tags. We need to ensure word count 500-800. We'll aim for ~650. Let's write. Title: "Security Study Finds Every Major x402 Facilitator Violates at Least One Rule" - but that's a bit long. Maybe "All 15 Major x402 Facilitators Fail Security Review" - but "fail" might be too strong. The facts say "violated at least one security rule" so we can say that. Better: "Study: All 15 Major x402 Facilitators Violate Security Rules" - that's good. Slug: "x402-facilitators-security-study" Content: We'll write paragraphs. Lead: "A new security review of x402 payment facilitators found that all 15 major providers, including Coinbase, Thirdweb, PayAI, and Mogami, violated at least one security rule. The study, which analyzed more than 119 million transactions on Base and Solana, mapped 49 rule violations to 31 distinct vulnerabilities." Then we can have a section "The scope of the audit" with details. Then "Four attack classes" - free shopping, asset theft, service disruption, gas abuse. Then "The most severe path" - ERC-6492. Then "What the findings mean" - not all transactions vulnerable, but potential losses. Then "The official kits" - all seven Coinbase reference server kits lacked reversal mechanisms. End with a next step: maybe the researchers validated six attack paths under bounded conditions, but the full impact is still being assessed. Or we can say that the study doesn't mean 99% of transactions are vulnerable, but the risks are real. We need a concrete next thing: maybe the researchers are releasing details, or the facilitators need to patch. But we don't have that. We can say "The researchers said the findings highlight the need for facilitators to address the identified vulnerabilities before x402 becomes more widely adopted." But that's a paraphrase, not a quote. We can say "The study's authors recommend that facilitators review their implementations against the identified attack paths." But we don't have that in facts. We can say "The study identified six attack paths that were directly validated under bounded conditions, and the researchers said the findings could lead to direct financial loss for merchants, theft of facilitator-held assets, and unbounded sponsor-paid gas fees." That's from facts. We need to end on a concrete next thing. Maybe: "The researchers said the findings do not mean that 99% of x402 transactions were themselves vulnerable, but the potential for loss is real. The study's authors have not yet released a full list of which facilitators were affected by which vulnerabilities." But that's not in facts. We can say "The study's authors have not yet disclosed which specific vulnerabilities affect each facilitator." But we don't know that. We can say "The researchers said the findings highlight the need for facilitators to address the identified vulnerabilities before x402 becomes more widely adopted." That's a reasonable paraphrase. Alternatively, we can end with: "The study comes as x402 is being promoted as infrastructure for machine-driven commerce, allowing websites and APIs to request payments that software and AI agents can complete autonomously." That's a fact. So we can end with that as a context. But we need a "concrete next thing" - maybe a deadline? No. We can say "The researchers said the findings do not mean that 99% of x402 transactions were themselves vulnerable, but the potential for loss is real." That's a conclusion, but not a recap. We can end with a question: "Whether facilitators will patch these vulnerabilities before x402 gains wider adoption remains an open question." But that's a rhetorical question? It's not a rhetorical question, it's a statement. But we are told not to use "It remains to be seen" - we can say "Whether facilitators will patch these vulnerabilities before x402 gains wider adoption is still an open question." That's fine. But we need to avoid clichés. Let's write. We'll structure: - Lead paragraph - H2: "The scope of the audit" - details on the study - H2: "Four attack classes" - list them - H2: "The most severe path" - ERC-6492 - H2: "What the findings mean" - implications - H2: "The official kits" - Coinbase kits - End with a sentence about the future. We need to keep it under 800 words. Let's write the content. We'll use HTML tags. We'll write in a human tone, with contractions, varied sentence lengths. Let's draft. Title: "Study: All 15 Major x402 Facilitators Violate Security Rules" Slug: "x402-facilitators-security-study" Content:
A security review of x402 payment facilitators found that all 15 major providers, including Coinbase, Thirdweb, PayAI, and Mogami, violated at least one security rule. The study, which analyzed more than 119 million transactions on Base and Solana, mapped 49 rule violations to 31 distinct vulnerabilities.
The scope of the audit
Researchers examined the facilitators' systems, which account for 99% of observed x402 transactions and 98% of payment volume. They looked at everything from how payments are verified to how actions are reversed after a transaction. The study covered transactions between Oct. 1 and Dec. 26, 2025.
Facilitators spent about $202,000 on network fees during that period, including roughly $5,800 on Base transactions that ultimately reverted or failed. That's a small slice of the overall volume, but it points to a bigger problem: some attacks could force facilitators to pay for expensive smart-contract deployment or initialization, shifting unbounded network costs onto them.
Four attack classes
The researchers identified four broad categories of attacks: free shopping, asset theft, service disruption, and gas abuse. Free-shopping attacks happen when an x402 payment passes off-chain verification but fails on-chain, allowing merchants to release services without receiving payment. Gas-abuse attacks force facilitators to pay for costly operations. Asset theft and service disruption are more straightforward.
Six attack paths were directly validated under bounded conditions: two free-shopping attacks, three gas-abuse attacks, and one path that could expose facilitator-held assets.
The most severe path
The most severe attack path involved ERC-6492, a standard for signature validation. Malicious metadata could cause a facilitator to fund and submit an arbitrary token-approval transaction, potentially leading to asset theft. That's a direct hit on the facilitator's own holdings, not just the merchant's revenue.
What the findings mean
The findings don't mean that 99% of x402 transactions were themselves vulnerable. But the potential for loss is real: merchants could lose revenue, facilitators could lose assets, and sponsors could be stuck with unbounded gas fees. The study also found that all seven official Coinbase reference server kits, up to Flask kit version 0.2.1, lacked explicit mechanisms for reversing actions taken after successful verification.
That's a gap that could matter in practice. If a payment passes verification but then fails on-chain, the facilitator has no built-in way to undo the action it already took.
The official kits
The Coinbase kits are meant to be a starting point for developers building x402 servers. If they don't include reversal mechanisms, developers who rely on them may be building on an incomplete foundation. The researchers didn't single out Coinbase for criticism; they just noted the gap in the reference implementations.
X402 is being promoted as infrastructure for machine-driven commerce, allowing websites and APIs to request payments that software and AI agents can complete autonomously. That makes the security findings more than an academic exercise. If the infrastructure is to be trusted for autonomous payments, these vulnerabilities need to be addressed.
Whether facilitators will patch these issues before x402 gains wider adoption is still an open question.
That's about 500 words? Let's count. Actually we need to ensure we have enough. We can expand a bit. We can add more details about the study methodology, but we don't have much. We can mention that the researchers tested 15 facilitators, but we already did. We can add a sentence about the fact that the study is not saying all transactions are vulnerable, but the risks are real. We can also mention that the study is the first of its kind? But we don't know that. We can add a sentence about the fact that the researchers validated six attack paths under bounded conditions, meaning they didn't test them in production but in a controlled environment. We can also mention that the study's authors are not named, so we just say "researchers". We need to avoid "experts say" etc. We can also mention that the study is a security review, not a penetration test. Let's refine. We'll write a bit more. We'll also ensure we have a meta description of 150-160 chars. Let's craft the meta description: "A security review of 15 major x402 facilitators found all violated at least one rule, with 31 vulnerabilities mapped across 119 million transactions." That's about 150 chars. Keywords: x402, security, facilitators, vulnerabilities, Coinbase, etc. Focus keyword: "x402 security" or "x402 facilitator vulnerabilities" We'll set focusKeyword: "x402 security vulnerabilities" Now we need to output JSON. We'll also set readability wordCount to 650, readingTime "3 min". Let's count our draft: I'll copy into a counter. But we can adjust. We'll write a final version. Let's write the content in HTML. We'll ensure we have propertags. We'll also make sure we don't have any invented quotes. We'll use "researchers" as the subject. We'll also mention that the study analyzed 119 million transactions, but we already did. We'll add a sentence about the fact that the study is based on data from Oct 1 to Dec 26, 2025. We'll also mention that the facilitators include Coinbase, Thirdweb, PayAI, and Mogami. We'll also mention that the study found 49 rule violations. We'll also mention that the most severe path is ERC-6492. We'll also mention that the official Coinbase kits lack reversal mechanisms. We'll end with the open question. Let's write the final content. I'll write it in a text editor and then put into JSON. We need to ensure the content is between 500-800 words. I'll aim for ~650. Let's write:
A security review of x402 payment facilitators found that all 15 major providers, including Coinbase, Thirdweb, PayAI, and Mogami, violated at least one security rule. The study, which analyzed more than 119 million transactions on Base and Solana, mapped 49 rule violations to 31 distinct vulnerabilities.
The scope of the audit
Researchers examined the facilitators' systems, which account for 99% of observed x402 transactions and 98% of payment volume. They looked at how payments are verified, how actions are reversed, and how network fees are handled. The study covered transactions between Oct. 1 and Dec. 26, 2025.
Facilitators spent about $202,000 on network fees during that period, including roughly $5,800 on Base transactions that ultimately reverted or failed. That's a small slice of the overall volume, but it points to a bigger problem: some attacks could force facilitators to pay for expensive smart-contract deployment or initialization, shifting unbounded network costs onto them.
Four attack classes
The researchers identified four broad categories of attacks: free shopping, asset theft, service disruption, and gas abuse. Free-shopping attacks happen when an x402 payment passes off-chain verification but fails on-chain, allowing merchants to release services without receiving payment. Gas-abuse attacks force facilitators to pay for costly operations. Asset theft and service disruption are more straightforward.
Six attack paths were directly validated under bounded conditions: two free-shopping attacks, three gas-abuse attacks, and one path that could expose facilitator-held assets.
The most severe path
The most severe attack path involved ERC-6492, a standard for signature validation. Malicious metadata could cause a facilitator to fund and submit an arbitrary token-approval transaction, potentially leading to asset theft. That's a direct hit on the facilitator's own holdings, not just the merchant's revenue.
What the findings mean
The findings don't mean that 99% of x402 transactions were themselves vulnerable. But the potential for loss is real: merchants could lose revenue, facilitators could lose assets, and sponsors could be stuck with unbounded gas fees. The study also found that all seven official Coinbase reference server kits, up to Flask kit version 0.2.1, lacked explicit mechanisms for reversing actions taken after successful verification.
That's a gap that could matter in practice. If a payment passes verification but then fails on-chain, the facilitator has no built-in way to undo the action it already took.
The official kits
The Coinbase kits are meant to be a starting point for developers building x402 servers. If they don't include reversal mechanisms, developers who rely on them may be building on an incomplete foundation. The researchers didn't single out Coinbase for criticism; they just noted the gap in the reference implementations.
X402 is being promoted as infrastructure for machine-driven commerce, allowing websites and APIs to request payments that software and AI agents can complete autonomously. That makes the security findings more than an academic exercise. If the infrastructure is to be trusted for autonomous payments, these vulnerabilities need to be addressed.
Whether facilitators will patch these issues before x402 gains wider adoption is still an open question.
That's about 500 words? Let's count: I'll copy into a counter. Actually, I'll estimate. It's around 500-550. We can add a bit more. We can add a sentence about the fact that the study is the first to look at x402 facilitators as a group, but we don't know that. We can say "The study is one of the first to examine x402 facilitators as a group" but that might be an invention. We can say "The study is the first to map vulnerabilities across the major facilitators" but we don't know. Better to stick to facts. We can add a sentence about the fact that the researchers validated the attack paths under bounded conditions, meaning they didn't test them in production. That's already there. We can add a sentence about the fact that the study's authors are not named, but we can say "The researchers" as we do. We can also mention that the study is based on public data? Not sure. We can add a sentence about the fact that the facilitators are responsible for verifying payments and executing actions, so their security is critical. We can also mention that the study found that all 15 facilitators violated at least one rule, but we already said that. We can expand the "What the findings mean" section a bit. Let's add a sentence: "The researchers said the findings could lead to direct financial loss to merchants, theft of facilitator-held assets, unbounded sponsor-paid gas or fees, and disruption of payment services." That's from the facts. We can also add: "The study's authors did not name which facilitators were affected by which vulnerabilities." But that's not in facts. We can say "The study did not disclose which specific vulnerabilities affect each facilitator." But we don't know if they did or not. We can say "The study did not provide a breakdown of which facilitators were affected by which vulnerabilities." That might be an inference. Better to avoid. We can say "The researchers said the findings do not mean that 99% of x402 transactions were themselves vulnerable, but the potential for loss is real." That's already there. We can add a sentence about the fact that the study is based on a large sample: "The study's sample covers the vast majority of x402 activity, making the findings representative of the ecosystem." But that's an interpretation. We can also mention that the study is a security review, not a penetration test, so the actual exploitation might be more limited. We can add: "The researchers validated six attack paths under bounded conditions, meaning they tested them in a controlled environment rather than on live systems." That's already there. We can also add: "The study comes as x402 is being promoted as infrastructure for machine-driven commerce." That's already there. We can add a final sentence: "The researchers said the findings highlight the need for facilitators to address the identified vulnerabilities before x402 becomes more widely adopted." That's a paraphrase, but it's not a quote. We can say "The study's authors recommend that facilitators review their implementations against the identified attack paths." But we don't have that. We can say "The study's findings suggest that facilitators need to review their implementations." That's a reasonable inference. But we need to be careful not to invent recommendations. We can say "The study's findings point to a need for facilitators to address the identified vulnerabilities." That's a conclusion from the facts. We can end with that. Let's add a sentence: "The study's findings point to a need for facilitators to address the
