From e847f2724348943c57e8fa08a905207c364dd6c1 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Thu, 26 Feb 2026 03:59:21 +0700
Subject: [PATCH] Clear in-memory site approvals on address switch

Non-remembered approvals should not survive switching to a different
address and back. Wipe connectedSites when broadcasting
accountsChanged so temporary approvals require re-prompting.
---
 src/background/index.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/background/index.js b/src/background/index.js
index 7f980f6..799bf73 100644
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -332,6 +332,10 @@ async function handleRpc(method, params, origin) {
 
 // Broadcast accountsChanged to all tabs, respecting per-address permissions
 async function broadcastAccountsChanged() {
+    // Clear non-remembered approvals on address switch
+    for (const key of Object.keys(connectedSites)) {
+        delete connectedSites[key];
+    }
     const s = await getState();
     const activeAddress = await getActiveAddress();
     const allowed = activeAddress ? s.allowedSites[activeAddress] || [] : [];