[bug] switchNetwork exposes project ID and stores it in user wallet (impersonating project)

[vittominacori]

Link to minimal reproducible example

https://appkit-lab.reown.com/library/wagmi/

Summary

If a user wants to switch to a network that has not been added to their network list, the switchNetwork hook (or modal.switchNetwork) suggests the walletconnect rpc instead of the default rpcurl, exposing the project ID and storing it in the user's wallet.

This means that users will also use our project ID on other websites (or within MetaMask itself), impersonating our project, consuming our API rate limit, and polluting our stats.

I think this is really bad behavior.

List of related npm package versions

• @reown/appkit v1.2.1
• @reown/appkit-adapter-wagmi v1.2.1

[rtomas]

https://linear.app/reown/issue/APKT-1415/[bug]-switchnetwork-exposes-project-id-and-stores-it-in-user-wallet

[vittominacori]

It also means that a custom rpc cannot be used for supported networks.

appkit/packages/appkit-utils/src/CaipNetworkUtil.ts

Lines 115 to 117 in d9187d4

	if (WC_HTTP_RPC_SUPPORTED_CHAINS.includes(caipNetworkId)) {
	return getBlockchainApiRpcUrl(caipNetworkId, projectId)
	}

https://github.com/orgs/reown-com/discussions/3170