Peer pin rejects real Ledger Live: name "Ledger Wallet" + non-ledger.com icon host

[szhygulin]

Severity: medium (repo has no severity labels; recording it here.)

The Ledger Live peer pin rejects the peer that a real Ledger Live pairing produces, so the warning fires on the legitimate wallet.

Pairing completed today by pasting the wc: URI into Ledger Live. Two of the pin's three checks failed (src/signing/walletconnect-peer-pin.ts:65,67): name is "Ledger Wallet", not the pinned exact "Ledger Live", and the sole icon is hosted at avatars.githubusercontent.com, not *.ledger.com. Only the url check passed — https://wc.apps.ledger.com, a genuine Ledger host.

Observed peer metadata:

{"name":"Ledger Wallet",
 "description":"Ledger Live Wallet with WalletConnect",
 "url":"https://wc.apps.ledger.com",
 "icons":["https://avatars.githubusercontent.com/u/37784886"]}

A pin that cries wolf on the only wallet it is meant to accept trains the operator to click through it, which removes the protection it exists to provide — the failure mode is worse than having no pin.

Acceptance criterion: a fresh pair_ledger_live against current Ledger Live completes with no wc-peer-pin warning on stderr, and a peer advertising a non-Ledger url still warns.

[graciangabriel8]

CLAIMED — branch fix/831-ledger-live-peer-pin, host Mac, 2026-08-16T11:43:31Z

[graciangabriel8]

DONE — PR #833, independent review verdict fix_sound after one blocker round, marked ready. The pin now anchors on the url host (ledger.com or subdomain), accepts name ∈ {"Ledger Live", "Ledger Wallet"}, drops the icon-host check, and names the exact mismatched field(s) in the warning. An empty url is tolerated only when the name is allowlisted — deliberately safe under both readings of the unverified 'mobile omits url' claim, per review. Acceptance clause 1 (a live pair_ledger_live with no stderr warning) is traced statically only — no live pairing was possible from this environment; the observed #831 metadata fixture passes as match, RED-before-fix. Signing-path change: not self-certified, flagged in the PR body for maintainer security review.