Require signature to submit challenge

[websurferdoteth]

Linked to CLI PR #130

Why

We don't currently require any authentication to submit a challenge, and it is possible for anyone to send contract submissions for anyone else.

How

• Adds extra validation to the /submit endpoint, requiring a message signed by the user's account
• Adds a GET /message/:userAddress endpoint for the CLI to get the correct message to be signed

Screencast.from.2025-08-27.14-22-11.webm

[websurferdoteth]

This nonce is what I am unsure about. I'd like have someway to invalidate old signatures once they've been used. Not sure if there is a more standard approach than a nonce, like maybe a timestamp?

Also wondering if there is a more standard way the message itself should be structured?

[escottalexander]

Why do we need to invalidate them? They are just proving that a certain address is the one submitting a challenge. Somebody could maliciously send the same signature later but first they would have to do a man in the middle attack. What am I missing?

[escottalexander]

I like a timestamp more than a nonce. That way we don't need to track nonces, we just need to look at the current time. Still not sure we need it though.

[websurferdoteth]

Ok got it, thanks. You're not missing anything. The only reason to add a nonce or timestamp would be to prevent signatures from being leaked and reused. But that does seem like overkill for ETT.