- Researchers discovered 31 flaws throughout 15 facilitators who had been processing 99% of noticed x402 funds.
- Verified exams revealed free procuring, fuel abuse, and restricted ERC-6492 theft vectors.
- Base and Solana’s x402 funds concerned greater than $202,000 in charges.
A safety investigation uncovered 31 beforehand unknown vulnerabilities throughout 15 facilitators supporting x402 funds. Collectively, these facilitators dealt with 99% of the noticed trades and 98% of the recorded commerce quantity.
Nevertheless, the researchers didn’t declare that 99% of particular person funds had been misused. As an alternative, the findings present that the companies examined related 60,000 sellers and 360,000 consumers, with all facilitators violating at the least one safety rule.
Facilitator flaw creates system-wide x402 safety threat
Specifically, x402 adapts the Web’s HTTP 402 “Cost Required” response to web sites, APIs, and autonomous software program brokers. On this system, consumers submit signed proof of cost earlier than accessing protected companies.
The facilitator then verifies these proofs, prepares the blockchain transaction, and broadcasts the settlement on-chain. Typically sponsored community charges enable retailers to just accept blockchain funds with out sustaining their very own infrastructure.
To evaluate the safety of this course of, researchers from EPFL, Zhejiang College, and unbiased contributors developed x402Scope. The black field check system examined authorization administration, certificates freshness, cost safety, and transaction prices.
Their evaluation recognized 49 rule violations, which had been categorized into 31 separate vulnerabilities. These weaknesses fall into 4 assault courses: free procuring, asset theft, denial of service, and fuel abuse.
A flaw in free procuring might enable a service provider to launch a service earlier than the cost has been efficiently cleared. However, asset theft vectors might enable attacker-controlled directions involving property managed by the facilitator.
Denial of service vulnerabilities may lead to repeated failures and resource-intensive transactions. Moreover, fuel abuse assaults can depart facilitators responsible for extreme blockchain charges.
In response to the examine, researchers recognized two free procuring incidents, three fuel abuse routes, and one restricted ERC-6492 asset theft situation. Nevertheless, the managed theft check solely concerned token authorization and no property had been transferred.
On-chain knowledge reveals cost failures and rising charges
To evaluate broader price dangers, the group examined 119 million Base and Solana transactions recorded between October 1 and December 26, 2025. Base registered 1.86 million canceled transactions, with a failure fee of 1.99%.
As compared, Solana recorded 5,148 returns, which equates to only 0.018%. On each networks, x402-related cost makes an attempt resulted in additional than $202,000 in transaction charges. Of this complete, roughly $5,800 was associated to functions that had been returned.
Nonetheless, researchers have discovered no proof to show that malicious acts had been the reason for these historic failures. The group disclosed its findings to the 14 affected companies in January 2026. As of February sixth, Coinbase, PayAI, and Mogami had acknowledged a complete of six vulnerabilities.
Some weaknesses have been mounted, however others are nonetheless into consideration. Due to this fact, the researchers withheld vendor-specific mapping and technical exploit particulars as some vulnerabilities haven’t but been patched.
To cut back future dangers, the paper recommends confirming funds earlier than offering companies. It additionally advisable a strict checklist of allowed transactions, caps on sponsored charges, nonce controls, deadline checks, and a refusal to pay zero worth.
Associated: Ledger exposes potential safety flaws in Trezor pockets
Disclaimer: The knowledge contained on this article is for informational and academic functions solely. This text doesn’t represent monetary recommendation or recommendation of any form. Coin Version isn’t liable for any losses incurred because of using the content material, merchandise, or companies talked about. We encourage our readers to do their due diligence earlier than taking any motion associated to our firm.