Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
coinbase/x402
main @ dd927a2
13
Fixes
0
CVEs
HIGH
Peak severity
80.0%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
typescript/packages/x402/src/schemes/exact/evm/facilitator.ts: most-fixed (2 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The EVM facilitator suffered from multiple critical validation gaps, including failing to verify that the destination address matches the payment recipient and accepting signatures from undeployed smart wallets lacking EIP-6492 info. Developers must ensure both identity verification and recipient verification are strictly performed on every transaction payload.
Auth Bypass: A lack of settlement caching across SVM SDKs allowed duplicate settlement race conditions on Solana. Implementations must maintain a secure, concurrent settlement cache to block replay and race-condition state mutations.
Auth Bypass: Malformed percent-encoding sequences on path parsing led to a complete paywall bypass when evaluating resource requests. Any URL parsing and normalization logic must handle decoding errors gracefully instead of silently failing or skipping security checks.