Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Add simulation retrigger #4792

Open
wants to merge 11 commits into
base: main
Choose a base branch
from

Conversation

OGPoyraz
Copy link
Member

Explanation

This PR adds a mechanism to re-trigger of simulations if the security provider mark transaction as malicious and the previous simulation native balance change is different then the previous simulation.

References

Fixes: https://github.com/MetaMask/MetaMask-planning/issues/3380

Changelog

@metamask/transaction-controller

  • ADDED: Add mechanism to re-trigger of simulations if the security provider mark transaction as malicious and the previous simulation native balance change is different then the previous simulation.
  • ADDED: Add changeInSimulationData property to simulationData in order to detect change of simulation data.

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've highlighted breaking changes using the "BREAKING" category above as appropriate
  • I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

@OGPoyraz OGPoyraz requested a review from a team as a code owner October 14, 2024 12:35
@OGPoyraz
Copy link
Member Author

@metamaskbot publish-preview

@@ -1307,6 +1307,9 @@ export type SimulationError = {

/** Simulation data for a transaction. */
export type SimulationData = {
/** Set to true if simulationData changed after updating security alert */
changeInSimulationData?: boolean;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of this property?

So the client can trigger an additional alert if the simulation isn't consistent?

If so, how do we differentiate between expected updates if the user changes the value or data?

Is this needed at all?

Copy link
Member Author

@OGPoyraz OGPoyraz Oct 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the designs, UI need to know if that re-simulation done because of the security alert. I thought this will be extra overhead in the UI to old and new values, so I've put it because of that.

Also I didn't have a chance to test this one out yet, so please consider this as draft for now.

// eslint-disable-next-line @typescript-eslint/naming-convention
result_type: string;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since string encompasses all the BlockaidResultType options, should we just leave it as string to minimise coupling to Blockaid?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

return transactionMeta;
}

#checkIfSimulationRetriggerNeeded(transactionMeta: TransactionMeta) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this keep firing unless we also pass the previousTransactionMeta and also check if any of the relevant inputs have changed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good spot Matthew, this is now fixed, comparing before and after

securityAlertResponse?.result_type === BlockaidResultType.Malicious;
const simulationNativeBalanceDifference =
simulationData?.nativeBalanceChange?.difference;
const isBalanceDifferenceEqual =
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we definitely looking for an exact comparison rather than a percentage difference?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do we think about the value on this? Would it make sense to make it 5%?

return false;
}

return true;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor, can we simplify to a single return since it's a boolean?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@@ -3599,9 +3600,42 @@ export class TransactionController extends BaseController<
);
}

if (this.#checkIfSimulationRetriggerNeeded(transactionMeta)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We still have the condition above and onTransactionParamsUpdated that also re-triggers a simulation, is it worth combining those for clarity?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've refactored that part a bit more, feedbacks appreciated!

@@ -1368,3 +1371,14 @@ export type SubmitHistoryEntry = {
/** The transaction parameters that were submitted. */
transaction: TransactionParams;
};

export enum BlockaidResultType {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather than defining a full enum, could we just define a local constant such as BLOCKAID_RESULT_TYPE_MALICIOUS?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Contributor

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.
{
  "@metamask-previews/accounts-controller": "18.2.2-preview-3fec6ed",
  "@metamask-previews/address-book-controller": "6.0.1-preview-3fec6ed",
  "@metamask-previews/announcement-controller": "7.0.1-preview-3fec6ed",
  "@metamask-previews/approval-controller": "7.1.0-preview-3fec6ed",
  "@metamask-previews/assets-controllers": "38.3.0-preview-3fec6ed",
  "@metamask-previews/base-controller": "7.0.1-preview-3fec6ed",
  "@metamask-previews/build-utils": "3.0.1-preview-3fec6ed",
  "@metamask-previews/chain-controller": "0.1.3-preview-3fec6ed",
  "@metamask-previews/composable-controller": "9.0.1-preview-3fec6ed",
  "@metamask-previews/controller-utils": "11.3.0-preview-3fec6ed",
  "@metamask-previews/ens-controller": "14.0.1-preview-3fec6ed",
  "@metamask-previews/eth-json-rpc-provider": "4.1.4-preview-3fec6ed",
  "@metamask-previews/gas-fee-controller": "20.0.1-preview-3fec6ed",
  "@metamask-previews/json-rpc-engine": "9.0.3-preview-3fec6ed",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.3-preview-3fec6ed",
  "@metamask-previews/keyring-controller": "17.2.2-preview-3fec6ed",
  "@metamask-previews/logging-controller": "6.0.1-preview-3fec6ed",
  "@metamask-previews/message-manager": "10.1.1-preview-3fec6ed",
  "@metamask-previews/name-controller": "8.0.1-preview-3fec6ed",
  "@metamask-previews/network-controller": "21.0.1-preview-3fec6ed",
  "@metamask-previews/notification-controller": "7.0.0-preview-3fec6ed",
  "@metamask-previews/notification-services-controller": "0.9.0-preview-3fec6ed",
  "@metamask-previews/permission-controller": "11.0.2-preview-3fec6ed",
  "@metamask-previews/permission-log-controller": "3.0.1-preview-3fec6ed",
  "@metamask-previews/phishing-controller": "12.0.3-preview-3fec6ed",
  "@metamask-previews/polling-controller": "10.0.1-preview-3fec6ed",
  "@metamask-previews/preferences-controller": "13.0.3-preview-3fec6ed",
  "@metamask-previews/profile-sync-controller": "0.9.7-preview-3fec6ed",
  "@metamask-previews/queued-request-controller": "5.1.0-preview-3fec6ed",
  "@metamask-previews/rate-limit-controller": "6.0.1-preview-3fec6ed",
  "@metamask-previews/selected-network-controller": "18.0.1-preview-3fec6ed",
  "@metamask-previews/signature-controller": "19.1.0-preview-3fec6ed",
  "@metamask-previews/transaction-controller": "37.2.0-preview-3fec6ed",
  "@metamask-previews/user-operation-controller": "15.0.1-preview-3fec6ed"
}

@OGPoyraz OGPoyraz requested review from a team as code owners October 15, 2024 11:24
@OGPoyraz OGPoyraz requested a review from a team as a code owner October 15, 2024 11:34
Copy link

socket-security bot commented Oct 15, 2024

Removed dependencies detected. Learn more about Socket for GitHub ↗︎

🚮 Removed packages: npm/[email protected]

View full report↗︎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants