fix: marinade multisig dapp requests by preserving original message bytes WPN-1035

[taran-a]

Fixes multisig dapp transaction signing by preserving the original transaction payload for external dapp origins.

• Decode dapp-origin signTransaction and signAndSendTransaction requests as transactions directly, whether the payload is a full serialized transaction or a bare compiled transaction message.
• Append only the snap account's signature, preserving existing signatures, compiled messageBytes, account ordering, and instruction account indices.
• Keep the existing MetaMask-origin signing flow unchanged.
• Add coverage for codec decoding, signer byte preservation, and wallet origin handling.

Screen.Recording.2026-06-04.at.19.54.59.mov

---

Note

High Risk
Changes signing semantics for all external dapp origins (marked BREAKING) and touches core transaction encoding—incorrect byte handling could break multisig or produce invalid signatures.

Overview
Fixes multisig and dapp signing (e.g. Marinade) by not recompiling transaction payloads from external origins.

For non–MetaMask origins, signTransaction and signAndSendTransaction now pass preserveMessageBytes: true into signing. The snap decodes the base64 payload as a transaction (full serialized tx or bare compiled message via new fromUnknowBase64StringToTransaction / fromBase64StringCompiledMessageToTransaction helpers) and only adds the wallet’s signature, leaving messageBytes, existing signatures, and account ordering unchanged. The MetaMask-origin path still uses the prior flow (fee payer, blockhash, compute budget, etc.).

Changelog calls this BREAKING for dapp-origin sign flows because behavior differs from before when messages were normalized. Manifest shasum updated; tests cover codecs, signer preservation, and origin gating.

^{Reviewed by Cursor Bugbot for commit 74941d7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[taran-a]

@metamaskbot publish-preview

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud