Feat/migrate units conversion utils #255

Nodonisko · 2025-08-14T23:21:20Z

This PR is migrating state of @metamask/ethjs-unit from this PR MetaMask/ethjs-unit#24 to Typescript and moving it to this repo.

I migrated all existing test cases and also added bunch of new ones.

Just migration to bigint improved performance already quite a bit and I also added few more optimizations to make it even faster.

Here are some results:

1. `getValueOfUnit` - 92.4% faster (13.1x speedup)

Old: 0.0008ms average, 1,186,924 ops/sec
New: 0.0001ms average, 15,559,761 ops/sec
Memory usage: Minimal impact

2. `numberToString` - Mixed Results

String inputs: 43.9% faster (1.8x speedup)
Number inputs: 211.7% slower*
Memory usage: Negligible difference
*Note: Regression due to additional BigInt support in benchmark and in absolute numbers it's still so fast that is negligible (0.0001ms vs 0.0003ms)

3. `fromWei` - 41.8% to 71.9% faster

Small values: 41.8% faster (1.7x speedup)
Gwei values: 47.4% faster (1.9x speedup)
Ether values: 47.4% faster (1.9x speedup)
Large values: 52.0% faster (2.1x speedup)
With options: 71.9% faster (3.6x speedup)
Memory usage: 63.8% to 99.2% reduction

4. `toWei` - 55.2% to 79.0% faster

Small values: 71.2% faster (3.5x speedup)
Medium values: 73.9% faster (3.8x speedup)
Large values: 79.0% faster (4.8x speedup)
Decimal values: 55.2% faster (2.2x speedup)
Memory usage: 63.4% reduction

socket-security · 2025-08-14T23:21:46Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality
	available-typed-arrays@1.0.5 ⏵ 1.0.7		⁺⁴
	safe-regex-test@1.0.0 ⏵ 1.1.0		⁺³
	is-arguments@1.2.0
	is-generator-function@1.1.0
	is-regex@1.1.4 ⏵ 1.2.1		⁺¹
	which-typed-array@1.1.11 ⏵ 1.1.19		⁺¹
	is-typed-array@1.1.12 ⏵ 1.1.15		⁺¹
	setimmediate@1.0.5
	tr46@0.0.3
	@types/ws@8.5.3
	isomorphic-ws@5.0.0
	possible-typed-array-names@1.1.0
	call-bind@1.0.7 ⏵ 1.0.8	⁺¹
	dunder-proto@1.0.1
	math-intrinsics@1.1.0
	get-proto@1.0.1
	@adraffy/ens-normalize@1.11.0
	cross-fetch@4.1.0
	eventemitter3@5.0.1
	web3-eth-iban@4.0.7
	web3-providers-ipc@4.0.7
	web3-rpc-methods@1.3.0
	web3-validator@2.0.6
	web3-net@4.1.0
	web3-eth-ens@4.4.0
	web3-providers-ws@4.0.8
	web3-providers-http@4.2.0
	web3-eth-personal@4.1.0
	web3-utils@4.3.3
	web3-errors@1.3.1
	web3@4.16.0
	web3-core@4.7.1
	web3-eth@4.11.1
See 11 more rows in the dashboard

View full report

socket-security · 2025-08-14T23:21:48Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`node-fetch@2.7.0` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/node-fetch@2.7.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`node-fetch@2.7.0` has Network access. Module: http Location: Package overview From: yarn.lock → `npm/node-fetch@2.7.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`node-fetch@2.7.0` has Network access. Module: https Location: Package overview From: yarn.lock → `npm/node-fetch@2.7.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`web3-providers-http@4.2.0` has Network access. Module: globalThis["fetch"] Location: Package overview From: yarn.lock → `npm/web3-providers-http@4.2.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-http@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`web3-providers-ipc@4.0.7` has Network access. Module: net Location: Package overview From: yarn.lock → `npm/web3-providers-ipc@4.0.7` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-ipc@4.0.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`ws@8.18.3` has Network access. Module: http Location: Package overview From: yarn.lock → `npm/ws@8.18.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ws@8.18.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`ws@8.18.3` has Network access. Module: https Location: Package overview From: yarn.lock → `npm/ws@8.18.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ws@8.18.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`ws@8.18.3` has Network access. Module: net Location: Package overview From: yarn.lock → `npm/ws@8.18.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ws@8.18.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`ws@8.18.3` has Network access. Module: tls Location: Package overview From: yarn.lock → `npm/ws@8.18.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ws@8.18.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`web3-net@4.1.0` has a New author. New Author: luu-alex Previous Author: mpetrunic From: yarn.lock → `npm/web3-net@4.1.0` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-net@4.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`web3-providers-ws@4.0.8` has a New author. New Author: luu-alex Previous Author: mpetrunic From: yarn.lock → `npm/web3-providers-ws@4.0.8` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/web3-providers-ws@4.0.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`zod@3.25.76` is a AI-detected potential code anomaly. Notes: No explicit network exfiltration, reverse shell, or credential theft is present in this fragment. However, the code assembles and compiles arbitrary code via the Function constructor and invokes passed-in functions immediately (twice). That behavior constitutes a strong dangerous primitive (arbitrary code execution) which can be abused if any inputs (strings or args) are attacker-controlled. Treat this module as risky in threat models where inputs are not fully trusted; review call sites and sanitize/validate inputs or avoid dynamic evaluation. Confidence: 1.00 Severity: 0.60 From: yarn.lock → `npm/zod@3.25.76` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/zod@3.25.76`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

cross-fetch@4.1.0

View full report

Gudahtt · 2025-08-21T13:39:14Z

src/unitsConversion.test.ts

@@ -0,0 +1,709 @@
+// web3 dependency is not used in the codebase, but only in tests
+// eslint-disable-next-line import/no-extraneous-dependencies


This ignore comment shouldn't be needed, since this is a test file

you are right, removed

mcmire

Nice! At some point we might want to investigate porting the Numeric class from the extension into this repo, using BigInt instead of BN. But this is sufficient for now.

I had a few comments but they are all pretty minor. Thanks for backfilling the tests!

src/unitsConversion.ts

Nodonisko · 2025-08-21T21:52:46Z

@mcmire All comments should be fixed now.

mcmire

LGTM!

mcmire · 2025-08-22T14:14:51Z

@SocketSecurity ignore npm/cross-fetch@4.1.0

cross-fetch is a transitive dependency of web3. Seems OK.

## **Description** This draft of migration from BN.js to native `BigInt`. It needs MetaMask/utils#255 to be merged and released first. Native BigInt is much much faster than JS only BN implementation. This could improve app performance in many places like account list, login, dashboard etc. I already measured `useAccounts` hook and it made it 7x faster `220ms => 30ms`. #### Proposal for handling migration: I moved cloned previous file `index.js` to `legacy.js` and updated imports everywhere to use this old implementation. Then I migrated whole old `index.js` to TS and to use `BigInt`. I also marked all legacy functions as deprecated so they could be spotted more easily during future refactoring and replaced with new implementation. I think this approach is best in current situation because: 1. Even that I tried my best I could have introduced some bugs it's better to introduce new functions slowly 2. We are on tight schedule with performance improvements and updating these functions across whole codebase could take quite a long time and I am not even talking about testing and PR review 3. I also added TS types which is causing type errors in some places where new functions are used because previous versions were typed as `any`. TODOs: - [x] merge MetaMask/utils#255 - [x] merge #18949 and then rebase - [x] in Engine.ts, around line ~1916 there is function` toHexadecimal` and while migrating it to new implementation with bigint I noticed that i receives params like `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp` . In old implementation it causes `toHexadecima`l return `NaN` and in my new implementation it throws error. I guess this might be causing bug even in current implementation like total balance not being correct if there is more than one Solana account or something like that. - [x] How to gracefully migrate from old BN? I would suggest keeping old BN implementation and only that functions deprecated. ## **Changelog**  CHANGELOG entry: ## **Related issues** Fixes: ## **Manual testing steps** 1. Check that total balance across the app is correct for different SRPs (combinations of coins/tokens/networks etc.) ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist** - [ ] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > Introduce BigInt-backed number utilities while re-pointing existing code to legacy implementations, updating balance/fee logic and tests accordingly. > > - **Core number utils (BigInt)**: > - Add new `util/number/index.ts` with BigInt-based conversions/formatting (`hexToBigInt`, `bigIntToHex`, `toWei`, `fromWei`, fiat/token helpers, etc.). > - Preserve previous BN.js utils in `util/number/legacy.js` (marked deprecated) and add comprehensive `legacy.test.ts`. > - Update ESLint globals to include `BigInt`. > - **Codebase migration (temporary legacy shim)**: > - Replace imports of `util/number` with `util/number/legacy` across app (Swaps, Ramp, Earn, Stake, Bridge, Transactions, selectors, hooks, components, tests). > - Adjust typings/usages (e.g., remove unnecessary `Hex` cast, tweak chainId handling for images/selectors). > - **Engine and calculations**: > - Update balance/fiat computations to use BigInt paths (`hexToBigInt`, `bigInt` math) and avoid string BN math; fix chainId map lookups (use raw `chainId`). > - Modify tests and data to store balances as hex strings with `0x` prefix. > - **Tests and minor fixes**: > - Add new tests for BigInt utils and adapt existing tests/mocks to legacy paths. > - Small test logic refinements (e.g., async wait/press order, debounced assertions). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 6ea5e81. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

Nodonisko added 2 commits August 15, 2025 00:38

feat: migrate units conversion utils

fedada4

chore: perf improvements of conversion utils

fe01742

This comment was marked as outdated.

Sign in to view

Nodonisko mentioned this pull request Aug 19, 2025

feat: replace BN with native BigInt MetaMask/metamask-mobile#18473

Merged

11 tasks

Nodonisko added 2 commits August 20, 2025 20:55

fix: add missing exports to tests

87c0939

fix: add tests to satisfy coverage

777c699

owencraston approved these changes Aug 20, 2025

View reviewed changes

Gudahtt reviewed Aug 21, 2025

View reviewed changes

chore: remove unused eslint disable

67db486

mcmire reviewed Aug 21, 2025

View reviewed changes

chore: better error messages, use let + const

d489240

Nodonisko force-pushed the feat/migrate-units-conversion-utils branch from 5cecf26 to d489240 Compare August 21, 2025 21:52

mcmire approved these changes Aug 22, 2025

View reviewed changes

owencraston approved these changes Aug 27, 2025

View reviewed changes

sethkfman enabled auto-merge (squash) August 27, 2025 18:39

Merge branch 'main' into feat/migrate-units-conversion-utils

fd354e3

sethkfman merged commit 0a6e1bd into MetaMask:main Aug 27, 2025
21 of 22 checks passed

		@@ -0,0 +1,709 @@
		// web3 dependency is not used in the codebase, but only in tests
		// eslint-disable-next-line import/no-extraneous-dependencies

Uh oh!

Feat/migrate units conversion utils #255

Feat/migrate units conversion utils #255

Uh oh!

Conversation

Nodonisko commented Aug 14, 2025

1. getValueOfUnit - 92.4% faster (13.1x speedup)

2. numberToString - Mixed Results

3. fromWei - 41.8% to 71.9% faster

4. toWei - 55.2% to 79.0% faster

Uh oh!

socket-security bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Gudahtt Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

Nodonisko Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Nodonisko commented Aug 21, 2025

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

mcmire commented Aug 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

1. `getValueOfUnit` - 92.4% faster (13.1x speedup)

2. `numberToString` - Mixed Results

3. `fromWei` - 41.8% to 71.9% faster

4. `toWei` - 55.2% to 79.0% faster

socket-security bot commented Aug 14, 2025 •

edited

Loading

socket-security bot commented Aug 14, 2025 •

edited

Loading