fix: eip712 domains not being valid for gen 5 devices

[montelaidev]

Description

EIP-712 signing fails on Ledger Gen5 devices with "the signature doesn't match the right address" when the payload omits the EIP712Domain type (common — ethers-style dapps infer it from the domain object keys).
The missing type gets defaulted to an empty list, so both the device and local verification hash an empty domain struct instead of the real domain values. Gen5 devices handle this undefined case differently than older devices, causing the signature check to fail.

Fix: derive the EIP712Domain type from the domain object keys before signing and verification. Payloads that already declare it are untouched — zero behavior change for well-formed input.

---

Note

Medium Risk
Changes EIP-712 normalization and signature recovery for payloads missing EIP712Domain; well-formed payloads are untouched, but incorrect derivation could affect permit/NFT signing on hardware wallets.

Overview
Fixes Ledger Gen5 failures when dapps send EIP-712 payloads with a populated domain but no types.EIP712Domain (common ethers-style shape). Without this, @metamask/eth-sig-util sanitization treats the domain type as empty, so the host hashes a zero-field domain while the device behaves differently—leading to “The signature doesn't match the right address”.

Adds withDerivedEip712Domain, which builds EIP712Domain from canonical domain keys (in contract order, skipping null/undefined and non-standard keys) when the type is missing or empty; payloads that already declare it are returned unchanged. LedgerKeyring.signTypedData runs this normalization before sanitizeData, sends the derived types to the device, and verifies with the same normalized data. The helper is re-exported from the package entry; unit and keyring tests cover NFT permit-style payloads and on-chain domain separator alignment.

^{Reviewed by Cursor Bugbot for commit c99a1a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[montelaidev]

@metamaskbot publish-preview

[github-actions]

Preview builds have been published. See these instructions (from the core monorepo) for more information about preview builds.

Expand for full list of packages and versions.

{
  "@metamask-previews/account-api": "2.0.0-de95397",
  "@metamask-previews/hw-wallet-sdk": "1.0.0-de95397",
  "@metamask-previews/keyring-api": "24.1.0-de95397",
  "@metamask-previews/eth-hd-keyring": "15.0.0-de95397",
  "@metamask-previews/eth-ledger-bridge-keyring": "13.0.2-de95397",
  "@metamask-previews/eth-money-keyring": "4.0.0-de95397",
  "@metamask-previews/eth-qr-keyring": "3.0.0-de95397",
  "@metamask-previews/eth-simple-keyring": "13.0.0-de95397",
  "@metamask-previews/eth-trezor-keyring": "11.0.0-de95397",
  "@metamask-previews/keyring-internal-api": "12.1.0-de95397",
  "@metamask-previews/keyring-internal-snap-client": "11.1.0-de95397",
  "@metamask-previews/keyring-sdk": "3.1.0-de95397",
  "@metamask-previews/eth-snap-keyring": "24.1.0-de95397",
  "@metamask-previews/keyring-snap-client": "10.0.0-de95397",
  "@metamask-previews/keyring-snap-sdk": "10.0.0-de95397",
  "@metamask-previews/keyring-utils": "5.0.0-de95397"
}