Payment Binding
The check that a payment matches the exact resource, amount, recipient and expiry of what is being bought, using the seller's own terms rather than terms supplied with the request.
A payment can be perfectly valid and still be the wrong payment. Payment binding is the step that ties a valid payment to the thing it is paying for: this route, at this price, to this recipient, before this deadline.
Weak binding appears when a server verifies a payment against the terms the request carries, or against the payment itself, instead of the price of the route being called. In a demo of this pattern on x402, a payment of 0.001 USDC signed for a cheap route opened a premium route priced at 5 USDC.
The fix is to build the expected terms on the server from the route being called and compare the payment to them. Because an EIP-3009 signature does not cover the resource URL, a server that sells several resources at the same price should also record which resource each payment ID was spent on.
Related Terms
x402
An open payment protocol that uses the HTTP 402 Payment Required status code so clients, including AI agents, can pay for web resources with signed stablecoin authorizations.
HTTP 402 Payment Required
The HTTP status code a server returns when a resource requires payment, which the x402 protocol uses to send payment terms to the client.
EIP-3009
An Ethereum token standard, implemented by USDC, whose transferWithAuthorization function moves tokens on the strength of a signed message from the holder, with a validity window and a single-use nonce.
Replay Attack
An attack where a valid transaction or message is maliciously resubmitted to execute the same action multiple times.
Need expert guidance on Payment Binding?
Our team at Zealynx has deep expertise in blockchain security and DeFi protocols. Whether you need an audit or consultation, we're here to help.
Get a Quote