Two spend-safety fixes from the gap audit (#4814):
- Client.Do refused a 402 only on the budget check, but parsed
maxAmountRequired with a swallowed error, so a non-decimal, overflowing
or negative amount became 0 and passed the cap trivially while Payer.Pay
still signed against the string. Now reject any amount that is not a
positive integer before signing.
- Require settled only when the facilitator implemented Settler; a
verify-only facilitator served the resource while no funds moved. Add
Config.RequireSettlement to fail closed in that case.
Tests cover invalid/negative/overflow amounts and the verify-only
fail-closed path.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
The x402 wrapper could advertise a 402 and verify a payment, but never
settled it (the "exact" scheme needs verify + settle to actually move
funds), and its HTTPFacilitator sent no auth, so it could not use the
Coinbase CDP facilitator — the only one that settles Base mainnet. It
also passed the raw base64 X-PAYMENT string where facilitators expect the
decoded payload object.
- Add an optional Settler interface; HTTPFacilitator now implements
Verify and Settle (POST /verify then /settle), and Require settles a
verified payment and emits the settlement reference.
- HTTPFacilitator.Authorize hook + x402.CDP(keyID, secret) constructor:
mint a short-lived Ed25519 Bearer JWT (stdlib crypto only, no chain
code, no new dependency) so verify/settle authenticate to CDP.
- Decode the X-PAYMENT payload to the object facilitators expect, with
passthrough for non-JSON payloads.
- Requirements gains extra (EIP-712 domain) and mimeType; the asset and
its {name,version} are auto-filled for known networks so clients can
sign. NormalizeNetwork maps base/base-sepolia to CAIP-2 ids.
- Accept the v2 PAYMENT-SIGNATURE request header and emit both
X-PAYMENT-RESPONSE and PAYMENT-RESPONSE.
Backward compatible: the default network stays "base", the Facilitator
interface is unchanged (Settler is additive), and gateway/mcp builds and
tests unchanged. Adds tests for settle, CDP JWT, header aliases, extra,
and payload decoding.
Asim Aslam