works now : )

ecrecover.js

// Welcome! require() some modules from npm (like you were using browserify)
// and then hit Run Code to run your code on the right side.
// Modules get downloaded from browserify-cdn and bundled in your browser.
var utils = require('ethereumjs-util')
var ethSigUtil = require('eth-sig-util')
//var buffer = require('buffer')
//var Buffer = buffer.Buffer
//console.log(Buffer)

// everything comes from coinbsae wallet which uses web3 1.2.1 calling web3.eth.sign(msg, address)
// where msg, address and the resulting sig are as they are here

  address = '0x45e25795A72881a4D80C59B5c60120655215a053'
	personalSign = '0x28506b600e3d6a15688fe6d126760a9a88f769814a6faa56bcd7c21976bba51f2f26a47ee5c3dc74a1a77c32d253a30465dbb10d636198f1984d41738c34624e1c'
  
  sgn = '0x017f6ec116b59dc8c7f5a85992da11e3126c6af1e48537dbeb1ceae09051c2f528a1cd74e5ce5c3c01becdfc9c97d33de7dcb009888296ab98fedd159b06d8891c'
  
  msg = 'To avoid bad things, sign below to authenticate with Clovers'

  hash = msg = utils.keccak256(msg)
  const sigParams = utils.fromRpcSig(personalSign)
  const hashBuffer = utils.toBuffer(hash)
  const result = utils.ecrecover(
    hashBuffer,
    sigParams.v,
    sigParams.r,
    sigParams.s
  )
  const signer = utils.bufferToHex(utils.publicToAddress(result))
  console.log({signer})

// tried it with the ethereum prefix as well but no dice
//prefix = "\x19Ethereum Signed Message:\n" + msg.length + msg
//msg = prefix

//const prefix = new Buffer("\x19Ethereum Signed Message:\n");
//msg = Buffer.concat([prefix, new Buffer(String(msg.length)), msg])

// fromUtf8 shows the message in hex (which is how metamask shows it when attempting to make the sig from the browsere)
console.log('fromUtf8', utils.fromUtf8(msg))

// tried hashing the message with hashPersonalMessage
//msg = utils.hashPersonalMessage(utils.toBuffer(msg))

// hash the message (tried with keccak, keccak256, sha256, ripemd160, rlphash)
// - should be buffer
msg = utils.keccak256(msg)

// hex representation of the hashed message
console.log('keccak', utils.bufferToHex(msg))        

// r is first 64 + 0x prefix - should be buffer
r = utils.toBuffer(sgn.slice(0,66))

// s is second 64 + 0x prefix - should be buffer
s = utils.toBuffer('0x' + sgn.slice(66,130))

// v is 27 (but could be 28?) - should be number
v = utils.bufferToInt(utils.toBuffer('0x' + sgn.slice(130,132)))

// log all values
console.log({msg, v, r, s})

// doesn't throw an error
pub = utils.ecrecover(msg, v, r, s)

// just returns an incorrect address
adr = '0x' + utils.pubToAddress(pub).toString('hex')

console.log({adr, address})

Instead of web3.eth.sign (eth_sign), try using web3.eth.personal.sign (personal_sign). Coinbase Wallet follows Metamask's behavior for compatibility.

For context: https://medium.com/metamask/the-new-secure-way-to-sign-data-in-your-browser-6af9dd2a1527