x402: Receipt names the wrong payer

A deliberately broken x402 endpoint charging 0.0001 USDC on Base Sepolia, advertising x402.org.

Pick a protocol

x402 uses its own PAYMENT-REQUIRED header. MPP uses the standard HTTP auth framework, with no facilitator.

x402Coinbase. PAYMENT-REQUIRED and PAYMENT-SIGNATURE headers.MPPTempo and Stripe. WWW-Authenticate: Payment, no facilitator.

New to these? Read what x402 and MPP put on the wire.

Pick a network

Testnets only. Nothing here can move real money.

Network

Asset

USDC, 6 decimals

Set the price

Amounts are atomic units of the asset, so no decimal point.

Amount

= 0.0001 USDC

Scheme

Recipient

Defaults to this network's burn address.

Pick a facilitator

What the challenge advertises for verify and settle. test402 issues challenges; it never settles.

Facilitator

Public testnet facilitator from the x402 docs.

Sign offers and receipts

The offer-receipt extension: a signed commitment to the terms on the 402, and a signed statement of delivery on the 200.

Signed artifacts

Offers and receipts as EIP-712 typed data. The payload travels beside the signature, and the signer is recovered from it rather than looked up.

Choose a behavior

Compliant by default. Every deviation is named, and never on by accident.

Behavior

The paid retry returns a genuinely signed receipt naming somebody else as the payer. A client that verifies the signature but never checks the receipt is about its own payment accepts a receipt for a payment it did not make.

Your endpointReceipt names the wrong payer

/api/x402?offerReceipt=eip712&quirk=receipt-payer-mismatch

Try it

curl -i "https://test402.com/api/x402?offerReceipt=eip712&quirk=receipt-payer-mismatch"

Returns 200 whose PAYMENT-RESPONSE carries a valid receipt for a different payer. The signature verifies; what fails is the check that the receipt matches the offer and the paying wallet.

The signature is minted per request and shown here as a placeholder, and the offer’s validUntil is always 300s past the moment you ask. Run the curl to see the real artifact.

Response it will return (HTTP 402)

PAYMENT-REQUIRED: eyJ4NDAyVmVyc2lvbiI6MiwiZXJyb3IiOiJQQVlNRU5ULVNJR05BVFVSRSBoZWFkZXIgaXMgcmVxdWlyZWQiLCJyZXNvdXJjZSI6eyJ1cmwiOiJodHRwczovL3Rlc3Q0MDIuY29tL2FwaS94NDAyP29mZmVyUmVjZWlwdD1laXA3MTImcXVpcms9cmVjZWlwdC1wYXllci1taXNtYXRjaCIsImRlc2NyaXB0aW9uIjoidGVzdDQwMiBjaGFsbGVuZ2UiLCJtaW1lVHlwZSI6ImFwcGxpY2F0aW9uL2pzb24ifSwiYWNjZXB0cyI6W3sic2NoZW1lIjoiZXhhY3QiLCJuZXR3b3JrIjoiZWlwMTU1Ojg0NTMyIiwiYW1vdW50IjoiMTAwIiwiYXNzZXQiOiIweDAzNkNiRDUzODQyYzU0MjY2MzRlNzkyOTU0MWVDMjMxOGYzZENGN2UiLCJwYXlUbyI6IjB4MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDQwMiIsIm1heFRpbWVvdXRTZWNvbmRzIjozMDAsImV4dHJhIjp7Im5hbWUiOiJVU0RDIiwidmVyc2lvbiI6IjIiLCJhc3NldFRyYW5zZmVyTWV0aG9kIjoiZWlwMzAwOSJ9fV0sImV4dGVuc2lvbnMiOnsiaHR0cHM6Ly90ZXN0NDAyLmNvbS9leHRlbnNpb25zL2ZhY2lsaXRhdG9yIjp7ImlkIjoieDQwMm9yZyIsInVybCI6Imh0dHBzOi8veDQwMi5vcmcvZmFjaWxpdGF0b3IifSwib2ZmZXItcmVjZWlwdCI6eyJpbmZvIjp7Im9mZmVycyI6W3siZm9ybWF0IjoiZWlwNzEyIiwiYWNjZXB0SW5kZXgiOjAsInBheWxvYWQiOnsidmVyc2lvbiI6MSwicmVzb3VyY2VVcmwiOiJodHRwczovL3Rlc3Q0MDIuY29tL2FwaS94NDAyP29mZmVyUmVjZWlwdD1laXA3MTImcXVpcms9cmVjZWlwdC1wYXllci1taXNtYXRjaCIsInNjaGVtZSI6ImV4YWN0IiwibmV0d29yayI6ImVpcDE1NTo4NDUzMiIsImFzc2V0IjoiMHgwMzZDYkQ1Mzg0MmM1NDI2NjM0ZTc5Mjk1NDFlQzIzMThmM2RDRjdlIiwicGF5VG8iOiIweDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA0MDIiLCJhbW91bnQiOiIxMDAiLCJ2YWxpZFVudGlsIjoxNzY3MjI1OTAwfSwic2lnbmF0dXJlIjoiPHNpZ25lZCBwZXIgcmVxdWVzdCAtLSBydW4gdGhlIGN1cmwgdG8gc2VlIGl0PiJ9XX0sInNjaGVtYSI6eyIkc2NoZW1hIjoiaHR0cHM6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQvMjAyMC0xMi9zY2hlbWEiLCJ0eXBlIjoib2JqZWN0IiwicHJvcGVydGllcyI6eyJvZmZlcnMiOnsidHlwZSI6ImFycmF5IiwiaXRlbXMiOnsidHlwZSI6Im9iamVjdCIsInByb3BlcnRpZXMiOnsiZm9ybWF0Ijp7InR5cGUiOiJzdHJpbmciLCJjb25zdCI6ImVpcDcxMiJ9LCJhY2NlcHRJbmRleCI6eyJ0eXBlIjoiaW50ZWdlciJ9LCJwYXlsb2FkIjp7InR5cGUiOiJvYmplY3QiLCJwcm9wZXJ0aWVzIjp7InZlcnNpb24iOnsidHlwZSI6ImludGVnZXIifSwicmVzb3VyY2VVcmwiOnsidHlwZSI6InN0cmluZyJ9LCJzY2hlbWUiOnsidHlwZSI6InN0cmluZyJ9LCJuZXR3b3JrIjp7InR5cGUiOiJzdHJpbmcifSwiYXNzZXQiOnsidHlwZSI6InN0cmluZyJ9LCJwYXlUbyI6eyJ0eXBlIjoic3RyaW5nIn0sImFtb3VudCI6eyJ0eXBlIjoic3RyaW5nIn0sInZhbGlkVW50aWwiOnsidHlwZSI6ImludGVnZXIifX0sInJlcXVpcmVkIjpbInZlcnNpb24iLCJyZXNvdXJjZVVybCIsInNjaGVtZSIsIm5ldHdvcmsiLCJhc3NldCIsInBheVRvIiwiYW1vdW50Il19LCJzaWduYXR1cmUiOnsidHlwZSI6InN0cmluZyJ9fSwicmVxdWlyZWQiOlsiZm9ybWF0IiwicGF5bG9hZCIsInNpZ25hdHVyZSJdfX19LCJyZXF1aXJlZCI6WyJvZmZlcnMiXX19fX0=

{
  "x402Version": 2,
  "error": "PAYMENT-SIGNATURE header is required",
  "resource": {
    "url": "https://test402.com/api/x402?offerReceipt=eip712&quirk=receipt-payer-mismatch",
    "description": "test402 challenge",
    "mimeType": "application/json"
  },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:84532",
      "amount": "100",
      "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
      "payTo": "0x0000000000000000000000000000000000000402",
      "maxTimeoutSeconds": 300,
      "extra": {
        "name": "USDC",
        "version": "2",
        "assetTransferMethod": "eip3009"
      }
    }
  ],
  "extensions": {
    "https://test402.com/extensions/facilitator": {
      "id": "x402org",
      "url": "https://x402.org/facilitator"
    },
    "offer-receipt": {
      "info": {
        "offers": [
          {
            "format": "eip712",
            "acceptIndex": 0,
            "payload": {
              "version": 1,
              "resourceUrl": "https://test402.com/api/x402?offerReceipt=eip712&quirk=receipt-payer-mismatch",
              "scheme": "exact",
              "network": "eip155:84532",
              "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
              "payTo": "0x0000000000000000000000000000000000000402",
              "amount": "100",
              "validUntil": 1767225900
            },
            "signature": "<signed per request -- run the curl to see it>"
          }
        ]
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "type": "object",
        "properties": {
          "offers": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "format": {
                  "type": "string",
                  "const": "eip712"
                },
                "acceptIndex": {
                  "type": "integer"
                },
                "payload": {
                  "type": "object",
                  "properties": {
                    "version": {
                      "type": "integer"
                    },
                    "resourceUrl": {
                      "type": "string"
                    },
                    "scheme": {
                      "type": "string"
                    },
                    "network": {
                      "type": "string"
                    },
                    "asset": {
                      "type": "string"
                    },
                    "payTo": {
                      "type": "string"
                    },
                    "amount": {
                      "type": "string"
                    },
                    "validUntil": {
                      "type": "integer"
                    }
                  },
                  "required": [
                    "version",
                    "resourceUrl",
                    "scheme",
                    "network",
                    "asset",
                    "payTo",
                    "amount"
                  ]
                },
                "signature": {
                  "type": "string"
                }
              },
              "required": [
                "format",
                "payload",
                "signature"
              ]
            }
          }
        },
        "required": [
          "offers"
        ]
      }
    }
  },
  "note": "test402 scenario. quirk=receipt-payer-mismatch"
}