fix: preserve Money Account EIP-7702 auths on same-chain pay batches

packages/transaction-controller/CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add optional `authorizationList` to `TransactionBatchRequest` so callers can include pre-signed EIP-7702 authorizations (e.g. Money Account upgrades) alongside any upgrade authorization generated for the batch payer (`from`) ([#9765](https://github.com/MetaMask/core/pull/9765))
+
 ### Changed
 
 - Bump `@metamask/network-controller` from `^35.0.0` to `^35.0.1` ([#9758](https://github.com/MetaMask/core/pull/9758))
@@ -24,6 +28,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - Refresh gas fee token quotes independently of balance changes for enforced-simulation transactions, and prevent stale simulation responses from overwriting newer transaction state. ([#9757](https://github.com/MetaMask/core/pull/9757))
+- Retain pre-signed entries in `signAuthorizationList` instead of re-signing them with `txParams.from`, so authorizations signed by a different account survive publish ([#9765](https://github.com/MetaMask/core/pull/9765))
+- Attribute EIP-7702 authorization nonces to their recovered authorities in the nonce tracker, so foreign authorizations (e.g. Money Account upgrades on same-chain pay batches) do not inflate the batch payer's pending nonce ([#9765](https://github.com/MetaMask/core/pull/9765))
 
 ## [69.4.0]
 

packages/transaction-controller/package.json

@@ -56,6 +56,7 @@
  },
  "dependencies": {
  "@ethereumjs/common": "^4.4.0",
+ "@ethereumjs/rlp": "^5.0.2",
  "@ethereumjs/tx": "^5.4.0",
  "@ethereumjs/util": "^9.1.0",
  "@ethersproject/abi": "^5.7.0",
@@ -78,6 +79,7 @@
  "bignumber.js": "^9.1.2",
  "bn.js": "^5.2.1",
  "eth-method-registry": "^4.0.0",
+ "ethereum-cryptography": "^2.1.2",
  "fast-json-patch": "^3.1.1",
  "lodash": "^4.17.21",
  "uuid": "^8.3.2"

packages/transaction-controller/src/types.ts

@@ -1831,6 +1831,16 @@ export type TransactionBatchRequest = {
  */
  atomic?: boolean;
 
+ /**
+ * Pre-signed or unsigned EIP-7702 authorizations to include on the batch
+ * type-4 transaction, in addition to any upgrade authorization generated for
+ * `from` when the batch payer is not yet upgraded.
+ *
+ * Used when vaulting/delegation requires upgrading a different account than
+ * `from` (e.g. Money Account deposits paid by an EOA with account override).
+ */
+ authorizationList?: AuthorizationList;
+
  batchId?: Hex;
 
  /** Whether to disable batch transaction processing via an EIP-7702 upgraded account. */

packages/transaction-controller/src/utils/batch.test.ts

@@ -830,6 +830,87 @@ describe('Batch Utils', () => {
  );
  });
 
+ it('merges provided authorizationList with from upgrade authorization', async () => {
+ isAccountUpgradedToEIP7702Mock.mockResolvedValueOnce({
+ delegationAddress: undefined,
+ isSupported: false,
+ });
+
+ addTransactionMock.mockResolvedValueOnce({
+ transactionMeta: TRANSACTION_META_MOCK,
+ result: Promise.resolve(''),
+ });
+
+ generateEIP7702BatchTransactionMock.mockReturnValueOnce(
+ TRANSACTION_BATCH_PARAMS_MOCK,
+ );
+
+ getEIP7702UpgradeContractAddressMock.mockReturnValueOnce(
+ CONTRACT_ADDRESS_MOCK,
+ );
+
+ const providedAuthorization = {
+ address: '0x1234567890123456789012345678901234567890' as const,
+ chainId: '0x1' as const,
+ nonce: '0x5' as const,
+ r: '0xabc' as const,
+ s: '0xdef' as const,
+ yParity: '0x1' as const,
+ };
+
+ request.request.authorizationList = [providedAuthorization];
+
+ await addTransactionBatch(request);
+
+ expect(addTransactionMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ type: TransactionEnvelopeType.setCode,
+ authorizationList: [
+ { address: CONTRACT_ADDRESS_MOCK },
+ providedAuthorization,
+ ],
+ }),
+ expect.anything(),
+ );
+ });
+
+ it('includes provided authorizationList when from is already upgraded', async () => {
+ isAccountUpgradedToEIP7702Mock.mockResolvedValueOnce({
+ delegationAddress: CONTRACT_ADDRESS_MOCK,
+ isSupported: true,
+ });
+
+ addTransactionMock.mockResolvedValueOnce({
+ transactionMeta: TRANSACTION_META_MOCK,
+ result: Promise.resolve(''),
+ });
+
+ generateEIP7702BatchTransactionMock.mockReturnValueOnce(
+ TRANSACTION_BATCH_PARAMS_MOCK,
+ );
+
+ const providedAuthorization = {
+ address: '0x1234567890123456789012345678901234567890' as const,
+ chainId: '0x1' as const,
+ nonce: '0x5' as const,
+ r: '0xabc' as const,
+ s: '0xdef' as const,
+ yParity: '0x1' as const,
+ };
+
+ request.request.authorizationList = [providedAuthorization];
+
+ await addTransactionBatch(request);
+
+ expect(addTransactionMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ type: TransactionEnvelopeType.setCode,
+ authorizationList: [providedAuthorization],
+ }),
+ expect.anything(),
+ );
+ });
+
  it('does not use type 4 if not upgraded but disableUpgrade set', async () => {
  isAccountUpgradedToEIP7702Mock.mockResolvedValueOnce({
  delegationAddress: undefined,
@@ -1390,6 +1471,47 @@ describe('Batch Utils', () => {
  CHAIN_ID_MOCK,
  );
  });
+
+ it('does not use provided foreign authorization as delegation mock when from is upgraded', async () => {
+ isAccountUpgradedToEIP7702Mock.mockResolvedValueOnce({
+ delegationAddress: CONTRACT_ADDRESS_MOCK,
+ isSupported: true,
+ });
+
+ addTransactionMock.mockResolvedValueOnce({
+ transactionMeta: TRANSACTION_META_MOCK,
+ result: Promise.resolve(''),
+ });
+
+ generateEIP7702BatchTransactionMock.mockReturnValueOnce(
+ TRANSACTION_BATCH_PARAMS_MOCK,
+ );
+
+ const providedAuthorization = {
+ address: '0x1234567890123456789012345678901234567890' as const,
+ chainId: '0x1' as const,
+ nonce: '0x5' as const,
+ r: '0xabc' as const,
+ s: '0xdef' as const,
+ yParity: '0x1' as const,
+ };
+
+ request.request.authorizationList = [providedAuthorization];
+
+ const validateSecurityMock = jest.fn();
+ validateSecurityMock.mockResolvedValueOnce({});
+
+ request.request.validateSecurity = validateSecurityMock;
+
+ await addTransactionBatch(request);
+
+ expect(validateSecurityMock).toHaveBeenCalledWith(
+ expect.objectContaining({
+ delegationMock: undefined,
+ }),
+ CHAIN_ID_MOCK,
+ );
+ });
  });
 
  describe('with publish batch hook', () => {

packages/transaction-controller/src/utils/batch.ts

@@ -36,6 +36,7 @@ import type {
 import { projectLogger } from '../logger.js';
 import { TransactionEnvelopeType, TransactionType } from '../types.js';
 import type {
+ AuthorizationList,
  NestedTransactionMetadata,
  SecurityAlertResponse,
  TransactionBatchSingleRequest,
@@ -282,6 +283,58 @@ async function getNestedTransactionMeta(
  };
 }
 
+/**
+ * Build the authorization list for an EIP-7702 batch transaction.
+ *
+ * When the batch payer (`from`) requires an upgrade, an unsigned upgrade
+ * authorization for that account is included first. Any caller-provided
+ * authorizations (e.g. a pre-signed Money Account upgrade) are appended so
+ * both can be submitted on the same type-4 transaction.
+ *
+ * @param options - Options bag.
+ * @param options.chainId - Chain ID of the batch.
+ * @param options.messenger - Controller messenger.
+ * @param options.providedAuthorizationList - Optional authorizations from the batch request.
+ * @param options.publicKeyEIP7702 - Public key used to resolve the upgrade contract.
+ * @param options.requiresUpgrade - Whether the batch payer requires an EIP-7702 upgrade.
+ * @returns The combined authorization list, or undefined when none are needed.
+ */
+function buildBatchAuthorizationList({
+ chainId,
+ messenger,
+ providedAuthorizationList,
+ publicKeyEIP7702,
+ requiresUpgrade,
+}: {
+ chainId: Hex;
+ messenger: TransactionControllerMessenger;
+ providedAuthorizationList?: AuthorizationList;
+ publicKeyEIP7702: Hex;
+ requiresUpgrade: boolean;
+}): AuthorizationList | undefined {
+ const authorizationList: AuthorizationList = [];
+
+ if (requiresUpgrade) {
+ const upgradeContractAddress = getEIP7702UpgradeContractAddress(
+ chainId,
+ messenger,
+ publicKeyEIP7702,
+ );
+
+ if (!upgradeContractAddress) {
+ throw rpcErrors.internal(ERROR_MESSAGE_NO_UPGRADE_CONTRACT);
+ }
+
+ authorizationList.push({ address: upgradeContractAddress });
+ }
+
+ if (providedAuthorizationList?.length) {
+ authorizationList.push(...providedAuthorizationList);
+ }
+
+ return authorizationList.length ? authorizationList : undefined;
+}
+
 /**
  * Process a batch transaction using an EIP-7702 transaction.
  *
@@ -300,6 +353,7 @@ async function addTransactionBatchWith7702(
 
  const {
  atomic,
+ authorizationList: providedAuthorizationList,
  batchId: batchIdOverride,
  disableUpgrade,
  from,
@@ -382,22 +436,23 @@ async function addTransactionBatchWith7702(
  maxPriorityFeePerGas: nestedTransactions[0]?.maxPriorityFeePerGas,
  };
 
- if (requiresUpgrade) {
- const upgradeContractAddress = getEIP7702UpgradeContractAddress(
- chainId,
- messenger,
- publicKeyEIP7702,
- );
-
- if (!upgradeContractAddress) {
- throw rpcErrors.internal(ERROR_MESSAGE_NO_UPGRADE_CONTRACT);
- }
+ const authorizationList = buildBatchAuthorizationList({
+ chainId,
+ messenger,
+ providedAuthorizationList,
+ publicKeyEIP7702,
+ requiresUpgrade,
+ });
 
+ if (authorizationList?.length) {
  txParams.type = TransactionEnvelopeType.setCode;
- txParams.authorizationList = [{ address: upgradeContractAddress }];
+ txParams.authorizationList = authorizationList;
  }
 
  if (validateSecurity) {
+ // `delegationMock` applies to the batch payer (`from`) only. When
+ // `requiresUpgrade` is true, that upgrade authorization is always first in
+ // the list. Caller-provided auths for other accounts must not be used here.
  const securityRequest: ValidateSecurityRequest = {
  method: 'eth_sendTransaction',
  params: [
@@ -407,7 +462,9 @@ async function addTransactionBatchWith7702(
  type: TransactionEnvelopeType.feeMarket,
  },
  ],
- delegationMock: txParams.authorizationList?.[0]?.address,
+ delegationMock: requiresUpgrade
+ ? authorizationList?.[0]?.address
+ : undefined,
  origin,
  };