The x402 payment layer has a state-synchronization gap, and four agent-payment attacks fall out of it

Short summary

x402 payment infrastructure has a critical state-synchronization gap between HTTP request confirmation and blockchain settlement finality. Four attack primitives fall out of this gap—cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement—all documented in peer-reviewed ACM SIGOPS research. Three attack classes are testable via security harness; architectural decisions about finality points determine whether a system actually closes the gap.

• •State-sync gap between HTTP requests and blockchain finality creates exploitable attack surface in x402 infrastructure
• •Four attack primitives (substitution, race, overdraft, denial) documented in peer-reviewed ACM conference paper
• •Three primitives testable via open-source security harness; finality-point architecture decides real security

Generated with AI, which can make mistakes.