Repository navigation
fix(tron): align security warnings and scan preferences - #557
Merged
Merged
Conversation
taran-a
temporarily deployed
to
default-branch
November 4, 2026 19:40 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
taran-a
force-pushed
the
feat/tron-align-security-warning-loading
branch
from
November 4, 2026 19:41
028dbb2 to
3855c09
Compare
taran-a
force-pushed
the
feat/tron-align-security-warning-loading
branch
from
November 5, 2026 07:17
3855c09 to
f241d4d
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new security warning is untranslated in the Spanish catalog, and the changelog incorrectly attributes the unreleased fix to version 4.3.1.
2 open issues
What changed in this PR
Updates Tron transaction confirmations to respect security-alert and simulation preferences while keeping local validity checks active.
Changes:
- Separates warning copy from malicious-request copy and limits the loading banner to the initial scan.
- Makes send scans preference-aware and preserves existing findings during background refreshes.
- Adds regression tests, warning-message entries, and changelog documentation.
| File | Description |
|---|---|
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmTransactionRequest/render.tsx |
Validates transaction structure and respects scan preferences. |
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmTransactionRequest/render.test.tsx |
Tests validation and scan-preference combinations. |
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmTransactionRequest/ConfirmTransactionRequest.test.tsx |
Tests initial loading and retained background warnings. |
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmSignTransaction/render.tsx |
Checks local expiry before enabling confirmation when scans are disabled. |
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmSignTransaction/render.test.tsx |
Tests preference handling and local blockers. |
packages/tron-wallet-snap/src/ui/confirmation/views/ConfirmSignTransaction/ConfirmSignTransaction.test.tsx |
Tests warning copy and background-refresh presentation. |
packages/tron-wallet-snap/src/ui/confirmation/utils/getTransactionAlertProps.ts |
Uses distinct warning messages and initial-only loading state. |
packages/tron-wallet-snap/src/handlers/cronjob/cronjob.tsx |
Makes send refresh scans preference-aware while retaining transaction refreshes. |
packages/tron-wallet-snap/src/handlers/cronjob/cronjob.test.tsx |
Tests transaction refreshes with scans disabled. |
packages/tron-wallet-snap/messages.json |
Defines dedicated risk-warning messages. |
packages/tron-wallet-snap/locales/es.json |
Adds warning entries to the Spanish catalog. |
packages/tron-wallet-snap/locales/en.json |
Adds English warning translations. |
packages/tron-wallet-snap/CHANGELOG.md |
Documents warning and scan-preference changes. |
Review effort: Balanced
|
| // Always request simulation for estimated changes; | ||
| // conditionally add validation based on user preference | ||
| const options: SecurityAlertsScanOption[] = ['simulation']; | ||
| // 3. Scan only when security alerts or simulation are enabled. |
Julink-eth
approved these changes
Nov 5, 2026
ulissesferreira
approved these changes
Nov 5, 2026
Contributor
|
@metamaskbot publish-preview |
This was referenced Nov 6, 2026
Merged
LabinatorSolutions
pushed a commit
to LabinatorSolutions/metamask-extension
that referenced
this pull request
Nov 7, 2026
<!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** Bumps the Solana, Stellar, and Tron wallet snaps to the versions released in internal-snaps `22.0.0`: - `@metamask/solana-wallet-snap`: `^7.2.0` → `^7.3.0` - `@metamask/stellar-wallet-snap`: `^2.0.0` → `^2.1.0` - `@metamask/tron-wallet-snap`: `^4.3.1` → `^4.4.0` All three are backwards-compatible minor updates; no application code changes are required. ### @metamask/solana-wallet-snap 7.3.0 - Remove the temporary fallback that injected `https://metamask.io` as the request origin when `keyring_submitRequest` was called without one ([MetaMask#533](MetaMask/internal-snaps#533)). ### @metamask/stellar-wallet-snap 2.1.0 - `confirmSend` now throws when signing or submission fails after the user confirms, instead of returning a JSON error response ([MetaMask#550](MetaMask/internal-snaps#550)). - Bump `@stellar/stellar-sdk` from `^17.2.1` to `^17.4.0` ([MetaMask#545](MetaMask/internal-snaps#545)). - Retry transient Token API, Price API, Security Alerts API, RPC, and Horizon failures with bounded timeouts and circuit breaking ([MetaMask#534](MetaMask/internal-snaps#534), [MetaMask#551](MetaMask/internal-snaps#551)). - Fix `onAmountInput` to accept the optional destination as `toAddress` instead of `to` ([MetaMask#558](MetaMask/internal-snaps#558)). ### @metamask/tron-wallet-snap 4.4.0 - Support `VoteWitnessContract` and `AccountPermissionUpdateContract` transactions by upgrading TronWeb to 6.5.1 ([MetaMask#561](MetaMask/internal-snaps#561)). - Align transaction security warning copy and scan-loading behavior with user preferences ([MetaMask#557](MetaMask/internal-snaps#557)). ## **Changelog** CHANGELOG entry: null ## **Related issues** n/a ## **Manual testing steps** n/a ## **Screenshots/Recordings** ### **Before** <!-- [screenshots/recordings] --> ### **After** <!-- [screenshots/recordings] --> ## **Pre-merge author checklist** - [X] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [X] I've completed the PR template to the best of my ability - [X] I’ve included tests if applicable - [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [X] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
anxolin
pushed a commit
to anxolin/internal-snaps
that referenced
this pull request
Nov 7, 2026
## Explanation This release branch prepares version `22.0.0`. It contains: - `@metamask/solana-wallet-snap` `7.2.0` → `7.3.0` (minor: remove obsolete `https://metamask.io` origin fallback) - `@metamask/stellar-wallet-snap` `2.0.0` → `2.1.0` (minor: fetch policy for RPC, Horizon and HTTP clients, `@stellar/stellar-sdk` upgrade, `onAmountInput` `toAddress` fix, `confirmSend` now throws after confirmation failures) - `@metamask/tron-wallet-snap` `4.3.1` → `4.4.0` (minor: `VoteWitnessContract` and `AccountPermissionUpdateContract` support via TronWeb 6.5.1, security warning copy and scan-loading alignment) - Root monorepo version bumped to `22.0.0` ## References - `@metamask/solana-wallet-snap`: [MetaMask#533](MetaMask#533) - `@metamask/stellar-wallet-snap`: [MetaMask#550](MetaMask#550), [MetaMask#545](MetaMask#545), [MetaMask#534](MetaMask#534), [MetaMask#551](MetaMask#551), [MetaMask#558](MetaMask#558) - `@metamask/tron-wallet-snap`: [MetaMask#561](MetaMask#561), [MetaMask#557](MetaMask#557) ## Checklist - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/internal-snaps/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/internal-snaps/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Updates Tron security warning copy and shows the loading banner only during the initial scan. Respects security-alert and simulation preferences while preserving existing findings during background refreshes and keeping local transaction checks active.
Cases addressed from the reference:
References
Checklist