892192812811141205
setupStore155151211340
numNetworkReqs1568221876
BrowserifyPower User HomeuiStartup26381678340251630483311
load1642936250450221242391
domContentLoaded1641936250350221222390
domInteractive1723199028395979
firstPaint------
backgroundConnect176201187205185467
firstReactRender6636973936096
getState1226534645138219
initialActions203123
loadScripts1552921248847420092236
setupStore4344677343223
numNetworkReqs74541311979117
WebpackStandard HomeuiStartup16031300284219517111899
load13201112259015913821465
domContentLoaded13201107259015913821464
domInteractive782823140106144
firstPaint------
backgroundConnect57222043666149
firstReactRender433398104756
getState178114181460
initialActions103122
loadScripts12901098256915813541433
setupStore186145241578
numNetworkReqs1567920872
WebpackPower User HomeuiStartup28301732445557132653592
load19261096281646423182624
domContentLoaded19261096281646423182623
domInteractive17932988276127918
firstPaint------
backgroundConnect183271162233196887
firstReactRender6242133156697
getState1396789592161231
initialActions3140537
loadScripts18301080271444422162504
setupStore62747010061351
numNetworkReqs71471462565125
📊 Page Load Benchmark Results

Current Commit: 8040352 | Date: 12/10/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.03s (±39ms) 🟡 | historical mean value: 1.03s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 719ms (±37ms) 🟢 | historical mean value: 722ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±14ms) 🟢 | historical mean value: 80ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.03s 39ms 1.00s 1.32s 1.08s 1.32s
domContentLoaded 719ms 37ms 692ms 990ms 739ms 990ms
firstPaint 77ms 14ms 60ms 200ms 84ms 200ms
firstContentfulPaint 77ms 14ms 60ms 200ms 84ms 200ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 3.08 KiB (0.06%)
  • ui: -2.55 KiB (-0.03%)
  • common: -739 Bytes (-0.01%)

metamaskbot avatar Dec 11 '25 13:12 metamaskbot