Skip to content

feat: Perform dappscanning when any EIP-7715 related request is received#40587

Merged
HowardBraham merged 3 commits intomainfrom
feat/dapp-scan-7715-methods
Mar 6, 2026
Merged

feat: Perform dappscanning when any EIP-7715 related request is received#40587
HowardBraham merged 3 commits intomainfrom
feat/dapp-scan-7715-methods

Conversation

@jeffsmale90
Copy link
Contributor

@jeffsmale90 jeffsmale90 commented Mar 4, 2026

Description

EIP-7715 specifies some new RPC methods that are available without a wallet connection:

  • wallet_requestExecutionPermissions
  • wallet_getGrantedExecutionPermissions
  • wallet_getSupportedExecutionPermissions

Because wallet_requestExecutionPermissions allows a dapp to request permissions from the wallet, it's important that we trigger dapp-scanning of the dapp's domain as early as possible, to ensure the greatest likelihood that a response is available to warn the user.

This PR adds the three RPC methods listed above to the methods that will trigger dapp scanning when called.

Open in GitHub Codespaces

Changelog

CHANGELOG entry: Trigger malicious website scanning when any EIP-7715 RPC method is executed

Testing

  • Navigate to a dapp
  • Open dev tools in the wallet
  • Trigger one of the methods above

Expect a request to https://dapp-scanning.api.cx.metamask.io/scan?url= (or otherwise configured dapp-scanning URL

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Adds new RPC methods to the trust-signals scan trigger path, which can increase phishing scan calls and affect UX/performance for dapps using EIP-7715. Behavior change is localized and covered by targeted tests.

Overview
Adds the EIP-7715 execution-permissions RPC methods (e.g. wallet_requestExecutionPermissions) to the set of requests that trigger dapp origin scanning via phishingController.scanUrl, even when no connection is established.

Introduces MESSAGE_TYPE constants and a new isEip7715AdvancedPermissionsRequest helper, and extends trust-signals-middleware tests to assert scanning occurs only when an origin is present for each new method.

Written by Cursor Bugbot for commit 7ac3033. This will update automatically on new commits. Configure here.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 4, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-delegation MetaMask Delegation Team label Mar 4, 2026
@github-actions github-actions bot added the size-S label Mar 4, 2026
@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Mar 4, 2026

Builds ready [3a25058]
⚡ Performance Benchmarks
👆 Interaction Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Load New Accountload_new_account31027535033335350
total31027535033335350
Confirm Txconfirm_tx5988597460031059896003
total5988597460031059896003
Bridge User Actionsbridge_load_page22919325827251258
bridge_load_asset_picker15710923648183236
bridge_search_token6926916941692694
total1068105110881510761088
🔌 Startup Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Standard HomeuiStartup14301181184512114561692
load1201983148110012331415
domContentLoaded119397814399612301383
domInteractive281696182579
firstPaint169691197131215339
backgroundConnect21519542627218250
firstReactRender19143542129
initialActions106124
loadScripts99679512309110251177
setupStore1372741520
numNetworkReqs312291192281
Power User HomeuiStartup17211363272119117642068
load11451015184415611251559
domContentLoaded11301010183815511151550
domInteractive3618159243789
firstPaint1617445380207313
backgroundConnect29125542928295339
firstReactRender24157192640
initialActions109214
loadScripts92181515551459091305
setupStore1676271726
numNetworkReqs59391732856140
🧭 User Journey Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Onboarding Import WalletimportWalletToSocialScreen2192172222221222
srpButtonToSrpForm93919529495
confirmSrpToPwForm22222202222
pwFormToMetricsScreen15151601516
metricsToWalletReadyScreen16161701617
doneButtonToHomeScreen61958865529654655
openAccountMenuToAccountListLoaded2922290229391429292939
total3900387039242139153924
Onboarding New WalletcreateWalletToSocialScreen2202192221221222
srpButtonToPwForm1091071122109112
createPwToRecoveryScreen889099
skipBackupToMetricsScreen36343813638
agreeButtonToOnboardingSuccess17171701717
doneButtonToAssetList4894825028495502
total8818708908889890
Asset DetailsassetClickToPriceChart47395255252
total47395255252
Solana Asset DetailsassetClickToPriceChart75727727677
total75727727677
Import Srp HomeloginToHomeScreen2272218823807422992380
openAccountMenuAfterLogin493265136065
homeAfterImportWithNewWallet26152378298824828352988
total48314248527539152615275
Send TransactionsopenSendPageFromHome22182842728
selectTokenToSendFormLoaded19162122021
reviewTransactionToConfirmationPage8498438545853854
total8928888943894894
SwapopenSwapPageFromHome1191161213121121
fetchAndDisplaySwapQuotes288928882890128902890
total301530063024830243024
🌐 Dapp Page Load Benchmarks

Current Commit: 3a25058 | Date: 3/4/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.06s (±44ms) 🟡 | historical mean value: 1.06s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 741ms (±36ms) 🟢 | historical mean value: 747ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 82ms (±13ms) 🟢 | historical mean value: 83ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.06s 44ms 1.02s 1.34s 1.08s 1.34s
domContentLoaded 741ms 36ms 716ms 1.01s 761ms 1.01s
firstPaint 82ms 13ms 68ms 204ms 88ms 204ms
firstContentfulPaint 82ms 13ms 68ms 204ms 88ms 204ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 3.18 KiB (0.06%)
  • ui: 16.08 KiB (0.19%)
  • common: -5.58 KiB (-0.05%)

@jeffsmale90 jeffsmale90 changed the title Perform dappscanning when any EIP-7715 related request is received feat: Perform dappscanning when any EIP-7715 related request is received Mar 4, 2026
@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Mar 4, 2026

Builds ready [7dcb26c]
⚡ Performance Benchmarks
👆 Interaction Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Load New Accountload_new_account30727233224326332
total30727233224326332
Confirm Txconfirm_tx606860656072360726072
total606860656072360726072
Bridge User Actionsbridge_load_page23618230443259304
bridge_load_asset_picker21817025331238253
bridge_search_token75769888571784885
total1156109712265711991226
🔌 Startup Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Standard HomeuiStartup14121157177011414641646
load1180976145610112221375
domContentLoaded117294714369912161363
domInteractive2817110192479
firstPaint188671299133220333
backgroundConnect21218827817216251
firstReactRender19113752028
initialActions105124
loadScripts97976712449910231171
setupStore1374251421
numNetworkReqs3122100212288
Power User HomeuiStartup17121410225515117782031
load11501036166214111401512
domContentLoaded11341029165113911281499
domInteractive3419130203488
firstPaint1567337671198284
backgroundConnect29725744133308363
firstReactRender23144562537
initialActions109113
loadScripts92180614181359071292
setupStore1564561828
numNetworkReqs57371612554116
🧭 User Journey Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Onboarding Import WalletimportWalletToSocialScreen2192182190219219
srpButtonToSrpForm96949829698
confirmSrpToPwForm22212202222
pwFormToMetricsScreen15151601616
metricsToWalletReadyScreen16161701617
doneButtonToHomeScreen62158667331638673
openAccountMenuToAccountListLoaded2922291029381129292938
total3913389039532439283953
Onboarding New WalletcreateWalletToSocialScreen2192182190219219
srpButtonToPwForm1071051081108108
createPwToRecoveryScreen889099
skipBackupToMetricsScreen36343923739
agreeButtonToOnboardingSuccess16161601616
doneButtonToAssetList587473747131746747
total974858113713311371137
Asset DetailsassetClickToPriceChart533378197678
total533378197678
Solana Asset DetailsassetClickToPriceChart75757607676
total75757607676
Import Srp HomeloginToHomeScreen20311911222711320792227
openAccountMenuAfterLogin45355574855
homeAfterImportWithNewWallet26982602291912127352919
total47744561495714249064957
Send TransactionsopenSendPageFromHome24173152731
selectTokenToSendFormLoaded19172111921
reviewTransactionToConfirmationPage8488488490849849
total8918838996894899
SwapopenSwapPageFromHome11710913310116133
fetchAndDisplaySwapQuotes289928962902228992902
total3013300030301230183030
🌐 Dapp Page Load Benchmarks

Current Commit: 7dcb26c | Date: 3/4/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.04s (±43ms) 🟡 | historical mean value: 1.06s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 732ms (±39ms) 🟢 | historical mean value: 748ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 82ms (±14ms) 🟢 | historical mean value: 83ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.04s 43ms 1.01s 1.36s 1.08s 1.36s
domContentLoaded 732ms 39ms 701ms 1.03s 767ms 1.03s
firstPaint 82ms 14ms 60ms 212ms 88ms 212ms
firstContentfulPaint 82ms 14ms 60ms 212ms 88ms 212ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 3.18 KiB (0.06%)
  • ui: 16.08 KiB (0.19%)
  • common: -5.58 KiB (-0.05%)

@metamaskbot metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Mar 4, 2026
@jeffsmale90 jeffsmale90 marked this pull request as ready for review March 4, 2026 05:59
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 5, 2026

@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Mar 5, 2026

Builds ready [7ac3033]
⚡ Performance Benchmarks
👆 Interaction Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Load New Accountload_new_account2702672743272274
total2702672743272274
Confirm Txconfirm_tx6070605560921360686092
total6070605560921360686092
Bridge User Actionsbridge_load_page2362242509235250
bridge_load_asset_picker15114217212144172
bridge_search_token7047027062705706
total109010811102910961102
🔌 Startup Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Standard HomeuiStartup14571241195511214991669
load1226103916319712641390
domContentLoaded1220103316199512601378
domInteractive2917114192675
firstPaint1707249684226322
backgroundConnect22520541123228255
firstReactRender19144152031
initialActions108114
loadScripts101283114199510461174
setupStore1364061522
numNetworkReqs3122102202584
Power User HomeuiStartup17301409267618917692086
load11631030175415811641610
domContentLoaded11491020174715711541595
domInteractive38181782836106
firstPaint1777845386240323
backgroundConnect30525550034317375
firstReactRender23155582442
initialActions104112
loadScripts92980715101509071342
setupStore1765581832
numNetworkReqs59361622954143
🧭 User Journey Benchmarks
BenchmarkMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P75 (ms)P95 (ms)
Onboarding Import WalletimportWalletToSocialScreen2202192200220220
srpButtonToSrpForm99931075102107
confirmSrpToPwForm23232402324
pwFormToMetricsScreen16151601616
metricsToWalletReadyScreen16161711717
doneButtonToHomeScreen6076026103608610
openAccountMenuToAccountListLoaded2931291329451329442945
total3918388239552539333955
Onboarding New WalletcreateWalletToSocialScreen2222212241223224
srpButtonToPwForm1191081287124128
createPwToRecoveryScreen1091321213
skipBackupToMetricsScreen40404114141
agreeButtonToOnboardingSuccess19182112021
doneButtonToAssetList612493777103680777
total1024886121111410871211
Asset DetailsassetClickToPriceChart1361251529140152
total1361251529140152
Solana Asset DetailsassetClickToPriceChart108921209114120
total108921209114120
Import Srp HomeloginToHomeScreen20791875232616021402326
openAccountMenuAfterLogin39354544245
homeAfterImportWithNewWallet26782459294717327812947
total48004633495813649094958
Send TransactionsopenSendPageFromHome24193042630
selectTokenToSendFormLoaded24183042730
reviewTransactionToConfirmationPage8518488584849858
total89888691511896915
SwapopenSwapPageFromHome41364534145
fetchAndDisplaySwapQuotes269626952698126982698
total273527312739327392739
🌐 Dapp Page Load Benchmarks

Current Commit: 7ac3033 | Date: 3/5/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.06s (±99ms) 🟡 | historical mean value: 1.05s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 751ms (±124ms) 🟢 | historical mean value: 740ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 92ms (±106ms) 🟢 | historical mean value: 82ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.06s 99ms 1.03s 2.01s 1.10s 2.01s
domContentLoaded 751ms 124ms 721ms 1.96s 767ms 1.96s
firstPaint 92ms 106ms 64ms 1.14s 88ms 1.14s
firstContentfulPaint 92ms 106ms 64ms 1.14s 88ms 1.14s
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs
  • background: 363 Bytes (0.01%)
  • ui: 5 Bytes (0%)
  • common: 260 Bytes (0%)

Copy link

@wzrdk3lly wzrdk3lly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR looks good to me. Due to EIP-7715 not requiring the traditional connect wallet flow, I agree dapp scanning should be performed for EIP-7715 request.

Copy link
Contributor

@AugmentedMode AugmentedMode left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The scan triggering is correct and will populate the urlScanCache. However, the warning won't actually display on the first screen the user sees -- the snap dialog renders through TemplateAlertContextProvider which doesn't include useOriginTrustSignalAlerts. The warning only surfaces on the second step (the eth_signTypedData_v4 delegation signing screen), which uses the redesigned confirm flow that does wire in origin trust signal alerts. Just flagging the gap so it's a conscious decision.

Can you confirm this is what you are expecting ? This PR will fill the cache. But in order to fire an alert this hook must be called useOriginTrustSignalAlerts

@jeffsmale90
Copy link
Contributor Author

jeffsmale90 commented Mar 5, 2026

@AugmentedMode thanks for the detailed feedback!

Yes that's exactly what we are after here. MetaMask/snap-7715-permissions#275 fetches directly from the service and surfaces the alert in the snap dialog.

@HowardBraham HowardBraham added this pull request to the merge queue Mar 6, 2026
Merged via the queue into main with commit d65d300 Mar 6, 2026
340 of 342 checks passed
@HowardBraham HowardBraham deleted the feat/dapp-scan-7715-methods branch March 6, 2026 21:14
@github-actions github-actions bot locked and limited conversation to collaborators Mar 6, 2026
@metamaskbot metamaskbot added the release-13.23.0 Issue or pull request that will be included in release 13.23.0 label Mar 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template release-13.23.0 Issue or pull request that will be included in release 13.23.0 size-S team-delegation MetaMask Delegation Team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants