Skip to content

Defi controller v2#9503

Open
bergarces wants to merge 24 commits into
mainfrom
defi-controller-v2
Open

Defi controller v2#9503
bergarces wants to merge 24 commits into
mainfrom
defi-controller-v2

Conversation

@bergarces

@bergarces bergarces commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Explanation

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

High Risk
Breaking V6BalanceMetadata rename in core-backend affects consumers; the controller’s hardcoded test account override would mis-attribute DeFi data in production if shipped.

Overview
Introduces DeFiPositionsControllerV2, which loads DeFi positions for the selected account group via fetchV6MultiAccountBalances, maps v6 CAIP account IDs back to internal account IDs, and persists a UI-ready shape under allDeFiPositionsV2. fetchDeFiPositions is messenger-exposed, gated by isEnabled, throttled per account set, and clears throttle on failure.

New helpers buildDeFiBalancesQuery (EVM eip155:0 + Solana accounts, supported networks, CAIP normalization) and groupDeFiPositionsV6 (protocol groups per chain, detail sections by productName, lending subtracted from marketValue, icon groups and token images) implement the fetch and transform pipeline. Types and constants are exported from assets-controllers.

core-backend aligns v6 DeFi metadata with the API: protocolNameproductName (breaking), typed positionType via V6_DEFI_POSITION_TYPES, and groupId on V6BalanceMetadata.

Note: fetchDeFiPositions still contains a temporary override that always queries a fixed test EVM address while attributing results to the selected account—likely not intended for release.

Also adds a local defi-visualizer.html for manual API inspection and broad unit tests for query building, grouping, and the controller.

Reviewed by Cursor Bugbot for commit 2a1338c. Bugbot is set up for automated code reviews on this repo. Configure here.

@bergarces
bergarces requested a review from a team as a code owner July 14, 2026 13:21
@bergarces
bergarces requested a review from a team as a code owner July 14, 2026 15:45
@bergarces

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

)) {
state.allDeFiPositionsV2[accountId] = positions;
}
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DeFi state not fully refreshed

Medium Severity

After a successful fetch, allDeFiPositionsV2 only updates account keys returned by groupDeFiPositionsV6, so queried accounts missing from the API response keep old positions. Early returns when the group has no DeFi-capable accounts leave prior group data in persisted state.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

return {
networks: [...new Set(networks)] as CaipChainId[],
internalAccountIdByCaip,
};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Networks list not always complete

Medium Severity

buildDeFiBalancesQuery builds the networks request parameter from EVM-only or Solana-only subsets based on which account types appear in the group, instead of always sending the full DEFI_SUPPORTED_NETWORKS list.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

balance.metadata !== undefined &&
(balance.metadata as Partial<V6BalanceMetadata>).protocolId !== undefined
);
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Position types not validated

Medium Severity

DeFi rows are accepted when only protocolId is present; positionType is not checked against exported DEFI_POSITION_TYPES, and liability handling hardcodes only lending instead of using that canonical list.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

@github-actions

Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.5.5-preview-2a8139a3e
@metamask-previews/accounts-controller@39.0.5-preview-2a8139a3e
@metamask-previews/address-book-controller@7.1.2-preview-2a8139a3e
@metamask-previews/ai-controllers@0.8.0-preview-2a8139a3e
@metamask-previews/analytics-controller@1.2.1-preview-2a8139a3e
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-2a8139a3e
@metamask-previews/announcement-controller@8.1.0-preview-2a8139a3e
@metamask-previews/app-metadata-controller@2.0.1-preview-2a8139a3e
@metamask-previews/approval-controller@9.0.2-preview-2a8139a3e
@metamask-previews/assets-controller@11.0.0-preview-2a8139a3e
@metamask-previews/assets-controllers@109.4.1-preview-2a8139a3e
@metamask-previews/authenticated-user-storage@3.0.1-preview-2a8139a3e
@metamask-previews/base-controller@9.1.0-preview-2a8139a3e
@metamask-previews/base-data-service@0.1.3-preview-2a8139a3e
@metamask-previews/bitcoin-regtest-up@1.0.0-preview-2a8139a3e
@metamask-previews/bridge-controller@77.5.0-preview-2a8139a3e
@metamask-previews/bridge-status-controller@74.2.0-preview-2a8139a3e
@metamask-previews/build-utils@3.0.4-preview-2a8139a3e
@metamask-previews/chain-agnostic-permission@1.7.0-preview-2a8139a3e
@metamask-previews/chomp-api-service@3.1.0-preview-2a8139a3e
@metamask-previews/claims-controller@0.5.3-preview-2a8139a3e
@metamask-previews/client-controller@1.0.1-preview-2a8139a3e
@metamask-previews/client-utils@1.1.0-preview-2a8139a3e
@metamask-previews/compliance-controller@2.1.0-preview-2a8139a3e
@metamask-previews/composable-controller@12.0.1-preview-2a8139a3e
@metamask-previews/config-registry-controller@0.4.1-preview-2a8139a3e
@metamask-previews/connectivity-controller@0.3.0-preview-2a8139a3e
@metamask-previews/controller-utils@12.3.0-preview-2a8139a3e
@metamask-previews/core-backend@6.5.0-preview-2a8139a3e
@metamask-previews/delegation-controller@3.0.2-preview-2a8139a3e
@metamask-previews/earn-controller@12.2.2-preview-2a8139a3e
@metamask-previews/eip-5792-middleware@3.0.5-preview-2a8139a3e
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-2a8139a3e
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-2a8139a3e
@metamask-previews/ens-controller@19.1.5-preview-2a8139a3e
@metamask-previews/eth-block-tracker@15.0.1-preview-2a8139a3e
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-2a8139a3e
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-2a8139a3e
@metamask-previews/foundryup@1.0.1-preview-2a8139a3e
@metamask-previews/gas-fee-controller@26.2.4-preview-2a8139a3e
@metamask-previews/gator-permissions-controller@4.2.3-preview-2a8139a3e
@metamask-previews/geolocation-controller@0.1.3-preview-2a8139a3e
@metamask-previews/java-tron-up@1.0.0-preview-2a8139a3e
@metamask-previews/json-rpc-engine@10.5.0-preview-2a8139a3e
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-2a8139a3e
@metamask-previews/keyring-controller@27.1.0-preview-2a8139a3e
@metamask-previews/local-node-utils@1.0.0-preview-2a8139a3e
@metamask-previews/logging-controller@8.0.2-preview-2a8139a3e
@metamask-previews/message-manager@14.1.2-preview-2a8139a3e
@metamask-previews/messenger@2.0.0-preview-2a8139a3e
@metamask-previews/messenger-cli@0.2.0-preview-2a8139a3e
@metamask-previews/money-account-api-data-service@0.1.0-preview-2a8139a3e
@metamask-previews/money-account-balance-service@2.2.0-preview-2a8139a3e
@metamask-previews/money-account-controller@0.3.3-preview-2a8139a3e
@metamask-previews/money-account-upgrade-controller@2.2.1-preview-2a8139a3e
@metamask-previews/multichain-account-service@13.0.0-preview-2a8139a3e
@metamask-previews/multichain-api-middleware@4.0.1-preview-2a8139a3e
@metamask-previews/multichain-network-controller@3.2.1-preview-2a8139a3e
@metamask-previews/multichain-transactions-controller@7.1.1-preview-2a8139a3e
@metamask-previews/name-controller@9.1.2-preview-2a8139a3e
@metamask-previews/network-connection-banner-controller@0.1.0-preview-2a8139a3e
@metamask-previews/network-controller@34.0.0-preview-2a8139a3e
@metamask-previews/network-enablement-controller@5.5.0-preview-2a8139a3e
@metamask-previews/notification-services-controller@25.0.0-preview-2a8139a3e
@metamask-previews/passkey-controller@2.0.1-preview-2a8139a3e
@metamask-previews/permission-controller@13.1.1-preview-2a8139a3e
@metamask-previews/permission-log-controller@5.1.0-preview-2a8139a3e
@metamask-previews/perps-controller@9.2.1-preview-2a8139a3e
@metamask-previews/phishing-controller@17.2.1-preview-2a8139a3e
@metamask-previews/platform-api-docs@0.0.0-preview-2a8139a3e
@metamask-previews/polling-controller@16.0.8-preview-2a8139a3e
@metamask-previews/preferences-controller@23.1.0-preview-2a8139a3e
@metamask-previews/profile-metrics-controller@4.0.2-preview-2a8139a3e
@metamask-previews/profile-sync-controller@28.3.0-preview-2a8139a3e
@metamask-previews/ramps-controller@17.0.0-preview-2a8139a3e
@metamask-previews/rate-limit-controller@7.0.1-preview-2a8139a3e
@metamask-previews/react-data-query@0.2.1-preview-2a8139a3e
@metamask-previews/remote-feature-flag-controller@4.2.2-preview-2a8139a3e
@metamask-previews/sample-controllers@5.0.3-preview-2a8139a3e
@metamask-previews/seedless-onboarding-controller@10.0.3-preview-2a8139a3e
@metamask-previews/selected-network-controller@26.1.5-preview-2a8139a3e
@metamask-previews/shield-controller@5.1.3-preview-2a8139a3e
@metamask-previews/signature-controller@39.2.7-preview-2a8139a3e
@metamask-previews/smart-transactions-controller@25.0.1-preview-2a8139a3e
@metamask-previews/snap-account-service@2.0.0-preview-2a8139a3e
@metamask-previews/social-controllers@2.5.0-preview-2a8139a3e
@metamask-previews/solana-test-validator-up@1.0.0-preview-2a8139a3e
@metamask-previews/stellar-quickstart-up@0.0.0-preview-2a8139a3e
@metamask-previews/storage-service@1.0.2-preview-2a8139a3e
@metamask-previews/subscription-controller@6.2.1-preview-2a8139a3e
@metamask-previews/transaction-controller@69.0.0-preview-2a8139a3e
@metamask-previews/transaction-pay-controller@25.0.0-preview-2a8139a3e
@metamask-previews/user-operation-controller@41.2.7-preview-2a8139a3e
@metamask-previews/wallet@7.0.1-preview-2a8139a3e
@metamask-previews/wallet-cli@0.0.0-preview-2a8139a3e

@bergarces

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant