Security & Regulatory Posture

Architectural Disclosures · Proven Non-Custodial Design · EIP-3009 Verification

TRUST VIA CODE, NOT ASSERTION

Trust is earned by reproducing potential attack vectors and demonstrating cryptographic immunity. code402 enforces multi-layered replay protection and formal non-custodial boundaries across all machine payment lanes.

1. Cryptographic Payment Verification (EIP-3009)

Naive implementations of x402 rely on checking transaction receipts post-facto, enabling replay attacks and underpayment exploits. code402 verifies an EIP-3009 TransferWithAuthorization voucher bound deterministically to every request:

Signer Recovery: The secp256k1 signature recovers strictly to the declared payer address (via verifyTypedData).
Exact Value Bound: The value field must match the dynamic tool quote to the micro-cent (preventing underpayment).
Recipient Bound: The to field is strictly validated against the seller's published vault address.
Validity Window: Enforced within [validAfter, validBefore) to prevent stale-voucher sniping.
Two-Layer Replay Immunity: Cloudflare KV provides fast-path nonce checking, backed authoritatively by USDC's on-chain authorizationState.

2. Regulatory Posture & Legal Boundaries

Boundary	Design Implementation	Regulatory Basis
No Custody	Worker only verifies and relays. Vouchers are signed directly payer→recipient.	The platform lacks the technical capacity to divert, retain, or pool funds.
Money Transmitter (MSB)	Designed as communication and validation software access; actual production role must be confirmed.	Not determined by this software. Independent counsel must assess the deployed flow, counterparties and applicable jurisdiction.
OFAC Sanctions	Edge and facilitator layer screens drop sanctioned counterparties before relay.	Enforces strict liability compliance without requiring custodial control.
SEC / CFTC	Restricted to spot metered digital services priced 1:1 in USDC.	Metered SaaS agreement; not an Alternative Trading System (ATS) or Swap Execution Facility.
Travel Rule (FATF)	Some product examples are small peer-to-peer transfers, but thresholds and obligations vary by asset, corridor and participant.	Applicability is not determined here; obtain a current Travel Rule and VASP/fiat-rail assessment before launch.

3. Concurrency & Race Mitigation

Concurrent request floods with duplicate vouchers are prevented by design: delivery of digital service output is strictly gated on synchronous settlement confirmation. If 8 parallel requests fire with the same voucher, exactly 1 settles on-chain and delivers a signed XDR-1 receipt; the other 7 receive SETTLEMENT_FAILED.

4. Independent Audit & Conformance Suite

All 28 reference endpoints achieve a verified 100/100 conformance score under the open x402 specification. The full test suite can be reviewed and executed locally from our repository:

git clone https://github.com/openfang/code402.git
cd code402/worker/redteam
node verify_test.mjs    # 6/6 test vectors: valid, replay, underpay, wrong-recipient, expiry, tamper
node redteam.mjs        # Comparative exploit analysis matrix

5. Accessibility & Web Standards (WCAG 2.2 AA & RFCs)

code402 and HCRB user interfaces adhere strictly to WCAG 2.2 Level AA, IETF BCP 47, RFC 9110, RFC 8446, and RFC 6797. All pages enforce keyboard navigation, visible focus indicators (:focus-visible), skip-to-content links, semantic landmarks (<header>, <nav>, <main>, <footer>), motion reduction (prefers-reduced-motion), and compliant color contrast across light and dark modes.