fix: initial multichain core by elribonazo · Pull Request #1317 · MetaMask/metamask-sdk

elribonazo · 2025-07-16T14:27:15Z

Explanation

This PR will be integrating the multi-chain core package, it does not yet fully integrate install modals and QRCode displaying. This will be implemented into the SDK once we have the playground merged.

I'd rather leave the multi-chain core as is and improve it in later PR's.

Added decent unitary test coverage for multichain and some minor changes in domain to make consuming this SDK easier.

Added session Management

Added Error Management

Added RPCClient with support for the ReadonlyRPC Calls as before but a much cleaner and isolated code.

Focusing on simplicity and strong separation of concerns

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've highlighted breaking changes using the "BREAKING" category above as appropriate

…be any not unknown

socket-security · 2025-07-16T15:03:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/jsdom@26.1.0

View full report

socket-security · 2025-07-16T15:03:49Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		`npm/jsdom@26.1.0` is a AI-detected potential code anomaly. Notes: The code fragment does not exhibit clear malicious behavior, but it has several anomalies, including typos and dynamic property manipulation using Reflect API, which could pose a security risk if not properly managed. Confidence: 1.00 Severity: 0.60 From: packages/sdk-multichain/package.json → `npm/jsdom@26.1.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@26.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`npm/jsdom@26.1.0` is a AI-detected potential code anomaly. Notes: The code uses new Function() and createFunction() to dynamically create and execute code, which can be dangerous if not properly controlled. The use of with statements and dynamic function creation is similar to using eval(), which is generally discouraged due to security risks. If user input is passed into the event handler bodies, it could lead to cross-site scripting (XSS) vulnerabilities. Confidence: 1.00 Severity: 0.60 From: packages/sdk-multichain/package.json → `npm/jsdom@26.1.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jsdom@26.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Bug: Error Handling: Validate Error Type Before Accessing Message

Multiple catch blocks in client.ts and index.ts directly access error.message (or err.message) without validating if the caught value is an Error object. Since JavaScript catch blocks can receive any type of value, this can lead to runtime errors if a non-Error value is caught.

packages/sdk-multichain/src/utis/rpc/client.ts#L139-L141

metamask-sdk/packages/sdk-multichain/src/utis/rpc/client.ts

Lines 139 to 141 in 7a99f2f

    
             return response 
        
           } catch (error) { 
        
             throw new RPCInvokeMethodErr(error.message)

packages/sdk-multichain/src/store/index.ts#L15-L20

metamask-sdk/packages/sdk-multichain/src/store/index.ts

Lines 15 to 20 in 7a99f2f

    
           } catch (err) { 
        
             throw new StorageGetErr( 
        
               this.#adapter.platform, 
        
               'anonId', 
        
               err.message 
        
             );

packages/sdk-multichain/src/utis/rpc/client.ts#L59-L60

metamask-sdk/packages/sdk-multichain/src/utis/rpc/client.ts

Lines 59 to 60 in 7a99f2f

    
           } 
        
           throw new RPCReadonlyRequestErr(error.message)

packages/sdk-multichain/src/utis/rpc/client.ts#L68-L69

metamask-sdk/packages/sdk-multichain/src/utis/rpc/client.ts

Lines 68 to 69 in 7a99f2f

    
           } catch (error) { 
        
            throw new RPCReadonlyResponseErr(error.message)

Fix in Cursor • Fix in Web

Was this report helpful? Give feedback by reacting with 👍 or 👎

codecov · 2025-07-16T15:41:45Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 74.93%. Comparing base (449a82a) to head (7a99f2f).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1317   +/-   ##
=======================================
  Coverage   74.93%   74.93%           
=======================================
  Files         184      184           
  Lines        4513     4513           
  Branches     1105     1105           
=======================================
  Hits         3382     3382           
  Misses       1131     1131

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sonarqubecloud · 2025-07-16T15:42:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

chakra-guy

Great work!

elribonazo added 7 commits July 14, 2025 13:44

fix: add initial implementation of the multichain building-block

e06a0cf

fix: useUnknownInCatchVariables in tsconfig to allow err in catch to …

0296210

…be any not unknown

fix: add error handling and rpcClient coverage

702a4d5

fix: add test coverage

68bad1c

fix: improve tests for multichain init

3b90956

fix: improve testing coverage

1cb9656

fix: remove empty lines

bd96bd0

elribonazo marked this pull request as ready for review July 16, 2025 14:29

elribonazo requested a review from a team as a code owner July 16, 2025 14:29

This comment was marked as outdated.

Sign in to view

elribonazo added 2 commits July 16, 2025 16:50

fix: remove biome lint err

6644540

fix: add missing jsdom pkg

d3b3a01

This comment was marked as outdated.

Sign in to view

fix: code + test improvements

81c84fe

This comment was marked as outdated.

Sign in to view

elribonazo added 3 commits July 16, 2025 17:13

fix: session upgrade test

d9c75c3

fix: using provider before its defined in sdk constructor

70b307f

fix: testing against wrong expect

7a99f2f

cursor Bot reviewed Jul 16, 2025

View reviewed changes

chakra-guy approved these changes Jul 17, 2025

View reviewed changes

elribonazo merged commit f72f1bf into main Jul 17, 2025
40 checks passed

elribonazo deleted the features/multichain-core branch July 17, 2025 12:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: initial multichain core#1317

fix: initial multichain core#1317
elribonazo merged 13 commits into
mainfrom
features/multichain-core

elribonazo commented Jul 16, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

socket-security Bot commented Jul 16, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 16, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor Bot left a comment

Uh oh!

codecov Bot commented Jul 16, 2025 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jul 16, 2025

Uh oh!

chakra-guy left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	return response
	} catch (error) {
	throw new RPCInvokeMethodErr(error.message)

	} catch (err) {
	throw new StorageGetErr(
	this.#adapter.platform,
	'anonId',
	err.message
	);

	} catch (error) {
	throw new RPCReadonlyResponseErr(error.message)

Uh oh!

Uh oh!

Conversation

elribonazo commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Checklist

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

socket-security Bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Bug: Error Handling: Validate Error Type Before Accessing Message

Uh oh!

codecov Bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sonarqubecloud Bot commented Jul 16, 2025

Quality Gate passed

Uh oh!

chakra-guy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

elribonazo commented Jul 16, 2025 •

edited

Loading

socket-security Bot commented Jul 16, 2025 •

edited

Loading

socket-security Bot commented Jul 16, 2025 •

edited

Loading

codecov Bot commented Jul 16, 2025 •

edited

Loading