Both problems are real, and they have different causes. I haven't told @surfcoderepeat yet: I wrote a ready-to-send message, but I didn't post it, because messaging someone on a public platform is something you should do or approve first.

Site	Project ID the live site uses	What WalletConnect's server says	Cause
imd.fun	5b3bd5688d21f6be053d6c1c018e2ec8, a fallback written into the code	3000 Unauthorized: origin not allowed	The project exists, but imd.fun isn't on its list of allowed domains
pool4.imd.fun	IMD_DEMO_PROJECT_ID, the placeholder text itself	3000 Project not found	The placeholder was never replaced with a real project ID

How I checked: I downloaded each site's code and found where the project ID is set. Then I connected to WalletConnect's server (relay.walletconnect.org) with each ID, claiming to come from each site's address, and recorded the replies. Everything was read-only.

• imd.fun: the ID was rejected from imd.fun, www, explorer and pool4, and from an unrelated test domain. It was accepted from localhost. WalletConnect's documentation says localhost is always allowed and that an empty allowed-domains list accepts everyone. So the project is fine; its list just has other domains on it and not imd.fun.
• pool4: the placeholder is passed through unchanged. The wallet library only swaps in its own default when the value is exactly YOUR_PROJECT_ID. The cached copy of the live pool4 site is about 25 days old.

Fixes:

• imd.fun: add https://imd.fun (and www/explorer if they connect wallets) to that project's allowed domains in the WalletConnect dashboard. No redeploy is needed.
• pool4: set a real project ID, make sure pool4.imd.fun is on its allowed list, and redeploy.

Limits:

• I didn't test in a real browser with a wallet. I reproduced the connection request the wallet library makes and read the server's replies, so what users actually see is my inference. I expect QR-code and mobile connections to fail, while browser-extension wallets probably still work.
• I can't see the WalletConnect dashboard, so I only know which domains are rejected, not what is on the list.
• That @surfcoderepeat (Adam) created IMD comes from one secondary source, a KuCoin blog post from 2026-09-29. The sites don't say who made them. The handle exists on X; there's no GitHub account by that name, and the sites list no contact address.

Also noticed: both sites put Alchemy API keys in their public code. That's common for websites, but it's worth checking whether those keys are restricted on Alchemy's side.

The report and the draft message are in artifacts/report.md, with a short artifacts/README.md. Both are left untracked as required. To notify @surfcoderepeat, send the draft at the end of the report by X DM or reply, or in the IMD Discord. I can post it if you tell me how you'd like it sent.

Sources:

• Reown relay docs (allowlist, localhost rule)
• KuCoin blog: creator attribution
• @surfcoderepeat on X