fix: Filter out duplicate JSON-RPC requests

[FrederikBolding]

Description

Copies createDupeReqFilterStream.ts from the extension repo and applies it to the provider stream in BackgroundBridge. This filters out any duplicate requests received from the dapp. It is possible for the RPC requests to be duplicated due to the "replay functionality" found here: https://github.com/MetaMask/metamask-mobile/blob/main/scripts/inpage-bridge/src/provider.js#L131

Feedback required.

Changelog

CHANGELOG entry: null

---

Note

Prevents duplicate JSON-RPC requests from reaching the engines.

• Add createDupeReqFilterStream with a three-minute expiry for seen request ids; comprehensive unit tests in createDupeReqFilterStream.test.ts
• Insert filter into BackgroundBridge pump chain for both setupProviderConnectionEip1193 and setupProviderConnectionCaip (between outStream and providerStream)
• Add @types/readable-stream to dependencies and update lockfile; annotate snaps execution setup with @ts-expect-error for stream type mismatch

^{Written by Cursor Bugbot for commit 31f5493. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​readable-stream@​2.3.15

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: FlaskBuildTests, SmokeConfirmationsRedesigned, SmokeWalletPlatform
• Risk Level: high
• AI Confidence: 85%

click to see 🤖 AI reasoning details

The changes modify the BackgroundBridge, which is a critical core component that handles all RPC communication between the app and dApps/external connections. The main change adds a duplicate request filter stream (createDupeReqFilterStream) to the provider connection pipeline in both setupProviderConnectionEip1193 and multichain provider connections.

Key impacts:

1. BackgroundBridge is used by:

   • BrowserTab (dApp browser)
   • SDKConnect (MetaMask SDK connections)
   • WalletConnect (WC sessions)
   • Multichain API connections

2. The duplicate filter stream is inserted into the pump() pipeline between outStream and providerStream, affecting all JSON-RPC requests flowing through the bridge. While this is a defensive measure to filter duplicate requests, any issues could break dApp interactions.

3. Snaps execution service has a minor type annotation fix (@ts-expect-error), but snaps also rely on the provider connection through BackgroundBridge.

Selected tags rationale:

• FlaskBuildTests: Snaps use the provider through BackgroundBridge, and there's a direct change to snaps execution service
• SmokeConfirmationsRedesigned: All signature and transaction confirmations from dApps flow through BackgroundBridge
• SmokeWalletPlatform: Core wallet functionality including dApp connections and network switching

The changes are in critical paths (app/core/) and affect the fundamental RPC communication layer, warranting high risk assessment.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
89.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud