Incidents and Security Advisories
A permanent record of security incidents, client vulnerabilities, phishing campaigns targeting WalletConnect sessions, and official advisories. Covers exploit mechanics, affected versions, remediation steps, and postmortem findings. Security teams, wallet operators, and risk assessors use this group to evaluate operational security posture and ensure their implementations are patched against known attack vectors.
WalletConnect v1.0 Bridge Shutdown and Migration Incidents
Postmortem of the forced deprecation of the v1.0 bridge, covering the timeline of service degradation, session disruption mechanics for non-migrated dapps and wallets, and the security implications of relying on unsupported relay infrastructure. Affected wallet operators and dapp teams should review their migration status and audit for residual v1.0 dependencies.
Client-Side Session Hijacking via Malicious Relays
Analysis of attack vectors where a compromised or malicious relay node intercepts or manipulates WalletConnect session proposals. Covers the cryptographic mitigations (symmetric encryption, session keys) and the practical risks when client implementations fail to validate peer identity correctly. Wallet SDK developers and security auditors should verify peer authentication logic.
Web3Modal Supply Chain Attacks and Dependency Confusion
Tracking of known and hypothetical supply chain attacks targeting the Web3Modal library and its dependency tree, including npm package impersonation attempts. Covers the blast radius of a compromised SDK on wallet and dapp key material, and mandatory integrity verification steps such as SRI and lockfile auditing. Integrators should conduct a dependency integrity review.
Phishing Campaigns Abusing WalletConnect Pairing Mechanics
Catalog of phishing techniques exploiting the 'scan to connect' UX, including fake airdrop sites, malicious dapps mimicking legitimate interfaces, and social engineering to approve malicious transactions via a valid WalletConnect session. Wallet teams and security operations centers should monitor for known malicious URIs and domain patterns.
Session Replay Vulnerability in Mobile Wallet SDKs
Deep-dive into a class of bugs where a mobile wallet's background state management fails, allowing a previously disconnected dapp to silently re-establish a session and request signatures without a new user prompt. Covers affected OS versions, SDK releases, and required state-management remediation patterns. Mobile wallet developers should audit session lifecycle handling.
Namespace Collision and Chain-ID Spoofing Attacks
Analysis of incidents stemming from CAIP-2 and CAIP-10 namespace collisions, where an attacker tricks a wallet into displaying a transaction for a spoofed chain by exploiting UI parsing bugs or non-canonical chain-ID registration. Wallet UI developers and chain registries should validate namespace resolution logic to prevent cross-chain asset loss.
SIWx Nonce Reuse and Replay Incidents
Security advisory on the criticality of nonce validation in CAIP-122 (Sign-In With X) implementations. Documents real-world incidents where dapps failed to validate nonces server-side, allowing an attacker to replay a captured signature to hijack user sessions. Dapp backend teams should audit their SIWx nonce generation and verification flows.
Push Protocol Notification Spoofing and Data Leakage
Postmortem on vulnerabilities within the WalletConnect Push protocol where a malicious dapp could spoof notification content, bypass user consent, or exfiltrate subscription metadata. Covers the message signing and verification updates that fixed these vectors. Wallet and dapp teams using Push should verify they have adopted the remediated message verification logic.
EIP-155 Chain-ID Conflict and Cross-Chain Replay Attacks
Persistent risk page documenting how shared chain-IDs across EVM networks interact with WalletConnect sessions. Covers incidents where a transaction signed for one network was replayed on another due to the wallet's failure to enforce the session's CAIP-2 scope. Wallet developers and multi-chain dapps should enforce strict chain-ID validation in session scopes.
QR Code Session Hijacking via Physical Proximity and Screen Recording
Analysis of an attack vector where a WalletConnect session is hijacked by capturing the QR code via a compromised webcam, screen recording malware, or shoulder surfing. Covers the protocol's lack of a binding out-of-band confirmation and the UX patterns that mitigate this risk. Wallet designers should implement additional pairing confirmation steps.
Unlimited Session Lifetime and Abandoned Session Exploitation
Advisory on the security implications of WalletConnect's default session expiry behavior. Documents incidents where long-lived, forgotten sessions were exploited by a compromised or transferred frontend to drain assets. Dapp operators and wallet teams should implement short-lived sessions and continuous authorization prompts.
WalletConnect Auth Key Material Extraction Vulnerability
Technical postmortem on a vulnerability where a flaw in a specific wallet's Auth (CAIP-222) implementation allowed a dapp to derive and exfiltrate the user's identity key pair, breaking the privacy model. Covers the secure enclave and key derivation path corrections required. Wallet teams implementing Auth should audit their key generation and storage architecture.
Relay Infrastructure DDoS and Centralized Points of Failure
Record of major outages and denial-of-service attacks against the centralized WalletConnect relay infrastructure. Covers the blast radius of a relay outage on all active sessions and the operational security posture of the relay. Infrastructure operators and large dapps should assess their exposure to relay downtime and monitor the decentralization roadmap.
JSON-RPC Injection and Malformed Payload Crashes
Catalog of client-side bugs where a malicious dapp sends a malformed JSON-RPC payload through an established WalletConnect session, causing the wallet application to crash, freeze, or behave unexpectedly. Wallet SDK developers should implement robust input sanitization and fuzz testing against malformed RPC payloads.
Cross-Origin Communication Bugs in Web3Modal iframe Integrations
Security advisory detailing vulnerabilities arising from Web3Modal's use of iframes for secure key management. Covers incidents where a flaw in postMessage origin validation allowed a malicious parent page to communicate with the iframe, potentially exfiltrating keys. Integrators using iframe-based wallet flows should audit their cross-origin messaging security.