From 5c54198a6834caed0dde421fe888d95db5eb61f5 Mon Sep 17 00:00:00 2001
From: shwoop <monkey.mambo.al.ferguson@gmail.com>
Date: Wed, 2 Jul 2025 14:05:49 +0200
Subject: [PATCH] add address validation

---
 signer/core/siwevalidation.go | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/signer/core/siwevalidation.go b/signer/core/siwevalidation.go
index 73867f7b31..51eb08920a 100644
--- a/signer/core/siwevalidation.go
+++ b/signer/core/siwevalidation.go
@@ -21,6 +21,8 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+
+	"github.com/ethereum/go-ethereum/common"
 )
 
 // Regular expression to match SIWE messages
@@ -34,7 +36,7 @@ var domain = `(?:[^ ]+)`
 var wantsMsg = ` wants you to sign in with your Ethereum account:\n`
 
 // Ethereum address (with basic 0x prefix + 40 hex digits)
-var address = `0x[a-fA-F0-9]{40}\n`
+var address = `(?:0x[a-fA-F0-9]{40})\n`
 
 // Optional statement (any line not containing "\n\n")
 var statement = `(?:[^\n]+\n)?`
@@ -84,7 +86,7 @@ func validateSIWE(req *SignDataRequest) error {
 			continue
 		}
 		patterns := siweMessageRegex.FindStringSubmatch(s)
-		if len(patterns) != 14 {
+		if len(patterns) != 15 {
 			return ErrMalformedSIWEMEssage
 		}
 		scheme := "https"
@@ -94,6 +96,9 @@ func validateSIWE(req *SignDataRequest) error {
 		if err := validateDomain(req, scheme, patterns[1]); err != nil {
 			return err
 		}
+		if err := validateAddress(req, patterns[2]); err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -105,3 +110,13 @@ func validateDomain(request *SignDataRequest, scheme, domain string) error {
 	}
 	return nil
 }
+
+func validateAddress(request *SignDataRequest, address string) error {
+	checksumAddr := common.HexToAddress(address).Hex()
+	requestAddr := request.Address.Address().Hex()
+
+	if checksumAddr != requestAddr {
+		return fmt.Errorf("sign in request address (%s) does not match source: %s", checksumAddr, requestAddr)
+	}
+	return nil
+}