From 3620a72338aaa3f53b42932472f399551f08ef7c Mon Sep 17 00:00:00 2001 From: martbost Date: Sat, 29 Aug 2026 05:53:34 -0500 Subject: [PATCH] Wallet diagnostics: a check page, and an error that names the signer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two sign-in failures with different causes and no way to tell them apart from the outside, so stop guessing and get the data off the member's device. /wallet-check reports what the page can actually see: whether window.ethereum exists, which wallet flags are set, which EIP-6963 wallets announced, the accounts and chain the wallet returns — and critically, any CSP violation. Our script-src is 'self' with no 'unsafe-inline', and a wallet browser that injects its provider via a script tag would be blocked silently, producing symptoms identical to "no wallet installed". The company dApp sends no CSP at all, which is a plausible reason it connects where we do not. This page will confirm or kill that theory rather than us theorising further. "Signature does not match this wallet" was true but useless — it never said WHICH wallet signed. It now names both the address the page asked for and the address that actually signed, which identifies the classic multi-account case (wallet signs with the selected account, not the one the page picked up) in one glance. Verified for the case in hand: 0x20E0…2248 IS the wallet registered to position #52 on-chain, so ownership was never the problem. Co-Authored-By: Claude Fable 5 --- messages.js | 5 ++- public/wallet-check.html | 29 +++++++++++++++ public/wallet-check.js | 80 ++++++++++++++++++++++++++++++++++++++++ server.js | 2 +- 4 files changed, 114 insertions(+), 2 deletions(-) create mode 100644 public/wallet-check.html create mode 100644 public/wallet-check.js diff --git a/messages.js b/messages.js index b0f42a2..b95d8d9 100644 --- a/messages.js +++ b/messages.js @@ -80,7 +80,10 @@ function verifyChallenge(address, signature) { if (!ch || ch.exp < Date.now()) return { error: 'Challenge expired - tap sign-in again.' }; let rec; try { rec = recoverAddress(ch.message, signature); } catch (e) { return { error: 'Invalid signature: ' + e.message }; } - if (rec !== a) return { error: 'Signature does not match this wallet.' }; + if (rec !== a) return { error: 'Your wallet signed with a different account than the page is using. ' + + 'The page asked for ' + a.slice(0, 6) + '…' + a.slice(-4) + ' but the signature came from ' + + rec.slice(0, 6) + '…' + rec.slice(-4) + '. Switch your wallet to the account that owns this ' + + 'position, reload the page, then tap sign-in again.', signer: rec, expected: a }; challenges.delete(a); const id = chain.memberIdByAccount(a); if (!id) return { error: 'No RM Circle position is registered to this wallet.' }; diff --git a/public/wallet-check.html b/public/wallet-check.html new file mode 100644 index 0000000..ad7a672 --- /dev/null +++ b/public/wallet-check.html @@ -0,0 +1,29 @@ +Wallet check + + +
RM CircleRM CircleWallet check
+
+

Wallet check

+

This page doesn't sign anything or ask for anything. It just reports what your browser can see, so we can work out why sign-in isn't working. Open it the same way you were opening the dashboard, then screenshot this whole page.

+ +
+ +
+
+ + 
collecting…
+
+ + + diff --git a/public/wallet-check.js b/public/wallet-check.js new file mode 100644 index 0000000..b07ff15 --- /dev/null +++ b/public/wallet-check.js @@ -0,0 +1,80 @@ +// Diagnostic page for wallet sign-in failures. Reports what the page can +// actually see, from the member's own device, instead of us guessing. +// +// It captures the one thing we cannot infer from the outside: whether a CSP +// violation is firing when the wallet tries to inject its provider. Our +// script-src is 'self' with no 'unsafe-inline', and wallet browsers that inject +// via a