Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments

Source: arXiv:2605.30998 · Published 2026-05-29 · By Shengchen Ling, Yihang Huang, Yuefeng Du, Yuan Chen, Yajin Zhou, Lei Wu et al.

TL;DR

This paper presents the first comprehensive, systematic security analysis of the x402 payment protocol, an emerging infrastructure for automated AI-agent mediated payments that underpins about 130 million transactions and has been integrated into major clouds and services like Google Cloud, Cloudflare, and Stripe. The authors dissect the complex multilayer x402 system—comprising an HTTP semantic, per-chain token transfer schemes, and SDK and deployment implementations—by defining five fundamental security invariants that must hold for safe operation. Through extensive empirical audits against official SDKs and a production deployment, they identify four primary flaw classes—cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement—that result in significant resource leakage, sometimes up to 100%, and violate critical invariants. Additionally, they prove a structural impossibility: no output-only pay-per-token pricing scheme can simultaneously ensure fairness for honest users and bound against inflation of hidden compute tokens, resulting in an inherent manipulation gap.

The authors propose targeted mitigations for each flaw and design a defense composed of three layers with provable security bounds, reducing reasoning overhead by 47% and flipping attacker leverage from 8.7× to 0.9× for only 2.8% runtime cost. All findings were responsibly disclosed to vendors. The work highlights fundamental protocol and implementation gaps in bridging synchronous HTTP requests with asynchronous blockchain state finality within emerging agentic web payment systems, pointing to critical security challenges and tradeoffs in dynamic AI-inference payment schemes.

Key findings

• Cross-resource substitution flaw (F1) allows an attacker to use a valid payment signature intended for one resource to access any equal-priced resource, violating context binding invariant I3; empirically reproduced 100/100 times under controlled conditions.
• Duplicate-settlement race (F2) enables nonce reuse across concurrent requests due to facilitator-side non-idempotency, resulting in multiple deliveries for a single on-chain settlement, violating authorization uniqueness (I4); observed 6% incidence in 50 rounds of 20 concurrent requests each on Base mainnet.
• Allowance overdraft exploit (F3) in the dynamic pay-per-token upto scheme arises from TOCTOU race and missing per-deduction nonces, allowing adversaries to obtain more compute than their spending cap; manipulation ratios of 35–3213× estimated across 10 production language models.
• Denial of settlement flaw (F4) caused by deployment misconfigurations can lead to free-riding, where resources are delivered without on-chain payment, violating payment integrity (I1) and execution conservation (I5); observed e.g. in Python Flask adapter serving redirects without settlement.
• Structural impossibility theorem (F5) proves that no output-only pricing scheme can simultaneously maintain fairness to honest users and bounded inflation of hidden "thinking" tokens, with the unavoidable gap scaling as sqrt(1+Theta), revealing fundamental limits of pay-per-consumption mechanisms.
• Across 24,875 resources audited, 99.6% use exact scheme vulnerable to cross-resource substitution; 38% hosts expose clusters of same-priced resources enabling substitution attack blast radius.
• A single facilitator operator relays settlement for 74% of active Base merchants, indicating concentration risk amplifying the impact of SDK or facilitator flaws.
• Proposed layered defense triple reduces per-call reasoning cost by 47% and lowers attacker leverage from 8.7× to 0.9× at only 2.8% runtime overhead.

Threat model

The adversary is primarily a malicious Shopper controlling their wallet and request workloads, capable of issuing concurrent, replayed, or substituted HTTP payment requests with arbitrary valid or intercepted authorizations. They do not compromise other users' keys or the blockchain consensus but exploit the temporal window between off-chain signature verification and asynchronous on-chain settlement. Passive network observers can replay intercepted authorizations on stateless upto schemes, while chain-layer adversaries may reorder transactions but classical mempool front-running is limited due to centralized sequencers. Facilitators are trusted only as stateless oracles verifying individual signatures and balances and are not assumed to enforce global deduplication or concurrency control.

Methodology — deep read

The authors analyze the x402 payment protocol, which repurposes HTTP 402 Payment Required status code to drive automated pay-per-resource workflows mediated by blockchain token transfers. They formalize the system into four interacting principals: Shopper, Merchant, Facilitator, and Blockchain. The facilitator acts as a stateless oracle verifying signatures and balances off-chain, while settlement occurs asynchronously on-chain. This separation underpins the protocol's design but also introduces temporal and state-synchronization vulnerabilities.

The analysis begins by distilling and grounding five security invariants (payment integrity, value consistency, context binding, authorization uniqueness, execution conservation) from protocol specs (e.g., EIP-712, EIP-3009), vendor docs (Coinbase, CDP), and prior literature (Wang et al. Cashier-as-a-Service, Bishop & Dilger TOCTOU races).

The authors adopt a three-layer taxonomy assigning flaws to protocol, SDK, or deployment layers. The protocol layer corresponds to specification-level constraints guaranteed across compliant implementations; SDK layer flaws arise from implementation choices/delegations; deployment layer flaws result from operator configuration choices.

Empirically, the authors conduct an extensive audit of four official Coinbase SDKs (TypeScript, Python, Java, Go) analyzing signature verification logic and concurrency controls through source code inspection and testing. They submit thousands of crafted requests to production deployments across multiple chains (Base, Solana, Polygon) totaling over 130 million transactions monitored on Dune and other telemetry data.

For dynamic pricing (upto scheme) supporting pay-per-token AI inference, they analyze the cryptographic and temporal protocol surfaces, identifying TOCTOU vulnerabilities due to asynchronous verify-execute-settle flows. They prove a fundamental impossibility theorem by constructing an adversarial cost inflation strategy with mathematical proof based on entropy and mechanism design principles.

The authors measure real-world impact by resource-leakage ratios, concurrency-induced race conditions, and unauthorized compute obtained. They reproduce flaws in controlled testbeds interacting with official facilitators on live blockchains, correlating results with third-party incident reports (e.g., GitHub issues #1062, #1805).

Mitigations are designed and analyzed mathematically. The final defense triple integrates cryptographic binding, SDK concurrency controls, and deployment best practices to restore the security invariants with provable bounds. The authors transparently discuss threat model assumptions, training data provenance (open source SDKs, production telemetry), evaluation metrics (nonce reuse rate, resource leakage ratio, attacker leverage), and reproducibility aspects (some code closed or internal; full method details in Appendix).

An illustrative end-to-end example: An adversarial Shopper creates a signed authorization for resource A priced at $1.00. Because the signature does not bind to the resource ID, the attacker reuses it on resource B priced the same, bypassing intended access controls (F1). Concurrently, the attacker issues multiple concurrent HTTP requests with this signature before on-chain settlement finalizes, obtaining multiple service deliveries while only paying once (F2). With dynamic pricing and the upto allowance, the attacker inflates token usage beyond allowance via repeated replay (F3). Exploiting deployment misconfigurations (F4), the attacker obtains full service without on-chain settlement. The protocol-level impossibility proof (F5) mathematically confirms oracle-based pricing cannot guarantee fairness without unbounded risk. This complete exploit chain is demonstrated and quantified in the paper.

Technical innovations

• A novel formalization of x402 payment protocol across three layers (protocol, SDK, deployment) with five grounded security invariants as a basis for systematic flaw discovery.
• Identification and empirical measurement of four new flaw classes in a real-world, high-volume agentic-web payment infrastructure, including cross-resource substitution and duplicate-settlement race.
• Proof of a fundamental structural impossibility in dynamic pay-per-token pricing schemes that no protocol can simultaneously guarantee fairness and bounded inflation over hidden compute.
• A defense triple integrating cryptographic binding of requests, concurrency control in SDKs, and deployment best practices, with provable security bounds reducing attacker leverage and analysis costs.
• The application of mechanism-design and entropy-projection methods to assess manipulation bounds in agentic compute payment systems.

Datasets

• CDP Resource Registry — 24,875 payment-protected web resources — public via x402scan agentic.market dataset
• Dune Analytics x402 Transaction Dataset — 130 million historic agentic payment transactions — public blockchain telemetry
• Official Coinbase SDKs (TypeScript, Python, Java, Go) — source code — public GitHub repositories
• Thirdweb production dynamic pricing deployment logs — size not specified — internal/proprietary

Baselines vs proposed

• Official TypeScript/ Python SDK resource-binding predicate check missing: 0% enforcement vs proposed per-flaw mitigations enforcing full binding (100% enforcement)
• Duplicate-settlement race occurrence on Base mainnet: 6% concurrency rounds exhibit duplicate free service vs defense triple reducing attacker leverage from 8.7× to 0.9×
• Allowance overdraft manipulation ratio: up to 3213× token inflation in production LLM pay-per-token schemes vs 1× bound hypothesized in ideal fair scheme (impossibility proves this unreachable)
• Resource-leakage ratio in production deployments: up to 100% under identified flaws vs 0% leak with proposed layered defenses
• Per-call reasoning cost cut by 47% with proposed defense triple vs baseline unsystematic manual checks

Limitations

• Evaluation focuses on the official Coinbase SDKs and a selected production deployment (Thirdweb); other implementations or future versions may differ.
• Assessment mainly covers current on-chain settlements without testing under large-scale, long-term adversarial network or chain-layer manipulations (e.g., sequencer front-running).
• The structural impossibility theorem applies to output-only pricing and hidden compute; alternative protocols with richer interaction or trusted hardware assumptions may mitigate but are not studied here.
• The deployment layer flaws stem partly from operational choices; fixing them relies on vendor/operator adoption beyond protocol changes.
• Some datasets and internal logs are proprietary or closed-source, limiting full independent reproducibility and third-party verification.
• The concurrency-related findings are statistically significant but derived under experimental conditions possibly differing from diverse real-world loads.

Open questions / follow-ons

• Can token-transfer protocols or payment schemes be designed to natively bind resource semantics cryptographically without SDK reliance?
• How might trusted execution environments or secure channels close the gap between verification and settlement to prevent TOCTOU and race conditions?
• What coordination mechanisms or distributed ledger enhancements could guarantee idempotent, synchronized settlement at scale for dynamic pay-per-token billing?
• Can alternative pricing schemes incorporating interactive proof of compute reduce the fundamental manipulation gap identified for output-only models?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this analysis highlights the critical challenges in securing automated pay-per-access or pay-per-utilization systems integrating blockchain settlement with stateless HTTP APIs. The cross-resource substitution and concurrent duplicate-settlement flaws demonstrate how poor cryptographic binding and asynchronous state finality can be exploited by automated agents to bypass access controls or obtain multiple services for a single payment, analogous to replay or session-fixation attacks in web contexts. Understanding the layered nature of these flaws informs bot defense strategies that combine protocol design, SDK implementation audit, and deployment configuration to mitigate atomicity and integrity violations. The structural impossibility result signals the need for holistic designs in dynamic AI-inference billing that align economic incentives with verifiable usage to prevent manipulation by adversarial agents. Bot defense engineers should be aware that payment-enabled automation in agentic ecosystems requires rigorous synchronization and authentication beyond traditional web-layer controls.

Cite

@article{arxiv2605_30998,
  title={ Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments },
  author={ Shengchen Ling and Yihang Huang and Yuefeng Du and Yuan Chen and Yajin Zhou and Lei Wu and Cong Wang },
  journal={arXiv preprint arXiv:2605.30998},
  year={ 2026 },
  url={https://arxiv.org/abs/2605.30998}
}

Read the full paper

• arXiv:2605.30998 (abstract)
• arXiv:2605.30998 (PDF)