The 402Proof Facilitator Rectification Program publishes 402Proof's compliance posture the way ScriptMasterLabs publishes everything else: the control as actually implemented, a live evidence link for each claim, and the partial or pending items stated as partial or pending — never aspirational.
Facilitator service: four02proof.onrender.com. This page is its public evidence page. Integration: OpenAPI · Configured rails and compatibility. The current flow is invoice → payer-submitted on-chain payment → verification → access token.
Read SECURITY.mdLive attestations (raw)Live /healthLive /v1/statsAgent API Evidence Hub
The USENIX Security 2026 study of the x402 ecosystem (arXiv:2607.19545) tested the 15 facilitators carrying 99% of x402 traffic and found 49 rule violations that resolved to 31 previously unknown vulnerabilities. Some findings were patched post-disclosure. Every facilitator tested violated at least one basic rule. 402Proof's response is this program: harden each attack class, prove it, publish the proof.
Market context, date-stamped: as of Oct 30, 2026, the official docs list at docs.x402.org (facilitator page, updated 2026-10-29) 19 production facilitators; XRPL appears once (T54) and Xahau does not appear. For comparison, Coinbase's CDP facilitator charges $0.001 per onchain transaction after 1,000 free transactions per month. We make no "first" or "only" claim beyond that date-stamped directory fact.
Counters are read live from /v1/stats and /health in your browser. The compliance fields (compliance_score, last_pass_at) are live as checked on 2026-10-31. The score is PASS / (PASS + FAIL) for the latest run; blocked and no-data probes are excluded. A score of 1 is not proof that every probe passed. Read the records and coverage below.
One payment, presented many times, must serve exactly once. Hosted rail: atomic check-and-set on the transaction hash after all checks pass, a durable on-disk used-tx set loaded on boot, and 409 rejections for a used hash or a settled invoice. Paywall: a 120-second recency window plus a durable seen-tx ledger — tests 9/9.
LIVE (GO) RESTART PROOF: CODE-PATH LEVEL
Evidence: /v1/stats → · Go commit b8c22a13 → · Paywall commit cef3b1a0 →
A payment proof for one resource must not spend at another. Every invoice binds endpoint, price, asset, network, destination, and a memo that is the hex of the invoice UUID; XRPL verification checks the presented transaction against that invoice, memo included. The HMAC-signed access token carries invoice, endpoint, and paying-wallet claims, and the endpoint check rejects a token minted for a different endpoint.
PARTIAL — BASE MEMO OPTIONAL · PROBE P2 PENDING
There is no allowance to overdraw: 402Proof's rails are discrete push payments — it never holds a transferFrom allowance or a session-wide approval. Destination, asset, and RLUSD issuer are pinned per invoice; underpayment is rejected on every rail.
XRPL EXACT AMOUNT: LIVE · BASE FLOOR: PARTIAL
The live XRPL probe rejects both underpayment and overpayment with amount_mismatch. The Xahau implementation also enforces drops-exact native XAH amounts. Base still uses a floor comparison; exact equality is not claimed for Base. SECURITY.md, Class 3 →
Access is issued only after on-chain verification passes — validated with tesSUCCESS on XRPL, receipt status 0x1 with a matching USDC Transfer on Base. Invoices expire in 5 minutes (410 after expiry; paid invoices stay on record so a duplicate verify returns an explicit 409). A failed attempt never burns the payer's transaction hash, so griefing cannot lock out a legitimate retry.
LIVE (GO) NO PER-PAYER VERIFY THROTTLE — NOT CLAIMED
Found in our own audit: invoice creation needed only a valid endpoint id — no throttle, no cap, no deletion. Fixed and live in production: per-IP and per-endpoint token-bucket throttle (429 + Retry-After, proven live), a 10,000 active-invoice cap, and a 30-second expiry sweep (proven live: active invoices 46 → 0).
LIVE IN PRODUCTION
The shared Node hardening module was rectified defect by defect: idempotency-ledger boot race removed, has() fixed in SQLite mode, event-log verification corrected past 10,000 entries, real fsync behind the durability claim, and proxy-aware rate-limit keying so clients behind Render no longer share one bucket. Selftest: 48/48.
CODE + TESTS
The probe suite attacks our own rails the way the researchers attacked the incumbents: replay the same transaction hash concurrently, claim one invoice's token against another endpoint, overpay and underpay, claim an expired invoice, pay the wrong destination or issuer, mismatch the memo, reuse a consumed token. Runs append hash-chained operator self-probe records served at four02proof.onrender.com/v1/attestations. This panel fetches published records live. They are operator self-tests, not an independent audit or digital-signature certification. Blocked probes and missing data remain visible.
| Probe | Expected | Observed | Result | Run at |
|---|---|---|---|---|
| Checking the attestation endpoint… | ||||
Raw feed: GET /v1/attestations · Compliance fields are available at /health.
| Claim | Evidence | Verified |
|---|---|---|
| Phase 1 Go hardening is live in production on four02proof: invoice throttle returns 429, and the 30-second expiry sweep took active invoices from 46 to 0. | Commit b8c22a13 · Live /v1/stats | 2026-10-30 |
| The paywall replay guard rejects a reused transaction hash after restart and rejects transfers older than the 120-second challenge window; replay-guard tests pass 9/9 and the Fortress selftest passes 48/48. | Commit cef3b1a0 | 2026-10-30 |
| The USENIX Security 2026 study (arXiv:2607.19545) tested 15 facilitators carrying 99% of x402 traffic and found 49 rule violations resolving to 31 previously unknown vulnerabilities; some findings were patched post-disclosure. | arXiv:2607.19545 | 2026-10-30 |
| As of Oct 30, 2026, the official docs list at docs.x402.org (facilitator page, updated 2026-10-29) 19 production facilitators; XRPL appears once (T54) and Xahau does not appear. | docs.x402.org facilitator page | 2026-10-30 |
| Coinbase's CDP facilitator charges $0.001 per onchain transaction after 1,000 free transactions per month. | docs.x402.org facilitator page | 2026-10-30 |
| GET /v1/attestations returns published records and /health exposes compliance_score, last_run_at, last_pass_at and chain_ok. The latest run contains blocked/no-data probes; the pass ratio is not complete coverage. | Live endpoint · Live /health | 2026-10-31 |
A public hardening program for ScriptMasterLabs' 402Proof x402 facilitator: each attack class gets an implemented control, a proof, and a published evidence link — with partial controls labeled partial. The full control text lives in SECURITY.md in the 402proof source tree.
Three layers: the transaction hash is claimed with an atomic check-and-set only after every verification passes; the used-hash set is durable on disk and survives restarts; and on the paywall, transfers older than the 120-second challenge window are rejected even if never seen before. Restart-safety on the Go rail is proven at code-path level today; the live consumed-hash proof is pending the first real post-deploy payment and is labeled that way.
Yes. On 2026-10-31, /v1/attestations returned a hash-chained log and /health returned its summary fields. The panel displays the latest published run, including PASS, FAIL, BLOCKED_NO_FUNDS and NO_DATA. These are operator self-probes; an unreachable feed is reported as unavailable, never as a pass.
No. Its rails are discrete push payments — an XRPL Payment or an ERC-20 Transfer the payer submitted. 402Proof never holds a transferFrom allowance or session approval, pins destination, asset, and issuer per invoice, and rejects underpayment on every rail. The hosted XRPL rail rejects underpayment and overpayment exactly; the Xahau code enforces native XAH equality. Base retains a floor check and is labeled partial.
The Verdict Protocol sells decision receipts for agent capital, and the URL-to-Markdown API is the proven paid machine job — both publish their own settlement evidence. This dashboard covers the facilitator's compliance posture only.
Email tim@scriptmasterlabs.com with the route, the request shape, and the transaction hash or invoice id involved. Never send private keys or seed phrases. The reporting policy and full control list are in SECURITY.md.