MetaMask · jeremytsng · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026 · Battambang
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Reveal and persist the wallet's own output scripts when signing a PSBT, so change from partner-supplied templates is always covered by routine sync ([#225](https://github.com/MetaMask/internal-snaps/pull/225))
 - Ensure certain errors are stringified correctly ([#179](https://github.com/MetaMask/internal-snaps/pull/179))
 
 ## [2.0.1]

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/internal-snaps.git"
   },
   "source": {
-    "shasum": "G3MeXJ/FUoBzk6fXEO0VoNvvkQn+9BwqGHeOTUEYRHk=",
+    "shasum": "nSjk7+KIcnigO131JD3KQEwj3RrOQhdcnOOlUOqo4Z0=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

@@ -97,6 +97,15 @@ export type BitcoinAccount = {
    */
   revealNextAddress(): AddressInfo;
 
+  /**
+   * Reveals addresses up to and including the derivation index of `script` if it belongs to
+   * this wallet and lies beyond the revealed set.
+   *
+   * @param script - the script to reveal up to.
+   * @returns true if new addresses were revealed.
+   */
+  revealToScript(script: ScriptBuf): boolean;
+
   /**
    * Start a full scan.
    *
@@ -222,20 +231,17 @@ export type BitcoinAccount = {
   applyUnconfirmedTx(tx: Transaction, lastSeen: number): void;
 };
 
-export const AccountCapability = {
-  SignPsbt: 'signPsbt',
-  ComputeFee: 'computeFee',
-  FillPsbt: 'fillPsbt',
-  BroadcastPsbt: 'broadcastPsbt',
-  SendTransfer: 'sendTransfer',
-  GetUtxo: 'getUtxo',
-  ListUtxos: 'listUtxos',
-  PublicDescriptor: 'publicDescriptor',
-  SignMessage: 'signMessage',
-} as const;
-
-export type AccountCapability =
-  (typeof AccountCapability)[keyof typeof AccountCapability];
+export enum AccountCapability {
+  SignPsbt = 'signPsbt',
+  ComputeFee = 'computeFee',
+  FillPsbt = 'fillPsbt',
+  BroadcastPsbt = 'broadcastPsbt',
+  SendTransfer = 'sendTransfer',
+  GetUtxo = 'getUtxo',
+  ListUtxos = 'listUtxos',
+  PublicDescriptor = 'publicDescriptor',
+  SignMessage = 'signMessage',
+}
 
 /**
  * BitcoinAccountRepository is a repository that manages Bitcoin accounts.
@@ -335,22 +341,18 @@ export type BitcoinAccountRepository = {
   getFrozenUTXOs(id: string): Promise<string[]>;
 };
 
-export const Purpose = {
-  Legacy: 44,
-  Segwit: 49,
-  NativeSegwit: 84,
-  Taproot: 86,
-  Multisig: 45,
-} as const;
-
-export type Purpose = (typeof Purpose)[keyof typeof Purpose];
-
-export const Slip44 = {
-  Bitcoin: 0,
-  Testnet: 1,
-} as const;
+export enum Purpose {
+  Legacy = 44,
+  Segwit = 49,
+  NativeSegwit = 84,
+  Taproot = 86,
+  Multisig = 45,
+}
 
-export type Slip44 = (typeof Slip44)[keyof typeof Slip44];
+export enum Slip44 {
+  Bitcoin = 0,
+  Testnet = 1,
+}
 
 export const addressTypeToPurpose: Record<AddressType, Purpose> = {
   p2pkh: Purpose.Legacy,

@@ -156,6 +156,20 @@ export class BdkAccountAdapter implements BitcoinAccount {
     return this.#wallet.reveal_next_address('external');
   }
 
+  revealToScript(script: ScriptBuf): boolean {
+    const indexed = this.#wallet.derivation_of_spk(script);
+    if (!indexed) {
+      return false;
+    }
+    const keychain = indexed[0];
+    const index = indexed[1];
+    const lastRevealed = this.#wallet.derivation_index(keychain);
+    if (lastRevealed !== undefined && lastRevealed >= index) {
+      return false;
+    }
+    return this.#wallet.reveal_addresses_to(keychain, index).length > 0;
+  }
+
   startFullScan(): FullScanRequest {
     return this.#wallet.start_full_scan();
   }

@@ -167,6 +167,10 @@ export class StoredAccountAdapter implements BitcoinAccount {
     return this.#unsupported();
   }
 
+  revealToScript(_script: ScriptBuf): boolean {
+    return this.#unsupported();
+  }
+
   sentAndReceived(_tx: Transaction): [Amount, Amount] {
     return this.#unsupported();
   }

@@ -1279,6 +1279,74 @@ describe('AccountUseCases', () => {
       expect(txid).toBe(mockTxid);
       expect(psbt).toBe('mockSignedPsbt');
     });
+
+    it('reveals and persists own output scripts after signing (broadcast: false)', async () => {
+      mockAccount.isMine.mockReturnValue(true);
+      mockAccount.revealToScript.mockReturnValue(true);
+
+      await useCases.signPsbt('account-id', mockPsbt, 'metamask', {
+        fill: false,
+        broadcast: false,
+      });
+
+      expect(mockAccount.revealToScript).toHaveBeenCalledWith(
+        mockOutput.script_pubkey,
+      );
+      expect(mockRepository.update).toHaveBeenCalledWith(mockAccount);
+    });
+
+    it('reveals and persists own output scripts after signing (broadcast: true)', async () => {
+      mockAccount.getTransaction.mockReturnValue(mockWalletTx);
+      mockAccount.isMine.mockReturnValue(true);
+      mockAccount.revealToScript.mockReturnValue(true);
+
+      await useCases.signPsbt('account-id', mockPsbt, 'metamask', {
+        fill: false,
+        broadcast: true,
+      });
+
+      expect(mockAccount.revealToScript).toHaveBeenCalledWith(
+        mockOutput.script_pubkey,
+      );
+      expect(mockRepository.update).toHaveBeenCalledWith(mockAccount);
+    });
+
+    it('does not persist when no output scripts get revealed (broadcast: false)', async () => {
+      mockAccount.isMine.mockReturnValue(true);
+      mockAccount.revealToScript.mockReturnValue(false);
+
+      await useCases.signPsbt('account-id', mockPsbt, 'metamask', {
+        fill: false,
+        broadcast: false,
+      });
+
+      expect(mockRepository.update).not.toHaveBeenCalled();
+    });
+
+    it('only persists once via #broadcast when no output scripts get revealed (broadcast: true)', async () => {
+      mockAccount.getTransaction.mockReturnValue(mockWalletTx);
+      mockAccount.isMine.mockReturnValue(true);
+      mockAccount.revealToScript.mockReturnValue(false);
+
+      await useCases.signPsbt('account-id', mockPsbt, 'metamask', {
+        fill: false,
+        broadcast: true,
+      });
+
+      expect(mockRepository.update).toHaveBeenCalledTimes(1);
+      expect(mockRepository.update).toHaveBeenCalledWith(mockAccount);
+    });
+
+    it('does not call revealToScript for outputs that are not isMine', async () => {
+      mockAccount.isMine.mockReturnValue(false);
+
+      await useCases.signPsbt('account-id', mockPsbt, 'metamask', {
+        fill: false,
+        broadcast: false,
+      });
+
+      expect(mockAccount.revealToScript).not.toHaveBeenCalled();
+    });
   });
 
   describe('fillPsbt', () => {
@@ -1372,6 +1440,7 @@ describe('AccountUseCases', () => {
       expect(mockTxBuilder.drainToByScript).toHaveBeenCalledWith(
         mockOutput.script_pubkey,
       );
+      expect(mockAccount.revealToScript).not.toHaveBeenCalled();
       expect(psbt).toBe(mockFilledPsbt);
     });
 
@@ -1690,6 +1759,7 @@ describe('AccountUseCases', () => {
         mockOutput.script_pubkey,
       );
       expect(mockTxBuilder.addRecipientByScript).not.toHaveBeenCalled();
+      expect(mockAccount.revealToScript).not.toHaveBeenCalled();
       expect(fee).toBe(mockFee);
     });
 

@@ -567,6 +567,16 @@ export class AccountUseCases {
       : psbt;
     const signedPsbt = account.sign(psbtToSign);
 
+    let revealed = false;
+    for (const txout of psbtToSign.unsigned_tx.output) {
+      if (account.isMine(txout.script_pubkey)) {
+        revealed = account.revealToScript(txout.script_pubkey) || revealed;
+      }
+    }
+    if (revealed) {
+      await this.#repository.update(account);
+    }
+
     if (options.broadcast) {
       const psbtString = signedPsbt.toString();
       const tx = account.extractTransaction(signedPsbt);