Description

Tier 4 of the E2E allowlist reduction (epic MMQA-1364). Removes four entries from tests/api-mocking/mock-e2e-allowlist.ts by adding default RPC mocks where the URL is actually pinged at runtime, and deleting one stale entry whose host is never wired into a NetworkController.

Entries removed:

Detox's blacklistURLs.json entries for avax + zksync are also removed — those URLs are now intercepted by the mock server and no longer leak to Detox's network-sync.

Out of scope: the npm: URI regex hack in MockServerE2E.ts (Tier 4 — Part 2, blocked by MMQA-1366). The Polymarket allowlist follow-up will be a separate ticket.

After this lands, ALLOWLISTED_HOSTS is down to 9 entries (4 local + 4 Tenderly + Polymarket carve-out + metamask.github.io) and ALLOWLISTED_URLS is down to 1 entry (metamask.github.io/test-dapp/metamask-fox.svg).

Changelog

CHANGELOG entry: null

Related issues

MMQA-1785 (Tier 4 — Part 1)
Parent epic: MMQA-1364

Fixes:

Manual testing steps

Feature: E2E mock coverage for popular network RPCs and ElysiumTestnet

  Scenario: smoke specs that load popular networks no longer leak live requests
    Given an E2E run that builds a fixture with withPopularNetworks()

    When the wallet boots and the NetworkController initializes
    Then requests to api.avax.network and mainnet.era.zksync.io are answered by the mock server
    And no entry for those hosts/URLs is required in mock-e2e-allowlist.ts

  Scenario: dapp chain-switch flow on ElysiumTestnet
    Given the spec permission-system-dapp-chain-switch-grant.spec.ts is run

    When the test taps Elysium Testnet to grant chain permission
    Then RPC calls routed via /proxy?url=https://rpc.atlantischain.network/... are intercepted by CUSTOM_RPC_PROVIDER_MOCKS
    And the spec passes without a live request leak

Screenshots/Recordings

Before

tests/api-mocking/mock-e2e-allowlist.ts — Tier 4 entries still permitted to leak as live requests:

export const ALLOWLISTED_HOSTS = [
  // ... local + Tenderly ...
  'testnet-rpc.monad.xyz',
  // ... Polymarket + metamask.github.io ...
];

export const ALLOWLISTED_URLS = [
  'https://api.avax.network/ext/bc/C/rpc',
  'https://mainnet.era.zksync.io/',
  'https://rpc.atlantischain.network/',
  'https://metamask.github.io/test-dapp/metamask-fox.svg',
];

tests/resources/blacklistURLs.json — Detox dropping the same hosts at the network layer:

".*mainnet.era.zksync.io/.*",
".*api.avax.network/ext/bc/C/rpc.*"

After

tests/api-mocking/mock-e2e-allowlist.ts — four entries removed (1 host + 3 URLs):

export const ALLOWLISTED_HOSTS = [
  '0.0.0.0',
  '127.0.0.1',
  'localhost',
  '10.0.2.2',
  'api.tenderly.co',
  'rpc.tenderly.co',
  'virtual.mainnet.rpc.tenderly.co',
  'virtual.linea.rpc.tenderly.co',
  'gamma-api.polymarket.com',
  '*.polymarket.com',
  'metamask.github.io',
];

export const ALLOWLISTED_URLS = [
  'https://metamask.github.io/test-dapp/metamask-fox.svg',
];

tests/resources/blacklistURLs.json — corresponding zkSync / avax patterns removed.

CI verification (commit cf2ba92fcc):

iOS E2E Smoke Tests
  ✓ network-abstraction-ios-smoke (1)  16m3s   PASS
  ✓ network-abstraction-ios-smoke (2)  16m32s  PASS

network-abstraction-ios-smoke is the suite that runs permission-system-dapp-chain-switch-grant.spec.ts (Elysium / atlantischain) and the multichain wallet-* specs that build fixtures with withPopularNetworks() (Avalanche / zkSync). Both shards passed on the latest commit, validating the new mocks across both code paths.

Note: Android smoke jobs flaked with an unrelated infrastructure error (Error: kill EPERM from nick-fields/retry during apt-get install on the runner — tests never executed). Same root cause across multiple suites and reruns; not a code issue.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.