Invalid
Exception thrown when the challenge transaction's time bounds are invalid.
SEP-10 Security Requirement: The challenge transaction MUST have time bounds set, and the current time must be within those bounds (with a configurable grace period).
Time bounds validation prevents:
Replay attacks using expired challenges
Use of challenges that are too far in the future
Indefinite validity of challenge transactions
Standard validation rules:
minTime must be in the past (accounting for clock skew)
maxTime must be in the future (accounting for clock skew)
The grace period (default: 300 seconds / 5 minutes) allows for:
Network latency
Clock differences between client and server
User time to review and sign
Typical time bounds:
Server sets minTime to current time
Server sets maxTime to current time + 15 minutes
Client validates within 5-minute grace period on each side
Attack scenario prevented: Without time bounds, an attacker who intercepts a signed challenge could replay it at any point in the future to impersonate the user.
Parameters
The minimum time bound (Unix timestamp)
The maximum time bound (Unix timestamp)
The current time when validation was performed
The grace period used for validation