Skip to content

fix(frontend): reject invalid WalletConnect signing requests#13154

Draft
cursor[bot] wants to merge 2 commits into
mainfrom
cursor/high-severity-issue-resolution-635f
Draft

fix(frontend): reject invalid WalletConnect signing requests#13154
cursor[bot] wants to merge 2 commits into
mainfrom
cursor/high-severity-issue-resolution-635f

Conversation

@cursor

@cursor cursor Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Motivation

Recent WalletConnect BTC/Solana signing changes introduced concrete request lifecycle failures:

  • Solana signing could return { success: false } without sending a WalletConnect JSON-RPC rejection when the wallet address was unavailable or when a sign-and-send transaction could not produce a signature. The user flow stopped, but the dApp request stayed pending indefinitely.
  • BTC signPsbt could approve a request with an unchanged PSBT when signInputs was present but selected no usable input indices, reporting success without signing anything.

Changes

  • Reject Solana WalletConnect requests before returning failure for a missing wallet address.
  • Reject Solana WalletConnect requests when signing cannot produce a signature.
  • Reject BTC PSBT requests when signInputs is provided but resolves to no input indices, before opening the signing progress flow.
  • Added regression coverage for the Solana rejection paths and BTC empty-signInputs PSBT path.

Tests

  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run test -- --run src/frontend/src/tests/sol/services/wallet-connect.services.spec.ts src/frontend/src/tests/btc/services/wallet-connect.services.spec.ts
  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run format
  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run lint -- --max-warnings 0
  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run check
  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run test
  • PATH="/home/ubuntu/.nvm/versions/node/v24.17.0/bin:$PATH" npm run lint:lockfile
Open in Web View Automation 

cursoragent and others added 2 commits June 20, 2026 11:06
Co-authored-by: Antonio Ventilii <AntonioVentilii@users.noreply.github.com>
Co-authored-by: Antonio Ventilii <AntonioVentilii@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant