fix: require EIP-7702 for direct mUSD vault batches by matthewwalsh0 · Pull Request #9240 · MetaMask/core

matthewwalsh0 · 2026-06-23T15:04:43Z

Explanation

Direct mUSD Money Account vault submission is intended to be an EIP-7702-only flow: the refreshed vault approve/deposit calls need to remain a sponsored atomic batch instead of being materialized as standalone child transactions. TransactionController previously preferred EIP-7702, but callers that depended on that path could still fall back to hook or sequential batch publishing when EIP-7702 was unavailable.

This PR makes that contract explicit. TransactionPayController submits direct mUSD vault batches with hook and sequential fallbacks disabled, while TransactionController now fails closed for those EIP-7702-only batch requests when account or chain support is unavailable. The direct mUSD submit path also always stops collecting submitted transaction IDs after the batch attempt completes, preventing later retries from being associated with a failed parent transaction.

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Changes batch routing and error behavior for EIP-7702-only internal flows (mUSD vault); incorrect handling could block deposits or leave stale transaction associations, but scope is limited to callers using both disable flags.

Overview
Direct mUSD vault deposits are now EIP-7702-only: TransactionPayController passes disableHook: true and disableSequential: true on addTransactionBatch, so approve/deposit stay a sponsored atomic batch instead of falling back to hook or sequential publishing.

TransactionController treats that flag combination as fail-closed: it throws when the account cannot use EIP-7702, and it no longer swallows a Chain does not support EIP-7702 error to continue on the hook path. Tests cover both account and chain rejection without creating transactions.

The direct mUSD submit path moves end() for transaction-ID collection into a finally block so collection always stops after the batch attempt, including on failure—avoiding stray IDs on retries.

^{Reviewed by Cursor Bugbot for commit c5e597d. Bugbot is set up for automated code reviews on this repo. Configure here.}

…32253) ## **Description** Sponsored and gas-included transaction publishing depends on the EIP-7702 delegation relay path. Previously, when atomic EIP-7702 support was unavailable for the selected chain, the delegation publish hook returned an empty result, which allowed the publish pipeline to continue to later publication paths. This PR makes that path fail closed for sponsored and gas-included transactions by throwing a clear error when the chain does not support EIP-7702 atomic batching. Non-sponsored transactions keep the existing empty-result behavior when EIP-7702 is unavailable. ## **Changelog** CHANGELOG entry: Fixed sponsored and gas-included transactions falling back when EIP-7702 support is unavailable ## **Related issues** Refs: MetaMask/core#9240 ## **Manual testing steps** N/A - covered by unit tests for the transaction publish hook. ## **Screenshots/Recordings** N/A ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Changes transaction publish behavior for gas-sponsored and gas-included flows on chains without EIP-7702, blocking unsafe fallbacks instead of silently continuing. > > **Overview** > **Sponsored** and **gas-included** publishes must use the EIP-7702 delegation relay. When atomic batch support is missing for the chain, `Delegation7702PublishHook` used to return an empty result so later publish hooks could run. > > This change **throws** for `isGasFeeSponsored` or `isGasFeeIncluded` when the chain is not EIP-7702-capable, with a clear error (prefixed as `Gas Station 7702:`). Regular transactions still get the empty result and can fall through. > > Gas flags are normalized earlier (`Boolean` on `isGasFeeIncluded` / `isGasFeeSponsored`) and `includeTransfer` now keys off the same `isSponsored` flag. Unit tests cover sponsored and gas-included cases when atomic batch is unsupported. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4e5dfa7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…ed gas transactions (#32253) ## **Description** Sponsored and gas-included transaction publishing depends on the EIP-7702 delegation relay path. Previously, when atomic EIP-7702 support was unavailable for the selected chain, the delegation publish hook returned an empty result, which allowed the publish pipeline to continue to later publication paths. This PR makes that path fail closed for sponsored and gas-included transactions by throwing a clear error when the chain does not support EIP-7702 atomic batching. Non-sponsored transactions keep the existing empty-result behavior when EIP-7702 is unavailable. ## **Changelog** CHANGELOG entry: Fixed sponsored and gas-included transactions falling back when EIP-7702 support is unavailable ## **Related issues** Refs: MetaMask/core#9240 ## **Manual testing steps** N/A - covered by unit tests for the transaction publish hook. ## **Screenshots/Recordings** N/A ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Changes transaction publish behavior for gas-sponsored and gas-included flows on chains without EIP-7702, blocking unsafe fallbacks instead of silently continuing. > > **Overview** > **Sponsored** and **gas-included** publishes must use the EIP-7702 delegation relay. When atomic batch support is missing for the chain, `Delegation7702PublishHook` used to return an empty result so later publish hooks could run. > > This change **throws** for `isGasFeeSponsored` or `isGasFeeIncluded` when the chain is not EIP-7702-capable, with a clear error (prefixed as `Gas Station 7702:`). Regular transactions still get the empty result and can fall through. > > Gas flags are normalized earlier (`Boolean` on `isGasFeeIncluded` / `isGasFeeSponsored`) and `includeTransfer` now keys off the same `isSponsored` flag. Unit tests cover sponsored and gas-included cases when atomic batch is unsupported. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4e5dfa7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…sk#32253) ## **Description** Sponsored and gas-included transaction publishing depends on the EIP-7702 delegation relay path. Previously, when atomic EIP-7702 support was unavailable for the selected chain, the delegation publish hook returned an empty result, which allowed the publish pipeline to continue to later publication paths. This PR makes that path fail closed for sponsored and gas-included transactions by throwing a clear error when the chain does not support EIP-7702 atomic batching. Non-sponsored transactions keep the existing empty-result behavior when EIP-7702 is unavailable. ## **Changelog** CHANGELOG entry: Fixed sponsored and gas-included transactions falling back when EIP-7702 support is unavailable ## **Related issues** Refs: MetaMask/core#9240 ## **Manual testing steps** N/A - covered by unit tests for the transaction publish hook. ## **Screenshots/Recordings** N/A ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Changes transaction publish behavior for gas-sponsored and gas-included flows on chains without EIP-7702, blocking unsafe fallbacks instead of silently continuing. > > **Overview** > **Sponsored** and **gas-included** publishes must use the EIP-7702 delegation relay. When atomic batch support is missing for the chain, `Delegation7702PublishHook` used to return an empty result so later publish hooks could run. > > This change **throws** for `isGasFeeSponsored` or `isGasFeeIncluded` when the chain is not EIP-7702-capable, with a clear error (prefixed as `Gas Station 7702:`). Regular transactions still get the empty result and can fall through. > > Gas flags are normalized earlier (`Boolean` on `isGasFeeIncluded` / `isGasFeeSponsored`) and `includeTransfer` now keys off the same `isSponsored` flag. Unit tests cover sponsored and gas-included cases when atomic batch is unsupported. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4e5dfa7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…ct mUSD vault deposits (MetaMask#9250) ## Summary Adds `disableUpgrade: true` to the `addTransactionBatch` call in the direct mUSD Money Account vault deposit path. The Money Account is always already upgraded to EIP-7702 on Monad, so the upgrade check (`isAccountUpgradedToEIP7702`) is unnecessary and adds latency. This skips it entirely. Also updates the test assertion to explicitly verify `disableHook: true`, `disableSequential: true`, and `disableUpgrade: true` are passed to the batch. ## Related Builds on top of MetaMask#9240 (`disableHook: true`, `disableSequential: true`, `finally` block for `end()`).  --- > [!NOTE] > **Low Risk** > Narrow change to batch submission flags on a fiat path that already assumes a pre-upgraded Money Account; wrong assumption would only affect this deposit flow. > > **Overview** > Direct mUSD Money Account vault deposits now pass **`disableUpgrade: true`** on `TransactionController:addTransactionBatch`, alongside the existing `disableHook` and `disableSequential` flags. That skips the redundant EIP-7702 upgrade probe (`isAccountUpgradedToEIP7702`) because the Money Account is already upgraded on Monad. > > The direct mUSD vault test now asserts all three batch options explicitly, and the changelog records the fix under **Fixed**. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 84d28a3. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).

…ed gas transactions (#32307) - fix: cp-8.0.0 require EIP-7702 for sponsored gas transactions (#32253) ## **Description** Sponsored and gas-included transaction publishing depends on the EIP-7702 delegation relay path. Previously, when atomic EIP-7702 support was unavailable for the selected chain, the delegation publish hook returned an empty result, which allowed the publish pipeline to continue to later publication paths. This PR makes that path fail closed for sponsored and gas-included transactions by throwing a clear error when the chain does not support EIP-7702 atomic batching. Non-sponsored transactions keep the existing empty-result behavior when EIP-7702 is unavailable. ## **Changelog** CHANGELOG entry: Fixed sponsored and gas-included transactions falling back when EIP-7702 support is unavailable ## **Related issues** Refs: MetaMask/core#9240 ## **Manual testing steps** N/A - covered by unit tests for the transaction publish hook. ## **Screenshots/Recordings** N/A ### **Before** N/A ### **After** N/A ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Changes transaction publish behavior for gas-sponsored and gas-included flows on chains without EIP-7702, blocking unsafe fallbacks instead of silently continuing. > > **Overview** > **Sponsored** and **gas-included** publishes must use the EIP-7702 delegation relay. When atomic batch support is missing for the chain, `Delegation7702PublishHook` used to return an empty result so later publish hooks could run. > > This change **throws** for `isGasFeeSponsored` or `isGasFeeIncluded` when the chain is not EIP-7702-capable, with a clear error (prefixed as `Gas Station 7702:`). Regular transactions still get the empty result and can fall through. > > Gas flags are normalized earlier (`Boolean` on `isGasFeeIncluded` / `isGasFeeSponsored`) and `includeTransfer` now keys off the same `isSponsored` flag. Unit tests cover sponsored and gas-included cases when atomic batch is unsupported. > > Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4e5dfa7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).  [48adf87](48adf87) Co-authored-by: Matthew Walsh <matthew.walsh@consensys.net>

matthewwalsh0 changed the title ~~Fix direct mUSD vault batch fallback~~ Require EIP-7702 for direct mUSD vault batches Jun 23, 2026

matthewwalsh0 changed the title ~~Require EIP-7702 for direct mUSD vault batches~~ fix: require EIP-7702 for direct mUSD vault batches Jun 23, 2026

matthewwalsh0 mentioned this pull request Jun 23, 2026

fix: cp-8.0.0 require EIP-7702 for sponsored gas transactions MetaMask/metamask-mobile#32253

Merged

10 tasks

Fix direct mUSD vault batch fallback

ebd0f54

matthewwalsh0 force-pushed the fix/direct-musd-vault-7702 branch from 5994deb to ebd0f54 Compare June 23, 2026 16:11

matthewwalsh0 added the team-confirmations label Jun 23, 2026

chore: update changelogs for #9240

c5e597d

matthewwalsh0 marked this pull request as ready for review June 24, 2026 08:15

matthewwalsh0 requested review from a team as code owners June 24, 2026 08:15

matthewwalsh0 temporarily deployed to default-branch June 24, 2026 08:15 — with GitHub Actions Inactive

OGPoyraz approved these changes Jun 24, 2026

View reviewed changes

matthewwalsh0 added this pull request to the merge queue Jun 24, 2026

Merged via the queue into main with commit 8b8a31d Jun 24, 2026
786 of 788 checks passed

matthewwalsh0 deleted the fix/direct-musd-vault-7702 branch June 24, 2026 09:28

runway-github Bot mentioned this pull request Jun 24, 2026

chore(runway): cherry-pick fix: cp-8.0.0 require EIP-7702 for sponsored gas transactions MetaMask/metamask-mobile#32307

Merged

10 tasks

matthewwalsh0 mentioned this pull request Jun 24, 2026

fix(transaction-pay-controller): skip EIP-7702 upgrade check for direct mUSD vault deposits #9250

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: require EIP-7702 for direct mUSD vault batches#9240

fix: require EIP-7702 for direct mUSD vault batches#9240
matthewwalsh0 merged 2 commits into
mainfrom
fix/direct-musd-vault-7702

matthewwalsh0 commented Jun 23, 2026 •

edited by cursor Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

matthewwalsh0 commented Jun 23, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

matthewwalsh0 commented Jun 23, 2026 •

edited by cursor Bot

Loading