Confirmation page alerts

.metamaskrc.dist

@@ -13,3 +13,4 @@ INFURA_PROJECT_ID=00000000000
 ; Set this to test changes to the phishing warning page.
 ;PHISHING_WARNING_PAGE_URL=
 BLOCKAID_FILE_CDN=
+BLOCKAID_PUBLIC_KEY=

app/scripts/controllers/transactions/index.js

@@ -2415,13 +2415,22 @@ export default class TransactionController extends EventEmitter {
 
     let uiCustomizations;
 
-    if (securityProviderResponse?.flagAsDangerous === 1) {
-      uiCustomizations = ['flagged_as_malicious'];
-    } else if (securityProviderResponse?.flagAsDangerous === 2) {
-      uiCustomizations = ['flagged_as_safety_unknown'];
+    ///: BEGIN:ONLY_INCLUDE_IN(blockaid)
+    if (securityAlertResponse?.result_type === BlockaidResultType.Failed) {
+      uiCustomizations = ['security_alert_failed'];
     } else {
-      uiCustomizations = null;
+      ///: END:ONLY_INCLUDE_IN
+      // eslint-disable-next-line no-lonely-if
+      if (securityProviderResponse?.flagAsDangerous === 1) {
+        uiCustomizations = ['flagged_as_malicious'];
+      } else if (securityProviderResponse?.flagAsDangerous === 2) {
+        uiCustomizations = ['flagged_as_safety_unknown'];
+      } else {
+        uiCustomizations = null;
+      }
+      ///: BEGIN:ONLY_INCLUDE_IN(blockaid)
     }
+    ///: END:ONLY_INCLUDE_IN
 
     /** The transaction status property is not considered sensitive and is now included in the non-anonymous event */
     let properties = {

app/scripts/controllers/transactions/index.test.js

@@ -2652,6 +2652,83 @@ describe('Transaction Controller', function () {
       );
     });
 
+    it('should call _trackMetaMetricsEvent with the correct payload when blockaid verification fails', async function () {
+      const txMeta = {
+        id: 1,
+        status: TransactionStatus.unapproved,
+        txParams: {
+          from: fromAccount.address,
+          to: '0x1678a085c290ebd122dc42cba69373b5953b831d',
+          gasPrice: '0x77359400',
+          gas: '0x7b0d',
+          nonce: '0x4b',
+        },
+        type: TransactionType.simpleSend,
+        origin: 'other',
+        chainId: currentChainId,
+        time: 1624408066355,
+        metamaskNetworkId: currentNetworkId,
+        securityAlertResponse: {
+          result_type: BlockaidResultType.Failed,
+          reason: 'some error',
+        },
+      };
+      const expectedPayload = {
+        actionId,
+        initialEvent: 'Transaction Added',
+        successEvent: 'Transaction Approved',
+        failureEvent: 'Transaction Rejected',
+        uniqueIdentifier: 'transaction-added-1',
+        persist: true,
+        category: MetaMetricsEventCategory.Transactions,
+        properties: {
+          network: '5',
+          referrer: 'other',
+          source: MetaMetricsTransactionEventSource.Dapp,
+          status: 'unapproved',
+          transaction_type: TransactionType.simpleSend,
+          chain_id: '0x5',
+          eip_1559_version: '0',
+          gas_edit_attempted: 'none',
+          gas_edit_type: 'none',
+          account_type: 'MetaMask',
+          asset_type: AssetType.native,
+          token_standard: TokenStandard.none,
+          device_model: 'N/A',
+          transaction_speed_up: false,
+          ui_customizations: ['security_alert_failed'],
+          security_alert_reason: 'some error',
+          security_alert_response: BlockaidResultType.Failed,
+        },
+        sensitiveProperties: {
+          baz: 3.0,
+          foo: 'bar',
+          gas_price: '2',
+          gas_limit: '0x7b0d',
+          transaction_contract_method: undefined,
+          transaction_replaced: undefined,
+          first_seen: 1624408066355,
+          transaction_envelope_type: TRANSACTION_ENVELOPE_TYPE_NAMES.LEGACY,
+        },
+      };
+
+      await txController._trackTransactionMetricsEvent(
+        txMeta,
+        TransactionMetaMetricsEvent.added,
+        actionId,
+        {
+          baz: 3.0,
+          foo: 'bar',
+        },
+      );
+      assert.equal(createEventFragmentSpy.callCount, 1);
+      assert.equal(finalizeEventFragmentSpy.callCount, 0);
+      assert.deepEqual(
+        createEventFragmentSpy.getCall(0).args[0],
+        expectedPayload,
+      );
+    });
+
     it('should call _trackMetaMetricsEvent with the correct payload (extra params) when flagAsDangerous is malicious', async function () {
       const txMeta = {
         id: 1,

app/scripts/lib/ppom/ppom-middleware.test.ts

@@ -1,3 +1,7 @@
+import {
+  BlockaidReason,
+  BlockaidResultType,
+} from '../../../../shared/constants/security-provider';
 import { createPPOMMiddleware } from './ppom-middleware';
 
 Object.defineProperty(globalThis, 'fetch', {
@@ -13,10 +17,16 @@ Object.defineProperty(globalThis, 'performance', {
 describe('PPOMMiddleware', () => {
   it('should call ppomController.usePPOM for requests of type confirmation', async () => {
     const useMock = jest.fn();
-    const controller = {
+    const ppomController = {
       usePPOM: useMock,
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
     await middlewareFunction(
       { method: 'eth_sendTransaction' },
       undefined,
@@ -26,25 +36,85 @@ describe('PPOMMiddleware', () => {
   });
 
   it('should add validation response on confirmation requests', async () => {
-    const controller = {
+    const ppomController = {
+      usePPOM: async () => Promise.resolve('VALIDATION_RESULT'),
+    };
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
+    const req = {
+      method: 'eth_sendTransaction',
+      securityAlertResponse: undefined,
+    };
+    await middlewareFunction(req, undefined, () => undefined);
+    expect(req.securityAlertResponse).toBeDefined();
+  });
+
+  it('should not do validation if user has not enabled preference', async () => {
+    const ppomController = {
       usePPOM: async () => Promise.resolve('VALIDATION_RESULT'),
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
-    const req = { method: 'eth_sendTransaction', ppomResponse: undefined };
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: false }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
+    const req = {
+      method: 'eth_sendTransaction',
+      securityAlertResponse: undefined,
+    };
     await middlewareFunction(req, undefined, () => undefined);
-    expect(req.ppomResponse).toBeDefined();
+    expect(req.securityAlertResponse).toBeUndefined();
+  });
+
+  it('should set Failed type in response if usePPOM throw error', async () => {
+    const ppomController = {
+      usePPOM: async () => {
+        throw new Error('some error');
+      },
+    };
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
+    const req = {
+      method: 'eth_sendTransaction',
+      securityAlertResponse: undefined,
+    };
+    await middlewareFunction(req, undefined, () => undefined);
+    expect((req.securityAlertResponse as any)?.result_type).toBe(
+      BlockaidResultType.Failed,
+    );
+    expect((req.securityAlertResponse as any)?.reason).toBe(
+      BlockaidReason.failed,
+    );
   });
 
   it('should call next method when ppomController.usePPOM completes', async () => {
     const ppom = {
       validateJsonRpc: () => undefined,
     };
-    const controller = {
+    const ppomController = {
       usePPOM: async (callback: any) => {
         callback(ppom);
       },
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
     const nextMock = jest.fn();
     await middlewareFunction(
       { method: 'eth_sendTransaction' },
@@ -55,12 +125,18 @@ describe('PPOMMiddleware', () => {
   });
 
   it('should call next method when ppomController.usePPOM throws error', async () => {
-    const controller = {
+    const ppomController = {
       usePPOM: async (_callback: any) => {
         throw Error('Some error');
       },
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
     const nextMock = jest.fn();
     await middlewareFunction(
       { method: 'eth_sendTransaction' },
@@ -75,12 +151,18 @@ describe('PPOMMiddleware', () => {
     const ppom = {
       validateJsonRpc: validateMock,
     };
-    const controller = {
+    const ppomController = {
       usePPOM: async (callback: any) => {
         callback(ppom);
       },
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
     await middlewareFunction(
       { method: 'eth_sendTransaction' },
       undefined,
@@ -94,12 +176,18 @@ describe('PPOMMiddleware', () => {
     const ppom = {
       validateJsonRpc: validateMock,
     };
-    const controller = {
+    const ppomController = {
       usePPOM: async (callback: any) => {
         callback(ppom);
       },
     };
-    const middlewareFunction = createPPOMMiddleware(controller as any);
+    const preferenceController = {
+      store: { getState: () => ({ securityAlertsEnabled: true }) },
+    };
+    const middlewareFunction = createPPOMMiddleware(
+      ppomController as any,
+      preferenceController as any,
+    );
     await middlewareFunction(
       { method: 'eth_someRequest' },
       undefined,

app/scripts/lib/ppom/ppom-middleware.ts

@@ -1,7 +1,14 @@
 import { PPOM } from '@blockaid/ppom';
-
 import { PPOMController } from '@metamask/ppom-validator';
 
+import {
+  BlockaidReason,
+  BlockaidResultType,
+} from '../../../../shared/constants/security-provider';
+import PreferencesController from 'app/scripts/controllers/preferences';
+
+const { sentry } = global as any;
+
 const ConfirmationMethods = Object.freeze([
   'eth_sendRawTransaction',
   'eth_sendTransaction',
@@ -23,19 +30,33 @@ const ConfirmationMethods = Object.freeze([
  * the request will be forwarded to the next middleware, together with the PPOM response.
  *
  * @param ppomController - Instance of PPOMController.
+ * @param preferencesController - Instance of PreferenceController.
  * @returns PPOMMiddleware function.
  */
-export function createPPOMMiddleware(ppomController: PPOMController) {
+export function createPPOMMiddleware(
+  ppomController: PPOMController,
+  preferencesController: PreferencesController,
+) {
   return async (req: any, _res: any, next: () => void) => {
     try {
-      if (ConfirmationMethods.includes(req.method)) {
+      const securityAlertsEnabled =
+        preferencesController.store.getState()?.securityAlertsEnabled;
+      if (securityAlertsEnabled && ConfirmationMethods.includes(req.method)) {
         // eslint-disable-next-line require-atomic-updates
-        req.ppomResponse = await ppomController.usePPOM(async (ppom: PPOM) => {
-          return ppom.validateJsonRpc(req);
-        });
+        req.securityAlertResponse = await ppomController.usePPOM(
+          async (ppom: PPOM) => {
+            return ppom.validateJsonRpc(req);
+          },
+        );
       }
-    } catch (error: unknown) {
+    } catch (error: any) {
+      sentry?.captureException(error);
       console.error('Error validating JSON RPC using PPOM: ', error);
+      req.securityAlertResponse = {
+        result_type: BlockaidResultType.Failed,
+        reason: BlockaidReason.failed,
+        description: 'Validating the confirmation failed by throwing error.',
+      };
     } finally {
       next();
     }