T09 · Insecure Skill Coding Practices
Error
- Location
- x402-MCP.md:136
- Finding
- Automatic Wallet Signing Lacks Payment and Network Restrictions<![CDATA[ ## Vulnerability Details **File Location**: `x402-MCP.md:136-163` **Vulnerability Type**: Unrestricted automatic cryptocurrency payment signing **Risk Level**: High ### Vulnerable Code ```typescript const evmPrivateKey = process.env.EVM_PRIVATE_KEY as `0x${string}`; const svmPrivateKey = process.env.SVM_PRIVATE_KEY as string; const baseURL = process.env.RESOURCE_SERVER_URL || "http://localhost:4021"; const endpointPath = process.env.ENDPOINT_PATH || "/weather"; if (!evmPrivateKey && !svmPrivateKey) { throw new Error("At least one of EVM_PRIVATE_KEY or SVM_PRIVATE_KEY must be provided"); } /** * Creates an axios client configured with x402 payment support for EVM and/or SVM. */ async function createClient() { const client = new x402Client(); // Register EVM scheme if private key is provided if (evmPrivateKey) { const evmSigner = privateKeyToAccount(evmPrivateKey); client.register("eip155:*", new ExactEvmScheme(evmSigner)); } // Register SVM scheme if private key is provided if (svmPrivateKey) { const svmSigner = await createKeyPairSignerFromBytes(base58.decode(svmPrivateKey)); client.register("solana:*", new ExactSvmScheme(svmSigner)); } return wrapAxiosWithPayment(axios.create({ baseURL }), client); } ``` The same unsafe wildcard registration pattern is repeated at `x402-MCP.md:252-265`. ### Technical Analysis The documented MCP implementation registers wallet signers for the wildcard network identifiers `eip155:*` and `solana:*`. It then wraps an HTTP client with automatic x402 payment handling for a configurable `RESOURCE_SERVER_URL`. The implementation does not locally validate or restrict: - The permitted blockchain network or chain ID - The payment token contract - The payment recipient - The maximum amount per request - The cumulative amount per session or day - The number of automatic payment attempts - Redirects to a different origin - Whether the user approved the exact payment terms Although `S ...[truncated 2135 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace wildcard scheme registration with an explicit allowlist of supported chain IDs, such as Base Mainnet or Base Sepolia only. 2. Allow only the expected USDC token contract for each approved network. 3. Validate the recipient against an explicit allowlist or require approval for a new recipient. 4. Enforce a hard maximum payment amount before creating any signature. 5. Add cumulative session, hourly, and daily spending limits. 6. Require interactive confirmation showing the endpoint, chain, token, recipient, and exact amount before payment. 7. Disable automatic cross-origin redirects or revalidate payment policy after every redirect. 8. Limit payment retries and prevent duplicate payment authorization for the same request. 9. Use a dedicated wallet funded only with the minimum amount needed for the task. 10. Record tamper-resistant payment audit logs without recording private keys or complete sensitive authorization payloads. 11. Add automated tests proving that excessive amounts, unsupported chains, unexpected tokens, and unknown recipients are rejected. ]]>