feeless402 / audits

ExactChange Audit · Delivery Attestation

We paid this service, and here is exactly what happened.

GET https://feeless402.com/dt/broken-usdc
Audited 2026-08-23 20:16 UTCReport cf8be54e791b
DEMONSTRATION CASE — this is a deliberately flawed reference endpoint operated by ExactChange to show what the auditor detects. It is not a real third-party service.
Verdict

PAID — NO DELIVERY

We paid and the service did not deliver a valid response. This is the failure on-chain settlement alone cannot detect.

Service claims to sellUSDC-paid market data on Base.

Scrutiny8 findings4 dimensions
Paid, for real10000 (raw)~$0.01 · usdc-base
SettlementUnconfirmed
DeliveryHTTP 40248 ms · 226 B

Findings ledger

Every check we ran, grouped by what it examines — 4 verified · 1 observed · 2 warnings · 1 critical.

Delivery
CRITICALNo delivery after payment (HTTP 402)226 bytes returned — payment sent, goods not delivered.
Payment
OBSERVEDReal payment sent on the usdc-base railWe paid 10000 (~$0.01) from 0xf422A85850a493B8722EB0AeEc590bE9dA486883 to 0x0000000000000000000000000000000000000000.
Protocol conformance
VERIFIEDPresents an x402 payment challengeHTTP 402 on unpaid request
VERIFIEDDeclares a supported x402 versionx402Version=2
VERIFIEDOffers at least one payment option1 payment option(s)
VERIFIEDOption 0 fieldseip155:8453: complete
WARNINGOption 0 eip712 domain — not meteip155:8453: extra.name/version MISSING — standard clients cannot sign without the EIP-712 domain
Settlement
WARNINGSettlement not independently verifiedserver returned no settlement tx hash — settlement not independently verifiable at audit time (may settle async); payer balance delta recorded instead

Payment receipt

The audit is only credible because we actually paid. This is the transaction, independently checkable on-chain.

Railusdc-base
From (auditor payer)0xf422A85850a493B8722EB0AeEc590bE9dA486883
To (service)0x0000000000000000000000000000000000000000
Amount10000 base units
On-chain reference
Independently confirmedno

What the service delivered

The first bytes of the response to our paid request, verbatim.

{"x402Version":2,"error":"Payment required","accepts":[{"scheme":"exact","network":"eip155:8453","asset":"USDC","amount":"10000","payTo":"0x0000000000000000000000000000000000000000","resource":"demo","maxTimeoutSeconds":300}]}

Cryptographic appendix

Re-verify this report yourself: the body hash is signed by the same key that paid the service, so the attester and the payer are one.

Report schemaexactchange-audit/v0
Report body sha25644f958549ef538abb552f3e673910ac9fa7286f940462063286d89615855ff29
Signed by0xf422A85850a493B8722EB0AeEc590bE9dA486883
Signature schemeeip712
Signature0x8c337a654206cd435df7820db845780c539f30434f34767ac5c9778b67ea052e2c06a5c352035e0554fbe251f30375259df7fe10f6434e9747ea6fda8c9f60f51b
independent — the auditor has no stake in the audited service

ExactChange Audit — the agent that reads the receipt. feeless402.com/audits