Responsible disclosures
A running log of vendor disclosures and public research. Findings appear here once a fix has shipped, the embargo has lifted, or the work has been published as research. Coordinate disclosures via [email protected].
-
x402 AI-agent wallet drain via slow-burn pricing (Vector 6)
high[ AI-AGENT WALLETS ] · disclosed
AI agents use programmatic keypairs and auto-approve below a price threshold. A service that ramps prices slowly after trust drains the agent without ever tripping the threshold.
-
x402 amount-string parser fuzzing (Vector 9)
medium[ COINBASE X402 ] · disclosed
x402 amounts ship as JSON strings. "1000", "1e3", " 1000 ", "+1000", "01000" round-trip differently across implementations. Mismatch between facilitator validator and Solana transfer is monetisable.
-
x402 partial-signing instruction injection (Vector 2)
high[ COINBASE X402 ] · disclosed
Client builds and partially signs the VersionedTransaction. A facilitator that validates structure but not bytes can sign a tx with extra clawback / drain instructions appended.
-
x402 settlement race (Vector 1)
high[ COINBASE X402 ] · disclosed
Multiple /settle calls succeed before on-chain confirmation when the facilitator's verify→settle pipeline lacks an atomic lock. Double-spend window equals blockhash validity (~60s).
-
x402 facilitator gas drain (Vector 3)
medium[ COINBASE X402 ] · disclosed
Facilitator pays all fees, no per-client rate limit. Crafted-failing-tx storms maximise CU consumption — economic DoS against the facilitator.
-
SOLMAL: Solana x402 attack surface
research[ COINBASE X402 ] · disclosed
Threat model for x402 on Solana. 9 attack vectors against the verify→settle pipeline plus AI-agent wallet-drain patterns.
-
Rusty Pipes Exploit (proof-of-concept)
research[ NPM ECOSYSTEM ] · disclosed
PoC: Rust used to inject malicious code into npm packages and hijack the entire Node runtime.
-
Rust in Peace: Hijacking Node.js with a single require
research[ NODE.JS / NPM ] · disclosed
Long-form on Rust-based supply-chain malware in Node.js and the mitigations needed at registry + runtime layers.
-
Rusty Pipes: an npm supply-chain exploit
research[ NPM ECOSYSTEM ] · disclosed
How a malicious package detects packages a contributor maintains and injects a Rust binary into the next release.