Security & Regulatory Posture

Architectural Disclosures · Proven Non-Custodial Design · EIP-3009 Verification

TRUST VIA CODE, NOT ASSERTION

Trust is earned by reproducing potential attack vectors and demonstrating cryptographic immunity. code402 enforces multi-layered replay protection and formal non-custodial boundaries across all machine payment lanes.

1. Cryptographic Payment Verification (EIP-3009)

Naive implementations of x402 rely on checking transaction receipts post-facto, enabling replay attacks and underpayment exploits. code402 verifies an EIP-3009 TransferWithAuthorization voucher bound deterministically to every request:

Signer Recovery: The secp256k1 signature recovers strictly to the declared payer address (via verifyTypedData).
Exact Value Bound: The value field must match the dynamic tool quote to the micro-cent (preventing underpayment).
Recipient Bound: The to field is strictly validated against the seller's published vault address.
Validity Window: Enforced within [validAfter, validBefore) to prevent stale-voucher sniping.
Two-Layer Replay Immunity: Cloudflare KV provides fast-path nonce checking, backed authoritatively by USDC's on-chain authorizationState.

2. Regulatory Posture & Legal Boundaries

Boundary	Design Implementation	Regulatory Basis
No Custody	Worker only verifies and relays. Vouchers are signed directly payer→recipient.	The platform lacks the technical capacity to divert, retain, or pool funds.
Money Transmitter (MSB)	Classified as communication and validation software access.	Exempt under FinCEN 2019 Guidance (FIN-2019-G001) for non-custodial software providers.
OFAC Sanctions	Edge and facilitator layer screens drop sanctioned counterparties before relay.	Enforces strict liability compliance without requiring custodial control.
SEC / CFTC	Restricted to spot metered digital services priced 1:1 in USDC.	Metered SaaS agreement; not an Alternative Trading System (ATS) or Swap Execution Facility.
Travel Rule (FATF)	Micro-payments ($0.001–$0.05) sit far below FATF $3,000 threshold; peer-to-peer unhosted.	code402 is not a VASP intermediary and holds no originator/beneficiary recording duties.

3. Concurrency & Race Mitigation

Concurrent request floods with duplicate vouchers are prevented by design: delivery of digital service output is strictly gated on synchronous settlement confirmation. If 8 parallel requests fire with the same voucher, exactly 1 settles on-chain and delivers a signed XDR-1 receipt; the other 7 receive SETTLEMENT_FAILED.

4. Independent Audit & Conformance Suite

All 28 reference endpoints achieve a verified 100/100 conformance score under the open x402 specification. The full test suite can be reviewed and executed locally from our repository:

git clone https://github.com/openfang/code402.git
cd code402/worker/redteam
node verify_test.mjs    # 6/6 test vectors: valid, replay, underpay, wrong-recipient, expiry, tamper
node redteam.mjs        # Comparative exploit analysis matrix