feat: validate eth_sendTransaction / eth_signTransaction params

packages/eth-json-rpc-middleware/CHANGELOG.md

@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **BREAKING:** Add strict validation for `eth_sendTransaction` and `eth_signTransaction` params ([#9482](https://github.com/MetaMask/core/pull/9482))
+  - Reject requests whose params do not match the transaction schema (extraneous top-level keys, ill-typed fields such as non-hex `to`/`data`, malformed `accessList` / `authorizationList` entries) or exceed `MAX_TRANSACTION_PARAMS_SIZE_BYTES` when serialized
+  - Prevents downstream normalization / PPOM WASM from crashing on deeply-nested junk fields or padded payloads and silently bypassing security scans
+
 - Bump `@metamask/utils` from `^11.9.0` to `^11.11.0` ([#9074](https://github.com/MetaMask/core/pull/9074))
 - Bump `@metamask/json-rpc-engine` from `^10.2.4` to `^10.5.0` ([#8661](https://github.com/MetaMask/core/pull/8661), [#8746](https://github.com/MetaMask/core/pull/8746), [#8753](https://github.com/MetaMask/core/pull/8753))
 - Bump `@metamask/message-manager` from `^14.1.1` to `^14.1.2` ([#8755](https://github.com/MetaMask/core/pull/8755))

packages/eth-json-rpc-middleware/src/index.test.ts

@@ -296,6 +296,7 @@ describe('index module', () => {
         "createWalletMiddleware": [Function],
         "providerAsMiddleware": [Function],
         "providerAsMiddlewareV2": [Function],
+        "validateTransactionParams": [Function],
       }
     `);
   });

packages/eth-json-rpc-middleware/src/index.ts

@@ -35,4 +35,5 @@ export {
 } from './methods/wallet-get-supported-execution-permissions';
 export * from './providerAsMiddleware';
 export * from './retryOnEmpty';
+export { validateTransactionParams } from './utils/validation';
 export * from './wallet';

packages/eth-json-rpc-middleware/src/utils/validation.test.ts

@@ -5,9 +5,11 @@ import { any, validate } from '@metamask/superstruct';
 
 import type { WalletMiddlewareKeyValues } from '../wallet';
 import {
+  MAX_TRANSACTION_PARAMS_SIZE_BYTES,
   resemblesAddress,
   validateAndNormalizeKeyholder,
   validateParams,
+  validateTransactionParams,
   validateTypedMessageKeys,
 } from './validation';
 
@@ -278,4 +280,190 @@ describe('Validation Utils', () => {
       });
     });
   });
+
+  describe('validateTransactionParams', () => {
+    const VALID_FROM = '0xbe93f9bacbcffc8ee6663f2647917ed7a20a57bb';
+    const VALID_TO = '0xdac17f958d2ee523a2206206994597c13d831ec7';
+
+    beforeEach(() => {
+      const actual = jest.requireActual<{
+        validate: typeof validate;
+      }>('@metamask/superstruct');
+      validateMock.mockImplementation(actual.validate);
+    });
+
+    it('does not throw for minimal valid params', () => {
+      expect(() =>
+        validateTransactionParams({ from: VALID_FROM }),
+      ).not.toThrow();
+    });
+
+    it('does not throw for the full valid param set', () => {
+      expect(() =>
+        validateTransactionParams({
+          accessList: [
+            {
+              address: VALID_TO,
+              storageKeys: ['0x00', '0x01'],
+            },
+          ],
+          authorizationList: [
+            {
+              chainId: '0x1',
+              address: VALID_TO,
+              nonce: '0x0',
+            },
+          ],
+          chainId: '0x1',
+          data: '0x095ea7b3',
+          from: VALID_FROM,
+          gas: '0x5208',
+          gasLimit: '0x5208',
+          gasPrice: '0x1',
+          maxFeePerGas: '0x2',
+          maxPriorityFeePerGas: '0x1',
+          nonce: '0x0',
+          to: VALID_TO,
+          type: '0x2',
+          value: '0x0',
+        }),
+      ).not.toThrow();
+    });
+
+    it.each([
+      ['null', null],
+      ['undefined', undefined],
+      ['a string', 'not-an-object'],
+      ['a number', 42],
+      ['a boolean', true],
+      ['an array', [{ from: VALID_FROM }]],
+    ])('throws when params is %s', (_label, value) => {
+      expect(() => validateTransactionParams(value)).toThrow(/Invalid params/u);
+    });
+
+    it('throws for an extraneous top-level key', () => {
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: VALID_TO,
+          extraKey: 'unexpected',
+        }),
+      ).toThrow(/Invalid params/u);
+    });
+
+    it('throws when params contain an extraneous key with a deeply-nested value', () => {
+      let junk: Record<string, unknown> = {};
+      for (let i = 0; i < 1200; i++) {
+        junk = { b: junk };
+      }
+
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: VALID_TO,
+          value: '0x0',
+          data: '0x095ea7b3',
+          test: junk,
+        }),
+      ).toThrow(/Invalid params/u);
+    });
+
+    it('rejects an extraneous top-level key without walking its value (JSON.stringify never called)', () => {
+      const stringifySpy = jest.spyOn(JSON, 'stringify');
+
+      const params = {
+        from: VALID_FROM,
+        to: VALID_TO,
+        test: {
+          get b(): never {
+            throw new Error('subtree must not be walked');
+          },
+        },
+      };
+
+      let thrown: unknown;
+      try {
+        validateTransactionParams(params);
+      } catch (error) {
+        thrown = error;
+      }
+      const stringifyCallsAtRejection = stringifySpy.mock.calls.length;
+      stringifySpy.mockRestore();
+
+      expect(thrown).toBeInstanceOf(Error);
+      expect(stringifyCallsAtRejection).toBe(0);
+    });
+
+    it('throws when a typed field has the wrong type', () => {
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: { nested: 'not-an-address' },
+        }),
+      ).toThrow(/Invalid params/u);
+    });
+
+    it('throws when `data` is not a hex string', () => {
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          data: 1234 as unknown as string,
+        }),
+      ).toThrow(/Invalid params/u);
+    });
+
+    it('throws when `accessList` entries are malformed', () => {
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          accessList: [{ address: 'not-hex', storageKeys: 'not-an-array' }],
+        }),
+      ).toThrow(/Invalid params/u);
+    });
+
+    it('throws for a data-padding attack that passes the schema', () => {
+      const padded = `0x${'00'.repeat(MAX_TRANSACTION_PARAMS_SIZE_BYTES)}`;
+
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: VALID_TO,
+          data: padded,
+        }),
+      ).toThrow('Invalid input.');
+    });
+
+    it('throws for an accessList-padding attack that passes the schema', () => {
+      const padded = Array.from(
+        { length: Math.ceil(MAX_TRANSACTION_PARAMS_SIZE_BYTES / 64) },
+        () => ({
+          address: VALID_TO,
+          storageKeys: [`0x${'00'.repeat(32)}`],
+        }),
+      );
+
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: VALID_TO,
+          accessList: padded,
+        }),
+      ).toThrow('Invalid input.');
+    });
+
+    it('does not throw for a legitimate multi-entry accessList well under the size limit', () => {
+      const entries = Array.from({ length: 16 }, () => ({
+        address: VALID_TO,
+        storageKeys: [`0x${'11'.repeat(32)}`, `0x${'22'.repeat(32)}`],
+      }));
+
+      expect(() =>
+        validateTransactionParams({
+          from: VALID_FROM,
+          to: VALID_TO,
+          accessList: entries,
+        }),
+      ).not.toThrow();
+    });
+  });
 });

packages/eth-json-rpc-middleware/src/utils/validation.ts

@@ -1,7 +1,13 @@
 import { TYPED_MESSAGE_SCHEMA } from '@metamask/eth-sig-util';
 import { providerErrors, rpcErrors } from '@metamask/rpc-errors';
 import type { Struct, StructError } from '@metamask/superstruct';
-import { validate } from '@metamask/superstruct';
+import {
+  array,
+  object,
+  optional,
+  string,
+  validate,
+} from '@metamask/superstruct';
 import type { Hex } from '@metamask/utils';
 
 import type { WalletMiddlewareContext } from '../wallet';
@@ -234,3 +240,72 @@ export function validateTypedMessageKeys(data: string): void {
     }
   }
 }
+
+export const TransactionParamsStruct = object({
+  accessList: optional(
+    array(object({ address: string(), storageKeys: array(string()) })),
+  ),
+  authorizationList: optional(
+    array(
+      object({
+        address: string(),
+        chainId: string(),
+        nonce: string(),
+        r: optional(string()),
+        s: optional(string()),
+        yParity: optional(string()),
+      }),
+    ),
+  ),
+  chainId: optional(string()),
+  data: optional(string()),
+  from: string(),
+  gas: optional(string()),
+  gasLimit: optional(string()),
+  gasPrice: optional(string()),
+  maxFeePerGas: optional(string()),
+  maxPriorityFeePerGas: optional(string()),
+  nonce: optional(string()),
+  to: optional(string()),
+  type: optional(string()),
+  value: optional(string()),
+});
+
+// Upper bound derived from the largest valid eth_sendTransaction payload:
+// EIP-3860 caps initcode at 49,152 bytes → hex-encoded in 'data' field ≈ 98 KB of JSON.
+// 200 KB is ~2× that ceiling, giving clear headroom above any protocol-legal
+// transaction while blocking the padding attacks this cap defends against.
+// TODO(CONF-1662): tighten once P99 production data is available.
+export const MAX_TRANSACTION_PARAMS_SIZE_BYTES = 200 * 1024;
+
+/**
+ * Validates `eth_sendTransaction` / `eth_signTransaction` params against the
+ * standard transaction schema and rejects payloads whose serialized size
+ * exceeds `MAX_TRANSACTION_PARAMS_SIZE_BYTES`.
+ *
+ * Guards against two attack shapes:
+ * - Structural: extraneous top-level keys or ill-typed fields (e.g.
+ *   `{ from, to, test: { b: { b: ... × 1200 } } }`) that would crash
+ *   downstream normalization / PPOM WASM with `RangeError: Maximum call
+ *   stack size exceeded`, silently bypassing security checks. Superstruct's
+ *   `object()` rejects unknown keys by name without accessing their values,
+ *   so hostile nested subtrees are never traversed.
+ * - Size: valid-shaped but oversized payloads (e.g. `data` padded with
+ *   millions of hex zeros) that exhaust memory in downstream code.
+ *
+ * @param params - The transaction params object supplied by the dapp.
+ * @throws rpcErrors.invalidParams() if params is an array or exceeds the
+ * serialized size limit.
+ * @throws rpcErrors.invalidInput() if params fails schema validation
+ * (wrong type, extraneous top-level key, or malformed nested field).
+ */
+export function validateTransactionParams(params: unknown): void {
+  validateParams(params, TransactionParamsStruct);
+
+  if (
+    new TextEncoder().encode(JSON.stringify(params)).byteLength >
+    MAX_TRANSACTION_PARAMS_SIZE_BYTES
+  ) {
+    throw rpcErrors.invalidInput();
+  }
+}