MetaMask / MetaMask/metamask-extension

[Bug]: Onramps - Wallet crashes with invalid API response `https://on-ramp-content.api.cx.metamask.io/`

Open
#44,089 0 comments 0 reactions 0 assignees View on GitHub
regression-prod-13.37.0 Sev2-normal team-money-movement type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

The API response from `https://on-ramp-content.api.cx.metamask.io/regions/networks` is not sanitized/validated, meaning it can break the wallet if we get an unexpected response (ie not array).

### Expected behavior

Validate API response so the wallet doesn't break

### Screenshots/Recordings

https://github.com/user-attachments/assets/0bc38004-90dc-4348-a3d1-63a2496e98f1

### Steps to reproduce

1. Setup a proxy
2. Intercept this GET request and subpaths `https://on-ramp-content.api.cx.metamask.io/regions/networks`
3. Add this payload response

```
{
"networks": "not-an-array"
}
```
4. Reload wallet and go to Assets page
5. See wallet breaks

### Error messages or log output

```shell

```

### Where was this bug found?

Live version (from official store)

### Version

13.37.0

### Build type

None

### Browser

Chrome

### Operating system

MacOS

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the code that requests https://on-ramp-content.api.cx.metamask.io/regions/networks and feeds its response to the Assets page. Reproduce the issue with {"networks":"not-an-array"}, then validate the response so unexpected data does not break the wallet. Done means the wallet remains usable with the malformed response and the normal response still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
66/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.