diff --git a/app/lib/ppom/ppom-util.test.ts b/app/lib/ppom/ppom-util.test.ts index b5f9faa220b..d0073396a45 100644 --- a/app/lib/ppom/ppom-util.test.ts +++ b/app/lib/ppom/ppom-util.test.ts @@ -33,6 +33,12 @@ jest.mock('../../core/Engine', () => ({ providerConfig: { chainId: CHAIN_ID_MOCK }, }, }, + AccountsController: { + state: { + internalAccounts: { accounts: [] }, + }, + listAccounts: () => [], + }, }, })); @@ -110,6 +116,22 @@ describe('PPOM Utils', () => { expect(spyTransactionAction).toBeCalledTimes(0); }); + it('should not validate if request is send to users own account ', async () => { + const spyTransactionAction = jest.spyOn( + TransactionActions, + 'setTransactionSecurityAlertResponse', + ); + MockEngine.context.PreferencesController.state.securityAlertsEnabled = + false; + MockEngine.context.AccountsController.listAccounts = () => [ + { address: '0x0c54FcCd2e384b4BB6f2E405Bf5Cbc15a017AaFb' }, + ]; + await PPOMUtil.validateRequest(mockRequest, CHAIN_ID_MOCK); + expect(MockEngine.context.PPOMController?.usePPOM).toBeCalledTimes(0); + expect(spyTransactionAction).toBeCalledTimes(0); + MockEngine.context.AccountsController.listAccounts = () => []; + }); + it('should not validate user if on a non supporting blockaid network', async () => { const spyTransactionAction = jest.spyOn( TransactionActions, diff --git a/app/lib/ppom/ppom-util.ts b/app/lib/ppom/ppom-util.ts index fa02d01ce0b..56185d0d6e1 100644 --- a/app/lib/ppom/ppom-util.ts +++ b/app/lib/ppom/ppom-util.ts @@ -24,9 +24,13 @@ import { } from './security-alerts-api'; import { PPOMController } from '@metamask/ppom-validator'; +interface Params { + to: string; +} + export interface PPOMRequest { method: string; - params: unknown[]; + params: Params[]; origin?: string; } @@ -61,6 +65,7 @@ async function validateRequest(req: PPOMRequest, transactionId?: string) { PPOMController: ppomController, PreferencesController, NetworkController, + AccountsController, } = Engine.context; const chainId = NetworkController.state.providerConfig.chainId; @@ -80,6 +85,20 @@ async function validateRequest(req: PPOMRequest, transactionId?: string) { return; } + if (req.method === 'eth_sendTransaction') { + const internalAccounts = AccountsController.listAccounts(); + const { to: toAddress } = req?.params?.[0] ?? {}; + + if ( + internalAccounts.some( + ({ address }: { address: string }) => + address?.toLowerCase() === toAddress?.toLowerCase(), + ) + ) { + return; + } + } + const isTransaction = isTransactionRequest(req); let securityAlertResponse: SecurityAlertResponse | undefined;