A brand new safety research reported 31 beforehand unknown vulnerabilities throughout 15 main facilitators supporting x402, an HTTP-native customary for programmatic funds. The examined group represented 99% of noticed transactions within the research window, and every facilitator failed at the very least certainly one of eight guidelines for fee verification or settlement.
The total findings mapped 49 violation situations to 4 assault lessons: free buying, asset theft, service denial, and fuel abuse.
Facilitators are the shared center layer. They test a consumer’s signed fee proof, assemble and broadcast settlement, and sometimes sponsor community charges; retailers use the response to determine when to launch a protected service. Greater than 93% of server addresses within the research had been related solely with one facilitator.
The findings don’t present that each x402 fee was susceptible, that every facilitator was exploitable in each method, or that Coinbase was breached.
What the 4 assault lessons proved
In a free-shopping assault, the service provider opens the door earlier than one clear, distinctive fee has settled. Asset theft provides an attacker a path to facilitator-controlled worth. Service denial jams the fee lane with failing or resource-hungry settlements, and fuel abuse leaves the facilitator paying the attacker’s execution invoice.
Researchers validated two free-shopping circumstances finish to finish. They categorised 10 extra as excessive threat as a result of precise loss relied on a service provider releasing service after verification with out ready for settlement or rolling again a failure.
The paper additionally reviews three gas-abuse situations and one ERC-6492 asset-theft path. A managed proof of idea induced a token approval, however the workforce made no subsequent switch and stole no funds.
All 15 facilitators confirmed high-risk service-denial or cost-amplification paths, however the researchers ran no gas-drain experiment or availability-degrading load take a look at and demonstrated no outage. Their separate address-based evaluation coated greater than 119 million Base and Solana transactions and estimated about $202,000 in fuel and costs from Oct. 1 to Dec. 26, 2025, together with about $5,800 related to reverts.
The researchers disclosed findings to 14 of 15 affected events in January. As of Feb. 6, Coinbase, PayAI and Mogami had collectively acknowledged six vulnerabilities and stuck some points whereas others remained in progress. As a result of outcomes are anonymized, the paper doesn’t establish which particular repair belonged to every vendor.
CryptoSlate has beforehand defined x402’s facilitator mannequin, coated its authorization constraints, and introduced an x402 integration by means of Proofivy.
Earlier than retailers depend on x402 at better scale, the authors suggest binding verification to settlement, reserving nonces, rechecking time and account state, strictly allowlisting ERC-1271 and ERC-6492 transaction shapes, capping sponsored charges, and rejecting uneconomic or non-settleable funds.
Retailers ought to launch service solely after settlement succeeds or implement express rollback. An open protocol nonetheless wants onerous controls across the middleman that decides what counts as paid and secure to execute.
