feat: allow partial revokes via wallet_revokeSession
#6668
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
jiexi
reviewed
Sep 22, 2025
packages/multichain-api-middleware/src/handlers/wallet-revokeSession.ts
Outdated
Show resolved
Hide resolved
jiexi
reviewed
Sep 22, 2025
jiexi
reviewed
Sep 22, 2025
packages/multichain-api-middleware/src/handlers/wallet-revokeSession.ts
Outdated
Show resolved
Hide resolved
adonesky1
reviewed
Sep 22, 2025
packages/multichain-api-middleware/src/handlers/wallet-revokeSession.test.ts
Outdated
Show resolved
Hide resolved
adonesky1
reviewed
Sep 22, 2025
Comment on lines
32
to
33
| * @param hooks.updateCaveat - | ||
| * @param hooks.getCaveatForOrigin - |
There was a problem hiding this comment.
Suggested change
| * @param hooks.updateCaveat - | |
| * @param hooks.getCaveatForOrigin - | |
| * @param hooks.updateCaveat - hook used to conditionally update the caveat rather than fully revoke the permission | |
| * @param hooks.getCaveatForOrigin - hook to fetch an existing caveat for the origin of the request |
adonesky1
reviewed
Sep 22, 2025
| }, | ||
| ) { | ||
| const { | ||
| params: { sessionScopes }, |
There was a problem hiding this comment.
🙏
Suggested change
| params: { sessionScopes }, | |
| params: { scopes }, |
There was a problem hiding this comment.
theoretically this is why we should propse a change to the caip first. But I'm fine with us rolling on it here first.
jiexi
reviewed
Sep 23, 2025
packages/multichain-api-middleware/src/handlers/wallet-revokeSession.test.ts
Show resolved
Hide resolved
jiexi
reviewed
Sep 23, 2025
|
|
||
| try { | ||
| hooks.revokePermissionForOrigin(Caip25EndowmentPermissionName); | ||
| if (scopes?.length) { |
There was a problem hiding this comment.
if we pass an empty array of scopes, what should happen?
There was a problem hiding this comment.
if (scopes?.length) evaluates to false, so we fully revoke the permission. Basically the same as passing an empty params object
There was a problem hiding this comment.
right, that's what happens right now, but is that what we want? If i say "hey, please remove the following specific scopes from my permission, nothing", should it remove everything? Idk. anyway not worth blocking on and probably not important right now
jiexi
reviewed
Sep 23, 2025
Comment on lines
32
to
43
| hooks: { | ||
| revokePermissionForOrigin: (permissionName: string) => void; | ||
| updateCaveat: ( | ||
| target: string, | ||
| caveatType: string, | ||
| caveatValue: Caip25CaveatValue, | ||
| ) => void; | ||
| getCaveatForOrigin: ( | ||
| endowmentPermissionName: string, | ||
| caveatType: string, | ||
| ) => Caveat<typeof Caip25CaveatType, Caip25CaveatValue>; | ||
| }, |
There was a problem hiding this comment.
nit. can we DRY these hook types since they are shared with the handler?
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
jiexi
previously approved these changes
Sep 23, 2025
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
jiexi
approved these changes
Sep 23, 2025
ffmcgee725
added a commit
that referenced
this pull request
Sep 23, 2025
## Explanation Release for `@metamask/multichain-api-middleware` - Add partial permission revoke into `wallet_revokeSession` ([#6668](#6668)) - Bump `@metamask/chain-agnostic-permission` from `1.0.0` to `1.1.1` ([#6241](#6241), [#6345](#6241)) - Bump `@metamask/controller-utils` from `^11.10.0` to `^11.14.0` ([#6069](#6069), [#6303](#6303), [#6620](#6620), [#6629](#6629)) - Bump `@metamask/network-controller` from `^24.0.0` to `^24.2.0` ([#6148](#6148), [#6303](#6303), [#6678](#6678)) - Bump `@metamask/utils` from `^11.2.0` to `^11.4.2` ([#6054](#6054)) - Bump `@metamask/utils` from `^11.4.2` to `^11.8.0` ([#6588](#6588)) - Bump `@metamask/json-rpc-engine` from `^10.0.3` to `^10.1.0` ([#6678](#6678)) <!-- Thanks for your contribution! Take a moment to answer these questions so that reviewers have the information they need to properly understand your changes: * What is the current state of things and why does it need to change? * What is the solution your changes offer and how does it work? * Are there any changes whose purpose might not obvious to those unfamiliar with the domain? * If your primary goal was to update one package but you found you had to update another one along the way, why did you do so? * If you had to upgrade a dependency, why did you do so? --> ## References <!-- Are there any issues that this pull request is tied to? Are there other links that reviewers should consult to understand these changes better? Are there client or consumer pull requests to adopt any breaking changes? For example: * Fixes #12345 * Related to #67890 --> * Fixes https://consensyssoftware.atlassian.net/browse/WAPI-728 ## Checklist - [x] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [x] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/contributing.md#updating-changelogs), highlighting breaking changes as necessary - [x] I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes
This was referenced Sep 24, 2025
Merged
github-merge-queue bot
pushed a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 24, 2025
…onnection is rejected (#36283) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> [](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1) ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** 1. Go to https://orca.so 2. On dev tools console, call `window.ethereum.enable()` 3. Proceed with permission (make sure _NO PERMISSIONS for Solana are checked_) and confirm 4. Click "Connect Wallet" button, choose "MetaMask" and proceed. 5. When wallet UI prompts to accept connection, click "Cancel" button. 6. Now, on dev tools console, call ``` await window.ethereum.request({ "method": "wallet_getPermissions", "params": [], }); ``` 7. Permission for `eth_accounts` should still be present with the permitted account in `caveats` array. ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d ### **After** https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
github-merge-queue bot
pushed a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 24, 2025
…onnection is rejected (#36283) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> [](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1) ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** 1. Go to https://orca.so 2. On dev tools console, call `window.ethereum.enable()` 3. Proceed with permission (make sure _NO PERMISSIONS for Solana are checked_) and confirm 4. Click "Connect Wallet" button, choose "MetaMask" and proceed. 5. When wallet UI prompts to accept connection, click "Cancel" button. 6. Now, on dev tools console, call ``` await window.ethereum.request({ "method": "wallet_getPermissions", "params": [], }); ``` 7. Permission for `eth_accounts` should still be present with the permitted account in `caveats` array. ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d ### **After** https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
github-merge-queue bot
pushed a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 24, 2025
…onnection is rejected (#36283) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> [](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1) ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** 1. Go to https://orca.so 2. On dev tools console, call `window.ethereum.enable()` 3. Proceed with permission (make sure _NO PERMISSIONS for Solana are checked_) and confirm 4. Click "Connect Wallet" button, choose "MetaMask" and proceed. 5. When wallet UI prompts to accept connection, click "Cancel" button. 6. Now, on dev tools console, call ``` await window.ethereum.request({ "method": "wallet_getPermissions", "params": [], }); ``` 7. Permission for `eth_accounts` should still be present with the permitted account in `caveats` array. ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d ### **After** https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
jeffsmale90
pushed a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 24, 2025
…onnection is rejected (#36283) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> [](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1) ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** 1. Go to https://orca.so 2. On dev tools console, call `window.ethereum.enable()` 3. Proceed with permission (make sure _NO PERMISSIONS for Solana are checked_) and confirm 4. Click "Connect Wallet" button, choose "MetaMask" and proceed. 5. When wallet UI prompts to accept connection, click "Cancel" button. 6. Now, on dev tools console, call ``` await window.ethereum.request({ "method": "wallet_getPermissions", "params": [], }); ``` 7. Permission for `eth_accounts` should still be present with the permitted account in `caveats` array. ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d ### **After** https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
jeffsmale90
pushed a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 24, 2025
…onnection is rejected (#36283) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> [](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1) ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** 1. Go to https://orca.so 2. On dev tools console, call `window.ethereum.enable()` 3. Proceed with permission (make sure _NO PERMISSIONS for Solana are checked_) and confirm 4. Click "Connect Wallet" button, choose "MetaMask" and proceed. 5. When wallet UI prompts to accept connection, click "Cancel" button. 6. Now, on dev tools console, call ``` await window.ethereum.request({ "method": "wallet_getPermissions", "params": [], }); ``` 7. Permission for `eth_accounts` should still be present with the permitted account in `caveats` array. ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** https://github.com/user-attachments/assets/77026a60-03e1-4293-ad8a-25f9c9c5056d ### **After** https://github.com/user-attachments/assets/e4bca63c-3e21-4736-88fc-6d35f723d90a ## **Pre-merge author checklist** - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Extension Coding Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
github-merge-queue bot
pushed a commit
to MetaMask/metamask-mobile
that referenced
this pull request
Sep 25, 2025
…onnection is rejected (#20309) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** ```gherkin Feature: fix EVM permmissions removed when Solana Wallet Standard connection rejected Scenario: user rejects Solana Wallet Standard connection Given there are existing EVM permissions for the dapp When user rejects Solana Wallet Standard connection Then EVM permissions should still exist, and not be revoked ``` ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** <!-- [screenshots/recordings] --> ### **After** <!-- [screenshots/recordings] --> ## **Pre-merge author checklist** - [x] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
weitingsun
pushed a commit
to MetaMask/metamask-mobile
that referenced
this pull request
Oct 15, 2025
](https://codespaces.new/MetaMask/metamask-extension/pull/36283?quickstart=1){kind=link}
…onnection is rejected (#20309) <!-- Please submit this PR as a draft initially. Do not mark it as "Ready for review" until the template has been completely filled out, and PR status checks have passed at least once. --> ## **Description** When a dapp connects to MetaMask via EVM and the user *rejects a subsequent connection request for SVM*, the *existing EVM connection is closed*. This can potentially break dapp flows and edge cases where maintaining the EVM connection is critical. To fix this, we implemented partial revoking into the `wallet_revokeSession` handler on MetaMask/core#6668 so that we can then update our solana wallet-standard provider would only revoke the solana scopes when it is asked to disconnect, here MetaMask/solana-wallet-standard#53. This PR bumps all necessary packages for this to take place, fixing the undesired EVM permissions revoke when a solana wallet standard connection is refused. <!-- Write a short description of the changes included in this pull request, also include relevant motivation and context. Have in mind the following questions: 1. What is the reason for the change? 2. What is the improvement/solution? --> ## **Changelog** <!-- If this PR is not End-User-Facing and should not show up in the CHANGELOG, you can choose to either: 1. Write `CHANGELOG entry: null` 2. Label with `no-changelog` If this PR is End-User-Facing, please write a short User-Facing description in the past tense like: `CHANGELOG entry: Added a new tab for users to see their NFTs` `CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker` (This helps the Release Engineer do their job more quickly and accurately) --> CHANGELOG entry: Fixes existing EVM permissions removed when a Solana Wallet Standard connection is rejected ## **Related issues** Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-413 ## **Manual testing steps** ```gherkin Feature: fix EVM permmissions removed when Solana Wallet Standard connection rejected Scenario: user rejects Solana Wallet Standard connection Given there are existing EVM permissions for the dapp When user rejects Solana Wallet Standard connection Then EVM permissions should still exist, and not be revoked ``` ## **Screenshots/Recordings** <!-- If applicable, add screenshots and/or recordings to visualize the before and after of your change. --> ### **Before** <!-- [screenshots/recordings] --> ### **After** <!-- [screenshots/recordings] --> ## **Pre-merge author checklist** - [x] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I’ve included tests if applicable - [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Explanation
Uniswap reported a bug in slack here where MetaMask was unpermitting any EVM connections for a dapp if that dapp used the solana wallet standard provider to make a connect request and then cancelled it.
This call to
disconnect()is happening outside of our packages and is not related to a previous but similar bug where our own wallet-standard provider was callingwallet_revokeSessionwhen receiving an empty solanaaccountsChangedevent.To fix this, this PR proposes an implementation for partial permission revoking in the
wallet_revokeSessionhandler so that we can then update our solanawallet-standardprovider to only revoke the solana scopes when it is asked to disconnect.References
Checklist