feat(temp): Perps Controller integration by gambinish · Pull Request #40078 · MetaMask/metamask-extension

gambinish · 2026-02-13T03:47:14Z

Description

Summary

This PR integrates @metamask/perps-controller into MetaMask Extension, establishing the controller layer for perpetual futures trading functionality. It was scoped down from a larger feature branch to focus on controller integration only — the initial UI was handled in a separate "mocked" PR (#40076, which was merged first).

What's Included

Core controller setup:

PerpsController integrated via app/scripts/controllers/perps/infrastructure.ts — wires platform-specific infrastructure (KeyringController signing, MetaMetrics, Sentry, performance monitoring)
PerpsStreamBridge (app/scripts/controllers/perps/perps-stream-bridge.ts) — per-connection manager for WebSocket subscription lifecycle, bridging background controller streams to the UI outStream
Controller registered in metamask-controller.js with messenger, stream bridge, and API surface (perpsInit, perpsActivateStreaming, perpsViewActive, etc.)
Controller messenger defined in app/scripts/controller-init/messengers/perps-controller-messenger.ts

Dependencies:
@metamask/perps-controller@^1.0.0 (production package — preview dependency fully removed)

Related Branches

UI Branch: feat: Perps UI #40076
Initial feature branch: feat: PoC PerpsController intergration #39721
PerpsHome refactor: refactor: Merge perps home to tab #40610 (Will need to be rebased into this branch before merging to main)

Changelog

CHANGELOG entry: Integrate Perps Controller

Related issues

Fixes:

Manual testing steps

Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Adds a new background controller and per-connection streaming lifecycle to metamask-controller plus new build/policy allowances for multiple ESM dependencies, which could affect runtime stability and bundle/permission constraints if misconfigured.

Overview
Integrates @metamask/perps-controller into the extension controller layer by registering a new PerpsController (with persisted-state merge and a defensive ensureInitialized guard) and exposing a background API surface (perpsInit, trading/data methods, and preferences helpers).

Adds a per-UI-connection PerpsStreamBridge to manage WebSocket subscription lifecycles and emit perpsStreamUpdate messages (static account/order/position streams plus dynamic price/orderbook/candle streams), including teardown on disconnect/testnet toggle/outstream end.

Updates controller messenger wiring and initialization plumbing, adds a geoblock fallback env var (MM_PERPS_BLOCKED_REGIONS), removes prior perps-controller mocks in Jest/webpack configs, and extends build/webpack/LavaMoat policies to allow the new perps and SDK ESM/transitive dependencies; includes comprehensive unit tests for the init logic, infrastructure stubs, and stream bridge.

^{Written by Cursor Bugbot for commit 116b98c. This will update automatically on new commits. Configure here.}

github-actions · 2026-02-13T03:47:25Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2026-02-13T03:58:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
@metamask/perps-controller@1.0.0
ws@8.19.0
viem@2.44.4 ⏵ 2.46.3	^-1	⁺¹

View full report

socket-security · 2026-02-13T03:58:38Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		System shell access: npm `@inquirer/external-editor` in module child_process Module: child_process Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/@inquirer/external-editor@2.0.3` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@inquirer/external-editor@2.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@metamask/perps-controller` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → `npm/@metamask/perps-controller@1.0.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@metamask/perps-controller@1.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@myx-trade/sdk` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/@myx-trade/sdk@0.1.265` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@myx-trade/sdk@0.1.265`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@nktkas/hyperliquid` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/@nktkas/hyperliquid@0.30.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@nktkas/hyperliquid@0.30.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `ethers` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/ethers@6.16.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ethers@6.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `ethers` in module net Module: net Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/ethers@6.16.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ethers@6.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `ethers` in module http Module: http Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/ethers@6.16.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ethers@6.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `ethers` in module https Module: https Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/ethers@6.16.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ethers@6.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `micro-eth-signer` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/micro-eth-signer@0.18.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/micro-eth-signer@0.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `wretch` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/wretch@2.11.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/wretch@2.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `ethers` is 100.0% likely to have a medium risk anomaly Notes: The analyzed code fragment appears to be a conventional ABI interface utility (likely from a library like ethers.js) used to parse, encode, and decode Ethereum function calls, events, and errors. There is no evidence of malicious behavior such as data exfiltration, remote control, or code injection. Minor anomalies (typo in an error message and a partially commented/unfinished block) are present but do not constitute malicious activity. Overall security risk from this fragment is low, assuming it is used as intended within a trusted library context. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/@metamask/perps-controller@1.0.0` → `npm/ethers@6.16.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ethers@6.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

metamaskbotv2 · 2026-02-13T03:58:58Z

✨ Files requiring CODEOWNER review ✨

👨‍🔧 @MetaMask/extension-platform (1 files, +34 -0)

📁 test/
- 📁 e2e/
  - 📁 fixtures/
    - 📄 onboarding-fixture.json +34 -0

🕵️ @MetaMask/extension-privacy-reviewers (1 files, +1 -0)

📄 privacy-snapshot.json +1 -0

👨‍🔧 @MetaMask/perps (4 files, +1370 -0)

📁 app/
- 📁 scripts/
  - 📁 controllers/
    - 📁 perps/
      - 📄 infrastructure.test.ts +79 -0
      - 📄 infrastructure.ts +176 -0
      - 📄 perps-stream-bridge.test.ts +865 -0
      - 📄 perps-stream-bridge.ts +250 -0

📜 @MetaMask/policy-reviewers (8 files, +1700 -0)

📁 lavamoat/
- 📁 browserify/
  - 📁 beta/
    - 📄 policy.json +231 -0
  - 📁 experimental/
    - 📄 policy.json +231 -0
  - 📁 flask/
    - 📄 policy.json +231 -0
  - 📁 main/
    - 📄 policy.json +231 -0
- 📁 webpack/
  - 📁 mv2/
    - 📁 beta/
      - 📄 policy.json +194 -0
    - 📁 experimental/
      - 📄 policy.json +194 -0
    - 📁 flask/
      - 📄 policy.json +194 -0
    - 📁 main/
      - 📄 policy.json +194 -0

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.

🧪 @MetaMask/qa (1 files, +34 -0)

📁 test/
- 📁 e2e/
  - 📁 fixtures/
    - 📄 onboarding-fixture.json +34 -0

…taMask/metamask-extension into perps/poc-controller-integration-temp

…c-controller-integration-temp

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

cursor · 2026-03-09T20:24:59Z