Connecting shares an address, not the secret behind it

async function connectWallet(wallet) {
  selectedWallet = wallet;
  statusLine.textContent = t("login.status.connecting", { wallet: wallet.name });

  try {
    const result = await wallet.provider.connect();
    const publicKey = result?.publicKey || wallet.provider.publicKey;
    if (!publicKey) throw new Error(t("login.status.publicKeyMissing"));

    await ensureLoginWalletNetwork(wallet.provider);
    walletAddress = publicKey.toString();
    persistConnectedWallet({ walletAddress, walletName: wallet.name });
    await initialize();
  } catch (error) {
    statusLine.textContent = loginNetworkErrorMessage(error) || error?.message || t("login.status.connectFailed");
  }
}

The page asks the installed provider to connect, requires a returned public key, runs its separate network check, and stores a browser binding before continuing. There is no signMessage or transaction call in this function. The catch path displays a failure rather than inventing a connected address.

1. 1-3

   Remember which wallet button was chosen and tell the player that the provider connection is starting.

2. 5-8

   Ask the wallet to connect, then accept only a result that exposes a public key.

3. 10-13

   Run the network check, convert the public key to an address string, store the local binding, and refresh the login state.

4. 14-17

   If connection or the network step fails, show the error and do not advance this function as a successful connection.

    const connectResult = await provider.connect();
    const publicKey = publicKeyToString(connectResult?.publicKey || provider.publicKey);
    if (!publicKey) throw new Error("Missing wallet public key.");
    await ensureLoginWalletNetwork(provider);

    const encodedMessage = new TextEncoder().encode(challenge.message);
    const signResult = await provider.signMessage(encodedMessage, "utf8");
    const signature = signatureToBytes(signResult);
    if (!signature?.length) throw new Error("Missing wallet signature.");
    const bs58 = await loadBs58();

    const proof = {
      version: 1,
      walletName: "Phantom",
      publicKey,
      signature: bs58.encode(signature),
      challenge,
    };

This is a different path inside the Phantom wallet browser. It connects, checks the network, encodes the exact challenge message, and explicitly calls signMessage. The resulting local proof contains the public key, signature, and challenge; it contains no private key and creates no Solana transaction. The browser later verifies it with TweetNaCl, subject to the replay and challenge-binding limitations described above.

1. 1-4

   Connect inside the wallet browser, obtain the public address, and run the same best-effort network check.

2. 6-9

   Turn the exact challenge text into bytes, ask for a message signature, and reject an empty result.

3. 11-17

   Package only the proof version, wallet label, public key, encoded signature, and original challenge for local verification.

  for (const signer of extraSigners) transaction.partialSign(signer);

  if (typeof provider.signTransaction === "function") {
    const signed = await provider.signTransaction(transaction);
    const signature = await sendRawTransactionWithLogs(conn, signed.serialize(), "wallet");
    await confirmTransactionByHttpPolling(conn, {
      signature,
      blockhash: transaction.recentBlockhash,
      lastValidBlockHeight: transaction.lastValidBlockHeight,
    }, "confirmed");
    return signature;
  }

This branch runs only after a transaction has been prepared with a fee payer and recent blockhash above the excerpt. Extra signers sign first, then the external provider gets a separate signTransaction request. NiceChunk sends those signed bytes and polls for confirmed before returning the signature. A connection approval does not execute these lines, and this function does not wait for finalized.

1. 1

   Apply any additional signatures the exact instruction requires; this does not replace the wallet owner's signature.

2. 3-5

   If the wallet supports transaction signing, ask it to sign the prepared bytes and then send the serialized signed transaction.

3. 6-10

   Poll the returned signature with the prepared blockhash limits until the client's confirmed condition is satisfied or the routine fails.

4. 11-12

   Only after that wait does this branch return the signature to its caller.

  onStatus?.({ type: "switching", requiredCluster, detectedCluster });
  let switchResult = null;
  try {
    switchResult = await requestWalletSolanaClusterSwitch(provider, requiredCluster);
  } catch (error) {
    if (!detectedCluster && !isUserRejectedError(error)) {
      onStatus?.({ type: "ready", requiredCluster, detectedCluster: "" });
      return {
        requiredCluster,
        detectedCluster: "",
        switched: false,
        unknown: true,
        unverified: true,
        switchUnsupported: error?.code === "unsupported",
      };

The client first reports that it is trying to switch. If no cluster could be detected and the switch attempt fails for a reason other than player rejection, this branch can report ready while returning unknown and unverified flags. That is a compatibility choice, not a genesis-hash check or proof that the provider and RPC are aligned.

1. 1-4

   Tell the interface a switch is being attempted, then call one of the provider-specific switch methods.

2. 5-7

   Enter the compatibility branch only when no cluster was detected and the failure was not an explicit player rejection.

3. 8-15

   Return the required cluster as guidance while honestly marking the detected cluster empty, not switched, unknown, and unverified.

  function disconnectWallet() {
    const provider = detectWalletProvider();
    try {
      if (provider?.disconnect) {
        Promise.resolve(provider.disconnect()).catch(() => {
          // The local session is already cleared; plugin disconnect is best effort.
        });
      }
    } catch {
      // Some wallet plugins throw when already disconnected.
    }
    clearWalletSession();
    state.walletAddress = "";
    state.sessionLamports = getStoredSessionLamports("");
    resetWalletBalance();
    dispatchWalletChanged("");
    globalThis.location?.replace?.(buildWalletLoginUrl({
      redirectPath: `${globalThis.location?.pathname || "/play/"}${globalThis.location?.search || ""}${globalThis.location?.hash || ""}`,
      autoConnect: false,
    }));

Play asks an available provider to disconnect, but failures are deliberately ignored so local logout can continue. It then clears the wallet session, resets local wallet and balance presentation, announces the change, and returns to login. Nothing here submits a revoke or close instruction, deletes the separately stored built-in Game Wallet record, reverses a completed transaction, or returns funds from a temporary Session key.

1. 1-10

   Find the current provider and ask it to disconnect when possible, while treating rejection or an already-disconnected error as non-blocking.

2. 12-16

   Clear the browser wallet session and wallet-scoped display state, then notify other local components that no wallet is selected.

3. 17-20

   Return to the login route with a safe local path back to the current game page and without automatic reconnection.