fix: fixed metamask EIP-6963 provider for injected wallet

[lwin-kyaw]

JIRA

https://consensyssoftware.atlassian.net/browse/EMBED-413?atlOrigin=eyJpIjoiMzMxNWExMTUwMGQwNDJjYmEyYTdjODNiZDIwMTU3NjgiLCJwIjoiaiJ9

Description

MetaMask is shown as installed without extension, and multichain MetaMask disconnect leaves stale SIWW auth cache

Summary

• fix MetaMask login modal detection so the MetaMask Connect SDK's EIP-6963 provider (io.metamask.mmc) is not treated as a native injected wallet
• preserve the expected desktop QR flow when MetaMask extension is not installed
• clear cached SIWW auth sessions for all connected MetaMask EVM and Solana addresses on disconnect in connect-and-sign mode

Root Cause

@metamask/connect-evm auto-announces an EIP-6963 provider even without the native MetaMask extension. Our mipd discovery path picked up that SDK-announced provider and registered it as an injected connector, which made the modal mark MetaMask as installed and does not proceed to mobile connect option (QR).

Additionally, MetaMask multichain auth tokens are cached per connector name + address, but disconnect cleanup only cleared the session for the currently active address, leaving stale tokens for the other connected namespace.

Test plan

• On desktop without MetaMask extension installed, open the login modal and confirm MetaMask does not show the installed badge
• On desktop without MetaMask extension installed, click MetaMask and confirm the QR flow is shown
• On desktop with MetaMask extension installed, confirm MetaMask still behaves as an injected wallet
• In connect-and-sign mode with MetaMask multichain enabled, connect and authorize with an EVM account and a Solana account
• Disconnect MetaMask and verify cached SIWW auth data is cleared for both connected addresses
• Reopen and reconnect after disconnect to confirm no stale authorization state is reused

---

Note

Medium Risk
Touches wallet discovery and connect-and-sign session cleanup for MetaMask; wrong filtering could hide real injected wallets or leave auth state inconsistent.

Overview
Fixes MetaMask showing as installed when only the Connect SDK is present, and stale SIWW auth after multichain disconnect.

EIP-6963 / injected discovery: Exports METAMASK_ERC_6963_PROVIDER_RDNS (io.metamask.mmc) and filters that provider out of MIPD-based injected EVM connector registration in noModal.ts, so the SDK-announced provider is not duplicated as a native injected wallet. MetaMask stays on the dedicated metaMaskConnector path (extension when present, QR/deeplink when not).

Disconnect / auth cache: MetaMaskConnector.disconnect now runs clearMultichainWalletSessions(), which clears SIWW sessions for every connected EVM and Solana address (not just the active one), only calls multichainClient.disconnect() when status is connected, and logs per-address cleanup failures without blocking disconnect.

^{Reviewed by Cursor Bugbot for commit 384c90e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web3auth-web	Ready	Preview, Comment	Jun 11, 2026 5:52pm

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7bf1d42. Configure here.}