x402 is a rising payment protocol that enables micropayments for web services.
Building on top of HTTP, x402 is an extension that allows, e.g., LLM agents to
pay for any requests that they make. x402 is backed by a blockchain
infrastructure where payments are validated and settled. We discovered that
implementations of x402 may be buggy and prone to several bug types.
In our x402 analysis, we discover
four types of attacks: free shopping (allowing the attacker to access resources
without paying), asset theft (extracting funds to attacker controlled accounts),
service denial (denying service to a client despite paying), and gas abuse
(causing the server to pay for gas even if there's no legitimate request). By
carefully analyzing the interactions of the different players, we highlight how
attackers can abuse the underlying system if the processing is not implemented
carefully. Even more concerning, some fundamental risks will remain given the
trade-off between fast service and waiting until a payment settles on the chain.
Using our analysis we create x402scope, a prototype that we apply to 15 major x402
facilitators and find violations in all evaluated facilitators. All bugs were
responsibly disclosed. x402scope is a semi automated framework to test
authorization correctness and execution safety of target facilitators. We
implement this as a rule-guided workflow to test for different violation types.
Using a manual analysis of the protocol, we create a dataset of rules that we
then apply to the different facilitators to detect our four attack types. The
key contribution lies in the protocol analysis along with the attack
definitions.
One of our findings especially highlights the trade-off between accepting
fraudulent transactions and providing fast service or alternatively delaying
service until transactions have settled. This trade-off will have to be
fine-tuned depending on the amount of fraud in the system and we argue that a
more reactive system will likely be necessary in practice that explores attacks
versus providing service.
This work was lead by Qinying Wang and Yong Wang while we explored these attack
vectors. The source code is of course
openly available. This work was published at Usenix SEC'26.