Security Advisory for x402 SDK: Vulnerability in Payment Processing on Solana
Summary
GHSA-qr2g-p6q7-w82m: x402 SDK Security Advisory. Affects @x402/svm versions < 2.6.0. Fixed in 2.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The x402 SDK is a software development kit designed to facilitate payment processing on the Solana blockchain. It enables developers to integrate payment solutions into their applications seamlessly. The SDK is widely used by facilitators who process transactions on Solana, providing essential functionality for handling payments securely and efficiently. However, certain outdated versions of the x402 SDK contain a security vulnerability that could potentially impact resource servers that accept payments.
Vulnerability Detail
A security vulnerability exists in outdated versions of the x402 SDK, specifically affecting facilitators that process payments on Solana. This issue does not compromise users' private keys, smart contracts, or funds. The vulnerability arises from the use of unpatched versions of the SDK, which may expose resource servers to security risks when they are running a vulnerable version.
How To Fix
Minimum fixed version
2.6.0
This is the first release that contains the fix.
npm install @x402/svm@2.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions of the x402 SDK as outlined in the 'how_to_fix' section.
Conclusion
The x402 SDK has a security vulnerability in outdated versions that affects payment processing on Solana. Facilitators must upgrade to the patched versions to ensure security. This advisory highlights the importance of keeping software dependencies up to date to protect against vulnerabilities.
See every vulnerability recorded for @x402/svm →
FAQ
Outdated versions of the x402 SDK prior to the patched versions are affected. Specifically, versions below @x402/svm 2.6.0, x402 2.3.0, and github.com/coinbase/x402/go 2.5.0.
No, this vulnerability does not affect users' private keys, smart contracts, or funds.
Facilitators that process payments on Solana must upgrade the x402 SDK. Clients and resource servers that do not self-facilitate are not required to upgrade.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check your application using the Vulert playground without any signup at Vulert Scanner.
While there are no specific workarounds, it is highly recommended to prioritize upgrading to the patched versions to mitigate any potential risks.
