MetaMask / MetaMask/metamask-extension

[Bug]: Notifications - Wallet crashes with invalid responses from API

Open
#44,088 1 comment 0 reactions 0 assignees View on GitHub
INVALID-ISSUE-TEMPLATE Sev2-normal team-engagement type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

**Describe the bug**

Notification API response data is not validated leading to crashes `https://notification.api.cx.metamask.io/api/v3/notifications`:
- `Message: Cannot read properties of undefined (reading 'eth')`
- `Cannot read properties of undefined (reading 'image_url')`

**Screenshots/Recordings**

https://github.com/user-attachments/assets/ef7bf578-b306-4692-80f0-28fe61329d81

**Steps to reproduce**

1. Setup proxy
2. Intercept this POST request and subpaths `https://notification.api.cx.metamask.io/api/v3/notifications`
3. Return this payload in the response, for reproducing each issue

Issue 1:

```
[
{
"id": "poison-1",
"notification_type": "platform",
"created_at": "2026-07-02T00:00:00.000Z",
"unread": true
}
]
```

Issue 2:

```
[
{
"id": "poison-1",
"notification_type": "on-chain",
"created_at": "2026-07-02T00:00:00.000Z",
"unread": true,
"payload": {
"chain_id": 1,
"network": "ethereum-mainnet",
"data": { "kind": "eth_received", "to": "0x1111111111111111111111111111111111111111", "from": "0x2222222222222222222222222222222222222222" }
}
}
]
```

**Error messages or log output**

```shell

```

**Where was this bug found?**

Live version (from official store)

**Version**

13.37.0

**Build type**

None

**Browser**

Chrome

**Operating system**

MacOS

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Start by reproducing the issue with a proxy against the notification API response, then trace the extension's notification response handling. Done means both malformed payloads no longer crash the wallet, with coverage for the provided responses.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.