x402 Facilitator Flaws Expose 99% of Crypto Payments to Asset Theft

A recent security study has uncovered 31 previously unknown vulnerabilities across 15 major facilitators supporting x402, an HTTP-native standard for programmatic payments. The tested group represented 99% of observed transactions in the study window, and each facilitator failed at least one of eight rules for payment verification or settlement.

The researchers mapped 49 violation instances to four attack classes: free shopping, asset theft, service denial, and gas abuse. They validated two free-shopping cases end-to-end and classified 10 more as high-risk because actual loss depended on a merchant releasing service after verification without waiting for settlement or rolling back a failure.

The study found that all 15 facilitators showed high-risk service-denial or cost-amplification paths, but the researchers ran no gas-drain experiment or availability-degrading load test. They demonstrated no outage and their separate address-based analysis covered more than 119 million Base and Solana transactions.

The authors recommend binding verification to settlement, reserving nonces, rechecking time and account state, strictly allowlisting ERC-1271 and ERC-6492 transaction shapes, capping sponsored fees, and rejecting uneconomic or non-settleable payments. Merchants should release service only after settlement succeeds or implement explicit rollback.