WalletConnect is broken on imd.fun and pool4.imd.fun: evidence report for @surfcoderepeat

Date of investigation: 2026-10-05 (UTC, about 10:25 to 10:35) Method: read-only. I downloaded the public HTML and JS bundles of both sites, then made WebSocket handshakes to the WalletConnect relay (wss://relay.walletconnect.org) with each project ID, sending the site's Origin header. I logged in nowhere and changed nothing.

TL;DR

Both claims in the request are confirmed, and the two sites fail for different reasons:

Site	Project ID shipped in the bundle	Relay response from the site's origin	Root cause
https://imd.fun/	5b3bd5688d21f6be053d6c1c018e2ec8 (hard-coded fallback)	{"code":3000,"message":"Unauthorized: origin not allowed"}	The project exists, but its Reown/WalletConnect Cloud allowlist does not include imd.fun (or www.imd.fun, explorer.imd.fun, pool4.imd.fun).
https://pool4.imd.fun/	IMD_DEMO_PROJECT_ID (literal placeholder string)	{"code":3000,"message":"Project not found"}	The placeholder was never replaced with a real project ID.

Fixes:

• imd.fun: in the Reown dashboard, add https://imd.fun to the allowlist of project 5b3bd568…2ec8. Also add www.imd.fun and explorer.imd.fun if they use wallet connections. No redeploy is needed.
• pool4: set a real project ID and redeploy. Its origin must be on that project's allowlist (https://pool4.imd.fun, or *.imd.fun).

1. Facts (directly observed, reproducible)

1.1 imd.fun

• F1. The imd.fun page chunk /_next/static/chunks/app/page-39311abfceaabad0.js (deployment dpl_HYr36wGCk4tnM2TfVn5vJU993pga, sha256 0b9918ef…4ba8) contains:

  let a = i.env.NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID || "5b3bd5688d21f6be053d6c1c018e2ec8"
  

  The same constant is in /token/'s page-ab9ac9690384fa9f.js.

• F2. The lazy chunk /_next/static/chunks/6023.17edcb64d7c8345a.js (sha256 d7162290…04d2) passes that value to RainbowKit's getDefaultConfig:

  (0,u.vX)({appName:"IMD",projectId:C.yh,chains:[b.u,h.R,x.o],wallets:[{groupName:"Popular",wallets:[…]}], …})
  

  9551.057f1f18ac584e8a.js contains the same config. The chains are Base, Ethereum mainnet and Robinhood chain, based on the RPC constants in the same module.

• F3. Relay handshakes with project 5b3bd5688d21f6be053d6c1c018e2ec8 gave these results. The tests ran twice, and the second run also included relay.walletconnect.com, with identical results.

  Origin header	Relay reply
  https://imd.fun	Unauthorized: origin not allowed (code 3000)
  https://www.imd.fun	Unauthorized: origin not allowed
  https://explorer.imd.fun	Unauthorized: origin not allowed
  https://pool4.imd.fun	Unauthorized: origin not allowed
  https://example.com (control)	Unauthorized: origin not allowed
  http://localhost:3000	connection accepted, no error frame within 4 s
  (no Origin header)	connection accepted, no error frame within 4 s

• F4. Reown's relay docs say: "Using localhost (or 127.0.0.1) is always permitted, and if empty all origins are allowed." Hostnames must match exactly, and wildcards are allowed per label. Source: https://docs.reown.com/cloud/relay

1.2 pool4.imd.fun

• F5. The pool4 chunk /_next/static/immutable/chunks/00kadx1u3psjv.js (sha256 68627180…d01c) contains:

  C=(0,n.getDefaultConfig)({appName:"IMD",projectId:"IMD_DEMO_PROJECT_ID",chains:[k.CHAIN],transports:{…},ssr:!0})
  

• F6. The bundled RainbowKit only substitutes its own fallback ID when the value is exactly "YOUR_PROJECT_ID" (return"YOUR_PROJECT_ID"===e&&(e="21fef48091f12692cad574a6f7753643") in 1efog54gvgz4p.js). So IMD_DEMO_PROJECT_ID is sent to the relay unchanged.
• F7. The relay answers Project not found (code 3000) for IMD_DEMO_PROJECT_ID, both from https://pool4.imd.fun and from http://localhost:3000. Reown's config API (api.web3modal.org/appkit/v1/config) returns HTTP 403 Forbidden for this ID, but HTTP 200 for 5b3bd568….
• F8. Vercel reported age: 2130494 (about 24.7 days) on the cached pool4 HTML. That means the live pool4 build was deployed around 2026-09-10 or earlier and has not been rebuilt since.

1.3 Other observations made along the way

• F9. Both bundles embed Alchemy RPC URLs with API keys in client code. imd.fun uses alch_sn3U… as a fallback for both Base and mainnet, and pool4 uses alch_kw7j…. This is common practice for frontends and not a vulnerability by itself. It does mean the keys are public, so domain or rate restrictions on the Alchemy side are worth checking.

2. Inferences (reasoned from the facts, not directly observed)

• I1 (high confidence). In the live imd.fun build, the effective project ID is the fallback 5b3bd568…2ec8. Next.js inlines NEXT_PUBLIC_* values at build time. If the env var had been set, the bundle would contain the literal value rather than the env.X || "…" expression (F1).
• I2 (high confidence). The project 5b3bd568… exists and is active, since localhost is accepted (F3, F4). Its allowlist is non-empty but lacks imd.fun: an empty allowlist would accept every origin (F4), but example.com and all imd.fun hosts are rejected. Likely explanations: the project was set up for a different domain, or it is the default ID from a template/earlier project that was reused.
• I3 (high confidence). On imd.fun, the injected-wallet route (browser extension) probably still works, because it does not use the relay. QR-code and mobile-deep-link flows (WalletConnect proper) fail. In a real browser you would see a console error such as Unauthorized: origin not allowed.
• I4 (high confidence). On pool4, every WalletConnect-based flow fails with "Project not found". Injected wallets are probably unaffected.

3. Uncertainty and limits

• I did not drive a real browser or wallet. The failure is shown at the relay-protocol level by emulating the handshake the WalletConnect SDK makes, with an ed25519 did:key JWT and the projectId and Origin headers. The user-visible symptom is inferred from that, not screenshotted.
• I can't see the Reown dashboard, so the actual allowlist contents for 5b3bd568… are unknown. I only know what it rejects and accepts.
• The relay's code 3000 messages (Unauthorized: origin not allowed, Project not found) are not listed in the Reown docs page I consulted. I report them verbatim as observed.
• Results reflect the deployments live on 2026-10-05. A redeploy or dashboard change after that date would change them.

4. Who to notify, and how (unanswered part of the request)

• Who: the request names @surfcoderepeat as the creator. A KuCoin blog post dated 2026-09-29 says: "The journey of IMD began with Fren Pet … released on Base in August 2023 by developer Adam, known as @surfcoderepeat." (https://www.kucoin.com/blog/vn-imd-token-community-owned-ai-agents). That is a secondary source. I found no creator attribution on imd.fun itself. The handle is an X/Twitter account (https://x.com/surfcoderepeat). There is no GitHub user with that name (GitHub API returned 404).
• Contact channel: none found on the sites. There is no /.well-known/security.txt (404), no repo link for the frontend, and no contact address.
• Not done: I did not send a message to @surfcoderepeat. Contacting a third party on a public platform is an outward-facing action that this task did not authorize, and I have no account to do it from. The draft below is ready for a human to send (X DM/reply, or the IMD community Discord).

Draft message

Hi @surfcoderepeat, heads-up: WalletConnect (QR/mobile) is broken on two IMD frontends, for different reasons. Checked 2026-10-05:

1. imd.fun: the bundle uses fallback projectId 5b3bd568…2ec8 (NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID isn't set at build). The relay rejects it from https://imd.fun with 3000 Unauthorized: origin not allowed (localhost works, so the project is fine; the allowlist just doesn't include imd.fun). Fix: add https://imd.fun (plus www/explorer if needed) to that project's allowlist in the Reown dashboard. No redeploy needed.
2. pool4.imd.fun: getDefaultConfig({ projectId: "IMD_DEMO_PROJECT_ID" }) is shipped literally, and the relay returns 3000 Project not found. Fix: set a real project ID and redeploy, with pool4.imd.fun on its allowlist.

Injected wallets (extensions) should still work on both. Full evidence: [link to this report]

5. How to reproduce

1. curl -s https://pool4.imd.fun/_next/static/immutable/chunks/00kadx1u3psjv.js | grep -o 'projectId:"[^"]*"' should print projectId:"IMD_DEMO_PROJECT_ID".
2. curl -s 'https://imd.fun/_next/static/chunks/app/page-39311abfceaabad0.js?dpl=dpl_HYr36wGCk4tnM2TfVn5vJU993pga' | grep -o 'WALLETCONNECT_PROJECT_ID||"[0-9a-f]*"'
3. Open https://imd.fun, open DevTools, choose "Connect", then pick WalletConnect / QR. The console and network (WS) tabs show the relay error. Doing the same on pool4.imd.fun shows Project not found.