feat: [MUSD-445] complete money account upgrade controller flow

[Jwhiles]

Description

This PR upgrades to the final version of the money account upgrade controller - which can in theory run through the entire chomp upgrade flow.

Things that we've changed in this PR in addition to bumping the package

1. Updated the config that is passed into the upgrade controller
2. Added a check which ensures the monad network is enabled before we start the upgrade process. This is necessary, because monad is enabled by default

TODO

1. This PR builds on @MoMannn's PR chore: add monad mUSD #29897 - and it should be merged first.
2. This PR requires us to change the vault config feature flag before it will function correctly.
3. Chomp returns a 500 on the final step of the upgrade process. We need to figure out why this is happening and fix it
4. We need to merge and publish this core pr and update the preview packages that are currently used in this branch to the real published updates.

Changelog

CHANGELOG entry: Update to final version of money account upgrade controller

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

High Risk
High risk because it changes on-chain transaction construction (deposit/withdraw asset address selection) and rewires the Money Account upgrade bootstrap to auto-add networks and use a new controller init contract, which can break upgrade/deposit flows if config or chain data is wrong.

Overview
Money Account upgrade bootstrapping is refactored to match the new @metamask/money-account-upgrade-controller API: initialization now reads chainId/boringVault from the moneyAccountVaultConfig feature flag (instead of CHOMP service details + DeleGator env) and passes a new object payload to controller.init.

Adds a pre-init guard to ensure the vault chain exists in NetworkController: if missing, it auto-adds the chain from PopularList (with explicit error handling when not found), and corresponding unit tests were updated/expanded.

Moves Money Account deposit asset selection to mUSD: getMoneyAccountDepositAssetAddress now resolves via MUSD_TOKEN_ADDRESS_BY_CHAIN (throwing if absent) rather than using a temporary hardcoded USDC address, and mUSD constants/config were extended for Monad (addresses/asset IDs) along with updated dev vault config + dependency bumps (money-account-upgrade-controller and chomp-api-service).

^{Reviewed by Cursor Bugbot for commit 2b4cc57. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​metamask/​chomp-api-service@​3.0.0 ⏵ 3.1.0	+1		+1	+2
	npm/​@​metamask/​money-account-upgrade-controller@​1.3.1 ⏵ 2.0.1	+1		+2	+2

View full report

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: SmokeAccounts, SmokeConfirmations, SmokeIdentity, SmokeNetworkAbstractions, SmokeNetworkExpansion, SmokeSwap, SmokeStake, SmokeWalletPlatform, SmokeMoney, SmokePerps, SmokeMultiChainAPI, SmokePredictions, SmokeSeedlessOnboarding, SmokeBrowser, SmokeSnaps
• Selected Performance tags: @PerformanceAccountList, @PerformanceOnboarding, @PerformanceLogin, @PerformanceSwaps, @PerformanceLaunch, @PerformanceAssetLoading, @PerformancePredict, @PerformancePreps
• Risk Level: high
• AI Confidence: 100%

click to see 🤖 AI reasoning details

E2E Test Selection:
Hard rule (controller-version-update): @MetaMask controller package version updated in package.json: @metamask/money-account-upgrade-controller. Running all tests.

Performance Test Selection:
Hard rule (controller-version-update): @MetaMask controller package version updated in package.json: @metamask/money-account-upgrade-controller. Running all tests.

View GitHub Actions results

[sonarqubecloud]

Quality Gate failed

Failed conditions
75.8% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud