[tylerc-consensys]

Explanation

Mobile's gasless 7702 publish hook limits single-use delegations to the Sentinel relay signers with a Redeemer caveat (metamask-mobile#37041), next to LimitedCalls(1), the Timestamp deadline and the exact-execution caveat. getMfaRequirement rejected the extra caveat, so Money deposits from an MPC Money account still asked for 2FA ("Single-use delegation caveats are not whitelisted").

Single-use delegations may now include one Redeemer caveat. A redeemer allowlist only narrows who can redeem the delegation, so the executions are still checked as before. RedeemerEnforcer is already part of DelegationFrameworkContracts, so configs don't change.

References

• Related to metamask-mobile#37041
• Follow-up to fix(money-account-mfa-whitelist): allow a deadline on single-use deposit delegations #11185

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes MFA bypass rules for Money Account delegations; scope is narrow (optional redeemer on deposit-shaped single-use delegations) but affects signing security policy.

Overview
Fixes false MFA prompts when Mobile signs vault deposits with a gasless-relay Redeemer caveat (alongside LimitedCalls(1), optional Timestamp, and exact deposit executions).

getSingleUseDelegationRequirement now treats at most one RedeemerEnforcer caveat as allowed noise—it only restricts who can redeem, so pinned deposit executions are still validated. Duplicate redeemer caveats or non-deposit delegations with redeemers still require MFA. Docs, changelog, test fixtures, and coverage for extension vs Mobile caveat ordering are updated accordingly.

^{Reviewed by Cursor Bugbot for commit f2b3435. Bugbot is set up for automated code reviews on this repo. Configure here.}