fix: serialize full message in embedded wallet 1CA by tomiir · Pull Request #4588 · reown-com/appkit

tomiir · 2025-06-30T19:02:12Z

Description

This PR addresses an incompatibility with the new 1CA feature that uses createSIWEMessage from viem.

Problem

Viem enforces validation on the nonce length for SIWE messages.
Our current implementation sends a shorter nonce, which causes validation to fail.

Breakdown

DefaultSiwx: The usage of createSIWEMessage exposed an issue where the message was not compliant with the SIWE spec, specifically around nonce formatting.
CloudAuthSiwx: We’re generating a new EVM-based SIWE message on Secure Site that doesn’t match the one created on Cloud, resulting in validation failures.

Fix

Ensure nonce generation and formatting are consistent and compliant with SIWE spec requirements.
Align message generation between Cloud and Secure Site to prevent mismatches and validation errors.

Type of change

Chore (non-breaking change that addresses non-functional tasks, maintenance, or code quality improvements)
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)

Associated Issues

For Linear issues: Closes APKT-xxx
For GH issues: closes #...

Showcase (Optional)

If there is a UI change include the screenshots with before and after state.
If new feature is being introduced, include the link to demo recording.

Checklist

Code in this PR is covered by automated tests (Unit tests, E2E tests)
My changes generate no new warnings
I have reviewed my own code
I have filled out all required sections
I have tested my changes on the preview link
Approver of this PR confirms that the changes are tested on the preview link

vercel · 2025-06-30T19:02:16Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
appkit-basic-html	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 1, 2025 2:52pm
appkit-demo	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 1, 2025 2:52pm
appkit-laboratory	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jul 1, 2025 2:52pm

10 Skipped Deployments

Name	Status	Preview	Updated (UTC)
appkit-basic-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
appkit-basic-sign-client-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
appkit-basic-up-example	⬜️ Ignored (Inspect)	Visit Preview	Jul 1, 2025 2:52pm
appkit-ethers5-bera	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
appkit-nansen-demo	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
appkit-vue-solana	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
appkit-wagmi-cdn-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
ethereum-provider-wagmi-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
next-wagmi-solana-bitcoin-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm
vue-wagmi-example	⬜️ Ignored (Inspect)		Jul 1, 2025 2:52pm

svenvoskamp · 2025-06-30T19:39:46Z

I think this will break a flow in the onAuthProviderConnected where we call SIWXUtil.addEmbeddedWalletSession with all the properties of the siwxMessage

changeset-bot · 2025-06-30T21:09:00Z

⚠️ No Changeset found

Latest commit: 497741c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2025-06-30T21:15:14Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	77.84%	30843 / 39621
🔵	Statements	77.84%	30843 / 39621
🔵	Functions	68.77%	2539 / 3692
🔵	Branches	84.39%	6399 / 7582

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/appkit/src/client/appkit.ts	47.17%	79.38%	84.61%	47.17%	69-125, 128-142, 145-152, 155-171, 174-181, 186-193, 199-200, 225-226, 233-234, 247-270, 278-290, 292, 294-313, 315-329, 354-360, 376, 397-398, 403-404, 419-499, 536-540, 562-563, 586-588, 596-597, 636-637
packages/controllers/src/utils/SIWXUtil.ts	78.83%	72.05%	60.86%	78.83%	41-42, 46-47, 52-53, 59-72, 81-82, 85-86, 89-90, 93-94, 106-107, 142, 164-165, 167-168, 178-180, 188-194, 259, 304-328, 415-426, 307-334
packages/scaffold-ui/src/modal/w3m-modal/index.ts	85.98%	84.12%	100%	85.98%	73-76, 91-92, 114, 118, 145, 190, 208-216, 233-235, 251, 253, 297-298, 307-309, 236
packages/wallet/src/W3mFrameSchema.ts	100%	100%	100%	100%

Generated in workflow #13090 for commit 497741c by the Vitest Coverage Report Action

github-actions · 2025-06-30T21:29:24Z

	Warnings
⚠️	Changes were made to one or more package.json(s), but not to pnpm-lock.yaml
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	🔑 Potential High‑entropy string detected in packages/controllers/tests/utils/SIWXUtil.test.ts (line 40): `0x123456789012345678...`
⚠️	Testing spec changed

Generated by 🚫 dangerJS against 497741c

tomiir · 2025-07-01T03:15:31Z

+    const sessions = await SIWXUtil.getAllSessions()
+    const isNextAuthenticated =
+      caipAddress && SIWXUtil.getSIWX()
+        ? sessions.some(
+            session =>
+              session.data.accountAddress === ParseUtil.parseCaipAddress(caipAddress)?.address
+          )
+        : true


@svenvoskamp could you double check this ? It was going back when it was connected but not authenticated so I added this check.

cursor · 2025-07-01T08:45:36Z

🚨 BugBot couldn't run

BugBot is experiencing high demand right now. Try again in a few minutes by commenting "bugbot run" (requestId: serverGenReqId_d4a0d78b-dd1d-458f-8a6d-56fdaa4b9fe2).

tomiir added 2 commits June 30, 2025 12:16

fix: amend SIWE nonce to 8 characters in default siwx

4428765

fix: forward full message instead of reconstructing in be

3363ee2

vercel bot deployed to Preview – appkit-basic-html June 30, 2025 19:03 View deployment

vercel bot had a problem deploying to Preview – appkit-laboratory June 30, 2025 19:04 Failure

This comment was marked as outdated.

Sign in to view

vercel bot had a problem deploying to Preview – appkit-demo June 30, 2025 19:04 Failure

0xmkh reviewed Jun 30, 2025

View reviewed changes

Comment thread packages/controllers/src/utils/SIWXUtil.ts Outdated

0xmkh reviewed Jun 30, 2025

View reviewed changes

Comment thread packages/controllers/src/utils/SIWXUtil.ts Outdated

0xmkh reviewed Jun 30, 2025

View reviewed changes

Comment thread packages/wallet/src/W3mFrameSchema.ts Outdated

0xmkh approved these changes Jun 30, 2025

View reviewed changes

feat: serialize mesage inside of siwxData

0ca3293

This comment was marked as outdated.

Sign in to view

vercel bot deployed to Preview – appkit-basic-html June 30, 2025 21:11 View deployment

vercel bot deployed to Preview – appkit-demo June 30, 2025 21:13 View deployment

vercel bot deployed to Preview – appkit-laboratory June 30, 2025 21:14 View deployment

tomiir added 2 commits June 30, 2025 15:17

Merge branch 'main' into fix/siwx-1ca

3ea6c64

chore: remove double comment

dc0df28

This comment was marked as outdated.

Sign in to view

chore: amend test with new siwx message format

83cd4f5

vercel bot deployed to Preview – appkit-basic-html June 30, 2025 21:24 View deployment

tomiir changed the title ~~wip: Fix/siwx 1ca~~ fix: amend embedded wallet 1CA for SIWX Jun 30, 2025

tomiir changed the title ~~fix: amend embedded wallet 1CA for SIWX~~ fix: serialize full message in embedded wallet 1CA Jun 30, 2025

vercel bot deployed to Preview – appkit-basic-html June 30, 2025 21:27 View deployment

This comment was marked as outdated.

Sign in to view

vercel bot deployed to Preview – appkit-demo June 30, 2025 21:29 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 02:31 View deployment

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 02:31 View deployment

This comment was marked as outdated.

Sign in to view

chore: only validate if siwx is enabled

1d61682

vercel bot deployed to Preview – appkit-basic-html July 1, 2025 02:54 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 02:55 View deployment

This comment was marked as outdated.

Sign in to view

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 02:55 View deployment

tomiir commented Jul 1, 2025

View reviewed changes

enesozturk reviewed Jul 1, 2025

View reviewed changes

Comment thread apps/laboratory/tests/cloud-auth-email.spec.ts Outdated

chore: cloud auth test open modal

0f8b43b

vercel bot deployed to Preview – appkit-basic-html July 1, 2025 07:11 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 07:12 View deployment

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 07:13 View deployment

This comment was marked as outdated.

Sign in to view

chore: use staging secure site

3527e20

vercel bot deployed to Preview – appkit-basic-html July 1, 2025 08:46 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 08:47 View deployment

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 08:47 View deployment

Merge branch 'main' into fix/siwx-1ca

6bbe0ab

vercel bot deployed to Preview – appkit-basic-html July 1, 2025 12:08 View deployment

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 12:10 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 12:11 View deployment

chore: update secure site url on tests

497741c

vercel bot deployed to Preview – appkit-basic-html July 1, 2025 14:49 View deployment

vercel bot deployed to Preview – appkit-demo July 1, 2025 14:50 View deployment

vercel bot deployed to Preview – appkit-laboratory July 1, 2025 14:52 View deployment

tomiir merged commit c41ea92 into main Jul 1, 2025
40 of 41 checks passed

tomiir deleted the fix/siwx-1ca branch July 1, 2025 15:05

Conversation

tomiir commented Jun 30, 2025 • edited by enesozturk Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Associated Issues

Showcase (Optional)

Checklist

Uh oh!

vercel bot commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

svenvoskamp commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

tomiir Jul 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot commented Jul 1, 2025

🚨 BugBot couldn't run

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tomiir commented Jun 30, 2025 •

edited by enesozturk

Loading

vercel bot commented Jun 30, 2025 •

edited

Loading

svenvoskamp commented Jun 30, 2025 •

edited

Loading

changeset-bot bot commented Jun 30, 2025 •

edited

Loading

github-actions bot commented Jun 30, 2025 •

edited

Loading

github-actions bot commented Jun 30, 2025 •

edited

Loading