Concurrent settle race (second racer gets 402)
Quirk · GET /api/x402/facilitator-settle-concurrent-race · Facilitator Dependency
Two concurrent requests carry the same PAYMENT-SIGNATURE; without a per-permit lock the merchant lets both race to /settle. The facilitator accepts only one — the second racer is charged but gets a confusing 402.
Explanation
Two concurrent HTTP requests arrive carrying the same PAYMENT-SIGNATURE. Both decode the permit, both call /verify (which succeeds for each), and then both race to call /settle. The facilitator is idempotent only for the winner — it rejects the duplicate with 'nonce already consumed'. The losing racer is returned a 402 even though the client paid and has a valid receipt from the winning request. The merchant must acquire a per-permit advisory lock (in-process mutex or distributed lock) before calling /settle to ensure only one concurrent settle attempt per permit id.
What to watch
Returns 402 with an 'already used' detail — the client paid but the second concurrent call lost the settle race.
Facilitator
Settled against the live Radius testnet facilitator (https://facilitator.testnet.radiustech.xyz). A valid payment runs a real /verify and /settle on-chain.
Metadata
- Status: Quirk
- Method: GET
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant