The limit you configured is not the limit it applies
An agent that pays for things needs a limit: a maximum price per call, a payee you expect, sometimes a list of networks and tokens you trust. The question here is narrower and more important than whether the limit exists: does it apply to the payment the client signs, or to a quote the agent saw a moment earlier? Those can be different payments. Two requests, two prices x402 turns HTTP 402 into a…
The issue at hand is not merely the presence or absence of a limit, but rather whether that limit applies to the payment that the client ultimately signs or to the quote that the agent previously saw. These could be two distinct transactions. In the classic agent flow, the process unfolds in two stages: initially, the agent makes a request and reads the 402 response, for example, a limit of 0.10 USDC to payee 0x1111.
It then decides if this is acceptable and proceeds to call the paying action, passing the chosen option. If the action subsequently sends a new request and signs in accordance with the new stipulations, the check and the payment pertain to different entities. The server might quote 0.10 and then request 0.90, transform the payee, or switch to a different network.
This problem, known as "what you see is not what you sign," has been addressed for transaction signing using hardware wallets, and for card payments in Europe through PSD2's dynamic linking, which links authentication to the amount and payee displayed to the payer. The issue is emerging in agent payments. A test harness (available at github.com/cleitonaugusto/x402-conformance) simulates a dishonest x402 seller that issues varying quotes and demands for different amounts on each subsequent 402 request.
The client's software, equipped with a configured limit of 0.50 USDC, is then evaluated across seven scenarios. The SDKs tested include vAPI, ClawRouter, and Coinbase AgentKit. The successful SDKs apply the limit to the requirement being signed, ensuring that the quote approved matches the payment that is signed. This implies that the amount, payee, asset, and network must either match or be no greater than the limit.
This principle is not currently outlined in the x402 specification, and there is no client conformance test that would identify a kit that violates this rule. The test harness is designed to check what the client signs, not what the user sees, meaning that if the agent shows the human a different quote than the one it checks, the correct client will still sign the wrong thing faithfully. The responsibility to bind the display is a separate, more complex issue.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.