feat: [MUSD-445] complete money account upgrade controller flow by Jwhiles · Pull Request #30002 · MetaMask/metamask-mobile

Jwhiles · 2026-05-11T19:37:05Z

Description

This PR upgrades to the final version of the money account upgrade controller - which can in theory run through the entire chomp upgrade flow.

Things that we've changed in this PR in addition to bumping the package

Updated the config that is passed into the upgrade controller
Added a check which ensures the monad network is enabled before we start the upgrade process. This is necessary, because monad is enabled by default

TODO

~~This PR builds on @MoMannn's PR chore: add monad mUSD #29897 - and it should be merged first.~~
This PR requires us to change the vault config feature flag before it will function correctly.
Chomp returns a 500 on the final step of the upgrade process. We need to figure out why this is happening and fix it
~~We need to merge and publish this core pr and update the preview packages that are currently used in this branch to the real published updates.~~

Changelog

CHANGELOG entry: Update to final version of money account upgrade controller

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

I've tested on Android
- Ideally on a mid-range device; emulator is acceptable
I've tested with a power user scenario
- Use these power-user SRPs to import wallets with many accounts and tokens
I've instrumented key operations with Sentry traces for production performance metrics
- See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Touches money account upgrade bootstrap logic and programmatically adds missing networks via NetworkController.addNetwork, which can affect upgrade flow behavior and user network state if misconfigured. Also bumps to @metamask/money-account-upgrade-controller@^2.0.0 with related dependency updates.

Overview
Updates moneyAccountUpgradeControllerInit to initialize MoneyAccountUpgradeController using the Money Account vault config (chainId + boring vault address) instead of deriving addresses from CHOMP service details / delegator environment.

Adds a bootstrap guard (ensureChainConfigured) that checks whether the vault chain is present in the user’s NetworkController config and, if missing, auto-adds it from PopularList (or logs an error and aborts if unsupported). Tests are updated to cover the new init parameters, missing vault config handling, and the chain auto-add behavior.

Expands the controller messenger permissions for the full upgrade flow (delegation + additional CHOMP actions) and bumps @metamask/money-account-upgrade-controller to ^2.0.0 plus related dependency versions in package.json/yarn.lock.

^{Reviewed by Cursor Bugbot for commit 74a760e. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-05-11T19:37:16Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2026-05-11T19:40:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@metamask/chomp-api-service@3.0.0 ⏵ 3.1.0	⁺¹	⁺¹	⁺²
npm/@metamask/authenticated-user-storage@1.0.0 ⏵ 1.0.1			⁺²
npm/@metamask/money-account-upgrade-controller@1.3.1 ⏵ 2.0.1	⁺¹	⁺²	⁺²
npm/@metamask/delegation-deployments@1.0.0 ⏵ 1.3.0	⁺¹	⁺¹	⁺¹

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9dd3275. Configure here.}

cursor · 2026-05-13T18:58:18Z

+
+  const popularEntry = PopularList.find(
+    (network) => toHex(network.chainId as string) === chainId,
+  );


Redundant toHex on already-hex PopularList chainId values

Low Severity

The PopularList entries already store chainId as hex strings (produced by toHex() at definition time, e.g. toHex('143') → '0x8f'). Calling toHex(network.chainId as string) applies the conversion a second time on an already-hex value. A direct comparison like network.chainId === chainId is clearer and avoids relying on toHex being idempotent for hex string inputs, which is an undocumented assumption about the @metamask/controller-utils implementation.

^{Reviewed by Cursor Bugbot for commit 9dd3275. Configure here.}

github-actions · 2026-05-14T12:01:58Z

🔍 Smart E2E Test Selection

Selected E2E tags: SmokeAccounts, SmokeConfirmations, SmokeIdentity, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeSwap, SmokeStake, SmokeWalletPlatform, SmokeMoney, SmokePerps, SmokeMultiChainAPI, SmokePredictions, SmokeSeedlessOnboarding, SmokeBrowser, SmokeSnaps
Selected Performance tags: @PerformanceAccountList, @PerformanceOnboarding, @PerformanceLogin, @PerformanceSwaps, @PerformanceLaunch, @PerformanceAssetLoading, @PerformancePredict, @PerformancePreps
Risk Level: high
AI Confidence: 100%

click to see 🤖 AI reasoning details

E2E Test Selection:
Hard rule (controller-version-update): @MetaMask controller package version updated in package.json: @metamask/money-account-upgrade-controller. Running all tests.

Performance Test Selection:
Hard rule (controller-version-update): @MetaMask controller package version updated in package.json: @metamask/money-account-upgrade-controller. Running all tests.

View GitHub Actions results

sonarqubecloud · 2026-05-14T12:20:11Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Jwhiles requested a review from a team as a code owner May 11, 2026 19:37

metamaskbotv2 Bot added the team-earn label May 11, 2026

Jwhiles changed the title ~~Musd 445~~ feat: [MUSD-445] complete money account upgrade controller flow May 11, 2026

github-actions Bot added the size-M label May 11, 2026

Jwhiles force-pushed the MUSD-445 branch from 7e449cf to ffcbd78 Compare May 12, 2026 15:08

Jwhiles changed the base branch from main to chore--add-monad-mUSD May 12, 2026 15:09

Jwhiles requested review from a team as code owners May 12, 2026 15:09

Jwhiles changed the base branch from chore--add-monad-mUSD to main May 12, 2026 15:10

Jwhiles force-pushed the MUSD-445 branch from ffcbd78 to 2b4cc57 Compare May 12, 2026 15:11

Matt561 previously approved these changes May 12, 2026

View reviewed changes

Jwhiles added 2 commits May 13, 2026 12:51

feat: implement complete money-account-upgrade

c1fd02e

chore: move to published packages

e4db7ad

Jwhiles dismissed Matt561’s stale review via e4db7ad May 13, 2026 11:51

Jwhiles force-pushed the MUSD-445 branch from 2b4cc57 to e4db7ad Compare May 13, 2026 11:51

Jwhiles added 2 commits May 13, 2026 13:09

chore: dedupe yarn.lock

0288bc7

Merge branch 'main' into MUSD-445

9dd3275

cursor Bot reviewed May 13, 2026

View reviewed changes

Matt561 self-requested a review May 13, 2026 19:30

Matt561 approved these changes May 13, 2026

View reviewed changes

Jwhiles enabled auto-merge May 13, 2026 19:31

Jwhiles added 3 commits May 14, 2026 10:24

Merge branch 'main' into MUSD-445

ac278c0

Merge branch 'main' into MUSD-445

09902ef

Merge branch 'main' into MUSD-445

74a760e

Jwhiles added this pull request to the merge queue May 14, 2026

Merged via the queue into main with commit b1c3a75 May 14, 2026
114 of 116 checks passed

Jwhiles deleted the MUSD-445 branch May 14, 2026 13:28

github-actions Bot locked and limited conversation to collaborators May 14, 2026

metamaskbotv2 Bot added the release-7.78.0 Issue or pull request that will be included in release 7.78.0 label May 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: [MUSD-445] complete money account upgrade controller flow#30002

feat: [MUSD-445] complete money account upgrade controller flow#30002
Jwhiles merged 7 commits into
mainfrom
MUSD-445

Jwhiles commented May 11, 2026 •

edited by cursor Bot

Loading

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

socket-security Bot commented May 11, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 13, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

sonarqubecloud Bot commented May 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Jwhiles commented May 11, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

TODO

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

Pre-merge reviewer checklist

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

socket-security Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 13, 2026

Choose a reason for hiding this comment

Redundant toHex on already-hex PopularList chainId values

Uh oh!

github-actions Bot commented May 14, 2026

🔍 Smart E2E Test Selection

Uh oh!

sonarqubecloud Bot commented May 14, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Jwhiles commented May 11, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented May 11, 2026 •

edited

Loading

Redundant `toHex` on already-hex PopularList chainId values