[SashaMIT]

Summary

• configureServerSideSIWE checked the session nonce, then called verifySiweMessage without a domain.
• Viem only compares the EIP-4361 domain when that argument is passed, so a signature minted for another host could mint a session here.
• Verify now fail-closes unless the message domain matches an explicit domain option or the request Host, and that value is forwarded to viem.

Attacker already controls a site that can prompt a wallet signature. They do not already control this app's host or SESSION_SECRET. Domain bind is the remaining guard.

Not the SIWE Invalid Date class. Distinct from rainbow-me/rainbowkit#2690 (example-only iron-session verify). This is the published connectkit-next-siwe helper.

Test plan

• npx tsx --test src/siweDomain.test.ts 7/7
• Revert-tested: dropping the equality check lets evil.example match app.example.com
• Behind a reverse proxy, pass domain: 'app.example.com' so Host is not the only bind

Made with Cursor

[vercel]

@SashaMIT is attempting to deploy a commit to the Aave Team on Vercel.

A member of the Team first needs to authorize it.