x402 has zero seller vetting — we built a deterministic verifier and hit real protocol gotchas

Cold_Quiet_7072 · reddit · 2026-09-03

x402 (pay-per-call HTTP with USDC on Base, a 402 challenge instead of a login wall) is becoming the standard way agents pay for APIs, but Coinbase's Bazaar index has 14,000+ self-declared listings with effectively zero vetting — a well-formed signed 402 challenge says nothing about the service behind it.

The author built /verify/seller: no LLM in the path, $0.005/call paid via x402 itself. Given a seller URL, it probes live (without paying): does it return a well-formed 402 challenge; does its declared Bazaar schema example validate against its own schema (catches broken/copy-pasted/abandoned listings); is the payout address OFAC-sanctioned via an on-chain oracle; plus wallet age/tx count. Honest ceiling: this confirms checkable things, not trustworthiness.

Real gotchas: the x402 FastAPI middleware returns {} as the 402 body by default — the challenge lives only in the header unless RouteConfig.unpaidresponsebody is set; body-reading clients fail closed. And the async hook called synchronously yields an un-awaited coroutine that try/except swallows — fix by calling the sync base method directly. Details: goodsong.dev/x402-safety.

Original post →

More from coding & agent

coding & agent channel →