feat: Implement extra validations and alert when sending burn address in EVM transfer transactions (#21772)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

This PR aims to integrate extra validations and alert when sending to
burn address in EVM transfer transactions.
The list of the additions: 

1. Extend `isNative` check to check asset address when creating
transaction in send flow
2. Implement new "burnAddress" alert in transfer confirmations - this
will also be raised if nested transactions have burn address too.
3. Filter contacts that has burn address to prevent proceeding to
confirmations

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
4. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Implement extra validations and alert when sending burn
address in EVM transfer transactions

## **Related issues**

Fixes: MetaMask/MetaMask-planning#6124

## **Manual testing steps**

- You shouldn't be able to proceed to confirmation when you type
`0x0000000000000000000000000000000000000000` as recipient
- Only possibility is to get a confirmation with burn address alert is
from test-dapp
1. Go into the section where you can type recipient 
2. Type `0x0000000000000000000000000000000000000000` to "To" and type
something in "Amount" 0x123
3. When you create transaction, you should be able to see confirmation

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<img width="559" height="1062" alt="Screenshot 2025-10-28 at 11 46 23"
src="https://github.com/user-attachments/assets/b4a13f94-7131-4622-9fb5-db30fd38a56b"
/>

<img width="559" height="1062" alt="Screenshot 2025-10-28 at 11 46 17"
src="https://github.com/user-attachments/assets/6a792754-0721-45a0-87dd-80e129165c36"
/>


## **Pre-merge author checklist**

- [X] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [X] I've completed the PR template to the best of my ability
- [X] I’ve included tests if applicable
- [X] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [X] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds burn-address detection across send/confirm flows (alerting,
contact filtering, nested recipient support) and updates native-token
checks for transaction typing.
> 
> - **Confirmations**:
> - **Burn-address alert**: New `useBurnAddressAlert`,
`AlertKeys.BurnAddress`, `RowAlertKey.BurnAddress`, i18n strings, and
metrics mapping; integrated into `useConfirmationAlerts` and rendered in
`from-to-row` via `AlertRow`.
> - **Recipient detection**: Refactor `useTransferRecipient` and add
`useNestedTransactionTransferRecipients` to extract recipients from
nested transactions.
> - **UI**: `InfoRow` now supports optional `label` and renders
`labelChildren` without a label; added `labelContainerWithoutLabel`
style.
> - **Send flow**:
> - **Contacts**: `useContacts` filters out EVM burn addresses using
exported `LOWER_CASED_BURN_ADDRESSES`.
> - **Native token check**: `isNativeToken` now matches chain-specific
native token addresses (`getNativeTokenAddress`); used in
`prepareEVMTransaction`/`submitEvmTransaction` for typing.
> - **Validation/Utils**:
> - Export `LOWER_CASED_BURN_ADDRESSES` from `send-address-validations`
for reuse.
> - **Tests**: Added/updated unit tests for burn-address alert,
confirmation alerts aggregation, contacts filtering, recipient hooks
(incl. nested), and `generic.isNativeToken` behavior.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
2d0f1aa. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: OGPoyraz

app/components/Views/confirmations/components/UI/info-row/alert-row/constants.ts

@@ -2,6 +2,7 @@ export enum RowAlertKey {
   Amount = 'amount',
   AccountTypeUpgrade = 'accountTypeUpgrade',
   BatchedApprovals = 'batchedApprovals',
+  BurnAddress = 'burnAddress',
   Blockaid = 'blockaid',
   EstimatedFee = 'estimatedFee',
   PayWith = 'payWith',

app/components/Views/confirmations/components/UI/info-row/info-row.styles.ts

@@ -33,6 +33,9 @@ const styleSheet = (params: { theme: Theme }) => {
       paddingBottom: 8,
       paddingHorizontal: 8,
     },
+    labelContainerWithoutLabel: {
+      marginLeft: -4,
+    },
   });
 };
 

app/components/Views/confirmations/components/UI/info-row/info-row.tsx

@@ -15,7 +15,7 @@ import styleSheet from './info-row.styles';
 import CopyIcon from './copy-icon/copy-icon';
 
 export interface InfoRowProps {
-  label: string;
+  label?: string;
   children?: ReactNode | string;
   onTooltipPress?: () => void;
   tooltip?: ReactNode;
@@ -48,6 +48,7 @@ const InfoRow = ({
   withIcon,
 }: InfoRowProps) => {
   const { styles } = useStyles(styleSheet, {});
+  const hasLabel = Boolean(label);
 
   const ValueComponent =
     typeof children === 'string' ? (
@@ -62,7 +63,7 @@ const InfoRow = ({
         style={{ ...styles.container, ...style }}
         testID={testID ?? 'info-row'}
       >
-        {Boolean(label) && (
+        {hasLabel && (
           <View style={styles.labelContainer}>
             <Text variant={TextVariant.BodyMDMedium} color={variant}>
               {label}
@@ -77,6 +78,16 @@ const InfoRow = ({
             )}
           </View>
         )}
+        {!hasLabel && labelChildren && (
+          <View
+            style={{
+              ...styles.labelContainer,
+              ...styles.labelContainerWithoutLabel,
+            }}
+          >
+            {labelChildren}
+          </View>
+        )}
         {valueOnNewLine ? null : ValueComponent}
         {copyText && (
           <CopyIcon textToCopy={copyText ?? ''} color={IconColor.Muted} />

app/components/Views/confirmations/components/rows/transactions/from-to-row/from-to-row.tsx

@@ -12,7 +12,9 @@ import Icon, {
 } from '../../../../../../../component-library/components/Icons/Icon';
 import { NameType } from '../../../../../../UI/Name/Name.types';
 import { useTransferRecipient } from '../../../../hooks/transactions/useTransferRecipient';
+import { RowAlertKey } from '../../../UI/info-row/alert-row/constants';
 import InfoSection from '../../../UI/info-row/info-section';
+import AlertRow from '../../../UI/info-row/alert-row';
 import styleSheet from './from-to-row.styles';
 
 const FromToRow = () => {
@@ -54,12 +56,15 @@ const FromToRow = () => {
         </View>
 
         <View style={[styles.nameContainer, styles.rightNameContainer]}>
-          <Name
-            type={NameType.EthereumAddress}
-            value={toAddress}
-            variation={chainId}
-            maxCharLength={MAX_CHAR_LENGTH}
-          />
+          {/* Intentional empty label to trigger the alert row without a label */}
+          <AlertRow alertField={RowAlertKey.BurnAddress}>
+            <Name
+              type={NameType.EthereumAddress}
+              value={toAddress as string}
+              variation={chainId}
+              maxCharLength={MAX_CHAR_LENGTH}
+            />
+          </AlertRow>
         </View>
       </View>
     </InfoSection>

app/components/Views/confirmations/constants/alerts.ts

@@ -1,6 +1,7 @@
 export enum AlertKeys {
   BatchedUnusedApprovals = 'batched_unused_approvals',
   Blockaid = 'blockaid',
+  BurnAddress = 'burn_address',
   DomainMismatch = 'domain_mismatch',
   InsufficientBalance = 'insufficient_balance',
   InsufficientPayTokenBalance = 'insufficient_pay_token_balance',

app/components/Views/confirmations/hooks/alerts/useBurnAddressAlert.test.ts

@@ -0,0 +1,142 @@
+import { useBurnAddressAlert } from './useBurnAddressAlert';
+import { renderHookWithProvider } from '../../../../../util/test/renderWithProvider';
+import {
+  useNestedTransactionTransferRecipients,
+  useTransferRecipient,
+} from '../transactions/useTransferRecipient';
+import { Severity } from '../../types/alerts';
+import { AlertKeys } from '../../constants/alerts';
+import { RowAlertKey } from '../../components/UI/info-row/alert-row/constants';
+
+jest.mock('../transactions/useTransferRecipient');
+
+describe('useBurnAddressAlert', () => {
+  const BURN_ADDRESS_1 = '0x0000000000000000000000000000000000000000';
+  const BURN_ADDRESS_2 = '0x000000000000000000000000000000000000dead';
+  const NORMAL_ADDRESS = '0x1234567890123456789012345678901234567890';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (useTransferRecipient as jest.Mock).mockReturnValue(undefined);
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([]);
+  });
+
+  it('returns empty array when no recipient addresses are present', () => {
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toEqual([]);
+  });
+
+  it('returns empty array when transaction recipient is a normal address', () => {
+    (useTransferRecipient as jest.Mock).mockReturnValue(NORMAL_ADDRESS);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toEqual([]);
+  });
+
+  it('returns empty array when nested transaction recipients are normal addresses', () => {
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([
+      NORMAL_ADDRESS,
+      '0xabcdef1234567890abcdef1234567890abcdef12',
+    ]);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toEqual([]);
+  });
+
+  it('returns burn address alert when transaction recipient is first burn address', () => {
+    (useTransferRecipient as jest.Mock).mockReturnValue(BURN_ADDRESS_1);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0]).toMatchObject({
+      key: AlertKeys.BurnAddress,
+      field: RowAlertKey.BurnAddress,
+      severity: Severity.Danger,
+      isBlocking: false,
+    });
+    expect(result.current[0].title).toBeDefined();
+    expect(result.current[0].message).toBeDefined();
+  });
+
+  it('returns burn address alert when transaction recipient is second burn address', () => {
+    (useTransferRecipient as jest.Mock).mockReturnValue(BURN_ADDRESS_2);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0]).toMatchObject({
+      key: AlertKeys.BurnAddress,
+      field: RowAlertKey.BurnAddress,
+      severity: Severity.Danger,
+      isBlocking: false,
+    });
+  });
+
+  it('returns burn address alert when transaction recipient is burn address with uppercase letters', () => {
+    (useTransferRecipient as jest.Mock).mockReturnValue(
+      '0x0000000000000000000000000000000000000000'.toUpperCase(),
+    );
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0].key).toBe(AlertKeys.BurnAddress);
+  });
+
+  it('returns burn address alert when nested transaction contains burn address', () => {
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([
+      NORMAL_ADDRESS,
+      BURN_ADDRESS_1,
+    ]);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0]).toMatchObject({
+      key: AlertKeys.BurnAddress,
+      field: RowAlertKey.BurnAddress,
+      severity: Severity.Danger,
+      isBlocking: false,
+    });
+  });
+
+  it('returns burn address alert when nested transaction contains burn address with mixed case', () => {
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([
+      '0x000000000000000000000000000000000000dEaD',
+    ]);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0].key).toBe(AlertKeys.BurnAddress);
+  });
+
+  it('returns single burn address alert when both transaction and nested transactions contain burn addresses', () => {
+    (useTransferRecipient as jest.Mock).mockReturnValue(BURN_ADDRESS_1);
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([
+      BURN_ADDRESS_2,
+    ]);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0].key).toBe(AlertKeys.BurnAddress);
+  });
+
+  it('returns single burn address alert when nested transactions contain multiple burn addresses', () => {
+    (useNestedTransactionTransferRecipients as jest.Mock).mockReturnValue([
+      BURN_ADDRESS_1,
+      NORMAL_ADDRESS,
+      BURN_ADDRESS_2,
+    ]);
+
+    const { result } = renderHookWithProvider(() => useBurnAddressAlert());
+
+    expect(result.current).toHaveLength(1);
+    expect(result.current[0].key).toBe(AlertKeys.BurnAddress);
+  });
+});

app/components/Views/confirmations/hooks/alerts/useBurnAddressAlert.ts

@@ -0,0 +1,48 @@
+import { useMemo } from 'react';
+import { Alert, Severity } from '../../types/alerts';
+import { RowAlertKey } from '../../components/UI/info-row/alert-row/constants';
+import { AlertKeys } from '../../constants/alerts';
+import { LOWER_CASED_BURN_ADDRESSES } from '../../utils/send-address-validations';
+import { strings } from '../../../../../../locales/i18n';
+import {
+  useNestedTransactionTransferRecipients,
+  useTransferRecipient,
+} from '../transactions/useTransferRecipient';
+
+export function useBurnAddressAlert(): Alert[] {
+  const transactionMetaRecipient = useTransferRecipient();
+  const nestedTransactionRecipients = useNestedTransactionTransferRecipients();
+
+  const hasBurnAddressRecipient = useMemo(() => {
+    const hasBurnAddressInTransactionMetaRecipient =
+      LOWER_CASED_BURN_ADDRESSES.includes(
+        transactionMetaRecipient?.toLowerCase() ?? '',
+      );
+    const hasBurnAddressNestedTransactionRecipient =
+      nestedTransactionRecipients.some((recipient) =>
+        LOWER_CASED_BURN_ADDRESSES.includes(recipient.toLowerCase()),
+      );
+
+    return (
+      hasBurnAddressInTransactionMetaRecipient ||
+      hasBurnAddressNestedTransactionRecipient
+    );
+  }, [transactionMetaRecipient, nestedTransactionRecipients]);
+
+  return useMemo(() => {
+    if (!hasBurnAddressRecipient) {
+      return [];
+    }
+
+    return [
+      {
+        key: AlertKeys.BurnAddress,
+        field: RowAlertKey.BurnAddress,
+        message: strings('alert_system.burn_address.message'),
+        title: strings('alert_system.burn_address.title'),
+        severity: Severity.Danger,
+        isBlocking: false,
+      },
+    ];
+  }, [hasBurnAddressRecipient]);
+}

app/components/Views/confirmations/hooks/alerts/useConfirmationAlerts.test.ts

@@ -18,6 +18,7 @@ import { useInsufficientPayTokenBalanceAlert } from './useInsufficientPayTokenBa
 import { useNoPayTokenQuotesAlert } from './useNoPayTokenQuotesAlert';
 import { useInsufficientPayTokenNativeAlert } from './useInsufficientPayTokenNativeAlert';
 import { useInsufficientPredictBalanceAlert } from './useInsufficientPredictBalanceAlert';
+import { useBurnAddressAlert } from './useBurnAddressAlert';
 
 jest.mock('./useBlockaidAlerts');
 jest.mock('./useDomainMismatchAlerts');
@@ -31,6 +32,7 @@ jest.mock('./useInsufficientPayTokenBalanceAlert');
 jest.mock('./useNoPayTokenQuotesAlert');
 jest.mock('./useInsufficientPayTokenNativeAlert');
 jest.mock('./useInsufficientPredictBalanceAlert');
+jest.mock('./useBurnAddressAlert');
 
 describe('useConfirmationAlerts', () => {
   const ALERT_MESSAGE_MOCK = 'This is a test alert message.';
@@ -144,6 +146,14 @@ describe('useConfirmationAlerts', () => {
       severity: Severity.Danger,
     },
   ];
+  const mockBurnAddressAlert: Alert[] = [
+    {
+      key: 'BurnAddressAlert',
+      title: 'Test Burn Address Alert',
+      message: ALERT_MESSAGE_MOCK,
+      severity: Severity.Danger,
+    },
+  ];
 
   beforeEach(() => {
     jest.clearAllMocks();
@@ -159,6 +169,7 @@ describe('useConfirmationAlerts', () => {
     (useNoPayTokenQuotesAlert as jest.Mock).mockReturnValue([]);
     (useInsufficientPayTokenNativeAlert as jest.Mock).mockReturnValue([]);
     (useInsufficientPredictBalanceAlert as jest.Mock).mockReturnValue([]);
+    (useBurnAddressAlert as jest.Mock).mockReturnValue([]);
   });
 
   it('returns empty array if no alerts', () => {
@@ -229,6 +240,7 @@ describe('useConfirmationAlerts', () => {
     (useInsufficientPredictBalanceAlert as jest.Mock).mockReturnValue(
       mockInsufficientPredictBalanceAlert,
     );
+    (useBurnAddressAlert as jest.Mock).mockReturnValue(mockBurnAddressAlert);
     const { result } = renderHookWithProvider(() => useConfirmationAlerts(), {
       state: siweSignatureConfirmationState,
     });
@@ -244,6 +256,7 @@ describe('useConfirmationAlerts', () => {
       ...mockNoPayTokenQuotesAlert,
       ...mockInsufficientPayTokenNativeAlert,
       ...mockInsufficientPredictBalanceAlert,
+      ...mockBurnAddressAlert,
       ...mockUpgradeAccountAlert,
     ]);
   });

app/components/Views/confirmations/hooks/alerts/useConfirmationAlerts.ts

@@ -12,6 +12,7 @@ import { useInsufficientPayTokenBalanceAlert } from './useInsufficientPayTokenBa
 import { useNoPayTokenQuotesAlert } from './useNoPayTokenQuotesAlert';
 import { useInsufficientPayTokenNativeAlert } from './useInsufficientPayTokenNativeAlert';
 import { useInsufficientPredictBalanceAlert } from './useInsufficientPredictBalanceAlert';
+import { useBurnAddressAlert } from './useBurnAddressAlert';
 
 function useSignatureAlerts(): Alert[] {
   const domainMismatchAlerts = useDomainMismatchAlerts();
@@ -30,6 +31,7 @@ function useTransactionAlerts(): Alert[] {
   const noPayTokenQuotesAlert = useNoPayTokenQuotesAlert();
   const insufficientPayTokenNativeAlert = useInsufficientPayTokenNativeAlert();
   const insufficientPredictBalanceAlert = useInsufficientPredictBalanceAlert();
+  const burnAddressAlert = useBurnAddressAlert();
 
   return useMemo(
     () => [
@@ -42,6 +44,7 @@ function useTransactionAlerts(): Alert[] {
       ...noPayTokenQuotesAlert,
       ...insufficientPayTokenNativeAlert,
       ...insufficientPredictBalanceAlert,
+      ...burnAddressAlert,
     ],
     [
       insufficientBalanceAlert,
@@ -53,6 +56,7 @@ function useTransactionAlerts(): Alert[] {
       noPayTokenQuotesAlert,
       insufficientPayTokenNativeAlert,
       insufficientPredictBalanceAlert,
+      burnAddressAlert,
     ],
   );
 }

app/components/Views/confirmations/hooks/metrics/useConfirmationAlertMetrics.ts

@@ -108,6 +108,7 @@ function getAlertNames(alerts: Alert[]): string[] {
 const ALERTS_NAME_METRICS: AlertNameMetrics = {
   [AlertKeys.BatchedUnusedApprovals]: 'batched_unused_approvals',
   [AlertKeys.Blockaid]: 'blockaid',
+  [AlertKeys.BurnAddress]: 'burn_address',
   [AlertKeys.DomainMismatch]: 'domain_mismatch',
   [AlertKeys.InsufficientBalance]: 'insufficient_balance',
   [AlertKeys.InsufficientPayTokenBalance]: 'insufficient_funds',