DEV Community

ScriptMasterLabs
ScriptMasterLabs

Posted on Originally published at scriptmasterlabs.com

Is an HTTP 402 Challenge Proof of Payment? No — Challenge vs. Settlement, With Live Receipts

#x402 #web3 #ai #programming

Payment screenshots are circulating in the x402 ecosystem, and a lot of them show the same thing: an HTTP 402 response body. Here is the problem — a 402 challenge is not proof of payment. It is a price quote. We proved it today on our own production endpoint.

The free exhibit

This afternoon (October 14, 2026, 22:01 UTC) we sent one unauthenticated request to our Verdict Protocol:

POST https://verdict.scriptmasterlabs.com/decide
(no payment header, empty JSON body)
Enter fullscreen mode Exit fullscreen mode

Back came HTTP 402 Payment Required with the full challenge: x402 v2, network eip155:8453 (Base), amount 250000 ($0.25 in atomic units), asset = USDC on Base, payTo = our settlement wallet. No wallet connected. No signature. No funds moved. Anyone can fetch that exact JSON right now — which is the point. Possessing a challenge proves exactly one thing: what the server charges.

The ladder people skip

  1. Challenge — the 402 response. Unsigned, free to issue, copyable. Proves a price.
  2. Authorization — the buyer signs an EIP-3009 authorization. A permission, not a movement of funds.
  3. Settlement — a facilitator broadcasts the transfer and it lands on-chain. The first state with a transaction hash.
  4. Receipt — the settlement response / service receipt referencing that transaction.

Anything below settlement is a quote, a permission, or a promise.

What proof looks like

Our launch-day settlements on Base (October 12, 2026), re-verified today against Base RPC with eth_getTransactionReceipt:

  • Verdict tier, $0.25: 0xfa3ec31ff345167a474c682cec4e2eac505cfdd570e158961a233187be5f6f1c — status 0x1, block 52522538
  • Seal tier, $0.01: 0x5bce2363ae8818fbb0ea5c6229ba8325c6c70792880d4939f324f96d35f7a1b7 — status 0x1, block 52522552

Plus the two PayAI probes from our facilitator field test (0x7867c4dd… $0.25, block 52522353; 0x8760e76a… $0.01, block 52522312 — both 0x1). Honest label, as always: these were owner proof-wallet self-tests — real settlements, not customer purchases.

And a signature isn't proof either: in that same field test, MeshGateway's verifies succeeded while its settles failed repeatedly and zero funds moved. The identical payloads later settled via PayAI.

The 6-step check for any "paid" claim

  1. Get the transaction hash — not a screenshot, not the 402 body.
  2. Look it up on an explorer or via eth_getTransactionReceipt.
  3. Confirm receipt status 0x1.
  4. Match the transfer: recipient = the payTo from the challenge, asset = the quoted token contract, amount = the quoted amount.
  5. Match the paperwork: the settlement response / service receipt references the same transaction.
  6. Any step uncheckable → treat as unproven. Deliver after settlement, never on a challenge.

Full canonical with the complete challenge JSON, the four-state table, Claim Receipts and FAQ: https://scriptmasterlabs.com/is-a-402-challenge-proof-of-payment

ScriptMasterLabs is a Service-Disabled Veteran-Owned Small Business. Verdict Protocol: LIVE_SETTLEMENT_VERIFIED, /decide $0.25 USDC, /seal $0.01 USDC, Base, x402 v2.

Top comments (0)