feat: add address poisoning detection to PhishingController

README.md

@@ -456,6 +456,7 @@ linkStyle default opacity:0.5
   perps_controller --> profile_sync_controller;
   perps_controller --> remote_feature_flag_controller;
   perps_controller --> transaction_controller;
+  phishing_controller --> address_book_controller;
   phishing_controller --> base_controller;
   phishing_controller --> controller_utils;
   phishing_controller --> messenger;

eslint-suppressions.json

@@ -1634,26 +1634,15 @@
       "count": 2
     }
   },
-  "packages/phishing-controller/src/PhishingController.test.ts": {
-    "jest/unbound-method": {
-      "count": 7
-    },
-    "no-restricted-syntax": {
-      "count": 1
-    }
-  },
   "packages/phishing-controller/src/PhishingController.ts": {
     "@typescript-eslint/explicit-function-return-type": {
-      "count": 19
+      "count": 14
     },
     "@typescript-eslint/naming-convention": {
       "count": 1
     },
     "@typescript-eslint/prefer-nullish-coalescing": {
       "count": 6
-    },
-    "no-restricted-syntax": {
-      "count": 10
     }
   },
   "packages/phishing-controller/src/PhishingDetector.test.ts": {

packages/phishing-controller/CHANGELOG.md

@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `findSimilarAddresses` utility and `PhishingController:checkAddressPoisoning` messenger action to detect address poisoning attempts against known recipients ([#8171](https://github.com/MetaMask/core/pull/8171))
+  - The controller now hydrates and maintains a set of known recipient addresses from confirmed transactions (`TransactionController`) and the address book (`AddressBookController`)
+  - Exposes match metadata including prefix/suffix match lengths, poisoning score, and diff indices
+- Add `@metamask/address-book-controller` as a dependency ([#8171](https://github.com/MetaMask/core/pull/8171))
 - Support path-based phishing lists (`blocklistPaths`, `whitelistPaths`) and path-aware URL scanning for shared gateways (for example IPFS gateways and `sites.google.com`) via `getPhishingDetectionScanUrlParam`, `isPhishingDetectionPathBasedHostname`, and `PHISHING_DETECTION_PATH_BASED_ROOT_DOMAINS` ([#8662](https://github.com/MetaMask/core/pull/8662))
 
 ### Changed

packages/phishing-controller/package.json

@@ -53,6 +53,7 @@
     "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch"
   },
   "dependencies": {
+    "@metamask/address-book-controller": "^7.1.2",
     "@metamask/base-controller": "^9.1.0",
     "@metamask/controller-utils": "^12.1.0",
     "@metamask/messenger": "^1.2.0",

packages/phishing-controller/src/PhishingController-method-action-types.ts

@@ -5,6 +5,17 @@
 
 import type { PhishingController } from './PhishingController';
 
+/**
+ * Finds known recipient addresses that look like an address poisoning match.
+ *
+ * @param candidate - The recipient address being checked.
+ * @returns Similar known recipient matches sorted by score.
+ */
+export type PhishingControllerCheckAddressPoisoningAction = {
+  type: `PhishingController:checkAddressPoisoning`;
+  handler: PhishingController['checkAddressPoisoning'];
+};
+
 /**
  * Conditionally update the phishing configuration.
  *
@@ -121,6 +132,7 @@ export type PhishingControllerGetApprovalsAction = {
  * Union of all PhishingController action types.
  */
 export type PhishingControllerMethodActions =
+  | PhishingControllerCheckAddressPoisoningAction
   | PhishingControllerMaybeUpdateStateAction
   | PhishingControllerTestOriginAction
   | PhishingControllerIsBlockedRequestAction