Implement EIP-712 replay protection for guild role delegation

[Lakes41]

Difficulty: Expert
Type: Security
Recommended labels (if available in this repo): security, eip712, sdk

Background

src/eip712/guildRoleDelegation.ts implements EIP-712 typed-data signing for delegating guild roles. Typed-data signature schemes are vulnerable to replay attacks unless explicit protections (nonces, domain separators, expiry) are enforced both when signing and when the resulting signature is later verified.

Problem

If guildRoleDelegation.ts does not currently enforce single-use nonces and expiry on delegation signatures, a captured signed delegation message could be replayed (re-submitted) by an attacker to re-apply a delegation the signer intended as a one-time action, or replayed across chains/contracts if the domain separator is insufficiently scoped.

Expected Outcome

Delegation messages include a mandatory nonce and expiry timestamp as part of the signed payload, with the domain separator correctly scoped to chain ID and verifying contract per EIP-712, and the SDK exposes helpers for consumers to track/validate nonce usage client-side before submission.

Suggested Implementation

Audit the current typed-data struct in guildRoleDelegation.ts and eip712.types.ts for nonce and expiry fields. Add them if missing, following EIP-712 domain separator best practices (chain ID + verifying contract address bound into the domain). Add a nonce-tracking helper (even a simple monotonic counter fetched from the API) so consumers don't have to manage this manually.

Acceptance Criteria

• Signed delegation payload includes a nonce and expiry timestamp
• Domain separator is scoped to chain ID and verifying contract address
• A test demonstrates that replaying an expired or already-used delegation signature is rejected by the validation helper
• Backward-incompatible payload change is clearly documented as a breaking change in CHANGELOG.md
• pnpm test:run passes

Likely Affected Files/Directories

• src/eip712/guildRoleDelegation.ts
• src/eip712/eip712.types.ts
• src/eip712/eip712.helpers.ts
• CHANGELOG.md

[Lspnjr1]

Hello maintainers,
I’m Lspnjr1
I would like to be assigned to this issue. After reviewing the requirements, I’m confident that I understand the scope of the task and the project’s contribution criteria. I believe I can deliver a clean, maintainable implementation that aligns with the project’s standards.

[peter-j23]

Hi maintainer,
I’m particularly interested in tackling this issue as it aligns well with my experience.

A bit about myself, I have 4 years of experience building production-grade software, so I’m comfortable with strict testing, CI pipelines, and writing clean, documented code. And i will like to resolve this issue if assigned