WalletConnect 2.25.0 Fixes CACAO Authentication Risks

Published: 2026-09-14 09:30:28 |

WalletConnect Sign Client 2.25.0 adds major security fixes to WalletConnect authentication and CACAO signature verification. The update makes validation fail closed when malformed signatures, attacker-controlled inputs or unsupported chains trigger errors. WalletConnect now also blocks session settlement when CACAO verification fails. Previously, an application could receive a rejected authenticate() response while an unverified session was still derived, subscribed and stored. The change removes that account-control risk. The new isCacaoBoundToRequest utility links each authentication response to its original request. It checks the domain, audience, nonce, requested chain, expiration and not-before fields. This helps stop a valid CACAO signed for one website from being reused by another dApp. Version 2.25.0 also adds URI support to AuthTypes.CacaoPayload and updates @walletconnect/utils, @walletconnect/types and @walletconnect/core. WalletConnect developers and dApp operators should upgrade promptly. For crypto traders, the WalletConnect security update is mainly an infrastructure and trust improvement, rather than a direct token-market catalyst. It may reduce authentication, session-hijacking and account-control risks across integrated wallets and dApps.

Neutral

The WalletConnect 2.25.0 release does not introduce a token, change network economics or directly affect demand for a major cryptocurrency. Its immediate effect is improved security for wallet authentication and dApp sessions. In the short term, traders may see limited price reaction because infrastructure patches rarely create direct buying pressure, although developers and users could respond positively to the reduced risk of session hijacking and unauthorized account control. Over the longer term, stronger CACAO verification and request binding could improve trust in WalletConnect integrations and support safer Web3 usage. That may benefit ecosystem activity indirectly, but the impact is unlikely to translate into a clear price catalyst. Since WalletConnect has no widely established native trading token referenced in the reports, the expected market impact remains neutral.