Description

Users can bypass the entire onboarding flow by navigating directly to the completion route (#/onboarding/completion), rendering the CreationSuccessful component without having created a wallet. Clicking "Open wallet" then calls completeOnboarding(), marking onboarding as complete even though the KeyringController vault was never created. This leads to an inconsistent state where the extension appears onboarded but has no wallet, causing errors when trying to unlock.

This PR adds a guard to the CreationSuccessful component that checks whether the wallet has been initialized (isInitialized). If the wallet is not initialized and the user is not arriving from a settings reminder, they are redirected back to the onboarding welcome page. This prevents users from skipping mandatory onboarding steps by directly manipulating route URLs.

Changelog

CHANGELOG entry: Fixed a security issue where users could skip onboarding by navigating directly to the completion route

Related issues

Fixes: #37079

Manual testing steps

1. Load the extension in Chrome and begin a fresh onboarding (clear extension data if needed)
2. Instead of going through the onboarding flow, navigate directly to chrome-extension://<extension-id>/home.html#/onboarding/completion
3. Verify that you are redirected back to the onboarding welcome page instead of seeing the "Your wallet is ready!" screen
4. Complete the normal onboarding flow (create password, back up SRP, etc.)
5. Verify the completion screen renders correctly after proper onboarding
6. After onboarding, go to Settings → Security & Privacy → Reveal Secret Recovery Phrase → back up SRP again
7. Verify the completion screen renders correctly when arriving from the settings reminder flow (?isFromReminder=true)

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.