feat: filter malicious non-evm activity transactions#42176
Conversation
Co-authored-by: Copilot <copilot@github.com>
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
There was a problem hiding this comment.
Renamed to token-scan.ts
✨ Files requiring CODEOWNER review ✨👨🔧 @MetaMask/core-extension-ux (2 files, +150 -11)
|
d680342 to
03683a5
Compare
03683a5 to
108052d
Compare
Builds ready [108052d]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 8 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
108052d to
0d0bf6d
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0d0bf6d. Configure here.
Builds ready [0d0bf6d]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 8 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
0d0bf6d to
6fbc4cd
Compare
6fbc4cd to
ecf4d30
Compare
|
Builds ready [ecf4d30]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 8 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|




Description
Filter non-EVM activity when a token in the transaction is already marked Malicious in tokenScanCache
Changelog
CHANGELOG entry: feat: filter malicious non-evm activity transactions
Related issues
Fixes:
Manual testing steps
Go to this Activity tab of a known account with scam transactions
Screenshots/Recordings
Before
After
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Medium Risk
Changes which non-EVM transactions are shown by filtering activity based on
tokenScanCachetrust results, which could unintentionally hide legitimate transactions if scan keys or cache entries are wrong. Scope is limited to UI selectors/rendering and adds test coverage.Overview
Non-EVM activity rows are now filtered out when any fungible token in the transaction is already marked
MaliciousintokenScanCache.ActivityListswitches to a new selector (selectNonEvmTransactionsForActivity) so the merged activity feed excludes flagged Solana token movements while leaving native-only and unscanned transactions visible.This introduces a shared
token-scanutility for generating normalized cache keys and extracting token scan keys from non-EVM transaction movements/fees, plus a newselectTokenScanResultsselector and exportsgetTokenScanCachefor reuse. Adds unit/integration tests covering key generation, key collection, selector filtering behavior, and ActivityList rendering for malicious vs non-malicious non-EVM transactions.Reviewed by Cursor Bugbot for commit ecf4d30. Bugbot is set up for automated code reviews on this repo. Configure here.