Verifying real wallet ownership without gas: a signed-nonce pattern with viem + Express

A production walkthrough of the auth pattern powering CoinHawk's admin layer — and why "the client says they're 0xABC" is a security bug. The naive way (and why it's broken) When a user connects MetaMask to your dapp, the browser hands you their wallet address through window.ethereum.request({ method: "eth_requestAccounts" }) . Tempting flow: Frontend asks MetaMask for the address Frontend POSTs { address: "0xABC..." } to your backend Backend stores it on the session Backend uses that address to