AI agentlari x402 SDK'lari yordamida API chaqiruvlari uchun to'lov qilganda, agar zararli API so'rasa, ular qo'llab-quvvatlanadigan tokenning to'liq balansiga to'lovni imzolashi mumkin edi, deb xabar berdi V12 xavfsizlik firmasi 22-oktabrda.
Sababi SDK'larning standart mijozi bo'lib, u 18-avgustdagi relizlar cheklov qo'shguncha hech qanday sarflash chegarasini o'rnatmagan. Xavf faqat to'lovlarni avtomatik imzolaydigan va ilovalari hech qanday cheklov o'rnatmagan agentlarga tegishli edi.
Cheklovning yo'qligi V12 x402 kodida topgan 25 ta kamchilikdan biri va u jiddiy deb baholagan va batafsil tasvirlagan uchta kamchilikdan biri. SDK'larni saqlaydigan x402 Foundation 18-avgustdagi relizlarda uchta jiddiy kamchilikni ham allaqachon tuzatgan edi.
Boshqa ikkitadan biri, x402 to'lovlarini tekshiradigan xizmat bo'lgan fasilitatorga, Solana'da hech qanday tokenni ko'chirmaydigan tranzaksiyani haqiqiy to'lov sifatida qabul qilishga imkon bergan. x402 SDK'lari orasida faqat TypeScript SDK'da bu kamchilik bor edi. Boshqasi esa zararli server agentni boshqa veb-sayt uchun kirish xabarini imzolashga majbur qilishga imkon bergan.
V12 kamchiliklarni kodni ko'rib chiqish va mahalliy testlar o'tkazish orqali topdi. V12 ham, x402 Foundation ham ulardan foydalanib amalga oshirilgan hujumlar haqida ommaviy xabar bermagan.
Foundation uchta kamchilik uchun hech qanday xavfsizlik ogohlantirishini e'lon qilmagan va uning o'zgarish jurnallari tuzatishlarni xavfsizlik tuzatishlari deb atamasdan ro'yxatga olgan. 23-oktabr holatiga ko'ra, npm audit tuzatishlardan oldingi oxirgi TypeScript relizlari uchun hech qanday ogohlantirish qaytarmagan va PyPI tuzatishlardan oldingi oxirgi Python relizi uchun hech qanday zaiflik ro'yxatga olmagan, deb topdi The Hacker News. Ushbu tekshiruvlarga tayanadigan dasturchi yangilash haqida hech qanday ogohlantirish olmaydi.
Coinbase x402 ni yaratgan va bu yil uni x402 Foundation'ga topshirgan, bu Linux Foundation loyihasi bo'lib, uning a'zolari orasida Visa va Mastercard ham bor. Coinbase foundationning texnik boshqaruv qo'mitasida eng yuqori o'rinni egallaydi.
Standart Mijozda Sarflash Cheklovi Yo'q
x402 ochiq standart bo'lib, u dasturiy ta'minot, jumladan AI agentlari, API chaqiruvi ichida to'lov qilishga imkon beradi, har bir to'lov uchun odamning tasdiqlashini talab qilmasdan.
To'lovni xohlagan server HTTP 402 Payment Required holat kodi bilan javob beradi va har bir to'lov variantini miqdor, token va qabul qiluvchi bilan ro'yxatlaydi. Mijoz birini tanlaydi, to'lovni imzolaydi va so'rovni yana yuboradi.
Standart mijoz ro'yxatdagi birinchi variantni tanlagan va tuzatishdan oldin miqdor bo'yicha hech qanday cheklov o'rnatmagan.
Dushman API bu xususiyatdan foydalanib, oddiy ma'lumot so'rovini hamyonning qo'llab-quvvatlanadigan tokenning to'liq balansiga so'rovga aylantirishi mumkin edi, deb aytdi V12. Oldingi kichik to'lov hamyon manzilini ochib berishi mumkin edi, shuning uchun server avval balansni tekshirishi mumkin edi.
Avtomatik imzolovchi va ilova tomonidan o'rnatilgan to'lov siyosati yo'q bo'lsa, mijoz shu miqdor uchun to'lovni imzolashi mumkin edi. Imzolangan o'tkazmalarni qo'llab-quvvatlaydigan token uchun hujumchi imzolangan to'lovni yuborishi va mablag'larni yig'ishi mumkin edi.
18-avgustdagi relizlar TypeScript, Python va Go mijozlariga sarflash nazoratini qo'shdi. Endi ular har bir to'lovni $1 bilan cheklaydi va faqat SDK tanigan AQSh dollari barqaror tangalarini, masalan USDC ni ruxsat etadi.
Token Tasdiqlari Solana To'lovlari Sifatida Qabul Qilingan
x402 da savdogarning serveri har bir to'lovni tekshirish va uni blokcheynga yuborish uchun fasilitatorga tayanadi. Solana'da fasilitator tranzaksiya to'lovini ham to'laydi.
Solana uchun TypeScript fasilitator kodi to'lov ruxsat etilgan token dasturini chaqirganini tekshirgan, keyin uni ko'rsatma turini tekshirmasdan o'tkazma sifatida o'qigan. Token tasdiqlashi, bu boshqa hisobga keyinchalik token sarflashga ruxsat beradi, lekin o'zi hech qanday tokenni ko'chirmaydi, o'tkazmadan faqat birinchi baytida farq qiladi.
V12 ning mahalliy testida fasilitator bunday tasdiqlashni haqiqiy to'lov sifatida qabul qilgan. Test jonli tranzaksiyani yubormagan.
Shuning uchun fasilitatorga tayanadigan savdogar hech qanday token olmasdan to'langan resursni yetkazib berishi mumkin edi, deb aytdi V12 va buni "to'liq to'lovni chetlab o'tish" deb atadi. Hujumchiga token hisobi kerak edi, lekin balans emas, va fasilitator har safar tranzaksiya to'lovini to'lagan.
Python va Go SDK'lari allaqachon ko'rsatma turini tekshirgan. 18-avgustdagi relizlar TypeScript kodiga ham xuddi shunday tekshiruvni qo'shdi.
Nashr etilgan har bir @x402/svm relizi 2.0.0 dan 2.22.0 gacha tekshiruvga ega emas va 2.23.0 dan boshlab har bir relizda u bor, deb topdi The Hacker News nashr etilgan paketlarni qidirib.
Boshqa Veb-saytlar Uchun Imzolangan Kirishlar
x402 da Sign-In-With-X (SIWx) deb ataladigan kirish kengaytmasi ham bor. U agentga hamyon bilan qisqa xabarni imzolash orqali kirishga imkon beradi, masalan, yana to'lash o'rniga oldingi to'lovni isbotlash uchun. Ethereum'da xabar veb-sayt nomini, hamyon manzilini va bir martalik kodni o'z ichiga oladi.
Avtomatlashtirilgan mijoz bu xabarlarni ularda nomlangan veb-sayt u bilan bog'langan veb-sayt ekanligini tekshirmasdan imzolagan.
Zararli server boshqa saytdan yangi kirish xabarini olishi, uni agentga uzatishi va imzodan foydalanib agentning hamyoni sifatida o'sha saytga kirishi mumkin edi, deb aytdi V12. Bu boshqa sayt qayta yuborilgan xabarni qabul qiladigan har qanday joyda ishlashi mumkin edi va hujumchi kirish ruxsat bergan har qanday kirish huquqiga ega bo'lar edi.
18-avgustdagi relizlar TypeScript, Python va Go mijozlarini xabardagi sayt 402 javobini yuborgan sayt bilan mos kelmasa imzolashni rad etishga majbur qiladi. Loyiha SIWx spetsifikatsiyasini ham o'zgartirgan, endi u mijoz ikkisi mos kelmasa imzolashni rad etishi kerakligini aytadi.
createSIWxPayload ni to'g'ridan-to'g'ri chaqiradigan TypeScript kodi endi har qanday yo'naltirishlardan keyin 402 javobining URL manzilini o'tkazishi kerak. @x402/fetch va @x402/axios o'rashlari buni o'zlari o'tkazadi.
Nimani Yangilash Kerak
Eng so'nggi relizlarga yangilash keyinchalik tuzatishlarni ham olib keladi, jumladan sentyabrda @x402/core 2.27.0 dagi alohida to'lovni chetlab o'tish tuzatishi. 23-oktabr holatiga ko'ra, eng so'nggi versiyalar @x402/core, @x402/svm, @x402/extensions, @x402/fetch va @x402/axios uchun 2.28.0, Go moduli uchun v2.28.0 va Python paketi uchun 2.25.0.
TypeScript'da mijozlar sarflash tuzatishini @x402/fetch yoki @x402/axios ni 2.23.0 yoki undan keyingi versiyaga yangilash orqali oladi, bu mos @x402/core ni tortib oladi. SIWx dan foydalanadigan ilovalar kirish tekshiruvini o'z ichiga olgan @x402/extensions 2.23.0 yoki undan keyingi versiyaga ham muhtoj. Solana to'lovlarini tekshiradigan fasilitatorlar @x402/svm 2.23.0 yoki undan keyingi versiyaga muhtoj.
Yangilashdan keyin, mavjud mijozlar har bir to'lovni $1 bilan cheklaydi va tan olingan barqaror tangalar bilan cheklaydi, agar ilova o'z sarflash nazoratini o'rnatmasa. spendControls: false ni o'tkazadigan ilovalar bu nazoratlarning barchasini o'chiradi.
Yangilay olmaydigan jamoalar belgilangan miqdordan yuqori har qanday variantni rad etadigan to'lov siyosatini ro'yxatdan o'tkazishi mumkin. Eski mijozlar buni TypeScript va Go'da registerPolicy va Python'da registerpolicy bilan qo'llab-quvvatlaydi, Python'da tayyor maxamount siyosati ham bor.
V12 mijozlarga SIWx kirish xabari ular bog'langan saytni aniqlashini imzolashdan oldin tekshirishni, har bir to'lov va umumiy byudjetni o'rnatishni va qaysi tokenlar, tarmoqlar va qabul qiluvchilarga to'lashni cheklashni maslahat beradi.
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.
The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set no limits.
The missing limit is one of 25 flaws V12 found in the x402 code, and one of three it rated critical and described in detail. The x402 Foundation, which maintains the SDKs, had already fixed all three critical flaws in the August 18 releases.
One of the other two let a facilitator, the service that checks x402 payments, accept a Solana transaction that moved no tokens as a valid payment. Among the x402 SDKs, only the TypeScript one had this flaw. The other let a malicious server get an agent to sign a login message for a different website.
V12 found the flaws by reviewing the code and running local tests. Neither V12 nor the x402 Foundation has publicly reported any attacks using them.
The foundation has published no security advisory for the three flaws, and its changelogs list the fixes without calling them security fixes. As of October 23, npm audit returned no advisories for the last TypeScript releases before the fixes, and PyPI listed no vulnerabilities for the last Python release before them, The Hacker News found. A developer who relies on those checks gets no warning to upgrade.
Coinbase created x402 and handed it to the x402 Foundation this year, a Linux Foundation project whose members include Visa and Mastercard. Coinbase holds the most senior seat on the foundation's technical steering committee.
No Spending Limit in the Default Client
x402 is an open standard that lets software, including AI agents, pay for an API call within the web request itself, without requiring a person to approve each payment.
A server that wants payment answers with the HTTP status code 402 Payment Required and lists its payment options, each with an amount, a token, and a recipient. The client picks one, signs a payment, and sends the request again.
The default client took the first option on the list, and before the fix, it set no limit on the amount.
A hostile API could use that to turn a routine data request into a request for the wallet's full balance of a supported token, V12 said. An earlier small payment could reveal the wallet address, so the server could look up the balance first.
With an automatic signer and no payment policy set by the app, the client could sign a payment for that amount. For a token that supports signed transfers, the attacker could then submit the signed payment and collect the funds.
The August 18 releases added spend controls to the TypeScript, Python, and Go clients. By default, they now cap each payment at $1 and allow only US dollar stablecoins the SDK recognizes, such as USDC.
Token Approvals Accepted as Solana Payments
In x402, a merchant's server relies on a facilitator to check each payment and submit it to the blockchain. On Solana, the facilitator also pays the transaction fee.
The TypeScript facilitator code for Solana checked that a payment called an allowed token program, then read it as a transfer without checking the instruction type. A token approval, which lets another account spend tokens later but moves none itself, differs from a transfer only in its first byte.
In V12's local test, the facilitator accepted such an approval as a valid payment. The test did not send a live transaction.
A merchant relying on the facilitator could therefore deliver a paid resource while receiving no tokens, V12 said, calling it "a complete payment bypass." The attacker needed a token account, but no balance, and the facilitator paid the transaction fee each time.
The Python and Go SDKs already checked the instruction type. The August 18 releases added the same check to the TypeScript code.
Every published @x402/svm release from 2.0.0 to 2.22.0 lacks the check, and every release from 2.23.0 on has it, The Hacker News found by searching the published packages.
Logins Signed for Other Websites
x402 also has a sign-in extension called Sign-In-With-X (SIWx). It lets an agent log in by signing a short message with its wallet, for example to prove an earlier payment instead of paying again. On Ethereum, the message names the website, the wallet address, and a one-time code.
The automated client signed these messages without verifying that the website named in them was the one it had contacted.
A malicious server could get a fresh login message from another site, pass it to the agent, and use the signature to log in to that site as the agent's wallet, V12 said. That would work wherever the other site accepted the relayed message, and the attacker would get whatever access the login allowed.
The August 18 releases make the TypeScript, Python and Go clients refuse to sign unless the site in the message matches the site that sent the 402 response. The project also changed the SIWx specification, which now says a client must refuse to sign when the two do not match.
TypeScript code that calls createSIWxPayload directly must now pass the URL of the 402 response, after any redirects. The @x402/fetch and @x402/axios wrappers pass it on their own.
What to Update
Upgrading to the latest releases also brings later fixes, including one for a separate payment bypass in @x402/core 2.27.0 in September. As of October 23, the latest versions are 2.28.0 for @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios, v2.28.0 for the Go module and 2.25.0 for the Python package.
In TypeScript, clients get the spending fix by updating @x402/fetch or @x402/axios to 2.23.0 or later, which pulls in the matching @x402/core. Apps that use SIWx also need @x402/extensions 2.23.0 or later, which holds the login check. Facilitators that check Solana payments need @x402/svm 2.23.0 or later.
After the upgrade, existing clients are capped at $1 per payment and limited to recognized stablecoins unless the app sets its own spend controls. Apps that pass spendControls: false turn all of these controls off.
Teams that cannot upgrade yet can register a payment policy that drops any option above a set amount. The older clients support this with registerPolicy in TypeScript and Go and registerpolicy in Python, which also has a ready-made maxamount policy.
V12 advises clients to check that a SIWx login message identifies the site they contacted before signing, to set budgets for each payment and in total, and to limit which tokens, networks, and recipients they will pay.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.