fix(siwe): reject unparseable expirationTime and notBefore

[SashaMIT]

Summary

parseSiweMessage turns fields like Expiration Time: never into a truthy Invalid Date. In validateSiweMessage, the lifetime checks were:

if (message.expirationTime && time >= message.expirationTime) return false
if (message.notBefore && time < message.notBefore) return false

Comparisons against Invalid Date are always false, so both gates no-op and a signed SIWE message with garbage expiration / not-before still validates. This rejects unparseable dates when those fields are present (same class as thirdweb-dev/js#8875 and supabase/auth#2688).

Test plan

• pnpm exec vitest run -c ./test/vitest.config.ts src/utils/siwe/validateSiweMessage.test.ts → 12/12
• Cases for Expiration Time: never / garbage Not Before

Made with Cursor

[changeset-bot]

🦋 Changeset detected

Latest commit: 832afb1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
viem	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@SashaMIT is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[jxom]

Two remaining cases:

• getTime() checks JavaScript date validity, not RFC 3339. Validate the raw SIWE timestamp before converting it to Date.
• An invalid time makes both lifetime comparisons false. Reject it before checking expirationTime or notBefore.

See the ERC-4361 validation requirements.

[SashaMIT]

Thanks @jxom. Follow-up covers both cases:

1. Raw SIWE timestamps are checked against the EIP-4361 / RFC 3339 profile before Date coercion in parseSiweMessage.
2. Invalid caller time is rejected before expirationTime / notBefore comparisons.

Added a changeset. SIWE unit tests green locally (25/25).

[SashaMIT]

Thanks for the merge @jxom. Glad the RFC 3339 and invalid-time follow-up landed with the original fail-closed checks.