feat: Blockaid Token Security Scanning for Change Trust Operations

[wantedsystem]

Description

Adds Blockaid token security scanning for Stellar change-trust confirmations and centralizes confirmation banner priority handling.

Changes

Token Security Scanning

• Added /token/scan support to SecurityAlertsApiClient.
• Added TransactionScanService.scanToken and token scan response/result mapping.

Background Scan Refresh

• Added ConfirmationTokenScanRefresher to perform background token scans while change-trust dialogs are open.

Change Trust Integration

• Wired token scanning into change-trust opt-in and opt-out confirmations using the classic asset reference format CODE-ISSUER.

Token Alerts

• Added TokenScanAlert for malicious and warning-level trustline assets.

Confirmation Banner Priority

• Centralized confirmation banner priority logic through resolveConfirmationBanner with the following order:

  1. Transaction validation error
  2. Transaction scan alert
  3. Token scan alert

Behavior Updates

• Kept confirmation disabling logic separate from banner priority handling.
• Documented token scan API errors as fail-open for trustline operations.
• Removed unused scope parameter from scanToken service APIs.

Test Coverage

Added unit tests covering:

• Token scan client mapping
• Token scan service mapping
• ConfirmationTokenScanRefresher behavior
• Token alert visibility
• Confirmation banner priority resolution
• Change-trust integration and wiring

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

[Copilot]

Pull request overview

This PR adds Blockaid token security scanning to Stellar change-trust confirmations (opt-in/opt-out) and centralizes confirmation banner priority so only one banner renders at a time.

Changes:

• Introduces /token/scan support end-to-end (API client → service mapping → confirmation context + background refresher).
• Integrates token-scan state into change-trust confirmation UI (new TokenScanAlert, confirm-disable logic, and banner resolution priority).
• Adds/updates unit tests and localization strings for the new token-scan UX.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/snap/src/ui/confirmation/views/ConfirmSignChangeTrustOptOut/ConfirmSignChangeTrustOptOut.tsx	Wires token scan + centralized banner resolution into change-trust opt-out confirmation UI.
packages/snap/src/ui/confirmation/views/ConfirmSignChangeTrustOptIn/ConfirmSignChangeTrustOptIn.tsx	Wires token scan + centralized banner resolution into change-trust opt-in confirmation UI.
packages/snap/src/ui/confirmation/views/ConfirmSendTransaction/ConfirmSendTransaction.tsx	Switches send confirmation banner rendering to resolveConfirmationBanner.
packages/snap/src/ui/confirmation/utils.ts	Adds token-scan confirm-disable logic, token/txn banner visibility helpers, and resolveConfirmationBanner.
packages/snap/src/ui/confirmation/utils.test.ts	Adds unit tests for token-scan visibility/disable logic and banner priority resolution.
packages/snap/src/ui/confirmation/controller.tsx	Adds scanToken option, plumbs token-scan request/context, and schedules a token-scan refresher.
packages/snap/src/ui/confirmation/controller.test.tsx	Tests controller validation for missing token-scan request when scanToken is enabled.
packages/snap/src/ui/confirmation/components/TokenScanAlert.tsx	Adds a new confirmation banner component for malicious/warning trustline assets.
packages/snap/src/ui/confirmation/components/TokenScanAlert.test.tsx	Adds unit tests for TokenScanAlert rendering behavior.
packages/snap/src/ui/confirmation/components/index.ts	Exports TokenScanAlert.
packages/snap/src/ui/confirmation/api.ts	Extends confirmation context/types with token-scan state + request structs.
packages/snap/src/services/transaction-scan/TransactionScanService.ts	Adds scanToken and token-scan response → result mapping.
packages/snap/src/services/transaction-scan/TransactionScanService.test.ts	Adds unit tests for scanToken mapping and error handling.
packages/snap/src/services/transaction-scan/SecurityAlertsApiClient.ts	Adds /token/scan request/response support with validation.
packages/snap/src/services/transaction-scan/SecurityAlertsApiClient.test.ts	Adds tests for token-scan POST request and HTTP error handling.
packages/snap/src/services/transaction-scan/api.ts	Adds token-scan request/response/result types + superstruct validation.
packages/snap/src/handlers/cronjob/refreshConfirmationContext/tokenScanRefresher.ts	Adds background refresher to update token scan while confirmation is open.
packages/snap/src/handlers/cronjob/refreshConfirmationContext/tokenScanRefresher.test.ts	Adds unit tests for token scan refresher scheduling and state transitions.
packages/snap/src/handlers/cronjob/refreshConfirmationContext/index.ts	Exports ConfirmationTokenScanRefresher.
packages/snap/src/handlers/cronjob/refreshConfirmationContext/api.ts	Adds TokenScan refresher key.
packages/snap/src/handlers/clientRequest/changeTrustOpt.ts	Enables token scanning for change-trust confirmations and passes classic CODE-ISSUER asset reference.
packages/snap/src/handlers/clientRequest/changeTrustOpt.test.ts	Updates change-trust tests to expect token-scan wiring.
packages/snap/src/context.ts	Registers the token-scan refresher in the background refresh handler.
packages/snap/snap.manifest.json	Updates bundle shasum.
packages/snap/messages.json	Adds new token-scan localization keys.
packages/snap/locales/es.json	Adds token-scan localization keys for Spanish locale file.
packages/snap/locales/en.json	Adds token-scan localization keys for English locale file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wantedsystem]

@metamaskbot publish-preview

[github-actions]

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.

@metamask-previews/stellar-wallet-snap@0.0.1-preview-a3c0091