x402: Offer contradicts the challenge

A deliberately broken x402 endpoint charging 0.0001 USDC on Base Sepolia, advertising x402.org.

Pick a protocol

x402 uses its own PAYMENT-REQUIRED header. MPP uses the standard HTTP auth framework, with no facilitator.

x402Coinbase. PAYMENT-REQUIRED and PAYMENT-SIGNATURE headers.MPPTempo and Stripe. WWW-Authenticate: Payment, no facilitator.

New to these? Read what x402 and MPP put on the wire.

Pick a network

Testnets only. Nothing here can move real money.

Network

Asset

USDC, 6 decimals

Set the price

Amounts are atomic units of the asset, so no decimal point.

Amount

= 0.0001 USDC

Scheme

Recipient

Defaults to this network's burn address.

Pick a facilitator

What the challenge advertises for verify and settle. test402 issues challenges; it never settles.

Facilitator

Public testnet facilitator from the x402 docs.

Sign offers and receipts

The offer-receipt extension: a signed commitment to the terms on the 402, and a signed statement of delivery on the 200.

Signed artifacts

Offers and receipts as EIP-712 typed data. The payload travels beside the signature, and the signer is recovered from it rather than looked up.

Choose a behavior

Compliant by default. Every deviation is named, and never on by accident.

Behavior

The signed offer commits to an amount 1000x what the matching accepts entry advertises. A client that trusts acceptIndex rather than comparing the signed fields never notices the two disagree.

Your endpointOffer contradicts the challenge

/api/x402?offerReceipt=eip712&quirk=offer-mismatch

Try it

curl -i "https://test402.com/api/x402?offerReceipt=eip712&quirk=offer-mismatch"

Returns 402 whose offer payload and accepts entry state different amounts. Spec §4.1.1: acceptIndex is an unsigned convenience field and clients MUST match offers to accepts entries by comparing the signed payload.

The signature is minted per request and shown here as a placeholder, and the offer’s validUntil is always 300s past the moment you ask. Run the curl to see the real artifact.

Response it will return (HTTP 402)

PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOiJQQVlNRU5ULVNJR05BVFVSRSBoZWFkZXIgaXMgcmVxdWlyZWQiLCJyZXNvdXJjZSI6eyJ1cmwiOiJodHRwczovL3Rlc3Q0MDIuY29tL2FwaS94NDAyP29mZmVyUmVjZWlwdD1laXA3MTImcXVpcms9b2ZmZXItbWlzbWF0Y2giLCJkZXNjcmlwdGlvbiI6InRlc3Q0MDIgY2hhbGxlbmdlIiwibWltZVR5cGUiOiJhcHBsaWNhdGlvbi9qc29uIn0sImFjY2VwdHMiOlt7InNjaGVtZSI6ImV4YWN0IiwibmV0d29yayI6ImVpcDE1NTo4NDUzMiIsImFtb3VudCI6IjEwMCIsImFzc2V0IjoiMHgwMzZDYkQ1Mzg0MmM1NDI2NjM0ZTc5Mjk1NDFlQzIzMThmM2RDRjdlIiwicGF5VG8iOiIweDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA0MDIiLCJtYXhUaW1lb3V0U2Vjb25kcyI6MzAwLCJleHRyYSI6eyJuYW1lIjoiVVNEQyIsInZlcnNpb24iOiIyIiwiYXNzZXRUcmFuc2Zlck1ldGhvZCI6ImVpcDMwMDkifX1dLCJleHRlbnNpb25zIjp7Imh0dHBzOi8vdGVzdDQwMi5jb20vZXh0ZW5zaW9ucy9mYWNpbGl0YXRvciI6eyJpZCI6Ing0MDJvcmciLCJ1cmwiOiJodHRwczovL3g0MDIub3JnL2ZhY2lsaXRhdG9yIn0sIm9mZmVyLXJlY2VpcHQiOnsiaW5mbyI6eyJvZmZlcnMiOlt7ImZvcm1hdCI6ImVpcDcxMiIsImFjY2VwdEluZGV4IjowLCJwYXlsb2FkIjp7InZlcnNpb24iOjEsInJlc291cmNlVXJsIjoiaHR0cHM6Ly90ZXN0NDAyLmNvbS9hcGkveDQwMj9vZmZlclJlY2VpcHQ9ZWlwNzEyJnF1aXJrPW9mZmVyLW1pc21hdGNoIiwic2NoZW1lIjoiZXhhY3QiLCJuZXR3b3JrIjoiZWlwMTU1Ojg0NTMyIiwiYXNzZXQiOiIweDAzNkNiRDUzODQyYzU0MjY2MzRlNzkyOTU0MWVDMjMxOGYzZENGN2UiLCJwYXlUbyI6IjB4MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDQwMiIsImFtb3VudCI6IjEwMDAwMCIsInZhbGlkVW50aWwiOjE3NjcyMjU5MDB9LCJzaWduYXR1cmUiOiI8c2lnbmVkIHBlciByZXF1ZXN0IC0tIHJ1biB0aGUgY3VybCB0byBzZWUgaXQ+In1dfSwic2NoZW1hIjp7IiRzY2hlbWEiOiJodHRwczovL2pzb24tc2NoZW1hLm9yZy9kcmFmdC8yMDIwLTEyL3NjaGVtYSIsInR5cGUiOiJvYmplY3QiLCJwcm9wZXJ0aWVzIjp7Im9mZmVycyI6eyJ0eXBlIjoiYXJyYXkiLCJpdGVtcyI6eyJ0eXBlIjoib2JqZWN0IiwicHJvcGVydGllcyI6eyJmb3JtYXQiOnsidHlwZSI6InN0cmluZyIsImNvbnN0IjoiZWlwNzEyIn0sImFjY2VwdEluZGV4Ijp7InR5cGUiOiJpbnRlZ2VyIn0sInBheWxvYWQiOnsidHlwZSI6Im9iamVjdCIsInByb3BlcnRpZXMiOnsidmVyc2lvbiI6eyJ0eXBlIjoiaW50ZWdlciJ9LCJyZXNvdXJjZVVybCI6eyJ0eXBlIjoic3RyaW5nIn0sInNjaGVtZSI6eyJ0eXBlIjoic3RyaW5nIn0sIm5ldHdvcmsiOnsidHlwZSI6InN0cmluZyJ9LCJhc3NldCI6eyJ0eXBlIjoic3RyaW5nIn0sInBheVRvIjp7InR5cGUiOiJzdHJpbmcifSwiYW1vdW50Ijp7InR5cGUiOiJzdHJpbmcifSwidmFsaWRVbnRpbCI6eyJ0eXBlIjoiaW50ZWdlciJ9fSwicmVxdWlyZWQiOlsidmVyc2lvbiIsInJlc291cmNlVXJsIiwic2NoZW1lIiwibmV0d29yayIsImFzc2V0IiwicGF5VG8iLCJhbW91bnQiXX0sInNpZ25hdHVyZSI6eyJ0eXBlIjoic3RyaW5nIn19LCJyZXF1aXJlZCI6WyJmb3JtYXQiLCJwYXlsb2FkIiwic2lnbmF0dXJlIl19fX0sInJlcXVpcmVkIjpbIm9mZmVycyJdfX19fQ==

{
  "x402Version": 2,
  "error": "PAYMENT-SIGNATURE header is required",
  "resource": {
    "url": "https://test402.com/api/x402?offerReceipt=eip712&quirk=offer-mismatch",
    "description": "test402 challenge",
    "mimeType": "application/json"
  },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:84532",
      "amount": "100",
      "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
      "payTo": "0x0000000000000000000000000000000000000402",
      "maxTimeoutSeconds": 300,
      "extra": {
        "name": "USDC",
        "version": "2",
        "assetTransferMethod": "eip3009"
      }
    }
  ],
  "extensions": {
    "https://test402.com/extensions/facilitator": {
      "id": "x402org",
      "url": "https://x402.org/facilitator"
    },
    "offer-receipt": {
      "info": {
        "offers": [
          {
            "format": "eip712",
            "acceptIndex": 0,
            "payload": {
              "version": 1,
              "resourceUrl": "https://test402.com/api/x402?offerReceipt=eip712&quirk=offer-mismatch",
              "scheme": "exact",
              "network": "eip155:84532",
              "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
              "payTo": "0x0000000000000000000000000000000000000402",
              "amount": "100000",
              "validUntil": 1767225900
            },
            "signature": "<signed per request -- run the curl to see it>"
          }
        ]
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "type": "object",
        "properties": {
          "offers": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "format": {
                  "type": "string",
                  "const": "eip712"
                },
                "acceptIndex": {
                  "type": "integer"
                },
                "payload": {
                  "type": "object",
                  "properties": {
                    "version": {
                      "type": "integer"
                    },
                    "resourceUrl": {
                      "type": "string"
                    },
                    "scheme": {
                      "type": "string"
                    },
                    "network": {
                      "type": "string"
                    },
                    "asset": {
                      "type": "string"
                    },
                    "payTo": {
                      "type": "string"
                    },
                    "amount": {
                      "type": "string"
                    },
                    "validUntil": {
                      "type": "integer"
                    }
                  },
                  "required": [
                    "version",
                    "resourceUrl",
                    "scheme",
                    "network",
                    "asset",
                    "payTo",
                    "amount"
                  ]
                },
                "signature": {
                  "type": "string"
                }
              },
              "required": [
                "format",
                "payload",
                "signature"
              ]
            }
          }
        },
        "required": [
          "offers"
        ]
      }
    }
  },
  "note": "test402 scenario. quirk=offer-mismatch"
}