Viem Migration - Upgrade wagmi and handling different tabs wallet connection

[lgahdl]

Summary

Fixes connection issues when the app is opened in Safe and in a cross-origin iframe (widget standalone mode).

Three separate problems are fixed:

1. Safe App iframe blink / disconnect — When the user switches wallets or disconnects in a regular browser tab, the Safe App iframe would blink or lose its connection. AppKit is now skipped entirely in Safe App iframes (plain wagmi config with only the Safe connector), and @appkit/* localStorage keys are redirected to sessionStorage for all cross-origin iframes so storage events don't leak across contexts.

2. Tab isolation — Connecting or disconnecting a wallet in Tab A was affecting Tab B. A new providerIsolation.ts module wraps every EIP-1193 provider (both EIP-6963 and legacy window.ethereum) to block wallet_revokePermissions (which revokes permissions for the entire origin, not just the current tab) and filter accountsChanged events so they only fire in the tab where the wallet is active.

3. Widget standalone "Connection declined" on first Rabby connect — When the widget reloads, wagmi restores a stale connector UID from localStorage. AppKit's reconnect falls back to connect() without isReconnecting: true, firing eth_requestAccounts as a background call. A manual wallet connect click then triggers a second request, causing Rabby (and other strict wallets) to decline it. Fixed by disabling enableReconnect in the widget context.

Also upgrades wagmi, @wagmi/core, and @wagmi/connectors to their latest versions.

To Test

1. Open the app normally in two browser tabs with the same wallet (e.g. Rabby)

   • Connecting in Tab A should not auto-connect Tab B
   • Disconnecting in Tab A should not disconnect Tab B

2. Open the app as a Safe App (inside app.safe.global)

   • Switching wallets or disconnecting in a regular tab should not cause the Safe iframe to blink or lose connection
   • The Safe App should connect automatically via the Safe connector

3. Open the widget configurator in standalone mode (localhost:4200)

   • Connecting Rabby on the first attempt (fresh page load, no prior MetaMask connection) should succeed without "Connection declined"
   • Connecting MetaMask should also work normally

Background

The root cause of the Safe iframe blink was AppKit writing to localStorage under @appkit/* keys — those writes fire storage events in all same-origin iframes, including the Safe App frame. Redirecting those writes to sessionStorage inside cross-origin iframes isolates the storage state per context.

The wallet_revokePermissions issue is a wagmi behaviour: on disconnect, wagmi calls this method to clear wallet state, but the method revokes permissions for the entire origin (all tabs share the same permission grant). Blocking it at the provider level while keeping shimDisconnect: true is sufficient — shimDisconnect prevents reconnect on next page load without touching origin-wide permissions.

Summary by CodeRabbit

• Bug Fixes

  • Improved wallet connection handling during widget mode transitions
  • Enhanced provider event listener cleanup to prevent stale connections
  • Fixed wallet disconnection flow when switching between standalone and dapp modes

• New Features

  • Added improved wallet state isolation for better multi-tab stability
  • Enhanced session storage handling for wallet connector state

• Tests

  • Improved swap functionality test reliability with explicit default value verification

• Chores

  • Updated blockchain wallet library dependencies for compatibility and stability

[lgahdl]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tslib@​2.8.1

View full report