jpuri · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Always request non-atomic quotes when the transaction's `from` keyring requires MFA ([#11389](https://github.com/MetaMask/core/pull/11389))
+  - An atomic quote embeds the target calls, which needs a fresh delegation signature per quote. On an MFA keyring every refresh of an open amount screen would cost the user a confirmation.
+  - The keyring is read from `transaction.txParams.from`, the account that signs the delegation, rather than the quote request's payer account.
+  - Resolved when building quote requests, so it applies to every strategy and to both the max and non-max quote paths.
+
 ## [31.1.0]
 
 ### Added

@@ -1,3 +1,4 @@
+import type { KeyringTypes } from '@metamask/keyring-controller';
 import { TransactionType } from '@metamask/transaction-controller';
 import type { Hex } from '@metamask/utils';
 
@@ -12,6 +13,29 @@ export const PERPS_DEPOSIT_TYPES: TransactionType[] = [
   TransactionType.perpsDepositAndOrder,
 ];
 
+/**
+ * Keyring types that support EIP-7702 authorization signing.
+ * Hardware wallets, snap keyrings, and custody keyrings are excluded.
+ */
+export const KEYRING_TYPES_SUPPORTING_7702: `${KeyringTypes}`[] = [
+  'HD Key Tree',
+  'Simple Key Pair',
+  'Money Keyring',
+];
+
+/**
+ * Keyring types whose signing requires multi-factor authentication.
+ *
+ * The MPC keyring splits its key across factors, so every signature it
+ * produces costs the user an MFA confirmation. Quote flows that would
+ * otherwise sign once per quote must avoid doing so for these accounts.
+ *
+ * The SRP-derived `Money Keyring` signs locally and is deliberately absent.
+ */
+export const KEYRING_TYPES_REQUIRING_MFA: `${KeyringTypes}`[] = [
+  'MPC Money Keyring',
+];
+
 export const CHAIN_ID_ARBITRUM = '0xa4b1' as Hex;
 export const CHAIN_ID_MAINNET = '0x1' as Hex;
 export const CHAIN_ID_POLYGON = '0x89' as Hex;

@@ -10,7 +10,7 @@ import type {
   TransactionPayControllerMessenger,
   TransactionPayQuote,
 } from '../types.js';
-import { accountSupports7702 } from '../utils/7702.js';
+import { accountSupports7702 } from '../utils/account.js';
 import { prefixError } from '../utils/error-prefix.js';
 import { getStrategyByName } from '../utils/strategy.js';
 import { updateTransaction } from '../utils/transaction.js';

@@ -22,7 +22,7 @@ import type {
   TransactionPayControllerMessenger,
   TransactionPayQuote,
 } from '../../types.js';
-import { accountSupports7702 } from '../../utils/7702.js';
+import { accountSupports7702 } from '../../utils/account.js';
 import { getPayStrategiesConfig } from '../../utils/feature-flags.js';
 import { getGasBuffer } from '../../utils/feature-flags.js';
 import {

@@ -10,6 +10,7 @@ import type {
   TransactionPayControllerMessenger,
   TransactionPayQuote,
 } from '../../types.js';
+import { accountRequiresMfa } from '../../utils/account.js';
 import { prefixError } from '../../utils/error-prefix.js';
 import { isAtomicMaxEnabled } from '../../utils/feature-flags.js';
 import {
@@ -118,6 +119,14 @@ export async function getRelayMaxQuote(
     return quote;
   }
 
+  // A request whose signing keyring requires MFA arrives here already cleared
+  // to `atomic: false` by `updateQuotes`. Promotion ignores that hint and sets
+  // `atomic: true` regardless, which would embed the target calls again and
+  // reintroduce the per-quote delegation signature.
+  if (accountRequiresMfa(messenger, transaction.txParams.from)) {
+    return quote;
+  }
+
   try {
     const promotedQuote = await getAtomicMaxQuote({
       amount: quote.original.details.currencyOut.amount,

@@ -1,4 +1,5 @@
 import { toHex } from '@metamask/controller-utils';
+import type { KeyringControllerGetStateAction } from '@metamask/keyring-controller';
 import { TransactionType } from '@metamask/transaction-controller';
 import type {
   GasFeeToken,
@@ -205,6 +206,12 @@ describe('Relay Quotes Utils', () => {
     polymarketGetDepositWalletAddressMock,
   } = getMessengerMock();
 
+  // The destructure above widens the mocks to `any`. Re-type the keyring mock
+  // so new assertions do not add `no-unsafe-call` violations to this file.
+  const keyringStateMock = getKeyringControllerStateMock as MockedFunction<
+    KeyringControllerGetStateAction['handler']
+  >;
+
   messenger.registerActionHandler(
     'TransactionPayController:getAmountData',
     getAmountDataMock,
@@ -4181,6 +4188,71 @@ describe('Relay Quotes Utils', () => {
         expect(successfulFetchMock).toHaveBeenCalledTimes(1);
       });
 
+      it('does not attempt promotion when the signing keyring requires MFA', async () => {
+        mockRelayResponses();
+        // `updateQuotes` already cleared `atomic` for this account, but
+        // promotion ignores that hint, so the guard has to re-check here.
+        // `txParams.from` signs the delegation an atomic quote needs, so the
+        // MFA check reads that rather than the request's payer account.
+        keyringStateMock.mockReturnValue({
+          isUnlocked: true,
+          keyrings: [
+            {
+              type: 'MPC Money Keyring',
+              accounts: [MONEY_ACCOUNT_MAX_TRANSACTION.txParams.from],
+              metadata: { id: 'mpc-money-keyring', name: 'MPC Money Keyring' },
+            },
+          ],
+        });
+
+        const result = await getRelayQuotes({
+          accountSupports7702: true,
+          from: FROM_MOCK,
+          messenger,
+          requests: [MONEY_ACCOUNT_MAX_REQUEST],
+          transaction: MONEY_ACCOUNT_MAX_TRANSACTION,
+        });
+
+        expect(result[0].request.atomic).toBe(false);
+        expect(getAmountDataMock).not.toHaveBeenCalled();
+        expect(successfulFetchMock).toHaveBeenCalledTimes(1);
+
+        // The real guarantee: no target calls embedded, so no delegation is
+        // signed per quote.
+        const [, requestInit] = successfulFetchMock.mock.calls[0] as [
+          unknown,
+          RequestInit | undefined,
+        ];
+        const body = JSON.parse(requestInit?.body as string) as {
+          txs?: unknown;
+        };
+        expect(body.txs).toBeUndefined();
+      });
+
+      it('promotes when a non-MFA keyring holds the signing account', async () => {
+        mockRelayResponses();
+        keyringStateMock.mockReturnValue({
+          isUnlocked: true,
+          keyrings: [
+            {
+              type: 'Money Keyring',
+              accounts: [MONEY_ACCOUNT_MAX_TRANSACTION.txParams.from],
+              metadata: { id: 'money-keyring', name: 'Money Keyring' },
+            },
+          ],
+        });
+
+        const result = await getRelayQuotes({
+          accountSupports7702: true,
+          from: FROM_MOCK,
+          messenger,
+          requests: [MONEY_ACCOUNT_MAX_REQUEST],
+          transaction: MONEY_ACCOUNT_MAX_TRANSACTION,
+        });
+
+        expect(result[0].request.atomic).toBe(true);
+      });
+
       it('does not attempt promotion when the discovery quote is not subsidized', async () => {
         const unsubsidizedQuote = buildRelayQuote({ subsidizedAmountUsd: '0' });
         successfulFetchMock.mockResolvedValue({

@@ -18,7 +18,7 @@ import type {
   TransactionPayControllerMessenger,
   TransactionPayQuote,
 } from '../../types.js';
-import { accountSupports7702 } from '../../utils/7702.js';
+import { accountSupports7702 } from '../../utils/account.js';
 import { prefixError } from '../../utils/error-prefix.js';
 import {
   getFeatureFlags,

@@ -21,7 +21,7 @@ import type {
   TransactionPayControllerMessenger,
   TransactionPayQuote,
 } from '../../types.js';
-import { accountSupports7702 } from '../../utils/7702.js';
+import { accountSupports7702 } from '../../utils/account.js';
 import {
   getServerPollingInterval,
   getServerPollingTimeout,

@@ -10,7 +10,6 @@ import type {
   KeyringControllerGetStateAction,
   KeyringControllerSignTypedMessageAction,
   KeyringControllerUnlockEvent,
-  KeyringTypes,
 } from '@metamask/keyring-controller';
 import type { Messenger } from '@metamask/messenger';
 import type { NetworkControllerFindNetworkClientIdByChainIdAction } from '@metamask/network-controller';
@@ -252,16 +251,6 @@ export type TransactionPayControllerMessenger = Messenger<
   TransactionPayControllerEvents | AllowedEvents
 >;
 
-/**
- * Keyring types that support EIP-7702 authorization signing.
- * Hardware wallets, snap keyrings, and custody keyrings are excluded.
- */
-export const KEYRING_TYPES_SUPPORTING_7702: `${KeyringTypes}`[] = [
-  'HD Key Tree',
-  'Simple Key Pair',
-  'Money Keyring',
-];
-
 /** Options for the TransactionPayController. */
 export type TransactionPayControllerOptions = {
   /**

@@ -0,0 +1,69 @@
+import {
+  KEYRING_TYPES_REQUIRING_MFA,
+  KEYRING_TYPES_SUPPORTING_7702,
+} from '../constants.js';
+import type { TransactionPayControllerMessenger } from '../types.js';
+
+/**
+ * Check whether a given account supports EIP-7702 authorization signing.
+ *
+ * Looks up the account's keyring via `KeyringController:getState` and returns
+ * `true` only when the keyring type is in the supported list (HD Key Tree,
+ * Simple Key Pair). Hardware wallets, snap keyrings, and other types return
+ * `false`. Returns `false` when the keyring cannot be resolved.
+ *
+ * @param messenger - Controller messenger used to call KeyringController.
+ * @param account - The account address to check.
+ * @returns Whether the account supports EIP-7702.
+ */
+export function accountSupports7702(
+  messenger: TransactionPayControllerMessenger,
+  account: string,
+): boolean {
+  return hasKeyringOfType(messenger, account, KEYRING_TYPES_SUPPORTING_7702);
+}
+
+/**
+ * Check whether a given account's keyring requires multi-factor
+ * authentication to sign.
+ *
+ * Looks up the account's keyring via `KeyringController:getState` and returns
+ * `true` only when the keyring type is in {@link KEYRING_TYPES_REQUIRING_MFA}.
+ * Returns `false` when the keyring cannot be resolved, so an unknown account
+ * keeps the default behaviour rather than silently losing an optimisation.
+ *
+ * @param messenger - Controller messenger used to call KeyringController.
+ * @param account - The account address to check.
+ * @returns Whether signing with the account requires MFA.
+ */
+export function accountRequiresMfa(
+  messenger: TransactionPayControllerMessenger,
+  account: string,
+): boolean {
+  return hasKeyringOfType(messenger, account, KEYRING_TYPES_REQUIRING_MFA);
+}
+
+/**
+ * Check whether an account belongs to a keyring of one of the given types.
+ *
+ * @param messenger - Controller messenger used to call KeyringController.
+ * @param account - The account address to check.
+ * @param types - Keyring types to match against.
+ * @returns Whether a keyring of one of the given types holds the account.
+ */
+function hasKeyringOfType(
+  messenger: TransactionPayControllerMessenger,
+  account: string,
+  types: string[],
+): boolean {
+  const { keyrings } = messenger.call('KeyringController:getState');
+
+  return keyrings.some(
+    (keyring) =>
+      types.includes(keyring.type) &&
+      keyring.accounts.some(
+        (keyringAccount) =>
+          keyringAccount.toLowerCase() === account.toLowerCase(),
+      ),
+  );
+}