Skip to content

Defi controller v2#9503

Open
bergarces wants to merge 21 commits into
mainfrom
defi-controller-v2
Open

Defi controller v2#9503
bergarces wants to merge 21 commits into
mainfrom
defi-controller-v2

Conversation

@bergarces

@bergarces bergarces commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Explanation

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
New portfolio-facing fetch path and valuation rules (e.g. lending liabilities), but additive alongside the legacy controller with broad unit tests and no auth changes.

Overview
Introduces DeFiPositionsControllerV2, which loads DeFi positions for the selected account group via fetchV6MultiAccountBalances, maps per-chain CAIP-10 responses back to internal account IDs, and persists allDeFiPositionsV2 as protocol groups the DeFi tab can read without extra shaping.

Supporting pieces include buildDeFiBalancesQuery (EVM all-chains + Solana CAIP IDs, supported network list, EVM case normalization), groupDeFiPositionsV6 (chain/protocol grouping, detail sections by protocolName, icon stack, lending subtracted from aggregated marketValue), messenger fetchDeFiPositions with per-account throttling and retry on failure, and a standalone defi-visualizer.html for manual API inspection.

@metamask/core-backend now exports V6_DEFI_POSITION_TYPES / V6DeFiPositionType and types V6BalanceMetadata.positionType accordingly. Public exports from assets-controllers cover the controller, state defaults, action types, and helpers. Legacy DeFiPositionsController is unchanged; the V2 state key avoids collisions when both run in one client.

Reviewed by Cursor Bugbot for commit 2a8139a. Bugbot is set up for automated code reviews on this repo. Configure here.

@bergarces bergarces requested a review from a team as a code owner July 14, 2026 13:21
@bergarces bergarces requested a review from a team as a code owner July 14, 2026 15:45
@bergarces

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

)) {
state.allDeFiPositionsV2[accountId] = positions;
}
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DeFi state not fully refreshed

Medium Severity

After a successful fetch, allDeFiPositionsV2 only updates account keys returned by groupDeFiPositionsV6, so queried accounts missing from the API response keep old positions. Early returns when the group has no DeFi-capable accounts leave prior group data in persisted state.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

return {
networks: [...new Set(networks)] as CaipChainId[],
internalAccountIdByCaip,
};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Networks list not always complete

Medium Severity

buildDeFiBalancesQuery builds the networks request parameter from EVM-only or Solana-only subsets based on which account types appear in the group, instead of always sending the full DEFI_SUPPORTED_NETWORKS list.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

balance.metadata !== undefined &&
(balance.metadata as Partial<V6BalanceMetadata>).protocolId !== undefined
);
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Position types not validated

Medium Severity

DeFi rows are accepted when only protocolId is present; positionType is not checked against exported DEFI_POSITION_TYPES, and liability handling hardcodes only lending instead of using that canonical list.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2a8139a. Configure here.

@github-actions

Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.5.5-preview-2a8139a3e
@metamask-previews/accounts-controller@39.0.5-preview-2a8139a3e
@metamask-previews/address-book-controller@7.1.2-preview-2a8139a3e
@metamask-previews/ai-controllers@0.8.0-preview-2a8139a3e
@metamask-previews/analytics-controller@1.2.1-preview-2a8139a3e
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-2a8139a3e
@metamask-previews/announcement-controller@8.1.0-preview-2a8139a3e
@metamask-previews/app-metadata-controller@2.0.1-preview-2a8139a3e
@metamask-previews/approval-controller@9.0.2-preview-2a8139a3e
@metamask-previews/assets-controller@11.0.0-preview-2a8139a3e
@metamask-previews/assets-controllers@109.4.1-preview-2a8139a3e
@metamask-previews/authenticated-user-storage@3.0.1-preview-2a8139a3e
@metamask-previews/base-controller@9.1.0-preview-2a8139a3e
@metamask-previews/base-data-service@0.1.3-preview-2a8139a3e
@metamask-previews/bitcoin-regtest-up@1.0.0-preview-2a8139a3e
@metamask-previews/bridge-controller@77.5.0-preview-2a8139a3e
@metamask-previews/bridge-status-controller@74.2.0-preview-2a8139a3e
@metamask-previews/build-utils@3.0.4-preview-2a8139a3e
@metamask-previews/chain-agnostic-permission@1.7.0-preview-2a8139a3e
@metamask-previews/chomp-api-service@3.1.0-preview-2a8139a3e
@metamask-previews/claims-controller@0.5.3-preview-2a8139a3e
@metamask-previews/client-controller@1.0.1-preview-2a8139a3e
@metamask-previews/client-utils@1.1.0-preview-2a8139a3e
@metamask-previews/compliance-controller@2.1.0-preview-2a8139a3e
@metamask-previews/composable-controller@12.0.1-preview-2a8139a3e
@metamask-previews/config-registry-controller@0.4.1-preview-2a8139a3e
@metamask-previews/connectivity-controller@0.3.0-preview-2a8139a3e
@metamask-previews/controller-utils@12.3.0-preview-2a8139a3e
@metamask-previews/core-backend@6.5.0-preview-2a8139a3e
@metamask-previews/delegation-controller@3.0.2-preview-2a8139a3e
@metamask-previews/earn-controller@12.2.2-preview-2a8139a3e
@metamask-previews/eip-5792-middleware@3.0.5-preview-2a8139a3e
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-2a8139a3e
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-2a8139a3e
@metamask-previews/ens-controller@19.1.5-preview-2a8139a3e
@metamask-previews/eth-block-tracker@15.0.1-preview-2a8139a3e
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-2a8139a3e
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-2a8139a3e
@metamask-previews/foundryup@1.0.1-preview-2a8139a3e
@metamask-previews/gas-fee-controller@26.2.4-preview-2a8139a3e
@metamask-previews/gator-permissions-controller@4.2.3-preview-2a8139a3e
@metamask-previews/geolocation-controller@0.1.3-preview-2a8139a3e
@metamask-previews/java-tron-up@1.0.0-preview-2a8139a3e
@metamask-previews/json-rpc-engine@10.5.0-preview-2a8139a3e
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-2a8139a3e
@metamask-previews/keyring-controller@27.1.0-preview-2a8139a3e
@metamask-previews/local-node-utils@1.0.0-preview-2a8139a3e
@metamask-previews/logging-controller@8.0.2-preview-2a8139a3e
@metamask-previews/message-manager@14.1.2-preview-2a8139a3e
@metamask-previews/messenger@2.0.0-preview-2a8139a3e
@metamask-previews/messenger-cli@0.2.0-preview-2a8139a3e
@metamask-previews/money-account-api-data-service@0.1.0-preview-2a8139a3e
@metamask-previews/money-account-balance-service@2.2.0-preview-2a8139a3e
@metamask-previews/money-account-controller@0.3.3-preview-2a8139a3e
@metamask-previews/money-account-upgrade-controller@2.2.1-preview-2a8139a3e
@metamask-previews/multichain-account-service@13.0.0-preview-2a8139a3e
@metamask-previews/multichain-api-middleware@4.0.1-preview-2a8139a3e
@metamask-previews/multichain-network-controller@3.2.1-preview-2a8139a3e
@metamask-previews/multichain-transactions-controller@7.1.1-preview-2a8139a3e
@metamask-previews/name-controller@9.1.2-preview-2a8139a3e
@metamask-previews/network-connection-banner-controller@0.1.0-preview-2a8139a3e
@metamask-previews/network-controller@34.0.0-preview-2a8139a3e
@metamask-previews/network-enablement-controller@5.5.0-preview-2a8139a3e
@metamask-previews/notification-services-controller@25.0.0-preview-2a8139a3e
@metamask-previews/passkey-controller@2.0.1-preview-2a8139a3e
@metamask-previews/permission-controller@13.1.1-preview-2a8139a3e
@metamask-previews/permission-log-controller@5.1.0-preview-2a8139a3e
@metamask-previews/perps-controller@9.2.1-preview-2a8139a3e
@metamask-previews/phishing-controller@17.2.1-preview-2a8139a3e
@metamask-previews/platform-api-docs@0.0.0-preview-2a8139a3e
@metamask-previews/polling-controller@16.0.8-preview-2a8139a3e
@metamask-previews/preferences-controller@23.1.0-preview-2a8139a3e
@metamask-previews/profile-metrics-controller@4.0.2-preview-2a8139a3e
@metamask-previews/profile-sync-controller@28.3.0-preview-2a8139a3e
@metamask-previews/ramps-controller@17.0.0-preview-2a8139a3e
@metamask-previews/rate-limit-controller@7.0.1-preview-2a8139a3e
@metamask-previews/react-data-query@0.2.1-preview-2a8139a3e
@metamask-previews/remote-feature-flag-controller@4.2.2-preview-2a8139a3e
@metamask-previews/sample-controllers@5.0.3-preview-2a8139a3e
@metamask-previews/seedless-onboarding-controller@10.0.3-preview-2a8139a3e
@metamask-previews/selected-network-controller@26.1.5-preview-2a8139a3e
@metamask-previews/shield-controller@5.1.3-preview-2a8139a3e
@metamask-previews/signature-controller@39.2.7-preview-2a8139a3e
@metamask-previews/smart-transactions-controller@25.0.1-preview-2a8139a3e
@metamask-previews/snap-account-service@2.0.0-preview-2a8139a3e
@metamask-previews/social-controllers@2.5.0-preview-2a8139a3e
@metamask-previews/solana-test-validator-up@1.0.0-preview-2a8139a3e
@metamask-previews/stellar-quickstart-up@0.0.0-preview-2a8139a3e
@metamask-previews/storage-service@1.0.2-preview-2a8139a3e
@metamask-previews/subscription-controller@6.2.1-preview-2a8139a3e
@metamask-previews/transaction-controller@69.0.0-preview-2a8139a3e
@metamask-previews/transaction-pay-controller@25.0.0-preview-2a8139a3e
@metamask-previews/user-operation-controller@41.2.7-preview-2a8139a3e
@metamask-previews/wallet@7.0.1-preview-2a8139a3e
@metamask-previews/wallet-cli@0.0.0-preview-2a8139a3e

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant