fix(x402): validate price input and fail closed on malformed on-chain amounts#771
Merged
Merged
Conversation
… amounts
Root cause: the --price/--per-request singular-price CLI path in
resolvePriceTable (cmd/obol/sell.go) had zero validation, unlike the
--per-mtok/--per-hour branches. A typo like an EU comma decimal ("0,01")
sailed through, and decimalToAtomic (internal/x402/chains.go) discarded
big.Float.Parse's error entirely: "0,01" silently parsed as "0" (mispricing
the offer at $0), while "abc"/""/"$0.01" left amountFloat nil, panicking the
next line's Mul(nil, ...) on every request through the verifier hot path
(verifier.go resolvePaidRoute -> BuildV2RequirementWithAsset -> decimalToAtomic).
A ServiceOffer applied directly via kubectl bypasses the CLI entirely, so a
CLI-only guard isn't sufficient.
Fix, two layers, both fail-closed:
1. CLI: resolvePriceTable now validates perRequest with validate.Price
before returning it, matching the existing perMTok/perHour branches.
2. Library (defense-in-depth): decimalToAtomic now returns (string, error)
instead of panicking on a discarded parse error; BuildV2RequirementWithAsset
and BuildV2Requirement propagate the error instead of building a $0/invalid
PaymentRequirements. resolvePaidRoute skips an option that fails to build
(mirroring its existing "chain not pre-resolved" skip-and-continue pattern);
if that leaves zero resolvable options the route already fails closed via
the existing len(reqs)==0 -> (nil,false) -> 403 path. inference/gateway.go
propagates the error from buildHandler.
Confirmed Canary402 proactive-audit finding (critical) on
integration/v0.14.0-rc0.
Claude-Session: https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proactive-audit finding (CRITICAL): unvalidated price → mispriced or panicking on-chain amount
Found by the 2026-07-16 hostile-operator audit (see PR #770), adversarially confirmed. The singular
--price/--per-requestCLI path is the only price path with no validation (unlike--per-mtok/--per-hour, which validate, and--accept'sprice=, which rejects negatives), and the on-chain amount conversion discards its parse error.Impact
obol sell http myapi --price 0,01 --pay-to 0x… --network base(EU comma decimal — an ordinary typo) succeeds, reconciles Ready, andobol sell statusprints "Price: 0,01" looking fine. Then in the verifier hot path (resolvePaidRoute→BuildV2RequirementWithAsset→decimalToAtomic):"0,01"parses0and drops the rest → the route silently prices at $0 (free)."abc","","$0.01"→big.Float.Parsereturns nil, the error is discarded, and the nextMul(nil, …)panics (nil deref) on every request to that route. A ServiceOffer applied directly via kubectl bypasses the CLI entirely, so both a CLI guard and a library-level guard are required.Fix (two layers, both fail-closed)
resolvePriceTablevalidates--price/--per-requestwith the existingvalidate.Price(rejects non-numeric incl.0,01, and negatives) before building the offer.decimalToAtomicnow returns(string, error)— capturing the parse error, rejecting nil and negative — threaded throughBuildV2Requirement/BuildV2RequirementWithAsset.resolvePaidRouteskips an option with a bad price so the route falls through its existinglen(reqs)==0 → 403fail-closed path (never a free or panicking route); the inference gateway propagates the error. A malformed price now denies the route, never serves it free.Tests:
resolvePriceTablerejects0,01/abc/$0.01/-1/``;decimalToAtomicreturns an error (not a panic) on the same; and an end-to-end verifier test proves a `RouteRule{Price:"0,01"}` (simulating a kubectl-applied offer) returns 403, not a free 402. Full `go test ./...` green.https://claude.ai/code/session_014YjPMViNrZ7zBVgUQzwEKk