When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments

• URL: http://arxiv.org/abs/2607.19545v1
• Date: Tue, 21 Jul 2026 19:45:13 GMT
• Title: When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments
• Abstract summary: x402 is an emerging payment protocol for Web APIs and autonomous AI agents.<n>We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild.<n>We derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse.
• Score: 53.795332613020946
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: x402 is an emerging payment protocol for Web APIs and autonomous AI agents. x402 extends HTTP 402 with a payment negotiation flow and delegates payment proof verification and on-chain settlement to third-party facilitators. As a result, facilitators serve as a shared payment infrastructure for many independent merchants. This centralizes trust and validation in one component, so a single flaw can affect many services. Despite rapid adoption by major vendors and economically meaningful mainnet activity, the security posture of real-world x402 deployments remains poorly characterized. We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild, identifying eight security rules for facilitators as critical payment infrastructure. Based on our analysis of rule violations, we derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse. These attacks exploit weaknesses in the real-world facilitator and server implementations and cause severe harm, including direct financial loss to merchants, theft of facilitator-held assets, unbounded sponsor-paid gas/fees, and disruption of payment services. To assess the security of x402 deployments at scale, we propose a semi-automated black-box tool and apply it to 15 major x402 facilitators collectively used by over 60K sellers and 360K buyers. Alarmingly, we find violations in all evaluated facilitators. We responsibly disclosed our findings to the affected parties, who acknowledged the issues and adopted mitigations, including changes by Coinbase. Finally, we complement our controlled testing with an empirical measurement of over 119 million recent Base and Solana transactions, quantifying x402 adoption, facilitator centralization, and ecosystem-level risk indicators.

Related papers

• SIR: Self-improving Red-teaming for Compute Use Agents [71.71987044117371]
  Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal.<n>Because they can be exposed to untrusted content while operating, they are vulnerable to indirect prompt injection (IPI)<n>We present SIR, a black box IPI attack that composes stealthy injections from a small library of reusable principles stated in plain language.
  arXiv  Detail & Related papers  (2026-08-31T03:39:43Z)
• Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems [103.90831279037094]
  LLM-based multi-agent trading systems are moving rapidly from research prototypes to live deployments that control real assets.<n>A corrupted signal can propagate to the final decision and translate into realized financial loss.<n>We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system.
  arXiv  Detail & Related papers  (2026-08-25T05:07:37Z)
• Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems [0.0]
  Large language model agents are entering regulated financial systems.<n>Security literature characterizing their attack surface is almost entirely laboratory-based.<n> practitioner guidance on deployment is neither peer-reviewed nor connected to a formal threat model.
  arXiv  Detail & Related papers  (2026-06-28T01:11:00Z)
• Free-Riding in the AI Economy: Demystifying Logic Flaws in x402-Enabled Payment Systems [14.489441237764161]
  We perform the first comprehensive security analysis of the x402 ecosystem.<n>We reveal that current implementations fail to enforce transactional atomicity and context binding.<n>We show that attackers can exploit the synchronization gap to force merchants to subsidize compute costs.
  arXiv  Detail & Related papers  (2026-05-29T08:31:18Z)
• Five Attacks on x402 Agentic Payment Protocol [4.93108576295077]
  We analyze x402 and empirically show that it is vulnerable in both design and implementation.<n>We present five concrete attacks that reveal weaknesses in authorization, binding, replay protection, and web-layer handling.<n>Our results show that all five attacks are practical and can cause either unpaid service or paid-but-denied outcomes.
  arXiv  Detail & Related papers  (2026-05-12T08:49:10Z)
• SoK: Security of Autonomous LLM Agents in Agentic Commerce [17.16390433047924]
  This paper develops a unified security framework for autonomous LLM agents in commerce and finance.<n>We organize threats along five dimensions: agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance.<n>We propose a layered defense architecture addressing authorization gaps left by current agent-payment protocols.
  arXiv  Detail & Related papers  (2026-04-15T01:55:40Z)
• A402: Bridging Web 3.0 Payments and Web 2.0 Services with Atomic Service Channels [14.234772345560645]
  We present A402, a trust-minimized payment architecture that securely binds Web 3.0 payments to Web 2.0 services.<n>A402 incorporates a TEE-based Liquidity Vault that privately manages the lifecycle of ASCs and aggregates their settlements into a single on-chain transaction.<n>Our results show that A402 delivers orders-of-magnitude performance and on-chain cost improvements over x402 while providing trust-minimized security guarantees.
  arXiv  Detail & Related papers  (2026-03-01T16:45:22Z)
• OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage [59.3826294523924]
  We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup.<n>We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable.
  arXiv  Detail & Related papers  (2026-02-13T21:32:32Z)
• TxRay: Agentic Postmortem of Live Blockchain Attacks [52.658018348998105]
  Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits.<n>We present TxRay, a postmortem system that reconstructs live ACT attacks from limited evidence.<n>On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction.
  arXiv  Detail & Related papers  (2026-02-01T16:17:33Z)
• Regulation conform DLT-operable payment adapter based on trustless - justified trust combined generalized state channels [77.34726150561087]
  Economy of Things (EoT) will be based on software agents running on peer-to-peer trustless networks. We give an overview of current solutions that differ in their fundamental values and technological possibilities. We propose to combine the strengths of the crypto based, decentralized trustless elements with established and well regulated means of payment.
  arXiv  Detail & Related papers  (2020-07-03T10:45:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.