[security] Stop initializing WalletConnect when it's not used in the dapp about rainbowkit

[talentlessguy]

This happens exclusively with rainbow connector because it initializes WC

[talentlessguy]

@floticerus I think if you have an injected connector it won't initialize WC at all

[magiziz]

@floticerus There isn't a way to do this unless you don't use wallets that use WC. Like @talentlessguy said you can use injected connector (injectedWallet) for now, but we're going to work on lazy loading the connectors soon.

[magiziz]

@talentlessguy I'm also able to reproduce this with Wagmi (npm create wagmi@latest).

I don't think this is a RainbowKit specific issue. If this is a security concern, then it's better to raise a PR for Wagmi here.

[talentlessguy]

@talentlessguy I'm also able to reproduce this with Wagmi (npm create wagmi@latest).

I don't think this is a RainbowKit specific issue. If this is a security concern, then it's better to raise a PR for Wagmi here.

From what I understand this happens only with a Rainbow connector in wagmi. Seems like that's where the issue is happening.

[magiziz]

@talentlessguy I'll look at it again and report back 👍

[floticerus]

Is there any solution for this? I don't want walletconnect and definitely don't want it opening up a websocket connection

[magiziz]

@talentlessguy WalletConnect and Wagmi team just got back to me. We could try and lazy load the connectors, but there is a problem with that. During page refresh we won't know if the user should be connected to the dApp or not and Wagmi also manages the states for that. It's best to fix these connector issues upstream instead of relying on RainbowKit, but doesn't seem that the EthereumProvider (@walletconnect/ethereum-provider) will disable tracking in the near future.

Also WalletConnect team has mentioned that you could turn off Verify API, but that's more risky. Essentially it'll be an empty iframe that doesn't do anything.

[talentlessguy]

@magiziz what do you mean by "fixing upsteam"? do you mean in WalletConnect? Can this be patched in wagmi somehow? But wagmi's WC connector doesn't initialize on page load, only when interacting with it.

[magiziz]

@talentlessguy Yeah upstream in WalletConnect. I'm not sure if this can be patched in Wagmi since they wouldn't know if the user is already connected whenever the page is refreshed. They also use a setup function for WalletConnect which gets the provider on mount https://github.com/wevm/wagmi/blob/main/packages/connectors/src/walletConnect.ts#L113-L124

[magiziz]

Going to close this issue for now since it's coming from walletConnect connector.