Security firm V12 identifies three x402 flaws it rates critical

Security firm V12 disclosed three flaws it rated critical in x402 payment software on October 22. The flaws could expose automatic payments, let a payment checker accept a transaction that moved no tokens, or trick software into signing a login for another website. The x402 Foundation had already fixed all three in its August 18 releases, The Hacker News reported on October 23.

Developers using older releases need to check their package versions rather than rely on automatic vulnerability alerts. According to The Hacker News, the foundation has published no security advisory for the three flaws, and its changelogs do not identify the fixes as security fixes. The outlet’s October 23 checks found no npm audit advisories for the last pre-fix TypeScript releases and no PyPI vulnerability listing for the last pre-fix Python release.

x402 is an open standard that lets software pay for an application programming interface (API)—a way for one program to request data or services from another—within a web request. A server returns “402 Payment Required” with payment options naming an amount, token and recipient. The client software chooses an option, signs a payment and sends the request again, without requiring a person to approve each payment.

When automatic signing could expose a wallet balance

Before the fix, the default client selected the first payment option without limiting its amount. V12 said a malicious API could request the wallet’s full balance of a supported token. The client could sign that payment only if it used an automatic signer and the application imposed no payment policy. Collecting the funds also required a token that supported signed transfers.

The August 18 releases added spending controls to the TypeScript, Python and Go software development kits (SDKs), the reusable code developers put into applications. Their default settings cap each payment at $1 and allow only recognized US-dollar stablecoins—tokens intended to track the dollar’s value. Applications can set their own controls, but passing spendControls: false disables all of these protections.

A local test accepted an approval as payment

A merchant using x402 relies on a facilitator, a service that checks payments and submits them to the blockchain. For Solana payments, the TypeScript facilitator checked the token program but failed to verify the instruction type. It could therefore treat a token approval—which authorizes later spending but moves no tokens—as a transfer.

V12 demonstrated that acceptance in a local test without sending a live transaction. The firm said a merchant could consequently deliver a paid resource without receiving tokens. An attacker would need a token account but no balance, while the facilitator would pay the transaction fee. Python and Go already checked the instruction type; the August release added that check to TypeScript.

Wallet logins also needed a website check

The Sign-In-With-X (SIWx) extension lets software log in by signing a message with its wallet, for example to prove an earlier payment. The automated client did not verify that the website named in a login message was the website it had contacted.

V12 said a malicious server could relay another site’s fresh login message to the client, then use the resulting signature to log in as that wallet. This would work only where the destination accepted the relayed message, and would grant only the access that login allowed. The August 18 TypeScript, Python and Go releases refuse to sign unless the named website matches the website that sent the 402 response.

Which packages to update

The Hacker News checked published packages and found the Solana instruction check missing from every @x402/svm release from 2.0.0 through 2.22.0, and present from 2.23.0 onward. It identified the following update paths and latest versions as of October 23.

Updating to the latest releases also includes later repairs, including a separate payment-bypass fix in @x402/core 2.27.0 in September. TypeScript applications calling createSIWxPayload directly must pass the URL of the 402 response after any redirects. The @x402/fetch and @x402/axios wrappers pass it automatically.

V12 found 25 flaws through code review and local tests; neither it nor the foundation has publicly reported attacks using the three critical flaws. Teams unable to upgrade yet can use