Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
x402-foundation/x402
main @ 2b74587
22
Fixes
0
CVEs
CRITICAL
Peak severity
87.5%
Coverage
Highlights
Auth Bypass: 11 prior fixes. Scrutinize any change in this area.
typescript/packages/x402/src/schemes/exact/evm/facilitator.ts: most-fixed (2 issues). Treat as high-risk during review.
19 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Payment verification logic silently ignored explicit negative validation responses ('isValid: false') from facilitators, allowing invalid or malicious payments to successfully clear authorization checks.
Auth Bypass: MCP wrappers failed to assert successful payment settlement prior to executing tasks, allowing clients to receive tool output even when the transaction settlement failed or replayed authorization signatures were used.
Arbitrary Code Execution: Insecure flags allowed ERC-6492 factory deployments to execute arbitrary code; the fix mandates strict factory address allowlisting during ERC-4337 deployments via EIP-6492.