Peer-reviewed x402 analysis (ATC '26) names 4 agent-payment attack primitives — 3 map to tests, 1 doesn't

[msaleme]

Two papers landed this week putting agent payments under a security microscope.

"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments" (arXiv:2605.30998, ACM SIGOPS ATC '26) reports resource-leakage ratios up to 100% against official x402 SDKs and production deployments — on a protocol now carrying 130M+ transactions across Google Cloud, Cloudflare, and Stripe. It names four attack primitives: cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement.

Separately, "Agent-to-Agent Finance" (arXiv:2607.00245) makes wallet risk a first-class channel: "a malicious service description can trigger prompt injection… which causes wallet authorisation to approve an unintended transfer."

Why it matters

This isn't a single-vendor bug. It's the state-synchronization gap between synchronous HTTP and asynchronous on-chain finality — structural to x402 and inherited by anything settling on top of it. The paper shows per-flaw defenses invert attacker economics (8.7× → 0.9× advantage at 2.8% overhead) — fixable, but only if you test for it.

What catches this

Mapping the primitives to existing conformance tests (agent-security-harness, 532 tests):

• Cross-resource substitution → FB-015 (Voucher Resource-Hash Binding), X4-044 (Payment Replay Against Different Endpoint), AP2-007 (Mandate Chain Link — transaction_id)
• Duplicate-settlement race → X4-038 (Double-Spend Detection), AP2-013 (Double-Spend on Open Mandate), FB-017 (Escrow Over-Redemption), FB-014 (Batch Voucher Replay / Monotonicity)
• Allowance overdraft → CTK-003/004 (Per-Transaction Amount Cap / Cumulative Velocity Cap), FB-011/012 (Amount Cap / Velocity Budget), AP2-015 (Funding-Instrument Scope Binding)
• Unlimited-approval session keys → FB-013 (Approval Quorum Above Threshold), X4-055 (Cascading Payment Approval Chain)

Each runs as a tamper→reject differential:

PASS  AP2-013: Double-Spend on Open Mandate
PASS  FB-017: Escrow Over-Redemption
PASS  CTK-004: Cumulative Velocity Cap

What's missing

• Denial of settlement — withholding on-chain finality while consuming the resource is a liveness attack; we have no test for it (X4-011 rate-limiting is adjacent, not equivalent).
• The paper's impossibility result — "no output-only pricing can be both fair and bounded against inflation" (reasoning-token stuffing) — is a pricing-design problem a conformance vector can't settle.

Discussion

For the duplicate-settlement race: in your x402 stack, what's the authoritative point where you treat a payment as final before releasing the resource — the facilitator callback, an on-chain confirmation count, or a settlement receipt? That single choice decides whether the race is even reachable.