fix(cacao): reject expired and not-before timestamps

packages/reown_sign/lib/sign_engine.dart

@@ -1876,6 +1876,13 @@ class ReownSign implements IReownSign {
     final CacaoPayload payload = cacao.p;
 
     try {
+      if (!AuthSignature.isWithinValidityWindow(
+        exp: payload.exp,
+        nbf: payload.nbf,
+      )) {
+        return false;
+      }
+
       final reconstructed = formatAuthMessage(
         iss: payload.iss,
         cacaoPayload: CacaoRequestPayload.fromCacaoPayload(payload),

packages/reown_sign/lib/utils/auth_signature.dart

@@ -1,5 +1,6 @@
 import 'dart:convert';
 import 'dart:typed_data';
+
 import 'package:convert/convert.dart';
 import 'package:http/http.dart' as http;
 
@@ -153,6 +154,29 @@ class AuthSignature {
     }
   }
 
+  /// Returns true when optional CACAO `exp` / `nbf` are absent or [now]
+  /// is inside the validity window. Unparseable timestamps fail closed.
+  static bool isWithinValidityWindow({
+    String? exp,
+    String? nbf,
+    DateTime? now,
+  }) {
+    final clock = now ?? DateTime.now().toUtc();
+    if (exp != null) {
+      final expTime = DateTime.tryParse(exp)?.toUtc();
+      if (expTime == null || !clock.isBefore(expTime)) {
+        return false;
+      }
+    }
+    if (nbf != null) {
+      final nbfTime = DateTime.tryParse(nbf)?.toUtc();
+      if (nbfTime == null || clock.isBefore(nbfTime)) {
+        return false;
+      }
+    }
+    return true;
+  }
+
   // verifies CACAO signature
   // Used by the wallet after formatting the message
   static Future<bool> verifySignature(

packages/reown_sign/test/auth/cacao_validity_window_test.dart

@@ -0,0 +1,77 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:reown_sign/reown_sign.dart';
+
+void main() {
+  final now = DateTime.fromMillisecondsSinceEpoch(
+    1700000000 * 1000,
+    isUtc: true,
+  );
+
+  test('absent exp and nbf are valid', () {
+    expect(AuthSignature.isWithinValidityWindow(now: now), isTrue);
+  });
+
+  test('future exp is valid', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(
+        exp: '2024-01-01T00:00:00Z',
+        now: now,
+      ),
+      isTrue,
+    );
+  });
+
+  test('past exp is expired', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(
+        exp: '2023-01-01T00:00:00Z',
+        now: now,
+      ),
+      isFalse,
+    );
+  });
+
+  test('exp equal to now is expired', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(
+        exp: '2023-11-14T22:13:20Z',
+        now: now,
+      ),
+      isFalse,
+    );
+  });
+
+  test('past nbf is valid', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(
+        nbf: '2023-01-01T00:00:00Z',
+        now: now,
+      ),
+      isTrue,
+    );
+  });
+
+  test('future nbf is not yet valid', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(
+        nbf: '2024-01-01T00:00:00Z',
+        now: now,
+      ),
+      isFalse,
+    );
+  });
+
+  test('unparseable exp fails closed', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(exp: 'not-a-timestamp', now: now),
+      isFalse,
+    );
+  });
+
+  test('unparseable nbf fails closed', () {
+    expect(
+      AuthSignature.isWithinValidityWindow(nbf: 'not-a-timestamp', now: now),
+      isFalse,
+    );
+  });
+}