📌 Description
internal/auth/verify.go (175 lines) verifies the signed SIWE message against the claimed wallet address. There's no dedicated test file, so edge cases like a valid signature over a different message, or a signature from a different key, aren't demonstrably rejected.
🧩 Requirements and context
- Add a test where the signature is valid but over a different message payload (must be rejected).
- Add a test where the address case (checksum vs lowercase) differs from the signing key's derived address.
- Add a test for a truncated/malformed signature byte string.
Non-functional requirements
- Must be secure, tested, and documented.
- Should be efficient and easy to review.
🛠️ Suggested execution
1. Fork the repo and create a branch
git checkout -b test/auth-verify-signature-edge-cases
2. Implement changes
- Add test: new
internal/auth/verify_test.go.
3. Test and commit
go test ./internal/auth/... -run Verify -v
- Cover edge cases: signature-message mismatch, address-case mismatch, malformed signature bytes, empty signature.
- Include test output and details in the PR description.
Example commit message
test: add signature verification edge-case tests to internal/auth/verify.go
✅ Acceptance criteria
🔒 Security notes
This is the core wallet-auth trust boundary. Validate that address comparison is case-insensitive-correct (checksummed) and that signature verification can't be tricked by a valid-but-unrelated signature.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
internal/auth/verify.go(175 lines) verifies the signed SIWE message against the claimed wallet address. There's no dedicated test file, so edge cases like a valid signature over a different message, or a signature from a different key, aren't demonstrably rejected.🧩 Requirements and context
Non-functional requirements
🛠️ Suggested execution
1. Fork the repo and create a branch
2. Implement changes
internal/auth/verify_test.go.3. Test and commit
go test ./internal/auth/... -run Verify -vExample commit message
✅ Acceptance criteria
🔒 Security notes
This is the core wallet-auth trust boundary. Validate that address comparison is case-insensitive-correct (checksummed) and that signature verification can't be tricked by a valid-but-unrelated signature.
📋 Guidelines