Find the payment bug before an agent signs it.
A focused adversarial review of one x402 buyer/server flow. You receive evidenced findings, regression tests where the public code permits them, prioritized fixes and one bounded retest.
Request a review No meeting or payment required to confirm the scope.What gets tested
- Independent amount, payee, asset, network and resource policy
- Request-to-payment binding and replay resistance
- Redirect, timeout and facilitator response trust boundaries
- Exact on-chain settlement and merchant-payment economics
- Signed receipt schemas, canonical signatures and tamper rejection
- Retry and recovery paths that must never double-pay
The review
USDC or SOL. The 24-hour clock starts after the target, access, deliverables and payment are confirmed.
If the flow does not fit the fixed scope, you receive a clear no before payment.
Exact fixed scope
One public repository or supplied source archive, one buyer/server payment flow, and up to three payment routes. Delivery is a concise report with severity, evidence, exploit preconditions, remediation and verification status. Public-code targets can include executable regression tests; private-code handling is agreed before access.
What is not promised
This is not a complete protocol audit, legal opinion, smart-contract audit, infrastructure penetration test, compliance certification or guarantee that no vulnerability exists. No production transaction is sent and no credential is requested until the scope requires it and safe handling is agreed.
Proof before promises
Norravex operates a live x402 endpoint conformance service with bounded fetching, redirect refusal, normalized payment options and deterministic reports. See the synthetic example. The fixed-price review goes deeper into code paths and payment authenticity; the public endpoint report alone is not a security audit.
Start with the payment flow
Send the public repository or endpoint and describe what the buyer signs, how settlement is verified, and what you want reviewed. You receive a private tracking link immediately.