T09 · Insecure Skill Coding Practices
Error
- Location
src/x402.py:25- Finding
Reusable and Unbound Payment Proofs Allow Payment Bypass
- Content
View full analysis
timestamp) # In production, use Redis or similar VERIFIED_PAYMENTS: Dict[str, float] = {} PAYMENT_TTL = 60 # 1 minute - payment valid for multiple requests ``` ```python def verify_payment(tx_hash: str) -> Tuple[bool, str]: """ Verify a payment transaction on Base. Returns (success, message). """ if not tx_hash: return False, "No transaction hash provided" # Clean the hash tx_hash = tx_hash.strip().lower() if not tx_hash.startswith("0x"): tx_hash = "0x" + tx_hash # Check cache first if tx_hash in VERIFIED_PAYMENTS: cached_time = VERIFIED_PAYMENTS[tx_hash] if time.time() - cached_time < PAYMENT_TTL: return True, "Payment verified (cached)" else: # Expired, remove from cache del VERIFIED_PAYMENTS[tx_hash] # Fetch transaction receipt from Base RPC try: receipt = fetch_tx_receipt(tx_hash) if not receipt: return False, "Transaction not found" # Check if successful if receipt.get("status") != "0x1": return False, "Transaction failed" # Parse logs for USDC transfer transfer_valid = verify_usdc_transfer(receipt.get("logs", [])) if not transfer_valid: return False, "No valid USDC transfer to payment address found" # Cache successful verification VERIFIED_PAYMENTS[tx_hash] = time.time() return True, "Payment verified" except Exception as e: return False, f"Verification error: {str(e)}" ``` ### Technical Analysis The transaction hash acts as a bearer authorization token, but it is not bound to the requester, a particular ...[truncated 1759 chars]- Remediation
View remediation