x402 has zero seller vetting — we built a deterministic verifier and hit real protocol gotchas
Cold_Quiet_7072 · reddit · 2026-09-03
x402 (pay-per-call HTTP with USDC on Base, a 402 challenge instead of a login wall) is becoming the standard way agents pay for APIs, but Coinbase's Bazaar index has 14,000+ self-declared listings with effectively zero vetting — a well-formed signed 402 challenge says nothing about the service behind it.
The author built /verify/seller: no LLM in the path, $0.005/call paid via x402 itself. Given a seller URL, it probes live (without paying): does it return a well-formed 402 challenge; does its declared Bazaar schema example validate against its own schema (catches broken/copy-pasted/abandoned listings); is the payout address OFAC-sanctioned via an on-chain oracle; plus wallet age/tx count. Honest ceiling: this confirms checkable things, not trustworthiness.
Real gotchas: the x402 FastAPI middleware returns {} as the 402 body by default — the challenge lives only in the header unless RouteConfig.unpaidresponsebody is set; body-reading clients fail closed. And the async hook called synchronously yields an un-awaited coroutine that try/except swallows — fix by calling the sync base method directly. Details: goodsong.dev/x402-safety.
More from coding & agent
- JamesDSP breaks stereo on T2 MacBook 6-channel speakers — fixed with Copilot CLI's help — DanWahlin · 2026-09-03
- Why aren't game studios using agent swarms to remaster old classics? — CSProfKGD · 2026-09-03
- New CSS progress() trick simplifies adaptive border radius — jh3yy · 2026-09-03
- Team shares 4 real LLM uses: contract negotiation, agent clarification, grading, math — xuanalogue · 2026-09-03
- RealSWE benchmark: realistic user requests test coding agents, explicit intent boosts results — skku · 2026-09-03
- Grok Build v1.0.18 adds managed MCP policy enforcement, multi-round tool elicitation and charts — XFreeze · 2026-09-03