[Bug]: Money account: deposit fails using Ledger

[Unik0rnMaggie]

Describe the bug

When trying to add funds to Money account using Ledger:

• the deposit fails with error for ETH tokens
• there is an insufficient funds message for other tokens (even though the balance is enough and there should be no fees)

Expected behavior

Be able to add funds to Money using Ledger account

Screenshots/Recordings

Ledger.mondey.account.2.mp4

Ledger.Money.account.8.2.0.mp4

Steps to reproduce

1. Connect Ledger device
2. Go to Money
3. Add funds
4. Notice error or insufficient funds message

Error messages or log output

Error: MetaMask Pay: Relay: DisconnectedDevice
   at construct (native)
   at apply (native)
   at _construct (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:752765)
   at Wrapper (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:756522)
   at call (native)
   at JsonRpcError (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:3008632)
   at getJsonRpcError (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:3014217)
   at internal (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:3014792)
   at ?anon_0_ (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:2863462)
   at next (native)
   at asyncGeneratorStep (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:753253)
   at _next (address at /var/mobile/Containers/Data/Application/C6CA2F0C-1083-49D2-9828-D3C690E36E9D/Library/Application Support/.expo-internal/bundle-3c8c5a2c-1f35-4cab-a408-2ae236966747.jsbundle:1:753510)
   at tryCallOne (address at InternalBytecode.js:1:1180)
   at anonymous (address at InternalBytecode.js:1:1874)

Where was this bug found?

Internal release testing

Version

8.2.0

Build number

5944

Device

iPhone 15

Operating system

iOS

[metamask-ci]

Triage Agent -- Classification

Severity: Sev1 (confidence: 0.88) ✅

The Money account deposit flow is completely broken for all Ledger hardware wallet users. This is a major feature broken for a significant user segment (Ledger users) with no workaround - they cannot deposit funds into their Money account. The DisconnectedDevice error suggests the Ledger communication breaks during the transaction signing flow, and the 'insufficient funds' error for non-ETH tokens suggests incorrect balance checking or transaction construction when a Ledger-managed account is the source.

Size: size-M (confidence: 0.72) ⚠️ Advisory

The issue likely involves the interaction between the Money account deposit flow (which uses delegation transactions and payment overrides) and the hardware wallet signing path. The deposit flow constructs batch transactions via buildMoneyAccountDepositBatch and then routes them through getDelegationTransaction, which needs to sign via the KeyringController. For Ledger, this requires maintaining a BLE transport connection throughout the async flow. The fix likely requires ensuring the Ledger transport stays connected during the multi-step deposit transaction construction and signing, and possibly fixing how balance is checked for Ledger-managed accounts. Multiple files across Money and hardware wallet integration layers would need changes.
Not auto-applied -- confidence below threshold.

Team: team-musd ✅

Matched via area fallback: area-musd (no CODEOWNERS match)

---

Root Cause Analysis

Affected component: Money account deposit flow + Ledger hardware wallet signing integration

The Money account deposit flow constructs batch transactions through getMoneyAccountDepositPaymentOverrideData in paymentoverride-callback.ts, which calls buildMoneyAccountDepositBatch and then getDelegationTransaction. This delegation transaction flow requires message signing via the KeyringController. When the account is managed by a Ledger device, the signing request goes through the Ledger BLE transport. The multi-step async nature of the deposit flow (building approve+deposit batch, constructing delegation transaction, signing) likely causes the Ledger BLE connection to time out or disconnect before the signing step is reached. The 'insufficient funds' error for non-ETH tokens may be a separate but related issue where the transaction construction uses moneyAccountAddress (the delegated Money account address) as the from field in txParams, but the balance check may be running against the Ledger EOA address, or the gas estimation fails because the Ledger transport disconnects during the estimation phase, causing a fallback error message. The stack trace shows the error originates from a JSON-RPC relay layer, suggesting the Ledger transport disconnection is being caught and re-thrown as a relay error.

Evidence:

• Stack trace shows 'MetaMask Pay: Relay: DisconnectedDevice' wrapped in JsonRpcError
• paymentoverride-callback.ts constructs transactionMeta with from: moneyAccountAddress for deposits
• getDelegationTransaction is called which requires signing - this is where Ledger interaction would occur
• The deposit flow is async with multiple steps (buildMoneyAccountDepositBatch, getDelegationTransaction) that could cause BLE timeout
• Hardware wallet KB notes that adapter interface has flow lifecycle methods (markFlowComplete/isFlowComplete/resetFlowState) suggesting connection state management is critical
• Two distinct error symptoms (DisconnectedDevice for ETH, insufficient funds for others) suggest the error manifests differently depending on which step fails

Suggested Fix

Confidence: medium: likely but needs investigation - the code context shows the transaction construction flow but the exact point of Ledger transport failure needs to be traced through the delegation signing path

The fix needs to address two issues: (1) Ensure the Ledger BLE transport connection is maintained or re-established during the Money account deposit flow's multi-step transaction construction and signing process, and (2) Fix the balance/gas estimation to correctly account for Ledger-managed accounts in the Money deposit context.

Target files: app/core/Engine/controllers/transaction-pay-controller/paymentoverride-callback.ts, app/components/UI/Money/hooks/useMoneyAccount.ts, app/components/UI/Money/utils/moneyAccountTransactions.ts
Target functions: getMoneyAccountDepositPaymentOverrideData, getDelegationTransaction, buildMoneyAccountDepositBatch

Approach:

1. Investigate whether the Money deposit flow checks if the current account is a hardware wallet account before initiating the deposit. If not, add detection logic. 2. In the deposit flow, ensure the Ledger transport connection is established and kept alive before calling getDelegationTransaction. This may require integrating with the HardwareWalletProvider's connection flow (useDeviceConnectionFlow) to ensure the device is connected before signing. 3. The payment override callback in paymentoverride-callback.ts may need to be wrapped with hardware wallet connection awareness - potentially by checking the account type via KeyringController and ensuring the Ledger adapter's flow state is properly managed. 4. For the 'insufficient funds' issue, check whether the balance validation in the deposit flow is checking the correct address (the EOA vs the money account address) and whether gas estimation is failing silently due to transport issues. 5. Consider adding a pre-flight check in the Money deposit UI that verifies Ledger connectivity before initiating the transaction construction pipeline.

---

Confidence threshold: 0.85. Labels marked ✅ were auto-applied. Labels marked ⚠️ are advisory only (below threshold).
To re-triage, remove the ta-bot-triage label and re-apply ta-needs-triage.
⚠️ Some dimensions could not be confidently classified. An engineer should review this issue.