@ancilar
A team migrating off Farcaster sign in shipped SIWE with no nonce validation.
The message was signable. It was also replayable, and not bound to their domain. One captured signature was a reusable session, indefinitely.
This will be a common finding this year. The Base App no longer surfaces FID based identity, so teams that leaned on Farcaster auth are rebuilding their front door under time pressure. The rebuild is where shortcuts get taken.
We surfaced it by capturing a signature from one session and using it to open another, on a different origin, days later.
The fixes are standard, which is why they get skipped:
→ server side nonce per attempt, invalidated on use
→ bind domain and chain id, verify both server side
→ set issuedAt and expirationTime, reject anything stale
SIWE is your front door now. A replayable login is a lock painted onto an open door.
0 reply
0 recast
0 reaction