The 402Proof Facilitator Rectification Program publishes 402Proof's compliance posture the way ScriptMasterLabs publishes everything else: the control as actually implemented, a live evidence link for each claim, and the partial or pending items stated as partial or pending — never aspirational.
Facilitator service: four02proof.onrender.com. This page is its public evidence page. Integration: OpenAPI · Configured rails and compatibility. The current flow is invoice → payer-submitted on-chain payment → verification → access token.
Read SECURITY.mdLive attestations (raw)Live /healthLive /v1/statsAgent API Evidence Hub
402Proof's hosted Xahau native XAH invoice and verification rail is configured on the live service. The merchant issues a fresh invoice via POST /v1/invoice selecting {"asset":"XAH","chain":"xahau"}, the buyer pays native XAH on the Xahau network, and the service verifies the memo-bound, exact-amount, finalized ledger payment via POST /v1/verify before issuing access. A 402 challenge or invoice is not proof of a completed payment.
Third-party merchant fee: 0.01 XAH per verified settlement. For a third-party merchant's invoice, the buyer needs a second native XAH Payment to the invoice-specified facilitator fee recipient, carrying the exact fee memo; both ledger transactions must verify before settlement is accepted. ScriptMasterLabs-owned registered endpoints are fee-exempt. Read the current invoice for the main amount, recipient, expiration and exact fee-leg details. The separate standard XRPL x402 v2 fee schedule in USD, shown below, does not apply to Xahau.
Protocol boundary: Xahau here is the product-specific /v1/invoice → /v1/verify API, not yet a separately advertised standard x402 v2 Xahau exact kind in /supported. The live health and discovery pages substantiate configuration; independent paying merchants and externally collected XAH fees have not been verified. Xahau was absent from the official facilitator comparison reviewed on October 30, 2026, but no exclusive market claim is made.
Check live supported rails · Verify live Xahau network configuration · Invoice and verification OpenAPI · Request Xahau merchant onboarding
402Proof's separate XRPL mainnet x402 v2 exact facilitator charges the third-party resource-server operator on successful settlement, not the agent buyer. List price: $0.0100 USD per success. No monthly subscription required. Verification, failures, indeterminate settlement and exact retries are free.
| Merchant tier | Prior successful third-party settlements | Discount | Fee on next successful settlement |
|---|---|---|---|
| Standard | 0–99 | 0% | $0.0100 USD |
| Loyal | 100–999 | 20% | $0.0080 USD |
| Proven | 1,000–9,999 | 30% | $0.0070 USD |
| Champion | 10,000+ | 50% | $0.0050 USD |
Discounts apply to the next successful settlement after the threshold, not retroactively. Per-merchant fees are accrued using micro-USD precision. The merchant billing collection system is not live yet; accrued balances are not collected revenue. Payer funds still go directly to the merchant's authorized receiving address. The standard XRPL rail and this merchant-side pricing do not replace ScriptMasterLabs' canonical Base/USDC buyer-payment authority.
Machine-readable tariff JSON (AI agents) · AI integration instructions · Facilitator discovery · OpenAPI
402Proof's standard x402 v2 sidecar (four02proof-x402-v2-xrpl.onrender.com/supported) settles standard x402 v2 exact payments on Solana mainnet (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp), asset native Circle USDC (EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v), alongside the XRPL kind. The payer signs one transaction; the facilitator co-signs only as network fee payer and never takes custody.
Facilitator fee: 0.005 USDC flat per Solana settlement, from the first one (owner-set 2026-11-02; no free-settlement allowance on this rail). The payer pays it inside the same signed transaction as a separate SPL transfer to the fee recipient Hv4cEGpyyNJDvxvgBb3C8GkcwtouF1qUfPT13innuXty (USDC ATA 6XhhopiMzgKhAm4Dtib5eytrCF2ypB8XkiytY7w3GLam), declared in the payment requirements extra (facilitatorFee / facilitatorFeeRecipient). /verify rejects a payment whose fee instruction is missing, mis-addressed, or under 5000 atomic. The merchant amount is never reduced by the fee.
Settlement proof — SELF-PROOF. SML's own canary payer paid SML's own recipient through SML's own facilitator; this proves the rail settles end-to-end and is not third-party traffic. No-fee canary (2026-11-02): tx 4EkneHY5WqKqVN9j… — slot 464611524, finalized, recipient ATA delta exactly +5000 atomic. Fee-carrying canary (2026-11-02): tx 5d6b2ojznZ6p3BQ5… — slot 464625034, finalized; the single transaction carries both the 5000-atomic merchant TransferChecked leg and the separate 5000-atomic fee Transfer leg (both individually visible on-chain), recipient ATA delta exactly +10000 atomic; a fee-less payment was rejected by /verify (invalid_exact_svm_payload_facilitator_fee_missing) in the same run, and the live /supported reports feeSettlementProven: true.
Check live supported rails + fee terms · Facilitator discovery · Request Solana merchant onboarding
The USENIX Security 2026 study of the x402 ecosystem (arXiv:2607.19545) tested the 15 facilitators carrying 99% of x402 traffic and found 49 rule violations that resolved to 31 previously unknown vulnerabilities. Some findings were patched post-disclosure. Every facilitator tested violated at least one basic rule. 402Proof's response is this program: harden each attack class, prove it, publish the proof.
Market context, date-stamped: as of Oct 30, 2026, the official docs list at docs.x402.org (facilitator page, updated 2026-10-29) 19 production facilitators; XRPL appears once (T54) and Xahau does not appear. For comparison, Coinbase's CDP facilitator charges $0.001 per onchain transaction after 1,000 free transactions per month. We make no "first" or "only" claim beyond that date-stamped directory fact.
Counters are read live from /v1/stats and /health in your browser. The compliance fields (compliance_score, last_pass_at) are live as checked on 2026-10-31. The score is PASS / (PASS + FAIL) for the latest run; blocked and no-data probes are excluded. A score of 1 is not proof that every probe passed. Read the records and coverage below.
One payment, presented many times, must serve exactly once. Hosted rail: atomic check-and-set on the transaction hash after all checks pass, a durable on-disk used-tx set loaded on boot, and 409 rejections for a used hash or a settled invoice. Paywall: a 120-second recency window plus a durable seen-tx ledger — tests 9/9.
LIVE (GO) RESTART PROOF: CODE-PATH LEVEL
Evidence: /v1/stats → · Go commit b8c22a13 → · Paywall commit cef3b1a0 →
A payment proof for one resource must not spend at another. Every invoice binds endpoint, price, asset, network, destination, and a memo that is the hex of the invoice UUID; XRPL verification checks the presented transaction against that invoice, memo included. The HMAC-signed access token carries invoice, endpoint, and paying-wallet claims, and the endpoint check rejects a token minted for a different endpoint.
PARTIAL — BASE MEMO OPTIONAL · PROBE P2 PENDING
There is no allowance to overdraw: 402Proof's rails are discrete push payments — it never holds a transferFrom allowance or a session-wide approval. Destination, asset, and RLUSD issuer are pinned per invoice; underpayment is rejected on every rail.
XRPL EXACT AMOUNT: LIVE · BASE FLOOR: PARTIAL
The live XRPL probe rejects both underpayment and overpayment with amount_mismatch. The Xahau implementation also enforces drops-exact native XAH amounts. Base still uses a floor comparison; exact equality is not claimed for Base. SECURITY.md, Class 3 →
Access is issued only after on-chain verification passes — validated with tesSUCCESS on XRPL, receipt status 0x1 with a matching USDC Transfer on Base. Invoices expire in 5 minutes (410 after expiry; paid invoices stay on record so a duplicate verify returns an explicit 409). A failed attempt never burns the payer's transaction hash, so griefing cannot lock out a legitimate retry.
LIVE (GO) NO PER-PAYER VERIFY THROTTLE — NOT CLAIMED
Found in our own audit: invoice creation needed only a valid endpoint id — no throttle, no cap, no deletion. Fixed and live in production: per-IP and per-endpoint token-bucket throttle (429 + Retry-After, proven live), a 10,000 active-invoice cap, and a 30-second expiry sweep (proven live: active invoices 46 → 0).
LIVE IN PRODUCTION
The shared Node hardening module was rectified defect by defect: idempotency-ledger boot race removed, has() fixed in SQLite mode, event-log verification corrected past 10,000 entries, real fsync behind the durability claim, and proxy-aware rate-limit keying so clients behind Render no longer share one bucket. Selftest: 48/48.
CODE + TESTS
The probe suite attacks our own rails the way the researchers attacked the incumbents: replay the same transaction hash concurrently, claim one invoice's token against another endpoint, overpay and underpay, claim an expired invoice, pay the wrong destination or issuer, mismatch the memo, reuse a consumed token. Runs append hash-chained operator self-probe records served at four02proof.onrender.com/v1/attestations. This panel fetches published records live. They are operator self-tests, not an independent audit or digital-signature certification. Blocked probes and missing data remain visible.
| Probe | Expected | Observed | Result | Run at |
|---|---|---|---|---|
| Checking the attestation endpoint… | ||||
Raw feed: GET /v1/attestations · Compliance fields are available at /health.
| Claim | Evidence | Verified |
|---|---|---|
| Phase 1 Go hardening is live in production on four02proof: invoice throttle returns 429, and the 30-second expiry sweep took active invoices from 46 to 0. | Commit b8c22a13 · Live /v1/stats | 2026-10-30 |
| The paywall replay guard rejects a reused transaction hash after restart and rejects transfers older than the 120-second challenge window; replay-guard tests pass 9/9 and the Fortress selftest passes 48/48. | Commit cef3b1a0 | 2026-10-30 |
| The USENIX Security 2026 study (arXiv:2607.19545) tested 15 facilitators carrying 99% of x402 traffic and found 49 rule violations resolving to 31 previously unknown vulnerabilities; some findings were patched post-disclosure. | arXiv:2607.19545 | 2026-10-30 |
| As of Oct 30, 2026, the official docs list at docs.x402.org (facilitator page, updated 2026-10-29) 19 production facilitators; XRPL appears once (T54) and Xahau does not appear. | docs.x402.org facilitator page | 2026-10-30 |
| Coinbase's CDP facilitator charges $0.001 per onchain transaction after 1,000 free transactions per month. | docs.x402.org facilitator page | 2026-10-30 |
| GET /v1/attestations returns published records and /health exposes compliance_score, last_run_at, last_pass_at and chain_ok. The latest run contains blocked/no-data probes; the pass ratio is not complete coverage. | Live endpoint · Live /health | 2026-10-31 |
A public hardening program for ScriptMasterLabs' 402Proof x402 facilitator: each attack class gets an implemented control, a proof, and a published evidence link — with partial controls labeled partial. The full control text lives in SECURITY.md in the 402proof source tree.
Three layers: the transaction hash is claimed with an atomic check-and-set only after every verification passes; the used-hash set is durable on disk and survives restarts; and on the paywall, transfers older than the 120-second challenge window are rejected even if never seen before. Restart-safety on the Go rail is proven at code-path level today; the live consumed-hash proof is pending the first real post-deploy payment and is labeled that way.
Yes. On 2026-10-31, /v1/attestations returned a hash-chained log and /health returned its summary fields. The panel displays the latest published run, including PASS, FAIL, BLOCKED_NO_FUNDS and NO_DATA. These are operator self-probes; an unreachable feed is reported as unavailable, never as a pass.
No. Its rails are discrete push payments — an XRPL Payment or an ERC-20 Transfer the payer submitted. 402Proof never holds a transferFrom allowance or session approval, pins destination, asset, and issuer per invoice, and rejects underpayment on every rail. The hosted XRPL rail rejects underpayment and overpayment exactly; the Xahau code enforces native XAH equality. Base retains a floor check and is labeled partial.
The Verdict Protocol sells decision receipts for agent capital, and the URL-to-Markdown API is the proven paid machine job — both publish their own settlement evidence. This dashboard covers the facilitator's compliance posture only.
Email tim@scriptmasterlabs.com with the route, the request shape, and the transaction hash or invoice id involved. Never send private keys or seed phrases. The reporting policy and full control list are in SECURITY.md.