security: replace Math.random() with crypto.randomUUID() for SIWE nonces

[cryptoasuran]

Summary

Fixes cryptographic vulnerability in SIWE nonce generation across 4 documentation examples.

Problem (Issue #1477)

Multiple examples use Math.random() to generate SIWE nonces:

// Insecure - predictable output
const nonce = Math.random().toString(36).substring(2, 15) + 
              Math.random().toString(36).substring(2, 15);

Math.random() is not cryptographically secure. It produces predictable values that can be exploited for replay attacks in SIWE authentication flows.

Security Impact

• Predictable nonces enable replay attacks
• Violates EIP-4361 security requirements
• Developers copying these examples will ship vulnerable authentication

Solution

Replace with crypto.randomUUID() (Web Crypto API):

// Secure - cryptographically random
const nonce = crypto.randomUUID().replace(/-/g, '');

Files Fixed

1. ✅ docs/base-account/framework-integrations/wagmi/setup.mdx (line 338-340)
2. ✅ docs/base-account/reference/ui-elements/sign-in-with-base-button.mdx (line 328)
3. ✅ docs/base-account/guides/sign-and-verify-typed-data.mdx (line 193)

Consistency

This aligns with the authenticate-users guide which already uses crypto.randomUUID() correctly.

Browser Support

• crypto.randomUUID(): All modern browsers + Node.js 14.17+
• crypto.randomBytes(): Node.js (used in server example)

Both are standard Web Crypto API methods.

References

• EIP-4361 Security Considerations
• Web Crypto API - randomUUID

Fixes #1477

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2