Summary

Fix: Replace unsafe object keys with validations or safe structures (Map / Object.create(null))

This pull request addresses multiple prototype pollution vulnerabilities across different controllers in the MetaMask/core. The root cause in all cases was the usage of untrusted dynamic keys (chainId, namespace, etc.) on plain JavaScript objects, which could allow pollution via special keys like __proto__, constructor, or prototype.

Changes Implemented

1. AccountTrackerController.ts (updateNativeBalances, updateStakedBalances)

• Added guard checks inside iteration loops to skip dangerous keys:

  • "__proto__"
  • "constructor"
  • "prototype"

• Prevents updates to polluted object prototypes.

2. TokenBalancesController.ts

• Inserted validation before assigning chainId keys in loops around lines 596–632.
• Dangerous keys are now skipped with an explicit continue.

3. earn-controller/selectors.ts

• Replaced nested plain objects with Map for storing protocol → id → LendingMarket mappings.
• Updated selectors (selectLendingMarketsByProtocolAndId, selectLendingMarketForProtocolAndId) to use .get() instead of unsafe property access.
• Updated return types to reflect Map usage.

4. EnsController.ts (delete method)

• Added explicit guard before performing delete state.ensEntries[chainId][normalizedEnsName].
• Ensures polluted keys (__proto__, etc.) are never used for deletion operations.

5. NameController.ts (#updateEntry)

• Replaced {} object instantiations with Object.create(null) for:

  • state.names
  • typeEntries
  • variationEntries

• Ensures prototype-less storage to prevent pollution.

6. NetworkEnablementController.ts (enableNetworkInNamespace)

• Added validation step after namespace checks.
• If namespace matches a forbidden key (__proto__, constructor, prototype), an Error is thrown and the update is rejected.

7. sample-petnames-controller.ts (assignPetname)

• Extended validation to explicitly reject dangerous property names.
• Throws error if chainId equals __proto__, constructor, or prototype.

Notes

• All changes are backwards-compatible with current controller APIs.
• Where full refactoring to Map was infeasible, localized guards were added for defense-in-depth.
• Object.prototype.proto
• Map

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes