EIP-3009: merchant replays the authorization nonce
Quirk · GET /api/x402/eip3009-replayed-nonce · Schemes (exact / upto / batch)
After settling successfully, the merchant submits the identical authorization (same from + nonce) a second time. ERC-3009 replay protection lives in the token, so the second attempt cannot move funds.
Explanation
After a settlement that succeeded, the merchant submits the identical authorization — same from, same nonce — to the facilitator a second time. It cannot double-charge: ERC-3009 records spent nonces in the TOKEN, so authorizationState(from, nonce) is already true and the transfer reverts. That is the structural difference from Permit2, where the nonce is consumed in the Permit2 contract rather than the asset, and it is why this quirk has no Permit2 equivalent. The bug being demonstrated is what the merchant does with the refusal: it reports the token's replay protection as a settlement failure of its own, which in a real implementation means retrying forever, or worse, denying a caller who has already paid. A merchant must treat 'this authorization is already used' as evidence the payment succeeded, and must key its own idempotency on the authorization nonce so the second submission never leaves the process.
What to watch
replayedSettlement fails while firstSettlement succeeded — the merchant reports the token's replay refusal as its own settlement error.
Facilitator
Settled against the live Radius testnet facilitator (https://facilitator.testnet.radiustech.xyz). A valid payment runs a real /verify and /settle on-chain.
Metadata
- Status: Quirk
- Method: GET
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant