Skip to content

feat: first-time recipient alert on Send flow#28650

Merged
vinistevam merged 8 commits into
mainfrom
vs/add-1st-time-interaction-alert-send-flow
May 6, 2026
Merged

feat: first-time recipient alert on Send flow#28650
vinistevam merged 8 commits into
mainfrom
vs/add-1st-time-interaction-alert-send-flow

Conversation

@vinistevam

@vinistevam vinistevam commented Apr 10, 2026

Copy link
Copy Markdown
Contributor

Description

This change aligns MetaMask Mobile’s Send flow with the extension by surfacing first-time recipient interaction and token contract warnings before the user continues to confirmation.

Reason: Users should be explicitly warned when sending to an address they have not interacted with on-chain before, and when the recipient looks like a token contract, so they can double-check the destination.

Solution:

  • Added checkFirstTimeInteraction in app/util/transaction-controller/index.ts, using getAccountAddressRelationship from the transaction-controller preview package so semantics match the extension.
  • Introduced send-flow alert hooks (useFirstTimeInteractionSendAlert, useTokenContractSendAlert) and an aggregator useSendAlerts that orders alerts (token contract first, then first-time interaction).
  • Refactored SendAlertModal to accept multiple SendAlert items with prev/next navigation (design-system ButtonIcon, no “N of M” counter) and per-step acknowledge labels where needed.
  • Updated Recipient to open the modal when there are unacknowledged alerts, reset acknowledgement when the recipient changes, and block Review / auto-advance while alert checks are pending.
  • Removed the old toAddressErrorAllowAcknowledge path from address validation in favor of the dedicated alert pipeline; token-contract detection moved out of validateHexAddress into the alert hook.
  • Added/updated unit tests and locale strings for the new copy and navigation accessibility labels.

Changelog

CHANGELOG entry: Added Send flow warnings for first-time recipient interaction

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/CONF-1016

Manual testing steps

Feature: Send flow first-time recipient

  Background:
    Given I am logged into MetaMask Mobile
    And I am on the Send flow recipient step for an EVM network

  Scenario: user sees first-time interaction alert for a new recipient
    Given I have an externally owned recipient address I have never sent to on this network
    And the recipient is not one of my accounts and is not shown as verified while trust data loads

    When user enters or selects that recipient and taps Review (or equivalent continue)
    Then a warning modal should appear about sending to this address for the first time
    And the modal should show the recipient address in the message

    When user acknowledges the alert (e.g. Continue / I understand as labeled)
    Then the flow should proceed toward confirmation as usual

Screenshots/Recordings

1st-alert-mobile.mp4

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Changes the Send recipient step gating logic and adds new asynchronous alert checks (token contract lookup and first-time interaction API), which can affect when users can proceed and may introduce edge cases around pending/acknowledgement state.

Overview
Adds a new Send-flow alert pipeline (useSendAlerts) that surfaces token contract and first-time recipient interaction warnings before proceeding to confirmation, backed by a new checkFirstTimeInteraction util that calls getAccountAddressRelationship.

Refactors SendAlertModal to accept a list of SendAlerts with prev/next navigation and per-alert acknowledge labels, and updates Recipient to block Review/auto-advance while alert checks are pending and to require acknowledging any unacknowledged alerts.

Removes the old toAddressErrorAllowAcknowledge/token-contract detection from address validation (validateHexAddress/useToAddressValidation) and updates tests/locales accordingly.

Reviewed by Cursor Bugbot for commit 45a6f81. Bugbot is set up for automated code reviews on this repo. Configure here.

@vinistevam vinistevam added the team-confirmations Push issues to confirmations team label Apr 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@vinistevam vinistevam changed the title feat: add first-time recipient and token contract send alerts feat: first-time recipient alert on Send flow Apr 10, 2026
@vinistevam

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@vinistevam vinistevam marked this pull request as ready for review April 13, 2026 12:24
@vinistevam vinistevam requested a review from a team as a code owner April 13, 2026 12:24

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit cb4296d. Configure here.

@vinistevam

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions github-actions Bot added the risk-medium Moderate testing recommended · Possible bug introduction risk label Apr 15, 2026
@github-actions github-actions Bot added risk-medium Moderate testing recommended · Possible bug introduction risk and removed risk-medium Moderate testing recommended · Possible bug introduction risk labels Apr 15, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeConfirmations
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: medium
  • AI Confidence: 88%
click to see 🤖 AI reasoning details

E2E Test Selection:
The PR refactors the send flow alert system in the confirmations UI:

  1. New alert infrastructure: Introduces SendAlert type, useSendAlerts aggregator hook, useTokenContractSendAlert (extracted from address validation), and useFirstTimeInteractionSendAlert (new feature warning when sending to a new address for the first time).

  2. SendAlertModal updated: Now supports multiple alerts with prev/next navigation, replacing the single-alert design.

  3. recipient.tsx updated: Uses new useSendAlerts hook, removes toAddressErrorAllowAcknowledge in favor of hasUnacknowledgedAlerts, adds isAlertCheckPending to disable the Continue button while checks run.

  4. send-address-validations.ts: Token contract check removed (moved to dedicated hook), allowAcknowledge field removed from return type.

  5. transaction-controller/index.ts: New checkFirstTimeInteraction utility using getAccountAddressRelationship from @metamask/transaction-controller.

  6. Localization: New strings for "New address" alert and navigation labels.

These changes directly affect the send/transfer confirmation flow — specifically recipient validation and the alert/warning system before proceeding. SmokeConfirmations covers transaction sending for native tokens (ETH), ERC-20 tokens, and Solana SPL tokens, which are exactly the flows impacted. No other tag areas (swaps, accounts, networks, identity) are affected by these changes.

Performance Test Selection:
The changes are focused on UI alert logic and recipient validation in the send flow. No performance-sensitive code paths are modified — no list rendering, no state management initialization, no app startup code, no account/network list components. The new checkFirstTimeInteraction call is an async check that only runs during recipient input, not in any performance-critical rendering path.

View GitHub Actions results

@github-actions

Copy link
Copy Markdown
Contributor

E2E Fixture Validation — Schema is up to date
11 value mismatches detected (expected — fixture represents an existing user).
View details

@sonarqubecloud

Copy link
Copy Markdown

@pedronfigueiredo pedronfigueiredo requested a review from OGPoyraz May 4, 2026 14:32
@vinistevam vinistevam added this pull request to the merge queue May 6, 2026
Merged via the queue into main with commit 036608e May 6, 2026
98 of 99 checks passed
@vinistevam vinistevam deleted the vs/add-1st-time-interaction-alert-send-flow branch May 6, 2026 08:14
@github-actions github-actions Bot locked and limited conversation to collaborators May 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

risk-medium Moderate testing recommended · Possible bug introduction risk size-XL team-confirmations Push issues to confirmations team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants