fix(siwe): reject unparseable expirationTime and notBefore

[SashaMIT]

Summary

parseSiweMessage turns fields like Expiration Time: never into a truthy Invalid Date. In validateSiweMessage, the lifetime checks were:

if (message.expirationTime && time >= message.expirationTime) return false
if (message.notBefore && time < message.notBefore) return false

Comparisons against Invalid Date are always false, so both gates no-op and a signed SIWE message with garbage expiration / not-before still validates. This rejects unparseable dates when those fields are present (same class as thirdweb-dev/js#8875 and supabase/auth#2688).

Test plan

• pnpm exec vitest run -c ./test/vitest.config.ts src/utils/siwe/validateSiweMessage.test.ts → 12/12
• Cases for Expiration Time: never / garbage Not Before

Made with Cursor

[changeset-bot]

⚠️ No Changeset found

Latest commit: f0ebf3d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@SashaMIT is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[jxom]

Two remaining cases:

• getTime() checks JavaScript date validity, not RFC 3339. Validate the raw SIWE timestamp before converting it to Date.
• An invalid time makes both lifetime comparisons false. Reject it before checking expirationTime or notBefore.

See the ERC-4361 validation requirements.