Summary
The register method creates an iframe to the verify server and listens for postMessage responses. The message event listener does not validate event.origin, allowing any website to send forged messages.
Affected Code
packages/core/src/controllers/verify.ts:85-103
window.addEventListener("message", listener, ...);
const listener = (event: MessageEvent) => {
if (!event.data) return; // ← no origin check!
if (typeof event.data !== "string") return;
try {
const data = JSON.parse(event.data);
if (data.type === "verify_attestation") {
const decoded = decodeJWT(data.attestation) as ...;
if (decoded.payload.id !== id) return; // ← only protection
resolve(data.attestation);
}
} catch (e) { ... }
};Impact
A malicious website hosting an iframe of a legitimate dApp can send forged postMessage events to manipulate the verify flow. While the id field check provides partial mitigation, defense-in-depth requires origin validation.
Fix
const listener = (event: MessageEvent) => {
if (event.origin !== "https://verify.walletconnect.com") return; // ← add origin check
// ...
};Reporter
zhantang bai (zhantang233@gmail.com)
Summary
The
registermethod creates an iframe to the verify server and listens forpostMessageresponses. Themessageevent listener does not validateevent.origin, allowing any website to send forged messages.Affected Code
packages/core/src/controllers/verify.ts:85-103Impact
A malicious website hosting an iframe of a legitimate dApp can send forged postMessage events to manipulate the verify flow. While the
idfield check provides partial mitigation, defense-in-depth requires origin validation.Fix
Reporter
zhantang bai (zhantang233@gmail.com)