MetaMask / MetaMask/metamask-extension
[Bug]: Notifications - Wallet crashes with invalid responses from API
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**Describe the bug**
Notification API response data is not validated leading to crashes `https://notification.api.cx.metamask.io/api/v3/notifications`:
- `Message: Cannot read properties of undefined (reading 'eth')`
- `Cannot read properties of undefined (reading 'image_url')`
**Screenshots/Recordings**
https://github.com/user-attachments/assets/ef7bf578-b306-4692-80f0-28fe61329d81
**Steps to reproduce**
1. Setup proxy
2. Intercept this POST request and subpaths `https://notification.api.cx.metamask.io/api/v3/notifications`
3. Return this payload in the response, for reproducing each issue
Issue 1:
```
[
{
"id": "poison-1",
"notification_type": "platform",
"created_at": "2026-07-02T00:00:00.000Z",
"unread": true
}
]
```
Issue 2:
```
[
{
"id": "poison-1",
"notification_type": "on-chain",
"created_at": "2026-07-02T00:00:00.000Z",
"unread": true,
"payload": {
"chain_id": 1,
"network": "ethereum-mainnet",
"data": { "kind": "eth_received", "to": "0x1111111111111111111111111111111111111111", "from": "0x2222222222222222222222222222222222222222" }
}
}
]
```
**Error messages or log output**
```shell
```
**Where was this bug found?**
Live version (from official store)
**Version**
13.37.0
**Build type**
None
**Browser**
Chrome
**Operating system**
MacOS
Contributor guide
Research direction
No source files or tests are named. Start by reproducing the issue with a proxy against the notification API response, then trace the extension's notification response handling. Done means both malformed payloads no longer crash the wallet, with coverage for the provided responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100