feat(WPN-1652): add CoreAssetsAdapter for Solana (not yet routed)

[ulissesferreira]

Summary

• Add CoreAssetsAdapter, mapControllerAsset, messenger types, and SDK 11.2.0 endowment
• Construct adapter in snapContext but do not route production balance reads through it
• SnapAssetsAdapter remains the sole read path

Test plan

• CoreAssetsAdapter unit tests
• yarn workspace @metamask/solana-wallet-snap test:core (946 passed)
• Grep: no #coreAssetsAdapter calls from AssetsService public methods

Stacked on #636. Next: choose Lane A (4a) or Lane B (4b).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask-previews/​snap-networks-utils@​0.0.0-preview-8589132
	@​metamask/​assets-controller@​13.0.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @metamask/network-controller@34.0.0
• @metamask/network-controller@35.0.0
• @metamask/remote-feature-flag-controller@4.2.2
• @metamask/remote-feature-flag-controller@5.0.0
• @tanstack/query-core@5.101.4
• ulid@2.4.0
• @metamask/assets-controller@13.0.0
• @metamask/assets-controller@13.1.0
• @ethersproject/providers@5.8.0
• @metamask/assets-controllers@110.1.0
• @metamask/config-registry-controller@2.0.0
• @metamask/core-backend@8.1.0
• @metamask/core-backend@7.0.0
• @metamask/phishing-controller@17.3.0
• @metamask/transaction-controller@69.2.1
• @metamask/transaction-controller@69.4.0
• @metamask/profile-sync-controller@28.3.0
• @metamask/eth-json-rpc-infura@10.3.0
• ethereumjs-wallet@1.0.2
• @metamask/multichain-network-controller@3.2.2
• keccak@3.0.4
• secp256k1@4.0.4
• @metamask/geolocation-controller@1.0.0
• rlp@2.2.7
• bs58@4.0.1
• node-addon-api@5.1.0
• ws@8.18.0
• @metamask/snaps-controllers@19.0.1
• bech32@1.1.4
• ripemd160@2.0.3
• sha.js@2.4.12
• apg-js@4.4.0

View full report

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/assets-controller@11.2.0
Direct dependency for Core AssetsController messenger action types; published snap dist does not bundle controller runtime.
Network/fetch is expected for MetaMask controller packages already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/snaps-controllers@19.0.1
Transitive via @metamask/assets-controller (messenger action types only; controller runtime not in published dist).
First-party MetaMask controller package; obfuscation alert is compiled/transpiled controller bundle.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/assets-controllers@110.0.0
Transitive via @metamask/assets-controller (types-only usage; controller runtime not shipped in published dist).
First-party MetaMask controller package; network access expected for RPC/API controllers in MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/core-backend@7.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/eth-json-rpc-infura@10.3.0
Transitive via @metamask/assets-controller. First-party MetaMask JSON-RPC client used by network controllers.
Publisher change gudahtt → metamaskbot is MetaMask org maintainers; package already in MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/network-controller@34.0.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/phishing-controller@17.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/profile-sync-controller@28.3.0
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@4.2.2
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/transaction-controller@69.2.1
Transitive via @metamask/assets-controller (types-only import path; controller runtime not in published dist).
First-party MetaMask controller package; network access expected and already used across MetaMask/core. AI anomaly is benign signature-verification utility code.

[ulissesferreira]

@SocketSecurity ignore npm/@ethersproject/providers@5.8.0
Transitive via @metamask/assets-controller. Standard ethers v5 JSON-RPC provider used by MetaMask controllers.
Not executed in @metamask/solana-wallet-snap published output; already present across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/@tanstack/query-core@5.101.4
Transitive via @metamask/assets-controller. Standard TanStack Query core used by MetaMask controllers for data fetching.
Not executed in @metamask/solana-wallet-snap published output; already present across MetaMask/core.

[ulissesferreira]

@SocketSecurity ignore npm/apg-js@4.4.0
Transitive via @metamask/assets-controller → @spruceid/siwe-parser. Standard ABNF parser used for SIWE message parsing.
Obfuscation alert is minified/generated parser tables; not bundled in published snap dist.

[ulissesferreira]

@SocketSecurity ignore npm/keccak@3.0.4
Transitive via @metamask/assets-controller → ethereum crypto stack. Standard keccak native addon used across MetaMask/core for address/hash operations.
Native binaries alert is expected for this package.

[ulissesferreira]

@SocketSecurity ignore npm/secp256k1@4.0.4
Transitive via @metamask/assets-controller → ethereum-cryptography. Standard secp256k1 native addon for ECDSA used across MetaMask/core.
Native binaries alert is expected for this elliptic-curve crypto primitive.

[ulissesferreira]

@SocketSecurity ignore npm/bech32@1.1.4
Transitive via @metamask/assets-controller → @ethersproject/providers. Standard bech32 encoding library used by Ethereum address tooling.
Publisher change is routine npm maintainer handoff; not bundled in published snap dist.

[ulissesferreira]

@SocketSecurity ignore npm/bs58@4.0.1
Transitive via @metamask/assets-controller (also used by Solana address encoding). Standard base58 codec for blockchain addresses.
Publisher change is routine npm maintainer handoff; required crypto/encoding primitive.

[ulissesferreira]

@SocketSecurity ignore npm/ethereumjs-wallet@1.0.2
Transitive via @metamask/assets-controller. Legacy ethereumjs-wallet used by MetaMask controller dependency tree.
Publisher change is ethereumjs org maintainer rotation; deprecated notice is upstream rename to @ethereumjs/wallet.

[ulissesferreira]

@SocketSecurity ignore npm/ripemd160@2.0.3
Transitive via @metamask/assets-controller → pbkdf2/create-hash crypto stack. Standard RIPEMD-160 hash used in HD wallet derivation.
Publisher change is routine npm maintainer handoff; standard crypto primitive.

[ulissesferreira]

@SocketSecurity ignore npm/rlp@2.2.7
Transitive via @metamask/assets-controller. Standard RLP encoding library in MetaMask/core dependency tree.
Publisher change holgerd77 → ralxz is ethereumjs org maintainer rotation.

[ulissesferreira]

@SocketSecurity ignore npm/sha.js@2.4.12
Transitive via @metamask/assets-controller → pbkdf2/create-hash crypto stack. Standard SHA hash implementation used across MetaMask/core.
Publisher change is routine npm maintainer handoff; standard crypto primitive.

[ulissesferreira]

@SocketSecurity ignore npm/ulid@2.4.0
Transitive via @metamask/assets-controller. Standard ULID generator used by MetaMask controllers.
Publisher change alizain → perrymitchell is routine npm maintainer handoff on the ulid package.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask-previews/snap-networks-utils@0.0.0-preview-8589132

First-party MetaMask package: preview build of the shared AssetsProvider from MetaMask/internal-snaps PR #82 (WPN-1784), source reviewed in that PR. Used as the snap's thin messenger read layer for AssetsController actions.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/assets-controller@13.0.0

First-party MetaMask core package; snap uses it types-only (messenger action types for the AssetsProvider). The controller itself runs in the host extension, never inside the snap.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/assets-controller@13.1.0

First-party MetaMask core package; resolved transitively from the preview snap-networks-utils package. Types-only usage in the snap; controller executes in the host.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/assets-controllers@110.1.0

First-party MetaMask core package pulled transitively by assets-controller 13.x. Never executed by the snap (types-only dependency graph); network access is inherent to controller design and gated by the host.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/config-registry-controller@2.0.0

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; network access is standard for MetaMask controllers and runs in the host.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/core-backend@8.1.0

First-party MetaMask core package, transitive dependency of the assets-controller family. Not executed by the snap bundle; network access by design, host-gated.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/geolocation-controller@1.0.0

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; network access is controller-inherent and host-gated.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/multichain-network-controller@3.2.2

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; standard MetaMask controller network usage.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/network-controller@35.0.0

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; fetch/websocket usage is core to its design and runs in the host.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/remote-feature-flag-controller@5.0.0

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; network access is its designed function (remote flags) and is host-gated.

[ulissesferreira]

@SocketSecurity ignore npm/@metamask/transaction-controller@69.4.0

First-party MetaMask core package, transitive from assets-controller 13.x. Not executed by the snap; controller network usage is host-gated.

[ulissesferreira]

@SocketSecurity ignore npm/ws@8.18.0

Standard, widely-adopted WebSocket library (ws), transitive from MetaMask network controllers. No known vulnerabilities; used by host-side networking only, not the snap bundle.

[ulissesferreira]

@SocketSecurity ignore npm/node-addon-api@5.1.0

Node.js native addon API helper, transitive dependency; not executed by the snap bundle (no native addons in the snap). Quality-only alert, no security impact.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
56.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud