safe-global / safe-client-gateway / 27822793011 / 1

90%

main: 88%

Pull #3173

github

fix: tolerate client/server clock skew when validating SiWe message time bounds

SiWe message time bounds (issuedAt, expirationTime, notBefore) were compared
against the server clock with zero tolerance, so a freshly-signed message whose
issuedAt was a few seconds ahead of the server (clock skew) was rejected with
"Message yet issued" until the server clock caught up.

Add a configurable clock-skew allowance applied symmetrically to the three time
bounds. It is sourced from AUTH_CLOCK_SKEW_SECONDS (default 30s) via
IConfigurationService and passed into the SiWe message schema, which becomes a
factory (buildSiweMessageSchema) following the existing schema-factory pattern.
Replay/freshness remain enforced by the single-use, TTL-bound nonce, so the
tolerance does not weaken those guarantees.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

3295 of 5722 branches covered (57.58%)

Branch coverage included in aggregate %.

29631 of 36521 relevant lines covered (81.13%)

261.04 hits per line