Coinbase and 14 x402 Facilitators Fail Security Tests

At the 35th USENIX Security Symposium, a research team presented test results showing security failures across 15 major x402 payment facilitators, including Coinbase, Thirdweb, PayAI and Mogami. The paper mapped 49 rule violations to 31 distinct vulnerabilities and validated multiple attack paths in controlled conditions.

The team analyzed more than 119 million x402 transactions on the Base and Solana networks from Oct. 1 to Dec. 26, 2025. The systems examined handled roughly 99% of observed x402 transactions and 98% of payment volume during that period. Every platform in the sample violated at least one security rule.

Researchers identified four broad attack classes: free shopping, asset theft, service disruption and gas abuse. They directly validated six specific attack paths: two that could let buyers obtain goods or services without final settlement, three that could force facilitators to pay excessive blockchain fees, and one that could expose assets held by a facilitator.

The single most severe validated path involved ERC-6492, an Ethereum signature standard intended to support smart-contract wallet signatures. The team found that specially crafted metadata could cause a facilitator to fund and submit an arbitrary token-approval transaction instead of the expected payment settlement. The researchers did not move funds during tests, but classified the flaw as a direct route to potential asset theft because it could enable approval of transfers controlled by a facilitator.

Several validated attacks exploited facilitator-sponsored gas, a feature that lets facilitators pay blockchain fees on behalf of merchants or buyers. The researchers showed how attackers could trigger costly smart-contract deployments or initializations, shifting network costs onto facilitators. During the study period, facilitators spent about $202,000 on network fees, including roughly $5,800 on Base transactions that reverted or failed.

The research also documented free-shopping scenarios in which an off-chain verification succeeds but the on-chain settlement later fails, for example because an authorization expired or the buyer lacked funds. If a merchant releases an irreversible product or service after verification, the buyer can receive it even though payment does not complete. The team validated two free-shopping paths and flagged 10 additional high-risk cases. All seven Coinbase reference server kits reviewed lacked explicit mechanisms to reverse actions taken after successful verification; versions of Coinbase’s Flask kit through 0.2.1 could release protected resources after verification regardless of settlement outcome.

The study highlighted market concentration. Coinbase processed 77.17 million transactions and nearly $27 million in payment volume during the measurement window, far more than other facilitators. More than 93% of the roughly 53,500 unique servers observed were associated with a single facilitator, magnifying the potential impact of a vulnerability or outage.

Some providers have acknowledged the disclosures. A remediation update dated Feb. 6 reported that Coinbase, PayAI and Mogami collectively confirmed six vulnerabilities; some fixes have been applied while work on others is ongoing. The paper did not publicly map specific vulnerabilities to individual providers, so the extent of fixes in live systems was not shown.

The authors recommended that facilitators treat all client-provided transaction fields as untrusted, recheck payment conditions immediately before on-chain settlement, and impose strict limits on facilitator-sponsored gas. For merchants, they advised withholding irreversible services until settlement completes or providing a way to reverse actions when payment fails. The paper noted that the effectiveness of these measures depends on consistent deployment by facilitators, SDK developers and merchants.