Skip to content
This repository was archived by the owner on Jul 31, 2026. It is now read-only.

feat: use security api for simulations - #205

Merged
ulissesferreira merged 10 commits into
mainfrom
feat/use-security-api-for-simulations
Feb 12, 2026
Merged

feat: use security api for simulations#205
ulissesferreira merged 10 commits into
mainfrom
feat/use-security-api-for-simulations

Conversation

@Julink-eth

@Julink-eth Julink-eth commented Feb 11, 2026

Copy link
Copy Markdown
Contributor

Explanation

Add security scanning (Blockaid) for simple token sends, matching the existing pattern used for swaps/dapp transactions and the Solana Snap.

  • Calls the Security Alerts API on every send confirmation to get transaction simulation and validation results
  • Displays TransactionAlert (when useSecurityAlerts is enabled) and EstimatedChanges from the scan response (when simulateOnChainActions is enabled), replacing the previous static estimated changes
  • Disables the Confirm button while the scan is in flight or on error
  • Refreshes the scan every 20s via a new RefreshConfirmationSend background job
  • Tracks SecurityScanCompleted and SecurityAlertDetected analytics events

References

Fixes NEB-324

Test

  • Go to https://tronscan.on.btfs.io/#/contract/TNUC9Qb1rRpS5CbWLmNMxXBjyFoydXjWFR/code
  • Connect your tron account on MM
  • In Write Contract select the deposit method
  • Write a small number like 1 in "Amount token to Send_unit256"
  • Click on send
  • You should see the estimated changes:
    You send. -0.000001 TRX
    You receive. +0.000001 WTRX
  • Dismiss the tx
  • Repeat the test but putting a very big number like 1000000000000000000
  • Click on send again
  • You should see "This transaction was reverted during simulation. Validate InternalTransfer error, balance is not sufficient."
  • You should see "No estimated changes"
  • Dismiss the tx

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

@Julink-eth
Julink-eth requested a review from a team as a code owner February 11, 2026 16:28
@ulissesferreira

Copy link
Copy Markdown
Contributor

The logic implemented by this PR is perfect and follows the standard set by Solana which is cool to have more code similarities. I have found some improvements though that should happen at the tests level which we are trying to enforce everywhere. Dropping them in the appropriate places

let mockTransactionScanService: jest.Mocked<TransactionScanService>;
let cronHandler: CronHandler;

beforeEach(() => {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quoting Michele here, following our Contributor Guidelines for new tests (we can change the existing ones as we go) I would love it if we could remove the beforeEach and "instead, we should prefer setup functions that wrap the test logic and provide the necessary context for the test, e.g.: https://github.com/MetaMask/core/blob/78fe98b1e74e2d1aea047727ec789121f123eb50/packages/profile-metrics-controller/src/ProfileMetricsController.test.ts#L719-L719"

More can be read about it here. I have some open PRs that follow this approach that you can pass to your favorite LLM to adapt the changes for you:

#197
#190

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Screenshot 2026-02-11 at 17 05 20

getInterfaceContext: jest.fn().mockResolvedValue(interfaceContext),
scheduleBackgroundEvent: jest.fn().mockResolvedValue(undefined),
getPreferences: jest.fn().mockResolvedValue({}),
} as unknown as jest.Mocked<SnapClient>;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove these unknown's? Even if it involves more boilerplate code

const mockState = {
setKey: jest.fn().mockResolvedValue(undefined),
getKey: jest.fn().mockResolvedValue(mapInterfaceNameToId),
} as unknown as jest.Mocked<{ getKey: jest.Mock; setKey: jest.Mock }>;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove these unknown's? Even if it involves more boilerplate code

const mockTransactionScanService = {
scanTransaction: jest.fn().mockResolvedValue(scanResult),
getSecurityAlertDescription: jest.fn().mockReturnValue('description'),
} as unknown as jest.Mocked<TransactionScanService>;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove these unknown's? Even if it involves more boilerplate code

error: jest.fn(),
log: jest.fn(),
debug: jest.fn(),
} as any,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove this any?

} as any,
accountsService: {} as AccountsService,
snapClient: mockSnapClient,
state: mockState as any,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And this one too?

@ulissesferreira
ulissesferreira merged commit 30ad563 into main Feb 12, 2026
11 checks passed
@ulissesferreira
ulissesferreira deleted the feat/use-security-api-for-simulations branch February 12, 2026 14:53
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants