Each smart account keeps a nonce. A signed user operation is valid for exactly one nonce, so the EntryPoint contract on-chain rejects any attempt to submit the same signed payment twice. Numpay doesn’t need to track this itself; it is enforced by the chain.
When you register, the server records the wallet address derived from your key against the identity in your verified token. A request body can’t change a user’s wallet, phone or email; those fields are rejected by the update schema. For NEAR deposits, the destination wallet is looked up from your account on the server, never taken from the client.
