T09 · Insecure Skill Coding Practices
Error
- Location
scripts/commands/fetch-paid.ts:65- Finding
Automatic Fetch Performs Payments Without Enforcing the Configured Spending Limit
- Content
View full analysis
0 ? headers : undefined, }); ``` ### Technical Analysis The `fetch` command passes an arbitrary user-supplied URL directly to the x402 payment wrapper. If the endpoint returns an HTTP 402 response, the wrapper can create a signed payment authorization automatically. This execution path neither reads nor enforces `X402_MAX_PAYMENT_USD`. It also provides no command-specific maximum to the payment wrapper. Consequently, the documented default limit of USD 10 does not protect payments initiated through `x402 fetch`. Because enforcement is absent at the signing boundary, a malicious or compromised resource server can request a substantially larger payment than the user or agent expects. ### Attack Path 1. An attacker hosts an HTTP endpoint that returns a valid x402 payment requirement with an excessive amount. 2. The user or agent executes `x402 fetch https://attacker.example/resource`. 3. `fetchWithPayment` processes the HTTP 402 response automatically. 4. No application-level amount validation occurs before signing. 5. The wallet signs the payment authorization, subject only to any protections provided externally by the SDK or available wallet balance. 6. The attacker settles the authorization and receives the requested funds. ### Impact Assessment Successful exploitation can cause unauthorized or unexpectedly large USDC payments from the configured wallet. The practical scope is limited by the wallet balance, protocol authorization constraints, and any independent SDK-level restrictions, but the project itself does not enforce its advertised USD 10 ...[truncated 142 chars]- Remediation
View remediation