Crypto
Home›Crypto›Market Structure›x402 payment facilitators show security flaws that cou…
x402 payment facilitators show security flaws that could impact merchants
A USENIX study tested 15 major x402 facilitators and found 49 rule violations tied to 31 vulnerabilities, including attack paths that could cause direct financial loss to merchants and potential asset theft by exploiting how facilitators handle transaction fees.
A new security study presented at the 35th USENIX Security Symposium found that major x402 payment facilitators, including Coinbase, Thirdweb, PayAI, and Mogami, failed security tests designed for the emerging AI agent economy.
Researchers tested 15 x402 facilitators and reported that every platform violated at least one security rule. Across the systems, they mapped 49 rule violations to 31 distinct vulnerabilities that they said covered 99% of observed x402 transactions and 98% of payment volume in the study.
The research identified four broad attack classes, including free shopping, asset theft, service disruption, and gas abuse. It also directly validated six attack paths under bounded conditions, including two free-shopping attacks, three gas-abuse attacks, and one route that could expose facilitator-held assets.
The most severe validated path involved ERC-6492, an Ethereum signature standard intended to support signatures from smart contract wallets. According to the paper, malicious metadata could lead a facilitator to submit an arbitrary token approval transaction instead of the payment it expected to settle, and the findings warned this could enable theft of assets controlled by the facilitator, even though researchers stopped short of moving facilitator funds. The paper also said x402 facilitators can sponsor blockchain transaction fees, and three other validated attacks exploited that same economic feature to potentially shift unbounded network costs.
The report said the findings do not mean that 99% of x402 transactions were themselves vulnerable, but that the attacks could still result in direct financial loss to merchants, theft of facilitator-held assets, unbounded sponsor-paid gas and fees, and disruption of payment services, as x402 is promoted as infrastructure for machine driven commerce.
Latest closeEthereum $1,885.62 ▲0.4%