feat: Add wallet library by FrederikBolding · Pull Request #8417 · MetaMask/core

FrederikBolding · 2026-04-09T17:44:32Z

Explanation

Feature branch. WIP.

Know limitations:

Does not run on Node 18. Currently skipped in CI. Would need polyfill to fix but we should probably deprecate Node 18 instead.

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

socket-security · 2026-04-14T11:14:35Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Native binaries present: npm `better-sqlite3` Location: Package overview From: packages/wallet/package.json → `npm/better-sqlite3@12.9.0` ℹ Read more on: This package \| This alert \| Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/better-sqlite3@12.9.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `detect-libc` in module child_process Module: child_process Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/detect-libc@2.1.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/detect-libc@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `simple-get` in module http Module: http Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/simple-get@4.0.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/simple-get@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `simple-get` in module https Module: https Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/simple-get@4.0.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/simple-get@4.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `tunnel-agent` in module net Module: net Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/tunnel-agent@0.6.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tunnel-agent@0.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `tunnel-agent` in module tls Module: tls Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/tunnel-agent@0.6.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tunnel-agent@0.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `tunnel-agent` in module http Module: http Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/tunnel-agent@0.6.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tunnel-agent@0.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `tunnel-agent` in module https Module: https Location: Package overview From: `?` → `npm/better-sqlite3@12.9.0` → `npm/tunnel-agent@0.6.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tunnel-agent@0.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `prebuild-install` Reason: No longer maintained. Please contact the author of the relevant native addon; alternatives are available. From: `?` → `npm/better-sqlite3@12.9.0` → `npm/prebuild-install@7.1.3` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/prebuild-install@7.1.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `chownr` is 100.0% likely to have a medium risk anomaly Notes: The code represents a standard, well-scoped recursive ownership utility with deliberate cross-version compatibility. No evidence of malicious activity, data leakage, or external communications. The main risk is the potential for broad permission changes if invoked with untrusted uid/gid values; usage should be restricted to trusted contexts. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/better-sqlite3@12.9.0` → `npm/chownr@1.1.4` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chownr@1.1.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `tunnel-agent` is 100.0% likely to have a medium risk anomaly Notes: No evidence of malicious behavior detected. This file implements a standard tunneling proxy agent used for HTTP/HTTPS over a proxy. Potential risk is typical usage: misconfiguration of proxies could cause traffic to be routed through an untrusted proxy, but this is inherent to proxy usage rather than malicious code. No data exfiltration, backdoors, or cryptomining indicators observed. Confidence: 1.00 Severity: 0.60 From: `?` → `npm/better-sqlite3@12.9.0` → `npm/tunnel-agent@0.6.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tunnel-agent@0.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

socket-security · 2026-04-29T11:20:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/better-sqlite3@7.6.13
	better-sqlite3@12.9.0

View full report

Builds and tests pass. All lint issues are fixed except a handful that are deferred pending future changes.  --- > [!NOTE] > **Medium Risk** > Moderate risk due to new controller dependencies and changes to initialization wiring/typing that could affect runtime messaging and controller lifecycle. Test behavior now depends on external `INFURA_PROJECT_KEY` and mocked timers, which may introduce CI/environment sensitivity. > > **Overview** > **Stabilizes wallet builds/tests by wiring in missing controllers and config.** The wallet package now depends on additional controllers (accounts/approval/connectivity/network/remote feature flags/transaction) and updates TS project references accordingly. > > **Improves runtime/test ergonomics.** Jest loads a local `.env` (with `.env.example` added and `.env` gitignored), `Wallet` exposes stronger typed `messenger`/`state` and adds `destroy()` to clean up controller instances; tests are updated to require `INFURA_PROJECT_KEY`, use fake timers, and properly teardown the wallet. > > **Tightens initialization typing and controller wiring.** Adds `initialization/defaults.ts` for inferred `DefaultInstances`/`DefaultActions`/`DefaultEvents`, introduces `bindMessengerAction` to preserve action typings, and updates controller initializers (notably `TransactionController` and `RemoteFeatureFlagController`) to pass required options and bind messenger actions safely. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit a652933. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Frederik Bolding <frederik.bolding@gmail.com>

Anvil provides a local chain for the transaction test, and the remaining tests don't make real RPC calls (nock blocks outgoing network), so a real Infura key is no longer needed to run the test suite. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Adds a test for `createSecretRecoveryPhrase` to cover the untested utility. Marks the defensive `return undefined` branch in `destroy()` as ignored (all real controllers have a destroy method). Lowers coverage thresholds from 100% to reflect code that is not yet reachable from the public API in this prototype stage (e.g. isOffline callback, encryptor factory bodies, ConnectivityController.init). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Previously a pretest lifecycle hook, which is not guaranteed to run depending on how CI invokes tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Silences foundryup output on success (prints on failure), extracts the install step into a named test:prepare script for discoverability, and adds a yarn.config.cjs exception since the wallet test script differs from the monorepo standard. Also updates the stale error message in anvil.ts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Yarn's built-in shell doesn't support the shell syntax needed to suppress foundryup output on success and print it on failure. Moving to a real bash script avoids Yarn shell quirks that may explain why the anvil binary download isn't running reliably in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mm-foundryup installs anvil to <cwd>/node_modules/.bin/anvil. If cwd isn't what we expect when the script runs (which may be why CI fails), anvil ends up somewhere neither getAnvilBinaryPath candidate matches. Explicitly cd to the package root and verify the expected file exists after install, with diagnostic output on failure. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Node 18 does not expose globalThis.crypto by default, which causes the wallet package's tests to fail inside browser-passworder's generateSalt. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

## Summary - Add synchronous, per-property SQLite persistence to the wallet package using better-sqlite3 - Each controller state property with `persist: true` metadata gets its own row in a `kv` table (key format: `ControllerName.propertyName`) - Writes happen synchronously within the same call stack as `controller.update()` via `stateChanged` event subscriptions, eliminating data loss windows - Defaults to `:memory:` when no database path is provided ## Test plan - [ ] `yarn workspace @metamask/wallet exec jest --no-coverage --watchman=false src/persistence/` — 22 unit tests covering KeyValueStore CRUD, loadState grouping, persist filtering, StateDeriver application, patch-based diffing, unsubscribe, and multi-controller scenarios - [ ] `yarn workspace @metamask/wallet exec tsc --noEmit` — no new type errors - [ ] Integration test with file-backed DB: create Wallet with a file path, perform operations, create second Wallet from same path, verify state restoration 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Introduces a new persistence layer and changes wallet lifecycle/messenger semantics, plus adds a native dependency (`better-sqlite3`) that can affect build/install reliability across environments. > > **Overview** > Adds a new `persistence` subpath export that provides synchronous SQLite-backed state storage via `KeyValueStore`, plus `loadState` (reconstruct controller state from `Controller.prop` keys) and `subscribeToChanges` (persist only `persist`-flagged controller properties based on Immer patches and delete on removal). > > Updates `Wallet` construction/typing to accept optional preloaded `state`, exposes `controllerMetadata` for initialized controllers, switches messenger namespace to `Wallet`, and makes `destroy()` idempotent while publishing a new `Wallet:destroyed` event after best-effort controller teardown. > > Wires in the native `better-sqlite3` dependency (with LavaMoat allow-scripts), adds test/CI setup to install required binaries (`anvil` + `better-sqlite3` prebuild) and documents how to rebuild the native addon. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 772c1e6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Gudahtt · 2026-04-30T18:09:34Z

Should this persistence API be in this package? I don't expect this would be used in either client

It shouldn't. We were planning to move that before attempting to merge this

FrederikBolding added the DO-NOT-MERGE label Apr 9, 2026

rekmarks force-pushed the feat/wallet-library branch 2 times, most recently from 623f9af to 3fb60ee Compare April 16, 2026 21:13

rekmarks added the team-core-platform label Apr 16, 2026

FrederikBolding force-pushed the feat/wallet-library branch from 45d013e to 6ec54b9 Compare April 17, 2026 09:30

FrederikBolding force-pushed the feat/wallet-library branch from 39b963d to 0d6028e Compare April 29, 2026 11:19

FrederikBolding and others added 22 commits April 29, 2026 14:49

Initialize wallet package

2148331

Default licensing

d747020

Add basic support KeyringController and AccountsController

0ce3730

Filter out overridden configuration

c8226fb

Add controllers required for signing and submitting transactions

fde6c32

Run tests on Sepolia

d107d93

chore: Fix or suppress eslint errors

1a6e92a

test: Use local dev chain via anvil

1b2f3b4

test: Fix anvil helper exports

c497557

chore: Fix remaining lint errors

f58bbf5

chore: Update teams.json

2e0a5fd

chore: yarn && yarn dedupe after rebase

9c1abb1

chore: oxfmt

7cc5922

fix: Inline anvil download into test script

eb18768

Previously a pretest lifecycle hook, which is not guaranteed to run depending on how CI invokes tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: Fix foundryup pretest script

df4c078

chore: Add exception for test script in constraints

9ea8f1a

rekmarks and others added 4 commits April 29, 2026 14:49

fix: Use tsx to run @metamask/foundryup

3857bb8

ci: Skip @metamask/wallet tests on Node 18

aef4bff

Node 18 does not expose globalThis.crypto by default, which causes the wallet package's tests to fail inside browser-passworder's generateSalt. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix yarn constraints after rebase

88c6f09

FrederikBolding force-pushed the feat/wallet-library branch from d9daf4f to 88c6f09 Compare April 29, 2026 12:49

Fix build issue after rebase

9ea77fb

Gudahtt reviewed Apr 30, 2026

View reviewed changes

rekmarks mentioned this pull request May 4, 2026

wallet-cli: Move sqlite persistence from wallet to wallet-cli #8682

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add wallet library#8417

feat: Add wallet library#8417
FrederikBolding wants to merge 27 commits into
mainfrom
feat/wallet-library

FrederikBolding commented Apr 9, 2026 •

edited by rekmarks

Loading

Uh oh!

socket-security Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

Gudahtt Apr 30, 2026

Uh oh!

FrederikBolding May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

FrederikBolding commented Apr 9, 2026 • edited by rekmarks Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

socket-security Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Gudahtt Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

FrederikBolding May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

FrederikBolding commented Apr 9, 2026 •

edited by rekmarks

Loading

socket-security Bot commented Apr 14, 2026 •

edited

Loading

socket-security Bot commented Apr 29, 2026 •

edited

Loading