Skip to content

Conversation

@FrederikBolding
Copy link
Member

@FrederikBolding FrederikBolding commented Feb 2, 2026

Disallow using unconnected account Snaps for address resolution in MultichainRouter, additionally ensure requests are only routed to connected accounts following resolution.


Note

Medium Risk
Medium risk because it changes account selection/routing logic for signing requests, which can affect which account is used or cause new request rejections if connectedAddresses is incorrect or missing.

Overview
Prevents MultichainRouter from routing account-Snap signing requests to accounts that are not in the request’s connectedAddresses, including during address resolution.

#getSnapAccountId now filters candidate accounts to those connected first, uses a connected Snap for resolution, and selects only from the connected subset (otherwise throws invalidParams with "No available account found for request."). A new test covers the failure case when no connected accounts are provided.

Written by Cursor Bugbot for commit 1eaf930. This will update automatically on new commits. Configure here.

@FrederikBolding FrederikBolding marked this pull request as ready for review February 2, 2026 12:57
@FrederikBolding FrederikBolding requested a review from a team as a code owner February 2, 2026 12:57
@codecov
Copy link

codecov bot commented Feb 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.39%. Comparing base (07d1937) to head (1eaf930).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3837   +/-   ##
=======================================
  Coverage   98.39%   98.39%           
=======================================
  Files         430      430           
  Lines       12457    12461    +4     
  Branches     1932     1933    +1     
=======================================
+ Hits        12257    12261    +4     
  Misses        200      200           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

@danroc danroc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@FrederikBolding FrederikBolding added this pull request to the merge queue Feb 2, 2026
Merged via the queue into main with commit d47ac3c Feb 2, 2026
131 checks passed
@FrederikBolding FrederikBolding deleted the fb/disallow-unconnected-accounts-in-multichain-router branch February 2, 2026 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants