Skip to content

fix(stellar-snap): drop Blockaid description for OTHER to use generic security alert #433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
khanti42 wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

fix(stellar-snap): drop Blockaid description for OTHER to use generic security alert #433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aeddbcd
fix(stellar-snap): drop Blockaid description for OTHER to use generic…
khanti42 Oct 9, 2026
d84a911
Merge branch 'main' into fix/stellar-use-generic-security-copy-for-bl…
khanti42 Oct 9, 2026
752d26f
chore: lint
khanti42 Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions packages/stellar-wallet-snap/.env.bpk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# Use:
# - local for local development
# - test for running tests locally (mandatory)
# - production before submitting a PR
ENVIRONMENT=local

# Use:
# - all for all logs
# - error for error logs
# - warn for warn logs
# - info for info logs
# - debug for debug logs
# - silent for silent logs
LOG_LEVEL=trace

STELLAR_RPC_URL_MAINNET=https://stellar-mainnet.infura.io/v3/faf5366661c14c60830f0b59306b27e0

Check failure on line 16 in packages/stellar-wallet-snap/.env.bpk

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure this Infura API key gets revoked, changed, and removed from the code. 


See more on https://sonarcloud.io/project/issues?id=MetaMask_internal-snaps&issues=AaEhCvZcngGJCBtb0jT9&open=AaEhCvZcngGJCBtb0jT9&pullRequest=433
STELLAR_HORIZON_URL_MAINNET=https://stellar-mainnet.infura.io/v3/faf5366661c14c60830f0b59306b27e0/horizon

Check failure on line 17 in packages/stellar-wallet-snap/.env.bpk

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure this Infura API key gets revoked, changed, and removed from the code. 


See more on https://sonarcloud.io/project/issues?id=MetaMask_internal-snaps&issues=AaEhCvZdngGJCBtb0jT-&open=AaEhCvZdngGJCBtb0jT-&pullRequest=433
STELLAR_EXPLORER_MAINNET_BASE_URL=https://stellar.expert/explorer/public
STELLAR_RPC_URL_TESTNET=https://stellar-testnet.infura.io/v3/faf5366661c14c60830f0b59306b27e0

Check failure on line 19 in packages/stellar-wallet-snap/.env.bpk

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure this Infura API key gets revoked, changed, and removed from the code. 


See more on https://sonarcloud.io/project/issues?id=MetaMask_internal-snaps&issues=AaEhCvZdngGJCBtb0jT_&open=AaEhCvZdngGJCBtb0jT_&pullRequest=433
STELLAR_HORIZON_URL_TESTNET=https://stellar-testnet.infura.io/v3/faf5366661c14c60830f0b59306b27e0/horizon

Check failure on line 20 in packages/stellar-wallet-snap/.env.bpk

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure this Infura API key gets revoked, changed, and removed from the code. 


See more on https://sonarcloud.io/project/issues?id=MetaMask_internal-snaps&issues=AaEhCvZdngGJCBtb0jUA&open=AaEhCvZdngGJCBtb0jUA&pullRequest=433
4 changes: 4 additions & 0 deletions packages/stellar-wallet-snap/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

- Render confirmation asset rows and icons with the shared `Asset` and `AssetIcon` components from `@metamask/snap-networks-utils` ([#428](https://github.com/MetaMask/internal-snaps/pull/428))

### Fixed

- Use MetaMask generic security-alert copy for Stellar (Solana/Tron pattern) instead of Blockaid `description`, which can embed machine labels when `reason` is `OTHER` ([#433](https://github.com/MetaMask/internal-snaps/pull/433))

## [1.1.1]

### Fixed
Expand Down
34 changes: 30 additions & 4 deletions packages/stellar-wallet-snap/src/services/transaction-scan/TransactionScanService.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ describe('TransactionScanService', () => {
validation: {
type: TransactionScanValidationType.Benign,
reason: '',
description: '',
description: null,
},
error: null,
});
Expand Down Expand Up @@ -173,7 +173,7 @@ describe('TransactionScanService', () => {
validation: {
type: TransactionScanValidationType.Benign,
reason: '',
description: '',
description: null,
},
error: null,
});
Expand Down Expand Up @@ -210,7 +210,7 @@ describe('TransactionScanService', () => {
validation: {
type: TransactionScanValidationType.Benign,
reason: '',
description: '',
description: null,
},
error: null,
});
Expand Down Expand Up @@ -243,7 +243,7 @@ describe('TransactionScanService', () => {
validation: {
type: TransactionScanValidationType.Benign,
reason: '',
description: '',
description: null,
},
error: null,
});
Expand Down Expand Up @@ -331,6 +331,32 @@ describe('TransactionScanService', () => {
});
});

it('drops Blockaid description so the banner uses MetaMask generic copy', async () => {
const { service, securityAlertsApiClient } = setup();
securityAlertsApiClient.scanTransaction.mockResolvedValue({
simulation: null,
validation: {
status: 'Success',
result_type: TransactionScanValidationType.Malicious,
reason: 'OTHER',
classification: 'other',
description:
'Gaining account GDUW4TP24B3PF2CCUZJ4AOSCHVXXQGKF3RDVCLFYFTL3XWB2YGTTXGIT is classified as stellar_expert_malicious',
},
});

const result = await service.scanTransactionSafe(scanParams);

expect(result).toMatchObject({
status: 'SUCCESS',
validation: {
type: TransactionScanValidationType.Malicious,
reason: 'OTHER',
description: null,
},
});
});

it('keeps free-form API errors as messages instead of codes', async () => {
const { service, securityAlertsApiClient } = setup();
securityAlertsApiClient.scanTransaction.mockResolvedValue({
Expand Down
7 changes: 6 additions & 1 deletion packages/stellar-wallet-snap/src/services/transaction-scan/TransactionScanService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,10 +321,15 @@ export class TransactionScanService {
{ status: 'Success' }
>,
): TransactionScanValidation {
// Match Solana/Tron: drive the banner from `result_type` and MetaMask
// generic copy. Do not pass Blockaid `description` / `classification` —
// they can embed machine labels (e.g. `stellar_expert_malicious`) when
// `reason` is `OTHER`. Placeholder until Blockaid provides mappable
// reasons (WPN-2215).
return {
type: validation.result_type,
reason: validation.reason ?? null,
description: validation.description ?? null,
description: null,
};
}

Expand Down
3 changes: 3 additions & 0 deletions packages/stellar-wallet-snap/src/ui/confirmation/components/ConfirmationAlerts.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,9 @@ describe('ConfirmationAlerts', () => {
severity: 'danger',
title: 'This is a deceptive request',
});
expect(JSON.stringify(component)).toContain(
'If you approve this request, a third party known for scams will take all your assets.',
);
});

it('renders warning validation alerts with softer warning copy', () => {
Expand Down
Loading