x402 is a rising payment protocol that enables micropayments for web services. Building on top of HTTP, x402 is an extension that allows, e.g., LLM agents to pay for any requests that they make. x402 is backed by a blockchain infrastructure where payments are validated and settled. We discovered that implementations of x402 may be buggy and prone to several bug types.

In our x402 analysis, we discover four types of attacks: free shopping (allowing the attacker to access resources without paying), asset theft (extracting funds to attacker controlled accounts), service denial (denying service to a client despite paying), and gas abuse (causing the server to pay for gas even if there's no legitimate request). By carefully analyzing the interactions of the different players, we highlight how attackers can abuse the underlying system if the processing is not implemented carefully. Even more concerning, some fundamental risks will remain given the trade-off between fast service and waiting until a payment settles on the chain.

Using our analysis we create x402scope, a prototype that we apply to 15 major x402 facilitators and find violations in all evaluated facilitators. All bugs were responsibly disclosed. x402scope is a semi automated framework to test authorization correctness and execution safety of target facilitators. We implement this as a rule-guided workflow to test for different violation types. Using a manual analysis of the protocol, we create a dataset of rules that we then apply to the different facilitators to detect our four attack types. The key contribution lies in the protocol analysis along with the attack definitions.

One of our findings especially highlights the trade-off between accepting fraudulent transactions and providing fast service or alternatively delaying service until transactions have settled. This trade-off will have to be fine-tuned depending on the amount of fraud in the system and we argue that a more reactive system will likely be necessary in practice that explores attacks versus providing service.

This work was lead by Qinying Wang and Yong Wang while we explored these attack vectors. The source code is of course openly available. This work was published at Usenix SEC'26.