Skip to content

feat(STX-583): move STX allowed RPC hosts config to flags#30812

Merged
rarquevaux merged 2 commits into
mainfrom
feat/STX-583-stx-allowed-hostname
Jun 3, 2026
Merged

feat(STX-583): move STX allowed RPC hosts config to flags#30812
rarquevaux merged 2 commits into
mainfrom
feat/STX-583-stx-allowed-hostname

Conversation

@rarquevaux

@rarquevaux rarquevaux commented May 29, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Description

Move to LD flag for allowed RPC host for STX.

  • Keep the current ones as hardcoded defaults
  • Allow for more generic public hosts like mainnet.base.org and rpc.linea.build to be added to mechanically increase smart-transaction availability for users.
  • True custom RPC providers remain excluded

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

  • I've tested on Android
    • Ideally on a mid-range device; emulator is acceptable
  • I've tested with a power user scenario
    • Use these power-user SRPs to import wallets with many accounts and tokens
  • I've instrumented key operations with Sentry traces for production performance metrics

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Production smart-transaction eligibility now depends on a remotely updatable RPC host list; misconfiguration could enable or disable STX for large user segments on specific networks.

Overview
Smart transactions allowed RPC hosts move from hardcoded Infura/Binance suffix checks to the remote flag smartTransactionsAllowedRpcHosts, with client defaults .infura.io and .binance.org when the flag is missing or invalid.

A new selector resolves the host list and selectSmartTransactionsEnabled passes it into getIsAllowedRpcUrlForSmartTransactions, which now takes an explicit allowlist: entries starting with . match host suffixes; other entries require an exact hostname match (so related subdomains like developer-access hosts are not implied). Non-production builds still allow any RPC URL.

The change is wired into the feature-flag registry, CI known-flag constants, and unit tests for the selector and RPC helper.

Reviewed by Cursor Bugbot for commit eee03bb. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions github-actions Bot added the pr-not-ready-for-e2e Skip E2E and block merging. Remove this label once the PR is ready to run the E2E tests. label May 29, 2026
@github-actions

github-actions Bot commented May 29, 2026

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbotv2 metamaskbotv2 Bot added the team-transactions Transactions team label May 29, 2026
@rarquevaux rarquevaux force-pushed the feat/STX-583-stx-allowed-hostname branch from d047e7a to 5646b46 Compare May 29, 2026 17:48
@rarquevaux rarquevaux marked this pull request as ready for review May 29, 2026 18:23
@rarquevaux rarquevaux requested review from a team as code owners May 29, 2026 18:23
@github-actions github-actions Bot added the risk:medium AI analysis: medium risk label May 29, 2026
cursor[bot]
cursor Bot reviewed May 29, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit abe1250. Configure here.

Comment thread app/util/smart-transactions/index.test.ts
@rarquevaux rarquevaux force-pushed the feat/STX-583-stx-allowed-hostname branch 2 times, most recently from 1f550f4 to 7021944 Compare May 29, 2026 18:30
@rarquevaux rarquevaux enabled auto-merge May 29, 2026 18:30
@rarquevaux rarquevaux removed the pr-not-ready-for-e2e Skip E2E and block merging. Remove this label once the PR is ready to run the E2E tests. label May 29, 2026
@rarquevaux rarquevaux force-pushed the feat/STX-583-stx-allowed-hostname branch from 6185675 to faa791b Compare May 29, 2026 21:00
dan437
dan437 previously approved these changes Jun 1, 2026
View reviewed changes
@github-actions github-actions Bot added risk:low AI analysis: low risk risk:medium AI analysis: medium risk and removed risk:medium AI analysis: medium risk risk:low AI analysis: low risk labels Jun 1, 2026
weitingsun
weitingsun previously approved these changes Jun 2, 2026
View reviewed changes

@weitingsun weitingsun left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mobile-platform codeowner file .github/scripts/known-feature-flag-constants.ts LGTM

@rarquevaux rarquevaux dismissed stale reviews from weitingsun and dan437 via b395424 June 2, 2026 14:33
@rarquevaux rarquevaux force-pushed the feat/STX-583-stx-allowed-hostname branch from d697e91 to c4aab0b Compare June 2, 2026 17:32
@github-actions github-actions Bot added risk:high AI analysis: high risk and removed risk:medium AI analysis: medium risk labels Jun 2, 2026
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeSwap, SmokeConfirmations
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: medium
  • AI Confidence: 85%
click to see 🤖 AI reasoning details

E2E Test Selection:
The changes make the Smart Transactions (STX) RPC host allowlist dynamically configurable via remote feature flags instead of hardcoded values. Key impacts:

  1. getIsAllowedRpcUrlForSmartTransactions now takes a dynamic allowedHosts array - this is the core function that gates whether STX is enabled for a given RPC URL.

  2. selectSmartTransactionsEnabled now incorporates selectAllowedSmartTransactionsRpcHosts from the new feature flag selector - this selector is used across swap, bridge, and confirmation flows.

  3. Feature flag registry updated with smartTransactionsAllowedRpcHosts - E2E tests will now mock this flag with production defaults ['.infura.io', '.binance.org'], preserving existing behavior.

  4. SmokeSwap is directly impacted: gasless-swap.spec.ts, swap-action-smoke.spec.ts, and bridge-action-smoke.spec.ts all use setupSmartTransactionsMocks which relies on STX being enabled. The new feature flag path must work correctly for these tests to pass.

  5. SmokeConfirmations is impacted: advanced-details-row.tsx uses selectSmartTransactionsEnabled, and gas-fee-tokens-eip-7702 tests explicitly call .withDisabledSmartTransactions(). The STX enablement logic change could affect confirmation UI behavior.

The default behavior is preserved (same hosts as before), so risk is medium rather than high. The feature flag registry update ensures E2E tests get production-accurate defaults. No other areas (accounts, identity, network, browser, snaps) are affected by this change.

Performance Test Selection:
The changes are to the Smart Transactions RPC host allowlist logic and feature flag configuration. While this affects the STX enablement selector, it does not introduce new rendering, data loading, or UI performance concerns. The logic change is a simple selector computation with no performance-sensitive operations (no new API calls, no list rendering changes, no animation changes). Performance tests are not warranted.

View GitHub Actions results

@github-actions github-actions Bot removed the risk:high AI analysis: high risk label Jun 2, 2026
@github-actions github-actions Bot added the risk:medium AI analysis: medium risk label Jun 2, 2026
@rarquevaux rarquevaux added this pull request to the merge queue Jun 3, 2026
Merged via the queue into main with commit 557a524 Jun 3, 2026
197 checks passed
@rarquevaux rarquevaux deleted the feat/STX-583-stx-allowed-hostname branch June 3, 2026 15:07
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 3, 2026
@metamaskbotv2 metamaskbotv2 Bot added the release-7.81.0 Issue or pull request that will be included in release 7.81.0 label Jun 3, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

@dan437 dan437 dan437 approved these changes

@hjetpoluru hjetpoluru hjetpoluru approved these changes

@weitingsun weitingsun weitingsun approved these changes

Assignees

No one assigned

Labels

release-7.81.0 Issue or pull request that will be included in release 7.81.0 risk:medium AI analysis: medium risk size-M team-transactions Transactions team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@rarquevaux @dan437 @hjetpoluru @weitingsun