Uncovering and Resolving a Cross-Site Scripting Attack in a Popular Wallet Protocol

This report describes the discovery and responsible disclosure of a reflected XSS vulnerability in WalletConnect's Verify API that allowed attacker-controlled payloads to be embedded in a token returned in a JavaScript context, enabling phishing pages that could trick users into signing malicious transactions; WalletConnect patched the validation logic to whitelist allowed characters and the issue was fixed within days of reporting.