Repository navigation
fix(money-account-mfa-whitelist): allow a deadline on single-use deposit delegations - #11185
Merged
Merged
Conversation
tylerc-consensys
marked this pull request as ready for review
October 29, 2026 06:39
tylerc-consensys
temporarily deployed
to
default-branch
October 29, 2026 06:39 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
…he README Co-authored-by: Cursor <cursoragent@cursor.com>
matthiasgeihs
approved these changes
Oct 29, 2026
Jwhiles
approved these changes
Oct 29, 2026
Contributor
|
@metamaskbot publish-preview |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
Closed
2 of 4 tasks
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Nov 4, 2026
## Explanation Releases `@metamask/money-account-mfa-whitelist@0.2.0`. This is a minor bump because the package is still `0.x` and the unreleased changes include a breaking type change. `0.2.0` moves the existing `Unreleased` entries into the new version: ### Added - Add support for Node.js 26 (MetaMask#10981) ### Changed - **BREAKING:** `DelegationFrameworkContracts` requires `TimestampEnforcer` (MetaMask#11185) - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` (MetaMask#11107) ### Fixed - Whitelist single-use vault deposit delegations that carry a `Timestamp` deadline caveat (MetaMask#11185) Consumers that construct a `DelegationFrameworkContracts` value need to supply `TimestampEnforcer`. ## Notes - `@metamask/utils` has unpublished test and CI changes only, and this package already depends on `^12.0.1`, so that package was intentionally left out of the release. - No workspace package depends on `@metamask/money-account-mfa-whitelist`. The lockfile now resolves the external `@metamask/eth-money-mpc-keyring` range `^0.1.0` to the published `0.1.0`, because `0.2.0` is outside that range. - Dropped non-consumer CI, test, and release commits that the tooling had added under `Uncategorized`. - `yarn changelog:validate` passes for `@metamask/money-account-mfa-whitelist`. ## References * MetaMask#11185 * MetaMask#11107 * MetaMask#10981 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > The release advertises a breaking type change for consumers building `DelegationFrameworkContracts`; the PR itself only bumps versions and the lockfile. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit abd4ae1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Open
3 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Single-use delegations from the transaction controller now carry a
TimestampEnforcerdeadline caveat (metamask-mobile#37338), next toLimitedCalls(1)and the exact-execution caveat.getMfaRequirementonly accepted exactly two caveats, so Money deposits from an MPC Money account were no longer whitelisted and asked for 2FA ("Single-use delegation caveats are not whitelisted").Single-use delegations may now include one
Timestampcaveat. A deadline only narrows when the delegation can be redeemed, so the executions are still checked as before.TimestampEnforceris added toDelegationFrameworkContracts, so configs need to include it: the Money MPC keyring config on mobile (MPC_MFA_WHITELIST_CONFIG) and the MPC service'sMPC_MFA_WHITELIST_CONFIG.References
Checklist
Note
Medium Risk
Touches MFA gating for Money Account delegations and introduces a breaking whitelist config field, though scope is limited to optional timestamp caveats on single-use deposits.
Overview
Fixes vault deposits from MPC Money accounts incorrectly requiring MFA after transaction-controller delegations started including a
TimestampEnforcerdeadline caveat alongsideLimitedCalls(1)and exact-execution pinning.getSingleUseDelegationRequirementnow accepts two or three caveats: requiredLimitedCalls(1)and one exact-execution caveat, plus at most one optionalTimestampdeadline (any order). Execution checks are unchanged, so single-use withdrawals with a deadline still fail MFA. Invalid shapes (duplicate deadlines, deadline without exact execution, etc.) still require MFA.DelegationFrameworkContractsgains a requiredTimestampEnforceraddress—a breaking config change for mobileMPC_MFA_WHITELIST_CONFIGand the MPC service. README and changelog document the updatedvault-deposit-delegationrule.Reviewed by Cursor Bugbot for commit 9799193. Bugbot is set up for automated code reviews on this repo. Configure here.