x402's Growth Outpaces Security, Leaving Wallets Open to Exploits

Security Alert: Hundreds of Wallets Targeted in x402 Token Exploits, Says GoPlus

The x402 token ecosystem, an open payment protocol inspired by the HTTP 402 "Payment Required" status code, is facing a critical security crisis as GoPlus Security, a blockchain risk-analysis platform, warns of widespread vulnerabilities in early-stage projects. The protocol, backed by major players like Coinbase and Google, has seen explosive growth with hundreds of meme-style tokens and experimental applications. However, this rapid expansion has exposed severe flaws, including unlimited minting, excessive developer permissions, and signature-replay attacks, leaving users' assets at risk.

GoPlus's AI-driven audit of over 30 x402-based tokens revealed recurring patterns of vulnerabilities. These include functions allowing owners to drain wallets, bypass token allowances, and mint tokens without limits. For example, the FLOCK token permits its owner to extract any ERC20 tokens from the contract, while x420 enables unrestricted minting via its crosschainMint function. The report also highlighted the October 28 exploit of a cross-layer x402 protocol, which drained USDC from over 200 wallets in minutes.

The risks are not theoretical. Real-world exploits have already occurred, underscoring the urgency for stricter security measures. GoPlus identified high-risk tokens such as U402, MRDN, PENG, and x402MO, all of which exhibit flaws like honeypot behaviors or allowance bypasses. For instance, PENG allows the owner to withdraw ETH from the contract and bypasses permission checks for specific accounts, while x402b replicates these vulnerabilities. The report emphasizes that these issues stem from a lack of rigorous auditing, as the ecosystem's growth has outpaced due diligence processes.

Retail and institutional investors alike face hidden dangers. GoPlus warns that vulnerabilities often remain undetected until exploited, leaving users with little recourse. The report urges developers and platforms to implement deeper security checks before launching new tokens, advocating for a shift from speculative hype to robust safeguards.

As the x402 ecosystem matures, the need for standardized audits and transparent governance becomes paramount. Without addressing these flaws, the protocol risks undermining trust and repeating the mistakes of past crypto cycles. For now, users are advised to exercise caution, particularly with early-stage projects lacking proven security frameworks.