fix(confirmations): prevent send account startsWith crash

[Prithpal-Sooriya]

Description

Context:

• ASSETS-3029 reports a crash in Extension Wallet 13.22.0 while entering send flows (Send -> select token or token -> Send).
• The error is TypeError: Cannot read properties of undefined (reading 'startsWith') and points to ui/pages/confirmations/utils/account.ts.

Problem:

• isEVMAccountForSend/isSolanaAccountForSend/isBitcoinAccountForSend/isTronAccountForSend assumed account.type and account.scopes always contained strings.
• When malformed account objects are present (e.g., missing type, or non-string scope entries), these checks could call .startsWith on undefined and crash the UI.

Solution:

• Added a shared, defensive compatibility helper that verifies values are strings before calling .startsWith.
• Updated all send-account compatibility helpers (EVM/Solana/Bitcoin/Tron) to use this guarded logic.
• Added regression tests for malformed account shapes (missing type, undefined scope entries) and added dedicated Tron coverage.

Changelog

CHANGELOG entry: Fixed a crash that could occur in send flow when malformed account entries were missing account type metadata.

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/ASSETS-3029

Manual testing steps

1. Open the extension and unlock a wallet with multiple token/account options.
2. Go through both reported flows:
   • Click Send and then select a token.
   • Select a token first and then click Send.
3. Confirm the send UI does not crash and recipients render normally.
4. Confirm this remains true even when account data includes non-EVM accounts in the wallet list.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

  

[mm-token-exchange-service]

✨ Files requiring CODEOWNER review ✨

✅ @MetaMask/confirmations (2 files, +134 -53)

• 📁 ui/
  • 📁 pages/
    • 📁 confirmations/
      • 📁 utils/
        • 📄 account.test.ts +99 -0
        • 📄 account.ts +35 -53

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mm-token-exchange-service]

Builds ready [0559dfc]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• Webpack builds: chrome, firefox
• Webpack builds (beta): chrome, firefox
• Webpack builds (flask): chrome, firefox
• Webpack builds (test): chrome, firefox
• Webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

Deprecated Browserify fallback builds

• Browserify builds: chrome, firefox
• Browserify builds (beta): chrome, firefox
• Browserify builds (flask): chrome, firefox
• Browserify builds (test): chrome, firefox
• Browserify builds (test-flask): chrome, firefox

⚡ Performance Benchmarks (Total: 🟢 12 pass · 🟡 12 warn · 🔴 0 fail)

Baseline (latest main): 1e3d238 | Date: 6/25/2026 | Pipeline: 28227949240 | Baseline logs

Interaction Benchmarks · Samples: 5

Benchmark	chrome-webpack	firefox-webpack
loadNewAccount [Sentry log · main/release]	🟡 [CI log]	🟢 [CI log]
confirmTx [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
bridgeUserActions [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↑ loadNewAccount/inp: +27%
• ↓ loadNewAccount/cls: -75%
• ↑ bridgeUserActions/bridge_load_page: +129%
• ↑ bridgeUserActions/bridge_load_asset_picker: +18%
• ↑ bridgeUserActions/longTaskCount: +67%
• ↑ bridgeUserActions/longTaskTotalDuration: +54%
• ↑ bridgeUserActions/longTaskMaxDuration: +11%
• ↑ bridgeUserActions/tbt: +51%
• ↑ bridgeUserActions/total: +12%
• ↓ loadNewAccount/inp: -21%
• ↓ loadNewAccount/fcp: -46%
• ↑ loadNewAccount/lcp: +1020%
• ↑ confirmTx/confirm_tx: +10%
• ↓ confirmTx/longTaskCount: -100%
• ↓ confirmTx/longTaskTotalDuration: -100%
• ↓ confirmTx/longTaskMaxDuration: -100%
• ↓ confirmTx/tbt: -100%
• ↑ confirmTx/total: +10%
• ↓ confirmTx/inp: -14%
• ↑ confirmTx/lcp: +1186%
• ↑ bridgeUserActions/bridge_load_page: +207%
• ↑ bridgeUserActions/bridge_load_asset_picker: +64%
• ↓ bridgeUserActions/longTaskCount: -100%
• ↓ bridgeUserActions/longTaskTotalDuration: -100%
• ↓ bridgeUserActions/longTaskMaxDuration: -100%
• ↓ bridgeUserActions/tbt: -100%
• ↑ bridgeUserActions/total: +20%
• ↑ bridgeUserActions/lcp: +1195%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 loadNewAccount/FCP: p75 1.8s
• 🟡 bridgeUserActions/FCP: p75 1.8s
• 🟡 confirmTx/FCP: p75 1.8s
• 🟡 bridgeUserActions/FCP: p75 1.8s

Startup Benchmarks · Samples: 100

Benchmark	chrome-webpack	firefox-webpack
startupStandardHome [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log] 🟡 loadScripts
startupPowerUserHome [Sentry log · main/release]	–	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↑ startupStandardHome/backgroundConnect: +11%
• ↓ startupStandardHome/setupStore: -29%
• ↑ startupPowerUserHome/backgroundConnect: +22%
• ↑ startupPowerUserHome/setupStore: +20%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 startupPowerUserHome/INP: p75 208ms
• 🟡 startupPowerUserHome/LCP: p75 3.4s

User Journey Benchmarks · Samples: 5 · mock API

Benchmark	chrome-webpack	firefox-webpack
onboardingImportWallet [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
onboardingNewWallet [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log] 🟡 total
assetDetails [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
solanaAssetDetails [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
importSrpHome [Sentry log · main/release]	🟢 [CI log]	🟡 [CI log]
sendTransactions [Sentry log · main/release]	🟡 [CI log]	🟡 [CI log]
swap [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ onboardingImportWallet/srpButtonToSrpForm: -23%
• ↓ onboardingImportWallet/confirmSrpToPwForm: -24%
• ↓ onboardingImportWallet/pwFormToMetricsScreen: -23%
• ↓ onboardingImportWallet/metricsToWalletReadyScreen: -45%
• ↓ onboardingImportWallet/doneButtonToHomeScreen: -77%
• ↓ onboardingImportWallet/openAccountMenuToAccountListLoaded: -100%
• ↓ onboardingImportWallet/longTaskCount: -75%
• ↓ onboardingImportWallet/longTaskTotalDuration: -92%
• ↓ onboardingImportWallet/longTaskMaxDuration: -89%
• ↓ onboardingImportWallet/tbt: -99%
• ↓ onboardingImportWallet/total: -83%
• ↑ onboardingNewWallet/skipBackupToMetricsScreen: +16%
• ↓ onboardingNewWallet/doneButtonToAssetList: -33%
• ↓ onboardingNewWallet/longTaskCount: -62%
• ↓ onboardingNewWallet/longTaskTotalDuration: -64%
• ↓ onboardingNewWallet/longTaskMaxDuration: -39%
• ↓ onboardingNewWallet/tbt: -72%
• ↓ onboardingNewWallet/total: -29%
• ↓ solanaAssetDetails/assetClickToPriceChart: -75%
• ↓ solanaAssetDetails/total: -75%
• ↓ solanaAssetDetails/inp: -19%
• ↓ solanaAssetDetails/fcp: -21%
• ↓ solanaAssetDetails/lcp: -12%
• ↑ solanaAssetDetails/cls: +12%
• ↑ importSrpHome/openAccountMenuAfterLogin: +17%
• ↓ importSrpHome/homeAfterImportWithNewWallet: -39%
• ↓ importSrpHome/longTaskCount: -33%
• ↓ importSrpHome/longTaskTotalDuration: -31%
• ↓ importSrpHome/tbt: -35%
• ↓ importSrpHome/total: -33%
• ↓ importSrpHome/inp: -28%
• ↓ importSrpHome/cls: -53%
• ↑ sendTransactions/openSendPageFromHome: +60%
• ↓ sendTransactions/longTaskCount: -50%
• ↓ sendTransactions/longTaskTotalDuration: -61%
• ↓ sendTransactions/longTaskMaxDuration: -37%
• ↓ sendTransactions/tbt: -100%
• ↑ sendTransactions/fcp: +26%
• ↑ sendTransactions/lcp: +29%
• ↓ sendTransactions/cls: -92%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 sendTransactions/FCP: p75 2.2s
• 🔴 assetDetails/INP: p75 736ms
• 🟡 assetDetails/FCP: p75 1.9s
• 🟡 solanaAssetDetails/FCP: p75 1.9s
• 🟡 importSrpHome/FCP: p75 1.8s
• 🟡 sendTransactions/FCP: p75 1.8s

Dapp Page Load Benchmarks · Samples: 100

Benchmark	chrome-webpack
dappPageLoad [Sentry log · main/release]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ dappPageLoad/pageLoadTime: -14%

Bundle size diffs

• background: 73 Bytes (0%)
• ui: -93 Bytes (0%)
• common: 0 Bytes (0%)
• other: 0 Bytes (0%)
• contentScripts: 0 Bytes (0%)
• zip: 82 Bytes (0%)