skills.rest
IagoPrandi
IagoPrandiCOMMUNITY
Explore all skills by this author →
GitHub

web2-wallet-auth

Implement replay-safe Web2 wallet authentication using SIWE, EIP-712, and ERC-1271 signature verification.

Updated Jul 28, 2026
Search Tags:#security#signature verification#SIWE#EIP-712#wallet authentication#erc-1271#web3 login
One-click install
npx skills add https://github.com/IagoPrandi/zeroclaw-plugin --skill web2-wallet-auth-iagoprandi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web2-wallet-auth
Source: https://github.com/IagoPrandi/zeroclaw-plugin/tree/main/.claude/skills/web2-wallet-auth
Command: npx skills add https://github.com/IagoPrandi/zeroclaw-plugin --skill web2-wallet-auth-iagoprandi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Wallet-based login flows are frequently vulnerable to replay attacks, IDOR, and smart-wallet incompatibility when developers verify signatures with ecrecover alone or skip nonce, domain, and chainId validation. This Skill provides a canonical, security-first implementation and review checklist for Web2 wallet authentication. ## Core Features & Use Cases - Replay-safe challenge/verify flow: Server-issued nonces with expiry, one-time use, and atomic state transitions for SIWE or EIP-712 logins. - Dual signature verification: Supports both EOA (ECDSA recovery) and smart contract wallets via ERC-1271 isValidSignature eth_call. - Authorization and abuse controls: Role-based least privilege, anti-IDOR ownership checks, rate limiting, and redacted structured logging. - Use Case: When adding a wallet login endpoint to an existing web app, use this Skill to design the /auth/challenge and /auth/verify routes, then audit the result against its testing checklist covering replay, expiry, and IDOR attempts. ## Quick Start Review my wallet login and session endpoints using the web2-wallet-auth checklist and identify any replay, smart-wallet, or authorization vulnerabilities.

Frequently Asked Questions about web2-wallet-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement Sign-In with Ethereum (SIWE) securely?▼

Implement SIWE with a server-issued random nonce stored per address, a short expiry of 5-10 minutes, and one-time-use enforcement marked atomically after verification. Validate the domain and chainId in the signed message before issuing a session.

How to verify smart contract wallet signatures with ERC-1271?▼

Verify ERC-1271 signatures by calling isValidSignature(messageHash, signature) on the wallet contract via an RPC eth_call. This is required alongside ECDSA recovery because ecrecover alone cannot validate smart wallet signatures.

Does ecrecover work for all Ethereum wallet logins?▼

No, ecrecover only works for externally owned accounts with ECDSA signatures. Smart contract wallets require ERC-1271 verification through eth_call, so treating ecrecover as universal breaks smart wallet login support.

How do I prevent replay attacks in wallet authentication?▼

Prevent replay attacks by generating a unique random nonce per challenge, storing it with an unused status and expiry timestamp, and marking it used atomically during verification. Reject reused, expired, or mismatched domain and chainId values.

What should never be logged in wallet auth flows?▼

Never log full signatures, full nonces, tokens, keys, or PII in clear text. Use structured logs with request correlation IDs and redaction so audit trails remain useful without leaking sensitive authentication material.

Related Skills

Explore More Software Engineering Skills→
cyoteecyotee

viem

Provide a type-safe TypeScript interface for Ethereum RPC actions.

Community
Advanced
hashintelhashintel
7

router-core-auth-and-guards

Implement route guards and RBAC with TanStack Router and React context.

Official
Intermediate
denish12denish12

qa_security_smoke_tests

Run automated smoke tests to identify API security weaknesses.

Community
Advanced
IagoPrandiIagoPrandi

web2-wallet-auth

Implement replay-safe Web2 wallet authentication using SIWE, EIP-712, and ERC-1271 signature verification.

Community
Intermediate