fix: decode authorization util and prefix errors

[matthewwalsh0]

Explanation

Current

EIP-7702 production failures across mobile and extension are surfacing as bare, unattributable strings in our error metrics — most prominently failed to decode param in array[0] invalid JSON input from Sentinel relay.

1. Non-canonical RLP hex in authorization signatures. signAuthorization slices raw 32-byte signature halves into r and s without canonicalizing.
2. Bare error strings with no failure-surface attribution. When a 7702 transaction fails, the same generic message can come from any of: core's eth_sendRawTransaction, the Relay strategy's /execute POST, the non-execute relay deposit path, or the Pay publish hook. Metrics can't distinguish them, and Relay's actual server error ({ message: "Insufficient liquidity" }) is discarded by successfulFetch in favour of a generic URL-leaking template.

Solution

Canonicalize once, in core. A new exported decodeAuthorizationSignature(signature) utility in @metamask/transaction-controller decodes a 65-byte EIP-7702 authorization signature into RLP-canonical r, s, and yParity. signAuthorizationList is refactored to use it, so every signed authorization tuple emitted by the controller is canonical out of the box. Mobile/extension can read straight off txMeta.txParams.authorizationList and submit to any backend without their own strip helpers.

Layered submission error prefixes. Four prefixes, each applied at the lowest sensible layer, that cascade up the call stack to attribute every failure surface in metrics:

Layer	Prefix	Wraps
Core RPC	RPC submit:	eth_sendRawTransaction failures
Relay strategy	Relay submit:	the entire submitRelayQuotes body
Inner relay execute	Relay execute:	Relay /execute POST failures (cascades inside Relay submit:)
Pay hook	MetaMask Pay:	the entire TransactionPayPublishHook.#hookWrapper

A private relayFetch helper in relay-api.ts replaces successfulFetch for Relay endpoints. On non-OK responses it surfaces the response body's message or error field as <status> - <message>, falling back to <status> alone — no URL leakage, server's actual reason preserved when present.

Example errors as they appear in metrics

MetaMask Pay: Relay submit: Relay execute: 422 - Insufficient liquidity
MetaMask Pay: Relay submit: RPC submit: nonce too low
MetaMask Pay: Insufficient source token balance for relay deposit
MetaMask Pay: Relay submit: Relay execute: 500
MetaMask Pay: Relay submit: Relay execute: 400 - failed to decode param in array[0] invalid JSON input
RPC submit: replacement transaction underpriced

References

• CONF-1133

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes transaction submission error handling and EIP-7702 signature decoding, which can affect downstream clients’ ability to submit transactions and how failures are reported. Main risk is altered error strings/prefixes and canonicalization behavior impacting integrations/tests.

Overview
Adds a new exported decodeAuthorizationSignature helper for EIP-7702 that canonicalizes r/s (strips leading zeroes, uses 0x0 for zero) and derives yParity, and refactors authorization signing to use it.

Standardizes failure-surface attribution by wrapping submission errors with layered prefixes: RPC submit: for eth_sendRawTransaction failures (including nested data.message), Relay submit: for Relay strategy execution, Relay execute: for Relay /execute POST failures, and MetaMask Pay: for Pay publish hook failures.

Replaces Relay’s successfulFetch usage with a local relayFetch that preserves server-provided non-OK details (<status> - <message|error> or <status>) without leaking request URLs, and updates tests/changelogs accordingly.

^{Reviewed by Cursor Bugbot for commit 1eb9b8c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1eb9b8c. Configure here.}

[cursor]

Test mock missing ok: true in timeout scenario

Medium Severity

The .mockImplementation response object is missing ok: true. Since getRelayStatus now goes through relayFetch, which checks response.ok, this causes the second poll to throw a relayFetch error (with message "undefined") rather than returning a successful { status: 'pending' } response. The test still passes by accident — the polling loop catches the throw as a network error, and the timeout fires using lastStatus from the first poll — but it no longer verifies the intended behavior of timing out after receiving repeated valid pending responses.

 

^{Reviewed by Cursor Bugbot for commit 1eb9b8c. Configure here.}