marty/rm-circle-team-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Wallet diagnostics: a check page, and an error that names the signer

Browse Source 
Two sign-in failures with different causes and no way to tell them apart from
the outside, so stop guessing and get the data off the member's device.

/wallet-check reports what the page can actually see: whether window.ethereum
exists, which wallet flags are set, which EIP-6963 wallets announced, the
accounts and chain the wallet returns — and critically, any CSP violation.
Our script-src is 'self' with no 'unsafe-inline', and a wallet browser that
injects its provider via a script tag would be blocked silently, producing
symptoms identical to "no wallet installed". The company dApp sends no CSP at
all, which is a plausible reason it connects where we do not. This page will
confirm or kill that theory rather than us theorising further.

"Signature does not match this wallet" was true but useless — it never said
WHICH wallet signed. It now names both the address the page asked for and the
address that actually signed, which identifies the classic multi-account case
(wallet signs with the selected account, not the one the page picked up) in
one glance.

Verified for the case in hand: 0x20E0…2248 IS the wallet registered to
position #52 on-chain, so ownership was never the problem.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-08-29 05:53:34 -05:00
parent 36327abed2
commit 3620a72338
4 changed files with 114 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
messages.js
+4 -1
View File
@@ -80,7 +80,10 @@ function verifyChallenge(address, signature) {
if (!ch || ch.exp < Date.now()) return { error: 'Challenge expired - tap sign-in again.' };
let rec;
try { rec = recoverAddress(ch.message, signature); } catch (e) { return { error: 'Invalid signature: ' + e.message }; }
if (rec !== a) return { error: 'Signature does not match this wallet.' };
if (rec !== a) return { error: 'Your wallet signed with a different account than the page is using. '
+ 'The page asked for ' + a.slice(0, 6) + '…' + a.slice(-4) + ' but the signature came from '
+ rec.slice(0, 6) + '…' + rec.slice(-4) + '. Switch your wallet to the account that owns this '
+ 'position, reload the page, then tap sign-in again.', signer: rec, expected: a };
challenges.delete(a);
const id = chain.memberIdByAccount(a);
if (!id) return { error: 'No RM Circle position is registered to this wallet.' };