chore(runway): cherry-pick fix: validate type of security data in token details and fetch when necessary cp-7.76.0

app/components/UI/TokenDetails/hooks/useTokenSecurityData.test.ts

@@ -109,6 +109,42 @@ describe('useTokenSecurityData', () => {
     expect(result.current.securityData).toBeNull();
   });
 
+  it('ignores prefetchedData with wrong shape and fetches instead', async () => {
+    const assetId = 'eip155:1/erc20:0x1234' as CaipAssetType;
+    mockFetchTokenAssets.mockResolvedValue([
+      {
+        assetId,
+        name: 'Test Token',
+        symbol: 'TEST',
+        decimals: 18,
+        securityData: mockSecurityData,
+      },
+    ]);
+
+    // Bridge SecurityData shape: { type: "Verified" } — missing resultType
+    const wrongShapedData = {
+      type: 'Verified',
+    } as unknown as TokenSecurityData;
+
+    const { result } = renderHook(() =>
+      useTokenSecurityData({
+        assetId,
+        prefetchedData: wrongShapedData,
+      }),
+    );
+
+    expect(result.current.isLoading).toBe(true);
+
+    await waitFor(() => {
+      expect(result.current.isLoading).toBe(false);
+    });
+
+    expect(mockFetchTokenAssets).toHaveBeenCalledWith([assetId], {
+      includeTokenSecurityData: true,
+    });
+    expect(result.current.securityData).toBe(mockSecurityData);
+  });
+
   it('does not fetch when assetId is null', () => {
     const { result } = renderHook(() =>
       useTokenSecurityData({ assetId: null }),

app/components/UI/TokenDetails/hooks/useTokenSecurityData.ts

@@ -18,10 +18,20 @@ interface UseTokenSecurityDataResult {
   error: Error | null;
 }
 
+const isValidTokenSecurityData = (data: unknown): data is TokenSecurityData =>
+  data != null &&
+  typeof data === 'object' &&
+  typeof (data as TokenSecurityData).resultType === 'string' &&
+  Array.isArray((data as TokenSecurityData).features);
+
 export const useTokenSecurityData = ({
   assetId,
-  prefetchedData,
+  prefetchedData: rawPrefetchedData,
 }: UseTokenSecurityDataOpts): UseTokenSecurityDataResult => {
+  const prefetchedData = isValidTokenSecurityData(rawPrefetchedData)
+    ? rawPrefetchedData
+    : undefined;
+
   const [securityData, setSecurityData] = useState<TokenSecurityData | null>(
     prefetchedData ?? null,
   );