{"id":"https://openalex.org/W7163067944","doi":"https://doi.org/10.48550/arxiv.2605.30998","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","display_name":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","publication_year":2026,"publication_date":"2026-05-29","ids":{"openalex":"https://openalex.org/W7163067944","doi":"https://doi.org/10.48550/arxiv.2605.30998"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.30998","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.30998","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.30998","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038867213","display_name":"Shengchen Ling","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ling, Shengchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137559140","display_name":"Yihang Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Yihang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137566675","display_name":"Yuan Chen","orcid":"https://orcid.org/0000-0002-1510-182X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Du, Yuefeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088790914","display_name":"Yajin Zhou","orcid":"https://orcid.org/0000-0001-7610-4736"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137536507","display_name":"Lei Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Yajin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137518905","display_name":"Cong Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Lei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Wang, Cong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Cong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.8454999923706055,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.8454999923706055,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.03359999880194664,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11504","display_name":"Advanced Authentication Protocols Security","score":0.014299999922513962,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5935999751091003},{"id":"https://openalex.org/keywords/concurrency","display_name":"Concurrency","score":0.438400000333786},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.43630000948905945},{"id":"https://openalex.org/keywords/payment","display_name":"Payment","score":0.396699994802475},{"id":"https://openalex.org/keywords/cryptocurrency","display_name":"Cryptocurrency","score":0.3707999885082245},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.3564999997615814},{"id":"https://openalex.org/keywords/cryptographic-primitive","display_name":"Cryptographic primitive","score":0.350600004196167},{"id":"https://openalex.org/keywords/asynchronous-communication","display_name":"Asynchronous communication","score":0.34709998965263367},{"id":"https://openalex.org/keywords/synchronization","display_name":"Synchronization (alternating current)","score":0.32910001277923584}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7369999885559082},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7063000202178955},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5935999751091003},{"id":"https://openalex.org/C193702766","wikidata":"https://www.wikidata.org/wiki/Q1414548","display_name":"Concurrency","level":2,"score":0.438400000333786},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.43630000948905945},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.396699994802475},{"id":"https://openalex.org/C180706569","wikidata":"https://www.wikidata.org/wiki/Q13479982","display_name":"Cryptocurrency","level":2,"score":0.3707999885082245},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3564999997615814},{"id":"https://openalex.org/C15927051","wikidata":"https://www.wikidata.org/wiki/Q246593","display_name":"Cryptographic primitive","level":4,"score":0.350600004196167},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.34709998965263367},{"id":"https://openalex.org/C2778562939","wikidata":"https://www.wikidata.org/wiki/Q1298791","display_name":"Synchronization (alternating current)","level":3,"score":0.32910001277923584},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.3174999952316284},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.31310001015663147},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.30410000681877136},{"id":"https://openalex.org/C108710211","wikidata":"https://www.wikidata.org/wiki/Q11538","display_name":"Mathematical proof","level":2,"score":0.29280000925064087},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.289000004529953},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.2879999876022339},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2793000042438507},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.27410000562667847},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.25429999828338623},{"id":"https://openalex.org/C72108876","wikidata":"https://www.wikidata.org/wiki/Q844565","display_name":"Transaction processing","level":3,"score":0.2540000081062317},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.2524999976158142}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.30998","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.30998","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.30998","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.30998","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5153108239173889,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"x402":[1],"protocol":[2],"has":[3,41,80],"crossed":[4],"from":[5,199],"prototype":[6],"to":[7,103,140,157,201],"infrastructure":[8],"for":[9],"the":[10,104,165,169],"agentic":[11],"web,":[12],"driving":[13],"130":[14],"million":[15],"all-time":[16],"transactions":[17],"and":[18,24,38,66,72,97,124,131,160,182,195],"embedded":[19],"in":[20,47,94],"Google":[21],"Cloud,":[22],"Cloudflare,":[23],"Stripe.":[25],"Yet":[26],"bridging":[27],"synchronous":[28],"HTTP":[29,62],"requests":[30],"with":[31,186],"asynchronous":[32],"blockchain":[33],"finality":[34],"creates":[35],"state-synchronization":[36],"challenges,":[37],"x402's":[39],"security":[40,87],"so":[42],"far":[43],"been":[44,210],"examined":[45],"only":[46,204],"piecemeal":[48],"vendor":[49,98],"disclosures.":[50],"It":[51],"is":[52],"moreover":[53],"not":[54,81],"one":[55],"artefact":[56],"but":[57],"a":[58,67,85,132,147,174,183],"stack":[59],"of":[60,70,126,164,171],"an":[61],"semantic,":[63],"per-chain":[64],"schemes,":[65],"long":[68],"tail":[69],"SDK":[71],"deployment":[73],"choices":[74],"whose":[75],"required":[76],"guarantees":[77],"prior":[78],"work":[79],"established.":[82],"We":[83,107,178],"perform":[84],"systematic":[86],"analysis":[88],"organized":[89],"around":[90],"five":[91],"invariants":[92],"grounded":[93],"specifications,":[95],"literature,":[96],"expectations,":[99],"resolving":[100],"every":[101],"violation":[102],"responsible":[105],"layer.":[106],"identify":[108],"four":[109],"flaw":[110],"classes:":[111],"cross-resource":[112],"substitution,":[113],"duplicate-settlement":[114],"race":[115],"(independently":[116],"corroborated":[117],"by":[118,193],"subsequent":[119],"third-party":[120],"reports),":[121],"allowance":[122],"overdraft,":[123],"denial":[125],"settlement.":[127],"Against":[128],"official":[129],"SDKs":[130],"production":[133],"deployment,":[134],"these":[135],"reach":[136],"resource-leakage":[137],"ratios":[138],"up":[139],"100%.":[141],"For":[142],"pay-per-token":[143],"scheme":[144],"we":[145],"prove":[146],"structural":[148],"limit:":[149],"no":[150],"output-only":[151],"pricing":[152],"can":[153],"be":[154],"both":[155],"fair":[156],"honest":[158],"users":[159],"bounded":[161],"against":[162],"inflation":[163],"hidden":[166],"\"thinking\"":[167],"tokens,":[168],"price":[170],"fairness":[172],"being":[173],"$\\sqrt{1+\u0398}$":[175],"manipulation":[176],"gap.":[177],"propose":[179],"per-flaw":[180],"mitigations":[181],"defense":[184],"triple":[185],"provable":[187],"guarantees,":[188],"cutting":[189],"per-call":[190],"reasoning":[191],"cost":[192],"47%":[194],"inverting":[196],"attacker":[197],"leverage":[198],"8.7$\\times$":[200],"0.9$\\times$":[202],"at":[203],"2.8%":[205],"overhead.":[206],"All":[207],"findings":[208],"have":[209],"disclosed.":[211]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-02T00:00:00"}