fix: fixed misc bugs

[lwin-kyaw]

Jira Link

• https://consensyssoftware.atlassian.net/browse/EMBED-391?atlOrigin=eyJpIjoiYWZmZWYwYWI0YTk4NGM0OTkyMGMzY2I4NWNhZTQyMmEiLCJwIjoiaiJ9
• https://consensyssoftware.atlassian.net/browse/EMBED-392?atlOrigin=eyJpIjoiN2I1Yjc4MGQyNGM1NGRjMDhkYjFlY2Q3NWY1YWI3OTMiLCJwIjoiaiJ9

Description

This PR fixes several chain-handling issues across external wallet flows, especially for multichain wallets like MetaMask.

• Fixes connect-and-sign / auth signing in multichain connectors by explicitly passing the target chainId into getAuthTokenInfo and generateChallengeAndSign, instead of inferring the chain from provider availability.
• Fixes account linking for mixed-chain flows by passing the target chainId into linking proof generation.
• Fixes external wallet chain reconciliation so Web3Auth state stays aligned with the wallet's actual connected chain after connect.
• For MetaMask EVM, switches to the requested chain after connect if needed.
• For MetaMask Solana, syncs Web3Auth chain state from wallet-standard change events since the underlying Solana connect flow does not expose a public chain-selection API.

How has this been tested?

• Verified multichain connect-and-sign flow for MetaMask where both EVM and Solana providers are initialized.
• Verified SIWW/SIWE uses the explicitly selected chain instead of defaulting to EVM when both providers are available.
• Verified account-linking proof generation uses the requested chain.
• Verified external wallet chain updates reconcile back into Web3AuthNoModal state.
• Ran IDE lint checks on updated files.

Screenshots (if appropriate)

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Touches connect-and-sign, account linking, and chain reconciliation in core wallet flows; changes are targeted but affect authentication and session chain state.

Overview
Fixes multichain external-wallet behavior so connect-and-sign, linking, and session state follow the active chain instead of guessing from which providers exist.

Core SDK (no-modal / modal) threads optional chainId through getAuthTokenInfo and generateChallengeAndSign, passes currentChainId from the controller into connector auth, and updates Web3Auth state when connectors report chainId via CONNECTOR_DATA_UPDATED. MetaMask syncs EVM/Solana after connect (syncChainStateAfterConnect, chainChanged → updateConnectorData) and resolves auth with resolveAuthChainConfig. Account linking uses the picker’s chainNamespace to pick the right chain when EVM vs Solana differs, and linking proofs call generateChallengeAndSign with the target chainId. AA RPC middleware maps undefined to null for wallet_switchEthereumChain / wallet_addEthereumChain to avoid JRPC “Nothing ended the request” errors (with tests).

Demos bump @web3auth/* lockfile versions, point x402 testers at the dev weather endpoint, and small Vue dashboard tweaks (wagmi useChainId, AUTH-only user-info UI).

^{Reviewed by Cursor Bugbot for commit 7b7aae4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web3auth-web	Ready	Preview, Comment	Jun 5, 2026 5:11am

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7b7aae4. Configure here.}

[cursor]

Solana auth uses stale chain

High Severity

After connect, syncChainStateAfterConnect can reconcile MetaMask Solana to a different network than requested via updateConnectorData, but getAuthTokenInfo still uses the original chainId from connect params. Connect-and-sign can build and verify proofs for the wrong chain while the wallet stays on the connected scope.

 

^{Reviewed by Cursor Bugbot for commit 7b7aae4. Configure here.}

[cursor]

Null solanaProvider scope check crashes

Medium Severity

In the Solana branch of syncChainStateAfterConnect, the code uses "scope" in this.solanaProvider without guarding this.solanaProvider. If connect runs for a Solana chain while the Solana client was not created, the in operator throws and aborts the connect flow.

 

^{Reviewed by Cursor Bugbot for commit 7b7aae4. Configure here.}