Grants access despite settle failure
Quirk · GET /api/x402/facilitator-already-settled-grants · Facilitator Dependency
When /settle returns a failure (e.g., already used), the merchant grants access anyway — a replay attacker can reuse any previously-rejected permit for free.
Explanation
When /settle returns a failure (e.g., 'already used' or 'nonce consumed'), the merchant's error-handling branch grants access anyway. A replay attacker can obtain free access indefinitely: pay once with a valid permit, capture the permit, then replay it — the facilitator will reject the re-settle but the merchant still serves the resource. The merchant must treat any settle failure as payment not confirmed and return 402.
What to watch
Returns 200 even though settle failed. The merchant is giving away the resource without confirmed payment.
Facilitator
Settled against the live Radius testnet facilitator (https://facilitator.testnet.radiustech.xyz). A valid payment runs a real /verify and /settle on-chain.
Metadata
- Status: Quirk
- Method: GET
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant