x402 SDK flaws put wallets, payments and logins at risk
The x402 SDK flaws disclosed by security firm V12 exposed three separate risks involving automated wallet spending, payment verification and website logins. V12 found 25 flaws during a code review and local testing, rating three as critical. The x402 Foundation, which maintains the software development kits (SDKs), fixed all three in releases published on August 18. Neither V12 nor the foundation has publicly reported attacks exploiting them.
x402 is an open standard that allows software, including artificial intelligence agents, to pay for an application programming interface (API) request without waiting for a person to approve every transaction. A server requests payment by returning HTTP status code 402 Payment Required, together with options specifying an amount, digital asset and recipient. The client selects an option, signs the payment and repeats the request with the payment attached.
Before the fixes, the default client selected the first payment option without imposing a maximum amount. According to V12, a malicious API could request the wallet's entire balance of a supported digital asset instead of a small routine payment. A previous transaction could reveal the wallet address, allowing the server to look up the available balance. If an application automatically signed payments and had not configured its own restrictions, the client could approve the full amount. For assets supporting signed transfers, the malicious server could then submit that payment and receive the funds. The risk was limited to deployments using automatic signing without application-level limits.
The August 18 TypeScript, Python and Go releases introduced default spending controls. Each payment is now limited to $1, and clients will pay only recognized US dollar stablecoins, including USDC, unless the application defines different controls. A stablecoin is a digital asset designed to track another asset, in this case the US dollar. Applications that explicitly set spendControls: false disable all of these safeguards.
A second critical flaw affected Solana payment verification in the TypeScript SDK. In x402, a facilitator checks a merchant's payment and submits it to the blockchain, the shared transaction record used by the network. On Solana, that facilitator also covers the transaction fee. The vulnerable code confirmed that a payment called an allowed token program, but it did not verify the instruction type before interpreting the instruction as a transfer.
A token approval authorizes another account to spend assets later but does not transfer anything immediately. It differs from a transfer in the first byte of the instruction. In a local test, V12 found that the TypeScript facilitator accepted an approval as if it were a completed payment. The test did not submit a live transaction. A merchant could consequently release a paid resource without receiving funds, while the facilitator paid the fee. The requester needed a token account but did not need a balance. Python and Go already checked the instruction type, and the August 18 TypeScript release added the missing validation. The Hacker News found that @x402/svm versions 2.0.0 through 2.22.0 lacked the check, while releases from 2.23.0 onward include it.
The third critical issue involved Sign-In-With-X (SIWx), an x402 extension that lets an agent prove control of a wallet by signing a login message. On Ethereum, that message identifies a website, wallet address and one-time code. The automated client did not verify that the website named in the message matched the server that had sent the payment response. V12 said a malicious server could relay a fresh message from another website, obtain the agent's signature and use it to access that other site wherever the relayed message was accepted. The resulting access would depend on what the login authorized.
Updated TypeScript, Python and Go clients refuse to sign when the website in the SIWx message differs from the site that returned the 402 response. The SIWx specification now requires the same check. TypeScript applications calling createSIWxPayload directly must supply the URL of the 402 response after redirects. The @x402/fetch and @x402/axios wrappers provide that URL automatically.
Despite the severity assigned by V12, the foundation did not publish a security advisory for these three issues, and its changelogs recorded the changes without identifying them as security fixes. As of October 23, The Hacker News found no npm audit advisory for the final vulnerable TypeScript releases and no vulnerability entry on PyPI for the final vulnerable Python release. Developers relying only on those package checks would therefore receive no upgrade warning. Coinbase created x402 and transferred it this year to the x402 Foundation, a Linux Foundation project whose members include Visa and Mastercard. Coinbase holds the most senior position on its technical steering committee.
Teams should install current releases rather than stopping at the first fixed versions, because later updates include a separate September payment-bypass fix in @x402/core 2.27.0. As of October 23, the latest TypeScript versions were 2.28.0 for @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios. The latest Go module was v2.28.0, while the Python package was 2.25.0. TypeScript clients receive the spending fix through @x402/fetch or @x402/axios 2.23.0 or later. SIWx users need @x402/extensions 2.23.0 or later, and Solana facilitators need @x402/svm 2.23.0 or later.
Teams unable to upgrade immediately can configure a payment policy that rejects options above a chosen amount. Older clients support registerPolicy in TypeScript and Go, while Python provides register_policy and a ready-made max_amount policy. V12 also recommends checking the website identified in every SIWx message, setting per-payment and total budgets, and restricting permitted assets, networks and recipients. Teams that need help planning security-focused infrastructure work can turn to AEU-I for security-first IT, infrastructure and consulting.