A live x402 endpoint can fail even when its payment route looks correctly configured: the facilitator may not support that exact version, scheme, or network; the server may perform work at the wrong point in the payment flow; an untrusted or failed facilitator response may be mistaken for confirmation; or retries may repeat work while settlement is unresolved. These are practical production failure classes—not claims that every x402 deployment has a vulnerability. Verify behavior against the scheme and facilitator you actually run.
How a typical x402 payment request moves
x402 separates three roles: the resource server provides the paid service, the client requests it and supplies payment authorization, and a facilitator can verify the signed payment payload and arrange settlement. In a typical flow, a request arrives without payment; the server responds with HTTP 402 Payment Required and payment requirements; the client selects a supported requirement and sends a signed payload; the server verifies it and fulfills the request according to the scheme; then settlement completes. A successful response can include PAYMENT-RESPONSE.
As an Amazon Associate I earn from qualifying purchases.
That sequence is a useful map, not a universal execution order. A scheme may require settlement before fulfillment. Keep the x402 version, scheme, network, and deployment model explicit in both configuration and operational documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bug 1: advertising a route the facilitator cannot support
A route can be valid in your server configuration and still fail when used. Facilitator support is specific: a facilitator that handles one x402 version, scheme, or network may not handle the combination your route advertises. A test on a test network does not establish support for the corresponding mainnet route.
#1 Best Overall
Check the exact combination before exposing the route
Query the selected facilitator’s /supported endpoint during startup or deployment, then advertise only the version, scheme, and network combinations it confirms. Solana’s official x402 facilitator guide says this endpoint lists supported versions, schemes, networks, extensions, and signers. Do not treat a successful response from /supported as a general endorsement of a facilitator: it answers a capability question, not questions about security, availability, or operational fit.
For production mainnet EVM routes, the x402 repository advises choosing a production provider, self-hosting, or self-facilitating explicitly. Do not assume the public x402.org facilitator is the production default.
Diagnose a persistent 402 by comparing requirements
If a request still returns 402 Payment Required after the client attaches PAYMENT-SIGNATURE, compare the offered requirements with the request actually received: version, scheme, network, asset, amount, and recipient must correspond to the supported route. Also confirm the client sent the payload in the header format expected by that protocol version. Cloudflare’s x402 gateway documentation describes version 2 using PAYMENT-REQUIRED and PAYMENT-SIGNATURE; it lists scheme, CAIP-2 network, asset, amount, receiving payTo address, and authorization timeout among the payment requirements. That page was last updated September 30, 2026; header names and support can differ across versions and implementations.
Recommended Free Tools
Bug 2: performing paid work at the wrong point in the flow
Do not treat receipt of a payment header as authorization to run the paid operation. Parse PAYMENT-SIGNATURE with a protocol library, then validate the payload against the exact PaymentRequirements the server offered. The scheme defines when verification, fulfillment, and settlement happen.
Follow the selected scheme’s ordering
- Authorization flow: verify the payment payload before fulfillment; settlement follows fulfillment.
- Other schemes: settlement may be required before fulfillment. Follow that scheme’s documented sequence rather than applying the authorization-flow order by default.
Running work before the required verification or settlement step risks providing a paid resource without satisfying the scheme’s payment conditions. Conversely, waiting for settlement where the scheme expects fulfillment after authorization can break the intended flow. Keep the ordering in one scheme-specific implementation path instead of scattering assumptions through shared HTTP middleware.
Use protocol errors to locate mismatches
The x402 specification describes error classes including insufficient funds, invalid network, invalid payload, invalid scheme, invalid payment requirements, mismatched amount or recipient, invalid signature, and authorization validity-window errors. Treat these as debugging categories, not as a promise that every implementation returns identical error names or details. Log enough context to identify the failed requirement without exposing secrets or sensitive payment data.
Bug 3: treating a facilitator failure as proof of payment
A facilitator response is part of the payment decision, so the server must establish that the response is authentic, valid, and relevant to the request before relying on it. Solana’s official x402 facilitator guide states: “A network error or malformed response is not proof of payment.” A timeout, invalid response body, or response from an untrusted party must not turn into a successful paid fulfillment.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Fail closed and bound the wait
- Authenticate facilitator traffic using the trust mechanism appropriate to your deployment.
- Validate every response against the expected request, payment requirements, and scheme—not merely the HTTP status code.
- Set strict connection and response timeouts. On timeout or malformed data, do not infer that verification or settlement succeeded.
- Record the failure as unresolved or failed according to the scheme; do not return a success response that represents payment as confirmed.
When evaluating a facilitator, Solana’s guide also calls out key protection, replay prevention, transaction confirmation, partial-failure handling, and incident reporting. A service that supports the desired network but cannot meet your trust and recovery requirements is not a suitable production choice.
Bug 4: letting fulfillment, settlement, and retries drift apart
Verification and settlement are distinct stages in the typical x402 flow, and fulfillment may occur between them depending on the scheme. If a response is lost or settlement confirmation is delayed, a blind retry can repeat an expensive or irreversible operation even though the original request is still in progress. This is an operational risk implied by the multi-stage flow, not a claim that every implementation has a demonstrated retry bug.
Rank #4
Track payment and request state separately
Model the request’s progress explicitly—for example, requirements offered, payload received, verification result, fulfillment result, and settlement result. Persist enough state to reconcile an interrupted request, and use documented idempotency guarantees where they exist. Do not assume that a client retry, facilitator retry, or repeated HTTP request is automatically safe to execute again.
Choose recovery behavior around the selected scheme. If fulfillment has completed but settlement confirmation is pending, avoid rerunning the underlying operation just to obtain a faster response. If the scheme requires settlement before fulfillment, keep the resource unavailable until the required settlement result is established. Where the implementation does not document idempotency or recovery guarantees, do not invent them: design an explicit reconciliation path and make uncertain outcomes visible to operators.
Choose a facilitation model for production, not just connectivity
Solana’s official x402 facilitator documentation describes managed facilitator, dedicated self-hosted facilitator, and in-process facilitation as deployment models. The trade-off is operational ownership and trust, not simply whether a /supported call succeeds. The distinctions below are architectural considerations; exact key, RPC, storage, scaling, network, availability, and data-policy details depend on the specific implementation and are not established for every model by the model names alone.
Best Value
| Model | Operational surface and control | Key, RPC, and storage responsibility | Scaling, network support, availability, trust, and data policy |
|---|---|---|---|
| Managed facilitator | Less infrastructure to operate directly; control over the facilitator implementation is limited by the service arrangement. | Responsibility and custody arrangements are provider-specific; verify them rather than assuming where keys, RPC access, or records reside. | Check exact version, scheme, and network support, service availability, trust terms, and data policy with the provider. These details are not stated universally for the model in Solana’s guide. |
| Dedicated self-hosted facilitator | You operate a separate facilitator service and gain direct control over its deployment and configuration. | You must establish who protects keys and operates RPC access and any required storage; the exact duties depend on the implementation. | You own the scaling and availability plan. Confirm that the deployed facilitator supports the exact route and define its trust and data-handling policies; model-wide values are not stated in Solana’s guide. |
| In-process facilitation | Facilitation runs within the application process, reducing the separation between the resource server and payment component. | The application’s deployment boundary contains the facilitation logic; specific key custody, RPC, and storage arrangements depend on the implementation. | Scaling and availability are coupled to the application’s operation. Confirm exact network support and assess the trust and data consequences for your architecture; model-wide values are not stated in Solana’s guide. |
If you are building Solana facilitator infrastructure rather than only consuming one, Kora is a relevant implementation option to evaluate. Cloudflare Monetization Gateway is another named software deployment option in Cloudflare’s x402 documentation. Neither name by itself establishes the support, availability, trust, or data-policy fit for a particular endpoint.
What security research does—and does not—establish
Wang, Yang, Chen, Ji, and Payer’s 2026 paper reports violations in all 15 facilitators they evaluated; the paper says those facilitators were collectively used by more than 60,000 sellers and 360,000 buyers. The authors also report measuring more than 119 million Base and Solana transactions. These figures describe the paper’s evaluated sample and measurement scope, not a live ecosystem total or proof that every facilitator remains vulnerable.
The paper describes four attack families: Free Shopping, Asset Theft, Service Denial, and Gas Abuse. The authors say they disclosed findings to affected parties, which acknowledged issues and adopted mitigations, including changes by Coinbase. Those results are evidence that facilitator implementations can have consequential security flaws; they are not the same four operational failure classes discussed above, and they do not establish that the reported issues persist after mitigation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
