Harden verify-token: parse SIWE address field instead of regex

[osr21]

What

In pages/api/verify-token.ts, derive the airdrop wallet address from the parsed SIWE address field instead of a loose regex over the raw message.

- const addressMatch = message.match(/0x[a-fA-F0-9]{40}/);
- const walletAddress = addressMatch ? addressMatch[0] : '';
+ walletAddress = new SiweMessage(message).address;

Why

The previous code extracted the recipient with message.match(/0x[a-fA-F0-9]{40}/), which returns the first 0x-prefixed 40-hex string anywhere in the message. The record written to the database should be the account the signature is cryptographically bound to — i.e. the SIWE address field — not whatever hex string happens to appear first in the text.

In a well-formed EIP-4361 message the address is line 2, so today the two usually coincide, but relying on positional regex is brittle: any future change to the statement/resources ordering, or a non-standard message shape, could bind the airdrop record to an unintended address. Parsing the field the signature actually attests to removes that ambiguity.

Notes

• siwe is already a dependency; no new packages.
• SiweMessage(...).address is EIP-55 checksummed, matching what the frontend generates, so existing records/flows are unaffected.
• Adds an explicit parse-failure path (400 Could not parse SIWE message) and an isAddress() sanity check.
• Pure hardening; no behavior change for valid requests.

[vercel]

@osr21 is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.