fix: bring back exception if invalid address passed in eth_accounts

app/scripts/controllers/permissions/specifications.js

@@ -192,3 +192,72 @@ export const unrestrictedMethods = Object.freeze([
   'metamaskinstitutional_openAddHardwareWallet',
   ///: END:ONLY_INCLUDE_IF
 ]);
+
+/**
+ * Validates the accounts associated with a caveat. In essence, ensures that
+ * the accounts value is an array of non-empty strings, and that each string
+ * corresponds to a PreferencesController identity.
+ *
+ * @param {string[]} accounts - The accounts associated with the caveat.
+ * @param {() => Record<string, import('@metamask/keyring-internal-api').InternalAccount>} getInternalAccounts -
+ * Gets all AccountsController InternalAccounts.
+ * TODO: Remove this function once permission refactor/factory differ work is merged into main
+ */
+export function validateCaveatAccounts(accounts, getInternalAccounts) {
+  if (!Array.isArray(accounts) || accounts.length === 0) {
+    throw new Error(
+      `${PermissionNames.eth_accounts} error: Expected non-empty array of Ethereum addresses.`,
+    );
+  }
+
+  const internalAccounts = getInternalAccounts();
+  accounts.forEach((address) => {
+    if (!address || typeof address !== 'string') {
+      throw new Error(
+        `${PermissionNames.eth_accounts} error: Expected an array of Ethereum addresses. Received: "${address}".`,
+      );
+    }
+
+    if (
+      !internalAccounts.some(
+        (internalAccount) =>
+          internalAccount.address.toLowerCase() === address.toLowerCase(),
+      )
+    ) {
+      throw new Error(
+        `${PermissionNames.eth_accounts} error: Received unrecognized address: "${address}".`,
+      );
+    }
+  });
+}
+
+/**
+ * Validates the networks associated with a caveat. Ensures that
+ * the networks value is an array of valid chain IDs.
+ *
+ * @param {string[]} chainIdsForCaveat - The list of chain IDs to validate.
+ * @param {function(string): string} findNetworkClientIdByChainId - Function to find network client ID by chain ID.
+ * @throws {Error} If the chainIdsForCaveat is not a non-empty array of valid chain IDs.
+ * TODO: Remove this function once permission refactor/factory differ work is merged into main
+ */
+export function validateCaveatNetworks(
+  chainIdsForCaveat,
+  findNetworkClientIdByChainId,
+) {
+  if (!Array.isArray(chainIdsForCaveat) || chainIdsForCaveat.length === 0) {
+    throw new Error(
+      `${PermissionNames.permittedChains} error: Expected non-empty array of chainIds.`,
+    );
+  }
+
+  chainIdsForCaveat.forEach((chainId) => {
+    try {
+      findNetworkClientIdByChainId(chainId);
+    } catch (e) {
+      console.error(e);
+      throw new Error(
+        `${PermissionNames.permittedChains} error: Received unrecognized chainId: "${chainId}". Please try adding the network first via wallet_addEthereumChain.`,
+      );
+    }
+  });
+}

app/scripts/metamask-controller.js

@@ -316,6 +316,8 @@ import {
   NOTIFICATION_NAMES,
   unrestrictedMethods,
   PermissionNames,
+  validateCaveatAccounts,
+  validateCaveatNetworks,
 } from './controllers/permissions';
 import { MetaMetricsDataDeletionController } from './controllers/metametrics-data-deletion/metametrics-data-deletion';
 import { DataDeletionService } from './services/data-deletion-service';
@@ -5292,6 +5294,18 @@ export default class MetamaskController extends EventEmitter {
         (caveat) => caveat.type === CaveatTypes.restrictReturnedAccounts,
       )?.value ?? [];
 
+    validateCaveatAccounts(
+      requestedAccounts,
+      this.accountsController.listAccounts.bind(this.accountsController),
+    );
+    console.log('i passed here');
+    validateCaveatNetworks(
+      requestedChains,
+      this.networkController.findNetworkClientIdByChainId.bind(
+        this.networkController,
+      ),
+    );
+
     const newCaveatValue = {
       requiredScopes: {},
       optionalScopes: {