poc/moonpay iron by jiexi · Pull Request #33305 · MetaMask/metamask-mobile

jiexi · 2026-07-14T22:31:48Z

feat: include kyc required endpoint into main architecture
feat: include kyc required endpoint into main architecture
feat: wip
fix bad merge
add geolocation fetching
add disclaimer fetching and submission
show disclaimers in text, thread to session creation
revert local network hardcode
fix session creation POST
add launch sumsub button. move debug component to bottom of page

Description

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

I've tested on Android
- Ideally on a mid-range device; emulator is acceptable
I've tested with a power user scenario
- Use these power-user SRPs to import wallets with many accounts and tokens
I've instrumented key operations with Sentry traces for production performance metrics
- See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Touches KYC/session auth and changes how MoonPay tokens flow into UKYC/SumSub, but scope is demo screens rather than production ramps UI; a debug console.log remains on the Check frame URL.

Overview
Refactors the KYC Demo MoonPay path to go through the local Universal KYC (UKYC) service instead of calling MoonPay’s platform identity APIs from the app.

API and auth: UKYC calls now use the wallet AuthenticationController bearer token (replacing a hardcoded dev token). New helpers load disclaimers and geolocation → ISO alpha-3 (countryCodes.ts), and checkKycRequired replaces client-side identity create/PATCH/upload/verification/polling. Session creation sends disclaimerIds from the fetched disclaimers.

Demo flow: After Check/Auth frames, the UI only picks a country profile and runs the kyc-required check; the done screen shows the JSON result and a Launch SumSub verification button (no auto-launch on approval). Challenge/verify/poll phases and rich identity fields are removed.

SumSub handoff: KYCDemo owns a single useSumSubDemo instance; MoonpayDemo receives launchSumSubSDK, and SumSubDemo displays status / sdkResult from props. SumSub UKYC session POSTs use bearer auth and pass the MoonPay token in vendorMetadata.

Minor iOS Xcode project path updates for AppDelegate / BrazeHelper references.

^{Reviewed by Cursor Bugbot for commit 1f590ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

…e into poc/moonpay-iron

github-actions · 2026-07-14T22:31:57Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1f590ac. Configure here.}

cursor · 2026-07-14T22:33:04Z

+          { error: String(err) },
+          'error',
+        );
+      }


Terms blocked after disclaimer failure

Medium Severity

When geolocation or disclaimer fetching fails, disclaimersLoaded never becomes true, so Accept terms and start stays disabled with no retry. The button label still reads Loading disclaimers… even when an error is shown, so the flow looks stuck rather than failed.

Additional Locations (1)

app/components/Views/MoonpayDemo/index.tsx#L382-L387

^{Reviewed by Cursor Bugbot for commit 1f590ac. Configure here.}

cursor · 2026-07-14T22:33:04Z

+        if (cancelled) return;
+        setDisclaimers(result);
+        setDisclaimersError(null);
+        setDisclaimersLoaded(true);


Geolocation vs profile country mismatch

Medium Severity

Disclaimers and disclaimerIds for session creation come from geolocation-derived country, but checkKycRequired uses the manually selected profile’s residentialAddress.country. A user can accept one jurisdiction’s disclaimers while querying KYC for another.

Additional Locations (1)

app/components/Views/MoonpayDemo/useMoonpayIdentityFlow.ts#L382-L388

^{Reviewed by Cursor Bugbot for commit 1f590ac. Configure here.}

cursor · 2026-07-14T22:33:04Z

    url.searchParams.set('publicKey', keypair.publicKeyHex);
    url.searchParams.set('channelId', CHANNEL_CHECK);
    url.searchParams.set('skipKyc', 'true');
+    console.log('==========> url', url.toString());


Debug log leaks session URL

Medium Severity

A console.log in the checkFrameUrl memo prints the full MoonPay check-connection URL, including the sessionToken query parameter, on every rebuild when a session exists.

^{Reviewed by Cursor Bugbot for commit 1f590ac. Configure here.}

github-actions · 2026-07-14T22:34:07Z

🔍 Smart E2E Test Selection

Selected E2E tags: None (no tests recommended)
Selected Performance tags: None (no tests recommended)
Risk Level: low
AI Confidence: 92%

click to see 🤖 AI reasoning details

E2E Test Selection:
All 8 changed files fall into two categories:

Developer Demo Components (7 files): KYCDemo, MoonpayDemo, and SumSubDemo are internal developer demo/testing screens. The changes refactor the KYC flow within these demo screens — simplifying from a multi-step identity creation/verification/polling flow to a simpler KYC-check flow, adding geolocation resolution, disclaimers fetching, and SumSub SDK integration. These are not production user-facing features and are not covered by any E2E smoke tests. A grep search confirms these components are only referenced in MainNavigator.js (as a route) and Wallet/index.tsx (as a developer button), with no smoke test files importing or testing them.
iOS Xcode Project File (1 file): ios/MetaMask.xcodeproj/project.pbxproj changes are minor path corrections (renaming display names from AppDelegate.swift to MetaMask/AppDelegate.swift, same for BrazeHelper.mm), adding empty inputPaths/outputPaths arrays to build phases, and adding a SplashScreen.storyboard reference to Recovered References. These are structural/cosmetic Xcode project file changes that don't affect app runtime behavior.

No production user flows, shared components, navigation, controllers, or E2E-testable features are affected. No smoke test tags are warranted.

Performance Test Selection:
No performance-sensitive code paths are affected. The changes are confined to developer demo screens (KYCDemo, MoonpayDemo, SumSubDemo) and an Xcode project file. None of the changed files touch app launch, onboarding, login, asset loading, swap flows, or any other performance-measured scenarios.

View GitHub Actions results

Akaryatrh and others added 13 commits July 2, 2026 15:51

feat: include kyc required endpoint into main architecture

d459ac4

Merge remote-tracking branch 'origin/poc/ukyc' into poc/moonpay-iron

c635d8b

feat: include kyc required endpoint into main architecture

e276f87

feat: wip

69cc2b3

Merge branch 'poc/moonpay-iron' of github.com:MetaMask/metamask-mobil…

d917b93

…e into poc/moonpay-iron

fix bad merge

91a96df

add geolocation fetching

838225d

add disclaimer fetching and submission

8beee41

show disclaimers in text, thread to session creation

ea2cf15

revert local network hardcode

fe8b8cc

Merge branch 'poc/ukyc' into poc/moonpay-iron

4f5c0f4

fix session creation POST

d0ba74c

add launch sumsub button. move debug component to bottom of page

1f590ac

metamask-ci Bot added the team-wallet-integrations Wallet Integrations team label Jul 14, 2026

cursor Bot reviewed Jul 14, 2026

View reviewed changes

github-actions Bot added the size-XL label Jul 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

poc/moonpay iron#33305

poc/moonpay iron#33305
jiexi wants to merge 13 commits into
poc/ukycfrom
poc/moonpay-iron

jiexi commented Jul 14, 2026 •

edited by cursor Bot

Loading

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 14, 2026

Uh oh!

cursor Bot Jul 14, 2026

Uh oh!

cursor Bot Jul 14, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

jiexi commented Jul 14, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Performance checks (if applicable)

Pre-merge reviewer checklist

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Terms blocked after disclaimer failure

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Geolocation vs profile country mismatch

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Debug log leaks session URL

Uh oh!

github-actions Bot commented Jul 14, 2026

🔍 Smart E2E Test Selection

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jiexi commented Jul 14, 2026 •

edited by cursor Bot

Loading