refactor(ens-controller): migrate from @ethersproject/providers to viem for ENS resolution

[yashgo0018]

Explanation

EnsController previously used ethers (@ethersproject/providers) to perform reverse ENS resolution (lookupAddress / resolveName) directly against the ENS registry contract. ENS is moving to ENSv2, and the recommended integration path is the ENS Universal Resolver (ENSIP-23) — a proxy contract owned by the ENS DAO that will be upgraded in place when ENSv2 launches, allowing clients to migrate automatically.

This PR replaces ethers@5 with viem, whose getEnsName action resolves through the Universal Resolver (reverse()), making the controller ENSv2-compatible with no future code changes.

What changed

• EnsController.ts
  • The private ethers Web3Provider is replaced with a viem client created via createClient({ chain, transport: custom(provider) }), wrapping the same EIP-1193 provider obtained from NetworkController:getNetworkClientById.
  • reverseResolveAddress now calls viem's getEnsName (reverse resolution through the Universal Resolver) and keeps the existing safety pipeline unchanged: forward-verification via getEnsAddress(normalize(domain)), rejection of zero/0x/mismatched addresses, punycode (toASCII) caching in ensResolutionsByAddress, and swallowing RPC errors to undefined.
  • DEFAULT_ENS_NETWORK_MAP now maps Mainnet and Sepolia to the ENS Universal Resolver contract address (0xeEeEEEeE14D718C2B47D9923Deab1335E144EeEe). Ropsten, Rinkeby, and Goerli have been shut down for years, and Holesky has no Universal Resolver deployment, so these entries were removed.
• Dependencies: @ethersproject/providers removed; viem added.
  • viem is pinned to exactly 2.55.8: starting with 2.55.10, viem marks its type declarations as ESM-only (_types/package.json with {"type":"module"}, viem#4903), which breaks this monorepo's dual CJS/ESM ts-bridge build (TS1479). 2.55.8 is the newest version with full Universal Resolver v3 support that type-checks cleanly for both output formats.
• Tests: The ethers module mock was replaced with a viem/actions mock of getEnsName / getEnsAddress. All existing test assertions are unchanged; coverage remains 100% across statements, branches, functions, and lines.

Public API

No API changes. The constructor options, all public methods, messenger actions, and generated action types are byte-for-byte identical. viem does not appear anywhere in the emitted type declarations, so downstream consumers are not exposed to viem's types.

Breaking change

The exported DEFAULT_ENS_NETWORK_MAP constant changed: it now contains Universal Resolver addresses for Mainnet and Sepolia only (previously ENS registry addresses for six chains). The default ensEntries state seeded from this map (under the . key) changes accordingly. Reverse resolution on Holesky is no longer available by default; the other removed chains were already non-functional.

Changelog

Updated packages/ens-controller/CHANGELOG.md (Unreleased):

• BREAKING: DEFAULT_ENS_NETWORK_MAP now maps Mainnet and Sepolia to the ENS Universal Resolver contract address
• Replace @ethersproject/providers with viem for ENS resolution; reverse resolution now goes through the ENS Universal Resolver (ENSIP-23), which makes the controller compatible with ENSv2 when it launches

Testing

• yarn workspace @metamask/ens-controller run test — 41 tests pass, 100% coverage on all metrics
• yarn build — full monorepo build passes (both CJS and ESM outputs)
• yarn exec eslint packages/ens-controller — clean
• yarn workspace @metamask/ens-controller run changelog:validate — passes
• yarn workspace @metamask/ens-controller run messenger-action-types:check — up to date
• yarn constraints and yarn lint:dependencies — pass

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	viem@​2.48.4 ⏵ 2.55.8				+1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm ox is 62.0% likely to have a medium risk anomaly Notes: This fragment is primarily a CPU-intensive proof-of-work/salt-mining implementation using worker-thread parallelism plus an async fallback. It includes input validation, structured error propagation, and abort handling, and it does not show classic malware behaviors (no network/file/process/persistence or dynamic execution in the snippet). The dominant security concern is potential resource-exhaustion/DoS if untrusted callers can control workerCount/count/chunkSize, and secondary concern is leakage of progress/rate metrics into application callbacks/logging. Overall: likely intended PoW functionality but potentially abuse-prone in the wrong threat model. Confidence: 0.62 Severity: 0.50 From: ? → npm/viem@2.55.8 → npm/ox@0.14.32 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.32. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 60.0% likely to have a medium risk anomaly Notes: This module implements parallel WebAssembly computation using Node worker_threads and browser Web Workers, including dynamic worker script execution (Node eval:true and browser Blob URL). It communicates only via postMessage and does not show network exfiltration, credential theft, or persistence within this snippet. The main risks are supply-chain/execution boundary concerns from dynamic worker code and potential CPU/DoS impact if the mining parameters are attacker-influenced. Overall: likely intended for compute work, but should be reviewed and guarded with strict input controls and hardened worker creation. Confidence: 0.60 Severity: 0.60 From: ? → npm/viem@2.55.8 → npm/ox@0.14.32 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.32. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 70.0% likely to have a medium risk anomaly Notes: This dependency is a cross-platform worker harness that executes embedded WebAssembly to perform a “salt mining” computation and returns progress/results to the caller via message passing. In this file, there is no clear evidence of classic malware behaviors such as network exfiltration, credential theft, or filesystem/system sabotage. The most notable supply-chain/security concerns are dynamic code execution patterns (Node Worker with eval:true and browser Blob URL worker scripts) and the potential for CPU-intensive abuse (computational mining-like workload) if invoked in an unauthorized context or with adversarial parameters. Overall: moderate security risk driven by execution surface and availability impact rather than direct data-stealing. Confidence: 0.70 Severity: 0.60 From: ? → npm/viem@2.55.8 → npm/ox@0.14.32 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.32. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 66.0% likely to have a medium risk anomaly Notes: This dependency is a worker-based “salt mining”/proof-of-work compute engine that loads an embedded WebAssembly payload and runs a CPU-intensive loop in Node worker_threads or browser Web Workers, communicating progress and results via postMessage. There is no direct evidence in this fragment of network exfiltration, credential access, persistence, or system modification. The main security concerns are (1) dynamic worker code execution (Node worker eval:true and browser Blob URL execution) and (2) cryptomining-like resource consumption that can be abused for CPU exhaustion. The embedded WASM module itself should be reviewed to confirm it contains only the expected computation and no hidden side effects. Confidence: 0.66 Severity: 0.55 From: ? → npm/viem@2.55.8 → npm/ox@0.14.32 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.32. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 62.0% likely to have a medium risk anomaly Notes: This fragment is primarily a CPU-intensive proof-of-work/salt-mining implementation using worker-thread parallelism plus an async fallback. It includes input validation, structured error propagation, and abort handling, and it does not show classic malware behaviors (no network/file/process/persistence or dynamic execution in the snippet). The dominant security concern is potential resource-exhaustion/DoS if untrusted callers can control workerCount/count/chunkSize, and secondary concern is leakage of progress/rate metrics into application callbacks/logging. Overall: likely intended PoW functionality but potentially abuse-prone in the wrong threat model. Confidence: 0.62 Severity: 0.50 From: ? → npm/@myx-trade/sdk@0.1.265 → npm/ox@0.14.33 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 60.0% likely to have a medium risk anomaly Notes: This module implements parallel WebAssembly computation using Node worker_threads and browser Web Workers, including dynamic worker script execution (Node eval:true and browser Blob URL). It communicates only via postMessage and does not show network exfiltration, credential theft, or persistence within this snippet. The main risks are supply-chain/execution boundary concerns from dynamic worker code and potential CPU/DoS impact if the mining parameters are attacker-influenced. Overall: likely intended for compute work, but should be reviewed and guarded with strict input controls and hardened worker creation. Confidence: 0.60 Severity: 0.60 From: ? → npm/@myx-trade/sdk@0.1.265 → npm/ox@0.14.33 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 70.0% likely to have a medium risk anomaly Notes: This dependency is a cross-platform worker harness that executes embedded WebAssembly to perform a “salt mining” computation and returns progress/results to the caller via message passing. In this file, there is no clear evidence of classic malware behaviors such as network exfiltration, credential theft, or filesystem/system sabotage. The most notable supply-chain/security concerns are dynamic code execution patterns (Node Worker with eval:true and browser Blob URL worker scripts) and the potential for CPU-intensive abuse (computational mining-like workload) if invoked in an unauthorized context or with adversarial parameters. Overall: moderate security risk driven by execution surface and availability impact rather than direct data-stealing. Confidence: 0.70 Severity: 0.60 From: ? → npm/@myx-trade/sdk@0.1.265 → npm/ox@0.14.33 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ox is 66.0% likely to have a medium risk anomaly Notes: This dependency is a worker-based “salt mining”/proof-of-work compute engine that loads an embedded WebAssembly payload and runs a CPU-intensive loop in Node worker_threads or browser Web Workers, communicating progress and results via postMessage. There is no direct evidence in this fragment of network exfiltration, credential access, persistence, or system modification. The main security concerns are (1) dynamic worker code execution (Node worker eval:true and browser Blob URL execution) and (2) cryptomining-like resource consumption that can be abused for CPU exhaustion. The embedded WASM module itself should be reviewed to confirm it contains only the expected computation and no hidden side effects. Confidence: 0.66 Severity: 0.55 From: ? → npm/@myx-trade/sdk@0.1.265 → npm/ox@0.14.33 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ox@0.14.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm viem is 75.0% likely to have a medium risk anomaly Notes: The code implements a cross-chain deposit flow with proper validations, artifact reads, and on-chain interactions. There is no evidence of hidden backdoors, data exfiltration, or malware. The main security considerations relate to token approval logic and correct configuration of flags to avoid granting excessive allowances. Overall, the module appears legitimate for a bridge deposit flow, with moderate risk primarily around configuration of approvals and correct handling of gas/fees. Confidence: 0.75 Severity: 0.60 From: ? → npm/@myx-trade/sdk@0.1.265 → npm/viem@2.55.10 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/viem@2.55.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm viem is 75.0% likely to have a medium risk anomaly Notes: The code implements a cross-chain deposit flow with proper validations, artifact reads, and on-chain interactions. There is no evidence of hidden backdoors, data exfiltration, or malware. The main security considerations relate to token approval logic and correct configuration of flags to avoid granting excessive allowances. Overall, the module appears legitimate for a bridge deposit flow, with moderate risk primarily around configuration of approvals and correct handling of gas/fees. Confidence: 0.75 Severity: 0.60 From: packages/ens-controller/package.json → npm/viem@2.55.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/viem@2.55.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Migrates @metamask/ens-controller from ethers v5 provider-based ENS lookups to viem’s ENS actions to perform reverse resolution via the ENS Universal Resolver (ENSIP-23), aligning the controller with the ENSv2 migration path.

Changes:

• Replace ethers Web3Provider.lookupAddress/resolveName with viem getEnsName/getEnsAddress and create a viem client from the existing EIP-1193 provider.
• Update DEFAULT_ENS_NETWORK_MAP to Universal Resolver addresses for Mainnet and Sepolia only (removing deprecated/shut-down networks).
• Update tests/mocks to use viem/actions, and document the breaking change in the package changelog.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
yarn.lock	Removes @ethersproject/providers, adds viem@2.55.8, and updates transitive versions (including another viem range).
packages/ens-controller/src/EnsController.ts	Switches ENS reverse/forward resolution to viem and configures a viem client from the network provider.
packages/ens-controller/src/EnsController.test.ts	Replaces ethers mocks with viem/actions mocks; updates assertions and adds a new chain-unsupported test.
packages/ens-controller/package.json	Drops ethers providers dependency and pins viem to 2.55.8.
packages/ens-controller/CHANGELOG.md	Adds Unreleased entries documenting the migration and breaking change.
eslint-suppressions.json	Updates suppression count due to test changes.

Suppressed comments (1)

packages/ens-controller/src/EnsController.test.ts:625

• Typo in test name: “through” should be “throws”.

    it('should fail if resolveName through an error', async () => {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.