A new security study has uncovered 31 vulnerabilities in x402 crypto payment facilitators, affecting nearly all observed transactions and putting merchants at risk of asset theft, free shopping, and increased operational costs.
A recent security analysis has revealed that 31 previously undocumented vulnerabilities exist across 15 major facilitators of x402, a protocol designed for programmatic crypto payments over HTTP. According to the study, these facilitators collectively processed 99% of observed x402 transactions during the research period, and every facilitator failed at least one of eight core rules for payment verification or settlement. The findings raise significant concerns for merchants relying on x402-based payment infrastructure, as the vulnerabilities could allow attackers to obtain goods or services without payment, steal assets, or impose additional costs on service providers.
How x402 Facilitators Process Payments
The x402 protocol relies on facilitators—intermediary services that verify signed payment proofs, construct and broadcast settlements, and often sponsor network fees. Merchants depend on these facilitators to determine when a payment is complete and when to release a protected service or product.
The study found that more than 93% of server addresses were tied exclusively to a single facilitator, highlighting the centralization risk in the current x402 ecosystem. While the research does not claim that every x402 transaction is vulnerable or that all facilitators are equally exploitable, it demonstrates that the majority of observed payment flows are exposed to at least some form of risk.
Four Main Categories of Security Risk
The vulnerabilities were mapped to four main attack categories: free shopping, asset theft, service denial, and gas abuse. In a free-shopping scenario, a merchant might release a product or service before a unique, valid payment has actually settled on-chain.
Asset theft vulnerabilities could allow attackers to access value controlled by the facilitator, while service-denial and gas-abuse attacks could drain facilitator resources or disrupt payment processing.
The researchers validated two free-shopping exploits end to end and identified ten additional high-risk cases where actual loss would depend on merchant behavior—specifically, whether a merchant releases a service after verification but before settlement is confirmed or fails to roll back access after a failed payment.
The study also documented three gas-abuse cases and one path to asset theft involving ERC-6492 token approvals, though no funds were ultimately stolen during the controlled tests.
Transaction Scale and Potential Financial Impact
All 15 facilitators exhibited high-risk vectors for service denial or cost amplification. However, the researchers did not conduct live gas-drain or denial-of-service attacks, nor did they demonstrate any real-world outages.
Their address-based analysis covered more than 119 million transactions on the Base and Solana networks. The researchers estimated approximately $202,000 in gas and network fees between October 1 and December 26, 2025, with about $5,800 attributed to failed or reverted transactions.
These figures demonstrate the scale of x402 payment activity and the potential financial impact of operational inefficiencies or deliberate attacks. Revert-related fees also illustrate how failed transactions can impose measurable costs even when no assets are directly stolen.
Disclosure and Partial Remediation
The research team disclosed its findings to 14 of the 15 affected facilitators in January. By early February, Coinbase, PayAI, and Mogami had acknowledged six vulnerabilities and reported partial remediation, although not all identified issues had been fully resolved.
Because the study anonymized individual facilitators, it does not specify which fixes correspond to which provider or which vulnerabilities remain active within particular implementations.
Recommended Security Controls
To mitigate these risks, the authors recommend that merchants and facilitators bind payment verification to actual settlement, reserve nonces to prevent replay attacks, recheck timestamps and account state, and strictly allowlist supported transaction types, including ERC-1271 and ERC-6492.
Facilitators should also cap sponsored fees and reject uneconomic, invalid, or non-settleable payments. Merchants are advised to release goods or services only after settlement has been confirmed or to implement explicit rollback mechanisms when a transaction fails.
The study emphasizes that open payment protocols such as x402 require robust controls around intermediaries to ensure that only genuinely settled payments are treated as final and safe for execution.
Centralization Remains a Broader Ecosystem Risk
Payment facilitators play a critical role in the crypto payment stack, particularly for protocols such as x402 that aim to streamline programmatic payments over HTTP. These intermediaries can simplify merchant integration, verify payment proofs, and sponsor network fees, but they also introduce additional risks related to verification, settlement, and operational security.
The concentration of activity among a relatively small number of facilitators can amplify the impact of vulnerabilities. Merchants and service providers therefore need layered security controls and should avoid relying solely on third-party verification when deciding whether to release goods, services, or digital access.
As crypto payment infrastructure continues to develop, balancing convenience, transaction costs, decentralization, and security will remain a central challenge for the industry.
