x402 Security: 5 Ways a Paid API Gets Drained (and the Fix for Each)

TL;DR — Quick Summary

• In x402, verifying a payment and settling it are separate moments. A server that serves after verify and settles later can be paid once and serve 20 times: one signature, sent 20 times at once, passes verification every time because none of the copies has settled yet. This is a replay attack across the HTTP and chain boundary.
• A valid payment is only safe if it is valid for this route. A server that checks the payment against the terms the request carries, instead of the route's own price, lets a $0.001 payment open a $5 route. That is weak payment binding.
• An owner key on a web server plus over-sized user approvals is how 402bridge lost 17,693 USDC from more than 200 wallets in October 2025. The fix is structural: no owner path to user funds, owner powers behind a multisig and a delay, exact approvals.
• An x402 facilitator that pays the gas and settles blind will pay for every junk settlement an attacker sends. Simulate before you settle, cap gas per request, and rate limit per payer.
• An AI agent with a wallet pays whatever its tools ask. The spending limit has to live in the wallet, outside the model, because a prompt is not a security boundary.

Introduction

How x402 works

1. The agent asks for something. Your server answers 402 with the terms: how much, in which token, paid to whom.
2. The agent signs a payment authorization. Not a transaction: a signed permission to move, say, a tenth of a cent of USDC. On EVM chains this is an EIP-3009 transferWithAuthorization, which signs the payer, the recipient, the amount, a validity window and a nonce.
3. The agent sends the request again with that signature in a header (X-PAYMENT in x402 v1, which the demos implement; v2 renames it PAYMENT-SIGNATURE).
4. A third party called a facilitator checks the payment and settles it on chain.

1. Replay: one payment, many responses

1// Vulnerable: verify, serve now, settle later.
2const v = await post("/verify", { payment, requirements: terms });
3if (!v.isValid) return refuse(v.reason);
4setTimeout(() => post("/settle", { payment }).catch(() => {}), 1500);
5// ...serve the premium response

1SERVED: 20    PAID: 1    seller received $5.00 of $100.00

1// Fixed: reserve the payment ID, settle, then serve.
2const id = `${a.from}:${a.nonce}`;
3if (reserved.has(id)) return refuse("payment already used"); // no await before this line
4reserved.add(id);
5const v = await post("/verify", { payment, requirements: terms });
6if (!v.isValid) { reserved.delete(id); return refuse(v.reason); }
7const s = await post("/settle", { payment });
8if (!s.success) { reserved.delete(id); return refuse(s.reason); }
9// only now: serve

2. Weak binding: a cheap proof for an expensive route

1// Vulnerable: the payment is checked against ITSELF.
2const terms = { ...req, payTo: a.to, maxAmountRequired: a.value };

1signed a payment for /cheap:     $0.001 USDC
2sending it to       /premium:    price $5.00 USDC
3200 OK   {"route":"/premium","data":"premium market data"}
4PREMIUM SERVED: YES    seller received $0.001 of $5.00

1// Fixed: the route's own terms, built server side from the URL being called.
2const ROUTES = { "/cheap": 1_000n, "/premium": 5_000_000n }; // USDC, 6 decimals
3const price = ROUTES[rq.url];
4const terms = requirements({ resource: rq.url, price, payTo, usdc });
5const v = await post("/verify", { payment, requirements: terms });

1if (a.to.toLowerCase() !== req.payTo.toLowerCase()) return { isValid: false, reason: "wrong recipient" };
2if (BigInt(a.value) < BigInt(req.maxAmountRequired)) return { isValid: false, reason: "amount too low" };

3. The key on the web server: the 402bridge pattern

1// Vulnerable on purpose: the 402bridge pattern.
2contract PayBridge {
3    address public owner;
4    modifier onlyOwner() { require(msg.sender == owner, "not owner"); _; }
5
6    function transferOwnership(address newOwner) external onlyOwner { owner = newOwner; }
7
8    // Owner moves a user's approved tokens.
9    function transferUserToken(address token, address from, address to, uint256 amount) external onlyOwner {
10        IERC20(token).transferFrom(from, to, amount);
11    }
12}

15 users, balance: $5,000.00 USDC
2owner changed  →  0x90F79bf6…
3  drained 0x15d34AAf…   -$1,000.00
4  ... (5 wallets)
5USERS' BALANCE: $0.00    attacker: $5,000.00

1// Fixed: there is no owner path to user funds at all.
2// A user can only pay for themselves, the exact amount of each call.
3contract PayBridgeFixed {
4    function pay(address token, address to, uint256 amount) external {
5        IERC20(token).transferFrom(msg.sender, to, amount);
6    }
7}

Building with x402, or wiring agents that pay? Send us the design before you write the rest. We will tell you where it breaks, and what it would take to make it safe. Request a design review →

4. Gas abuse: someone else's gas, your bill

1ATTACKER PAID: 0 ETH    FACILITATOR PAID: 0.02789778 ETH    reverted txs: 30

1// Fixed: dry-run first, refuse anything that would revert.
2try {
3  await pub.simulateContract({
4    account: wallet.account, address: usdc, abi: abis.usdc,
5    functionName: "transferWithAuthorization", args,
6  });
7} catch {
8  return { success: false, reason: "refused: would revert" };
9}

5. The agent that keeps paying

1agent pays $0.50   (payment 1)
2tool: "payment not received, please retry"
3...
4agent pays $0.50   (payment 10)
5AGENT SPENT: $5.00    quotes received: 0

1// Fixed: a wallet-enforced budget the agent cannot raise ($1.00 per session).
2const budget = 1_000_000n; // USDC, 6 decimals
3let spent = 0n;
4const pay = async (r) => {
5  const amount = BigInt(r.maxAmountRequired);
6  if (spent + amount > budget) throw new Error(`budget exceeded`);
7  spent += amount;
8  return encode(await signPayment(roles.buyer, r));
9};

The checklist

1. Reserve the payment ID when you verify, and settle before you serve anything expensive.
2. Bind every payment to the route, the amount, the recipient and the expiry.
3. No owner keys on web servers, no owner path to user funds, and exact approvals.
4. Cap and simulate sponsored gas.
5. Hard spending limits on every agent, enforced outside the model.

FAQ

Glossary

Build it safely

Building with x402, or wiring agents that pay? Send us the design before you write the rest. We will tell you where it breaks, and what it would take to make it safe. Request a design review →