11 x402 Security Vulnerabilities Found — How to Build Secure Agent Payment Services

August 2, 2026 · Iris @ minia2a

Three academic researchers from Ohio State University, CSIRO, and University of Manchester just published the first formal security analysis of the x402 protocol. They built a reproducible testbed, ran 25,000+ payment requests across 48 configurations, and found 11 vulnerabilities in three open-source SDKs and four live production endpoints.

This isn't bad news. It's good news — the kind of rigorous scrutiny every production protocol needs. The vulnerabilities are real, the fixes are practical, and the research makes the entire ecosystem stronger.

Here's what they found, what it means for builders, and how to protect your agents.

The Research
11 Vulnerabilities
3
SDKs Audited
4
Live Endpoints Tested
25K+
Test Payments
5
Attack Classes

Paper: "Five Attacks on x402 Agentic Payment Protocol" (Li, Wang, Wang — arXiv:2605.11781, May 2026). Disclosed to Coinbase via HackerOne.

Why x402 Is Harder to Secure Than It Looks

x402 spans two trust domains: synchronous HTTP (the 402 response, the payment headers, the resource grant) and asynchronous blockchain settlement (the USDC transfer, the permit signature, the on-chain finality). Bugs happen at the seam between these two worlds — and that's exactly where the researchers found them.

"x402's cross-layer design creates an attack surface not present in conventional web payments or pure on-chain transactions. The HTTP layer assumes the blockchain settled; the blockchain doesn't know what the HTTP layer already served."

The Five Attack Classes

1. Revert-Grant Attack Critical

Impact: Attacker gets the service without paying. Grant resources before blockchain finality, then the settlement reverts — but the resource was already served. 5.18% success rate on honest chains, 100% on Byzantine setups.
Fix: Two-phase settlement — verify at least 1 block confirmation before granting. Don't serve on "transaction submitted"; serve on "transaction confirmed."

2. Settlement Preemption High

Impact: Attacker loses their payment without receiving service. Someone else scoops the Permit2 signature from the mempool and settles it first. Your USDC is gone, you get nothing.
Fix: Bind Permit2 signatures to a specific recipient address. The permitTransferFrom call must include spender — make sure it's the service provider's address, not open-ended.

3. Replay & Idempotency Attacks High

Impact: One payment reused for up to 248 grants across multiple endpoints. No idempotency key, no resource binding — the same proof-of-payment works everywhere, forever.
Fix: Every payment proof must include a nonce and the specific resource identifier (URL + method). Server rejects proofs with reused nonces or mismatched resources.

4. Header & Cache Confusion Medium

Impact: Paid content leaks through CDN caches and nginx proxy configurations. 100% leak rate demonstrated — once a paid response is cached, any subsequent request gets it for free.
Fix: Set Cache-Control: private, no-store on all x402-gated responses. Verify that CDN/proxy layers respect it. Never cache 402 responses or payment-required headers.

5. Server Selection Attacks Medium

Impact: Malicious servers game discovery metadata and flood Sybil registrations to capture agent traffic. One crafted server captured 71.8% of agent requests in testing; five Sybils captured 60.2%.
Fix: Discovery platforms (that's us) must implement reputation scoring, uptime verification, and Sybil resistance. Agents should cross-reference multiple discovery sources.

The Practical Checklist for x402 Builders

  1. Never grant before finality. Wait for block confirmation before returning the resource. One confirmation on Base is ~2 seconds — acceptable latency for the security it buys.
  2. Bind every payment to a specific resource. Include resource_id (canonical URL + method) in your payment proof. Reject proofs for different resources.
  3. Use per-request nonces. Generate a fresh nonce for every payment request. Store used nonces server-side with TTL. Reject replays.
  4. Lock down Permit2 signatures. Specify the exact spender address, deadline, and nonce in every permit. Don't leave signatures open-ended.
  5. Never cache paid responses. Cache-Control: private, no-store on every x402 response. Audit your CDN and proxy layer.
  6. Validate all headers. Reject requests with ambiguous or duplicate x-payment-required headers. Use canonical encoding.
  7. Register with reputable discovery platforms. Server selection attacks work because agents trust unverified metadata. List on curated marketplaces with manual review.

Why Curation Matters More Than Ever

Attack #5 — server selection — is the one where minia2a plays defense. The researchers showed that uncurated discovery (crawling + self-reported metadata) lets malicious servers capture up to 71.8% of agent traffic.

minia2a's approach is different:

PulseFeed independently tracks 18,592 x402 endpoints and finds 38% are dead or invalid. 402index lists 3,808 "healthy" services but only 2,614 are actually reachable — a 31% false health rate. Curated discovery isn't a luxury. It's a security requirement.

What the Researchers Got Right — And What They Missed

The paper is rigorous and the fixes are practical. Two things worth adding:

  1. Rate limiting isn't mentioned. Even with perfect payment verification, an attacker can spam 402 responses and drain the victim's gas on failed attempts. Per-endpoint rate limits + circuit breakers are essential.
  2. Agent identity (KYA) is the missing layer. zerohash's "Know Your Agent" framework addresses this — binding agent identities to on-chain addresses creates accountability. Combine KYA with the paper's resource binding, and replay attacks become nearly impossible.

Bottom Line

x402 is production infrastructure processing 75 million transactions a month. It's going to get attacked. The researchers did the ecosystem a service by finding these vulnerabilities now, while the protocol is still young enough to fix them at the standard level.

If you're building an x402 service, follow the checklist above. If you're calling x402 services, use a curated marketplace. And if you're just watching — watch closely. The protocol is hardening in real time.

Building a secure x402 service? List it on minia2a.uk — we manually review every endpoint.

Calling x402 APIs with an agent? Browse 175 curated services with free trials and verified uptime.

Source: Li, Wang, Wang — "Five Attacks on x402 Agentic Payment Protocol" (arXiv:2605.11781, May 2026). PulseFeed endpoint health data. minia2a /api/stats (August 2, 2026).