[SEC-12] Bypass total de x402: prefijo mock: en X-PAYMENT sin gate de entorno

[ericmt-98]

⚠️ Solo reporte — NO cambies código. Esta es una issue de auditoría de seguridad. La entrega es únicamente el reporte en docs/security-reports/SEC-XX-*.md (resultado, evidencia, reproducción). No modifiques código de la app ni del backend — los fixes los implementa el equipo. Si tienes una propuesta de arreglo, descríbela en la sección Sugerencia de fix del reporte, no la implementes. Los PRs que cambien código de la aplicación no se aceptarán para esta issue (se pedirá separar el reporte del fix).

---

[SEC-12] Bypass total de x402: el prefijo mock: en X-PAYMENT se acepta sin gate de entorno

Archivo: apps/api/src/middleware/x402.ts:107-112

Contexto

verifyPayment() —el corazón del middleware x402 que protege todos los endpoints de pago— empieza con:

if (xdrBase64.startsWith("mock:")) {
  return xdrBase64.replace("mock:", "").split(":")[0] ?? "GTEST_PAYER";
}

Cualquier petición con header X-PAYMENT: mock:G<cualquier-cosa>:0 es aceptada como pago válido y devuelve esa dirección como payerAddress, sin verificar nada. Esto no tiene ninguna guarda por entorno: index.ts:29-31 sí rechaza X402_MOCK_MODE=true en producción, pero ese flag no se consulta en x402.ts — el bypass mock: está siempre activo, incluso en producción.

Endpoints afectados (todos los que usan requirePayment): /api/v1/swaps/plan, /swaps/execute, /api/v1/credentials/buy, /api/v1/bazaar/intent|feed|quote|accept, /api/v1/fund. Esto convierte el pago en opcional y habilita SEC-16, SEC-17 y SEC-18 de forma gratuita.

Pasos para reproducir

1. curl -X POST .../api/v1/bazaar/feed -H "X-PAYMENT: mock:GAAAA...:0" → esperar 200 sin pago real
2. Repetir contra /api/v1/credentials/buy y /api/v1/swaps/plan
3. Confirmar que payer/payerAddress en la respuesta refleja la dirección arbitraria enviada
4. Verificar que no existe ninguna variable de entorno que desactive la rama mock:

Lo que reportar

• ¿Se obtiene acceso al recurso pagado sin un pago real?
• ¿La dirección payer se puede falsificar a voluntad?
• ¿Existe algún gate (NODE_ENV, env var) que desactive mock:? (esperado: no)

Severidad estimada: Crítica si llega a producción — anula todo el modelo de pago x402

---

Plantilla de respuesta: Resultado: Vulnerable/No vulnerable/Parcial · Evidencia: (curl/log) · Reproducible en testnet: sí/no · Sugerencia de fix: (opcional)

---

Cómo entregar

Completa la plantilla docs/security-reports/SEC-12-x402-mock-bypass.md con tu resultado, evidencia y entorno, y envíala como PR (el bot de Drips rastrea PRs) o como comentario en este issue. Un asignado por issue.

[Handynfts2]

@Handynfts2 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer,
I would love to fix this issue, kindly assign me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Handynfts2 to this issue.

[SamixYasuke]

@SamixYasuke has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer, I’d like to investigate the x402 mock payment bypass, validate whether it affects production, document the findings in the required security report, and implement an environment-gated fix if the issue is confirmed.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @SamixYasuke to this issue.

[Sughter99]

@Sughter99 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can this be assigned to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Sughter99 to this issue.

[miracleokaa]

@miracleokaa has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to take on this security audit. I have experience reviewing authentication and payment verification flows, and I can thoroughly validate whether the x402 mock payment mechanism can bypass payment verification in testnet or release configurations. I'll reproduce the reported scenarios, collect clear evidence using requests and logs, determine whether the vulnerability is reproducible, and assess its impact on the payment flow.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @miracleokaa to this issue.

[larryjay007]

@larryjay007 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi, please assign to me this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @larryjay007 to this issue.

[nnennaokoye]

@nnennaokoye has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello Maintainer, I'd like to take on this security audit to verify whether the x402 payment verification flow accepts unsigned or non-settled XDRs without confirming successful on-chain execution. I'll reproduce the reported attack scenarios, compare the API behavior with the actual blockchain state, and submit a detailed report with evidence and recommended fixes.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nnennaokoye to this issue.

[fairbid01]

@fairbid01 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @fairbid01 to this issue.

[Meet-hybrid]

@Meet-hybrid has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Can I work on this please?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Meet-hybrid to this issue.