Reality2byte · pull · May 8, 2026 · May 8, 2026 · May 8, 2026 · May 8, 2026
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metamask/core-monorepo",
-  "version": "968.0.0",
+  "version": "970.0.0",
   "private": true,
   "description": "Monorepo for packages shared between MetaMask clients",
   "repository": {
@@ -54,7 +54,7 @@
     "@metamask/eslint-config-typescript": "^15.0.0",
     "@metamask/eth-block-tracker": "^15.0.1",
     "@metamask/eth-json-rpc-provider": "^6.0.1",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/network-controller": "^30.1.0",
     "@metamask/utils": "^11.9.0",
     "@ts-bridge/cli": "^0.6.4",

diff --git a/packages/base-controller/package.json b/packages/base-controller/package.json
@@ -56,7 +56,7 @@
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^6.1.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@ts-bridge/cli": "^0.6.4",
     "@types/jest": "^29.5.14",
     "deepmerge": "^4.2.2",

diff --git a/packages/composable-controller/package.json b/packages/composable-controller/package.json
@@ -56,7 +56,7 @@
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^6.1.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@ts-bridge/cli": "^0.6.4",
     "@types/jest": "^29.5.14",
     "deepmerge": "^4.2.2",

diff --git a/packages/eip1193-permission-middleware/CHANGELOG.md b/packages/eip1193-permission-middleware/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Bump `@metamask/permission-controller` from `^13.0.0` to `^13.1.0` ([#8722](https://github.com/MetaMask/core/pull/8722))
+- Bump `@metamask/json-rpc-engine` from `^10.3.0` to `^10.4.0` ([#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [2.0.0]
 

diff --git a/packages/eip1193-permission-middleware/package.json b/packages/eip1193-permission-middleware/package.json
@@ -53,7 +53,7 @@
   "dependencies": {
     "@metamask/chain-agnostic-permission": "^1.5.0",
     "@metamask/controller-utils": "^11.20.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/permission-controller": "^13.1.0",
     "@metamask/utils": "^11.9.0",
     "lodash": "^4.17.21"

diff --git a/packages/eth-block-tracker/package.json b/packages/eth-block-tracker/package.json
@@ -65,7 +65,7 @@
   },
   "devDependencies": {
     "@metamask/auto-changelog": "^6.1.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@ts-bridge/cli": "^0.6.4",
     "@types/jest": "^29.5.14",
     "@types/json-rpc-random-id": "^1.0.1",

diff --git a/packages/eth-json-rpc-middleware/CHANGELOG.md b/packages/eth-json-rpc-middleware/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.3.0` ([#8661](https://github.com/MetaMask/core/pull/8661))
+- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.4.0` ([#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [23.1.3]
 

diff --git a/packages/eth-json-rpc-middleware/package.json b/packages/eth-json-rpc-middleware/package.json
@@ -60,7 +60,7 @@
     "@metamask/eth-block-tracker": "^15.0.1",
     "@metamask/eth-json-rpc-provider": "^6.0.1",
     "@metamask/eth-sig-util": "^8.2.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/message-manager": "^14.1.1",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/superstruct": "^3.1.0",

diff --git a/packages/eth-json-rpc-provider/CHANGELOG.md b/packages/eth-json-rpc-provider/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.3.0` ([#8661](https://github.com/MetaMask/core/pull/8661))
+- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.4.0` ([#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [6.0.1]
 

diff --git a/packages/eth-json-rpc-provider/package.json b/packages/eth-json-rpc-provider/package.json
@@ -56,7 +56,7 @@
     "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch"
   },
   "dependencies": {
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/utils": "^11.9.0",
     "nanoid": "^3.3.8"

diff --git a/packages/json-rpc-engine/CHANGELOG.md b/packages/json-rpc-engine/CHANGELOG.md
@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Export `assertExpectedHooks` utility ([#8747](https://github.com/MetaMask/core/pull/8747))
+
+## [10.4.0]
+
+### Added
+
 - Add legacy `createOriginMiddleware` utility ([#8734](https://github.com/MetaMask/core/pull/8734))
 
 ## [10.3.0]
@@ -302,7 +308,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     This change may affect consumers that depend on the eager execution of middleware _during_ request processing, _outside of_ middleware functions and request handlers.
     - In general, it is a bad practice to work with state that depends on middleware execution, while the middleware are executing.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.3.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.4.0...HEAD
+[10.4.0]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.3.0...@metamask/json-rpc-engine@10.4.0
 [10.3.0]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.2.4...@metamask/json-rpc-engine@10.3.0
 [10.2.4]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.2.3...@metamask/json-rpc-engine@10.2.4
 [10.2.3]: https://github.com/MetaMask/core/compare/@metamask/json-rpc-engine@10.2.2...@metamask/json-rpc-engine@10.2.3

diff --git a/packages/json-rpc-engine/package.json b/packages/json-rpc-engine/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@metamask/json-rpc-engine",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "A tool for processing JSON-RPC messages",
   "keywords": [
     "Ethereum",

diff --git a/packages/json-rpc-engine/src/v2/index.test.ts b/packages/json-rpc-engine/src/v2/index.test.ts
@@ -9,6 +9,7 @@ describe('@metamask/json-rpc-engine/v2', () => {
         "JsonRpcServer",
         "MiddlewareContext",
         "asLegacyMiddleware",
+        "assertExpectedHooks",
         "createMethodMiddleware",
         "createOriginMiddleware",
         "createScaffoldMiddleware",

diff --git a/packages/json-rpc-engine/src/v2/index.ts b/packages/json-rpc-engine/src/v2/index.ts
@@ -23,6 +23,7 @@ export {
   isRequest,
   JsonRpcEngineError,
   selectHooks,
+  assertExpectedHooks,
 } from './utils';
 export type {
   Json,

diff --git a/packages/json-rpc-middleware-stream/CHANGELOG.md b/packages/json-rpc-middleware-stream/CHANGELOG.md
@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Upgrade `@metamask/utils` from `^11.8.1` to `^11.9.0` ([#7511](https://github.com/MetaMask/core/pull/7511))
-- Bump `@metamask/json-rpc-engine` from `^10.1.1` to `^10.3.0` ([#7202](https://github.com/MetaMask/core/pull/7202), [#7642](https://github.com/MetaMask/core/pull/7642), [#7856](https://github.com/MetaMask/core/pull/7856), [#8078](https://github.com/MetaMask/core/pull/8078), [#8317](https://github.com/MetaMask/core/pull/8317), [#8661](https://github.com/MetaMask/core/pull/8661))
+- Bump `@metamask/json-rpc-engine` from `^10.1.1` to `^10.4.0` ([#7202](https://github.com/MetaMask/core/pull/7202), [#7642](https://github.com/MetaMask/core/pull/7642), [#7856](https://github.com/MetaMask/core/pull/7856), [#8078](https://github.com/MetaMask/core/pull/8078), [#8317](https://github.com/MetaMask/core/pull/8317), [#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [8.0.8]
 

diff --git a/packages/json-rpc-middleware-stream/package.json b/packages/json-rpc-middleware-stream/package.json
@@ -51,7 +51,7 @@
     "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch"
   },
   "dependencies": {
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/safe-event-emitter": "^3.0.0",
     "@metamask/utils": "^11.9.0",
     "readable-stream": "^3.6.2"

diff --git a/packages/multichain-api-middleware/CHANGELOG.md b/packages/multichain-api-middleware/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bump `@metamask/multichain-transactions-controller` from `^7.0.4` to `^7.1.0` ([#8665](https://github.com/MetaMask/core/pull/8665))
 - Bump `@metamask/accounts-controller` from `^37.2.0` to `^38.0.0` ([#8665](https://github.com/MetaMask/core/pull/8665))
 - Bump `@metamask/permission-controller` from `^13.0.0` to `^13.1.0` ([#8722](https://github.com/MetaMask/core/pull/8722))
+- Bump `@metamask/json-rpc-engine` from `^10.3.0` to `^10.4.0` ([#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [3.0.0]
 

diff --git a/packages/multichain-api-middleware/package.json b/packages/multichain-api-middleware/package.json
@@ -55,7 +55,7 @@
     "@metamask/api-specs": "^0.14.0",
     "@metamask/chain-agnostic-permission": "^1.5.0",
     "@metamask/controller-utils": "^11.20.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/network-controller": "^30.1.0",
     "@metamask/permission-controller": "^13.1.0",
     "@metamask/rpc-errors": "^7.0.2",

diff --git a/packages/network-controller/CHANGELOG.md b/packages/network-controller/CHANGELOG.md
@@ -16,7 +16,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.3.0` ([#8661](https://github.com/MetaMask/core/pull/8661))
+- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.4.0` ([#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [30.1.0]
 

diff --git a/packages/network-controller/package.json b/packages/network-controller/package.json
@@ -61,7 +61,7 @@
     "@metamask/eth-json-rpc-middleware": "^23.1.3",
     "@metamask/eth-json-rpc-provider": "^6.0.1",
     "@metamask/eth-query": "^4.0.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/messenger": "^1.2.0",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/swappable-obj-proxy": "^2.3.0",

diff --git a/packages/permission-controller/CHANGELOG.md b/packages/permission-controller/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Bump `@metamask/json-rpc-engine` from `^10.3.0` to `^10.4.0` ([#8746](https://github.com/MetaMask/core/pull/8746))
+
 ## [13.1.0]
 
 ### Added

diff --git a/packages/permission-controller/package.json b/packages/permission-controller/package.json
@@ -56,7 +56,7 @@
     "@metamask/approval-controller": "^9.0.1",
     "@metamask/base-controller": "^9.1.0",
     "@metamask/controller-utils": "^11.20.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/messenger": "^1.2.0",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/utils": "^11.9.0",

diff --git a/packages/permission-log-controller/CHANGELOG.md b/packages/permission-log-controller/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.3.0` ([#8661](https://github.com/MetaMask/core/pull/8661))
+- Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.4.0` ([#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746))
 - Bump `@metamask/messenger` from `^1.0.0` to `^1.2.0` ([#8364](https://github.com/MetaMask/core/pull/8364), [#8373](https://github.com/MetaMask/core/pull/8373), [#8632](https://github.com/MetaMask/core/pull/8632))
 - Bump `@metamask/base-controller` from `^9.0.1` to `^9.1.0` ([#8457](https://github.com/MetaMask/core/pull/8457))
 

diff --git a/packages/permission-log-controller/package.json b/packages/permission-log-controller/package.json
@@ -54,7 +54,7 @@
   },
   "dependencies": {
     "@metamask/base-controller": "^9.1.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/messenger": "^1.2.0",
     "@metamask/utils": "^11.9.0"
   },

diff --git a/packages/selected-network-controller/CHANGELOG.md b/packages/selected-network-controller/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Bump `@metamask/permission-controller` from `^13.0.0` to `^13.1.0` ([#8722](https://github.com/MetaMask/core/pull/8722))
+- Bump `@metamask/json-rpc-engine` from `^10.3.0` to `^10.4.0` ([#8746](https://github.com/MetaMask/core/pull/8746))
 
 ## [26.1.1]
 

diff --git a/packages/selected-network-controller/package.json b/packages/selected-network-controller/package.json
@@ -54,7 +54,7 @@
   },
   "dependencies": {
     "@metamask/base-controller": "^9.1.0",
-    "@metamask/json-rpc-engine": "^10.3.0",
+    "@metamask/json-rpc-engine": "^10.4.0",
     "@metamask/messenger": "^1.2.0",
     "@metamask/network-controller": "^30.1.0",
     "@metamask/permission-controller": "^13.1.0",

diff --git a/packages/transaction-controller/CHANGELOG.md b/packages/transaction-controller/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Trigger the first-time-interaction warning correctly for `safeTransferFrom` token transfers by including `TransactionType.tokenMethodSafeTransferFrom` in the effective-recipient decoding logic ([#8723](https://github.com/MetaMask/core/pull/8723))
 
+### Fixed
+
+- Reject transactions with a missing `to` and empty `data` to prevent accidental empty contract deployments ([#8744](https://github.com/MetaMask/core/pull/8744))
+
 ## [65.2.0]
 
 ### Added

diff --git a/packages/transaction-controller/src/utils/transaction-type.test.ts b/packages/transaction-controller/src/utils/transaction-type.test.ts
@@ -165,7 +165,7 @@ describe('determineTransactionType', () => {
     });
   });
 
-  it('returns a contract deployment type when "to" is falsy and there is data', async () => {
+  it('returns a contract deployment type when "to" is falsy and there is real bytecode', async () => {
     const result = await determineTransactionType(
       {
         ...txParams,
@@ -180,6 +180,34 @@ describe('determineTransactionType', () => {
     });
   });
 
+  it('does NOT classify as deployContract when "to" is falsy but data is "0x" (empty bytecode)', async () => {
+    jest.mocked(rpcRequest).mockResolvedValue('0x');
+
+    const result = await determineTransactionType(
+      {
+        ...txParams,
+        to: '',
+        data: '0x',
+      },
+      { messenger: messengerMock, networkClientId: networkClientIdMock },
+    );
+    expect(result.type).not.toBe(TransactionType.deployContract);
+  });
+
+  it('does NOT classify as deployContract when "to" is undefined but data is "0x"', async () => {
+    jest.mocked(rpcRequest).mockResolvedValue('0x');
+
+    const result = await determineTransactionType(
+      {
+        ...txParams,
+        to: undefined,
+        data: '0x',
+      },
+      { messenger: messengerMock, networkClientId: networkClientIdMock },
+    );
+    expect(result.type).not.toBe(TransactionType.deployContract);
+  });
+
   it('returns a simple send type with a 0x getCodeResponse when there is data, but the "to" address is not a contract address', async () => {
     jest.mocked(rpcRequest).mockResolvedValue('0x');
 

diff --git a/packages/transaction-controller/src/utils/transaction-type.ts b/packages/transaction-controller/src/utils/transaction-type.ts
@@ -41,7 +41,9 @@ export async function determineTransactionType(
 ): Promise<InferTransactionTypeResult> {
   const { data, to } = txParams;
 
-  if (data && !to) {
+  const hasRealBytecode = Boolean(data && data !== '0x' && data.length > 2);
+
+  if (hasRealBytecode && !to) {
     return { type: TransactionType.deployContract, getCodeResponse: undefined };
   }