T09 · Insecure Skill Coding Practices
Error
- Location
rules/payment.md:28- Finding
Unbounded Server-Directed USDC Payment Signing
- Content
View full analysis
{ const account = privateKeyToAccount(privateKey); // 1. Create x402 client and register the EVM "exact" payment scheme const client = new x402Client(); registerExactEvmScheme(client, { signer: account }); const httpClient = new x402HTTPClient(client); // 2. Decode payment requirements from the PAYMENT-REQUIRED header const encoded = response.headers.get("PAYMENT-REQUIRED")!; const paymentRequired = decodePaymentRequiredHeader(encoded); // 3. Create the signed payment payload const paymentPayload = await httpClient.createPaymentPayload(paymentRequired); // 4. Encode as a header value return encodePaymentSignatureHeader(paymentPayload); } ``` The automatic request workflow similarly states: ```typescript const client = new x402Client(); registerExactEvmScheme(client, { signer }); const httpClient = new x402HTTPClient(client); const paidFetch = wrapFetchWithPayment(fetch, httpClient); ``` ### Technical Analysis The payment requirements are controlled by the HTTP `PAYMENT-REQUIRED` response. The documented flow decodes those requirements and immediately generates an EIP-712 USDC transfer authorization without verifying critical fields such as: - Maximum amount - Expected USDC contract address - Expected payment recipient - Expected resource URL - Permitted network - Payment scheme and timeout - Per-request or cumulative spending limits The optional selector in `rules/making-requests.md` only demonstrates selecting a network. It does not validate the amount, recipient, asset, or resource. The defau ...[truncated 1299 chars]- Remediation
View remediation