fix: marinade multisig dapp requests by preserving original message bytes WPN-1035

[taran-a]

Fixes multisig dapp transaction signing by preserving the original transaction payload for external dapp origins.

• Decode dapp-origin signTransaction and signAndSendTransaction requests as transactions directly, whether the payload is a full serialized transaction or a bare compiled transaction message.
• Append only the snap account's signature, preserving existing signatures, compiled messageBytes, account ordering, and instruction account indices.
• Keep the existing MetaMask-origin signing flow unchanged.
• Add coverage for codec decoding, signer byte preservation, and wallet origin handling.

Screen.Recording.2026-06-04.at.19.54.59.mov

---

Note

Medium Risk
Changes core transaction signing for all external dapps and is documented as breaking; incorrect decoding could break signing, though origin gating and tests limit blast radius.

Overview
Fixes multisig and dapp signing (e.g. Marinade) by no longer decompiling and enriching dapp payloads before signing.

For non-MetaMask origins, signTransaction and signAndSendTransaction now decode the base64 payload as a transaction (full serialized tx or bare compiled message) and only add the wallet’s signature, keeping messageBytes, existing signatures, and account layout unchanged. MetaMask-origin requests still use the prior path that can fill fee payer, blockhash, and compute budget instructions.

New codec helpers (fromBase64StringCompiledMessageToTransaction, fromUnknowBase64StringToTransaction) and a preserveMessageBytes flag on partiallySignBase64String implement this. Changelog notes a breaking behavior change for dapp-origin signing.

^{Reviewed by Cursor Bugbot for commit 09a876d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[taran-a]

@metamaskbot publish-preview

[github-actions]

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/solana-wallet-snap@2.9.1-preview-09a876d