upto: challenge omits facilitatorAddress
Quirk · POST /api/x402/upto-missing-facilitator-address · Schemes (exact / upto / batch)
Advertises an upto challenge whose extra carries only name and version — the facilitatorAddress the scheme requires is missing.
Explanation
The x402 EVM upto scheme requires the challenge's extra object to carry facilitatorAddress alongside name and version. The client MUST copy that address into permit2Authorization.witness.facilitator, which binds the signed authorization to one facilitator so no other party can settle it. This endpoint omits the field, so a conformant client has nothing to bind to: it must either refuse to sign or sign an unbound witness that any facilitator holding the permit could redeem. Settlement behaviour here is otherwise correct (actual usage is settled) — the only deviation is the missing address. The merchant must advertise the facilitator address it will settle through, discovering it from the facilitator's /supported document or from its own configuration.
What to watch
The 402 extra has no facilitatorAddress, so the client has nothing to put in permit2Authorization.witness.facilitator.
Facilitator
Settled against the live Radius testnet facilitator (https://facilitator.testnet.radiustech.xyz). A valid payment runs a real /verify and /settle on-chain.
Metadata
- Status: Quirk
- Method: POST
- Price: 0.0001 (100 atomic)
- Responsible party: Merchant