{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:KYU43U4FVWYC6JC5RVAQ6YF2YT","short_pith_number":"pith:KYU43U4F","canonical_record":{"source":{"id":"2605.30998","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T08:31:18Z","cross_cats_sorted":["cs.CE"],"title_canon_sha256":"a92c3d57d51e495b4c220bfcd0749dff9e83a0085cf72716b4c9cc5d1bed6f59","abstract_canon_sha256":"6d28c4990f92c9d44a35b55ba2bd56cbabbb69d6dc19c3d3a0352b3a3b0edc7e"},"schema_version":"1.0"},"canonical_sha256":"5629cdd385adb02f245d8d410f60bac4d447a0d26839c7b75ba19ec813a6647e","source":{"kind":"arxiv","id":"2605.30998","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.30998","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"arxiv_version","alias_value":"2605.30998v1","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.30998","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_12","alias_value":"KYU43U4FVWYC","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_16","alias_value":"KYU43U4FVWYC6JC5","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_8","alias_value":"KYU43U4F","created_at":"2026-06-01T01:03:29Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:KYU43U4FVWYC6JC5RVAQ6YF2YT","target":"record","payload":{"canonical_record":{"source":{"id":"2605.30998","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T08:31:18Z","cross_cats_sorted":["cs.CE"],"title_canon_sha256":"a92c3d57d51e495b4c220bfcd0749dff9e83a0085cf72716b4c9cc5d1bed6f59","abstract_canon_sha256":"6d28c4990f92c9d44a35b55ba2bd56cbabbb69d6dc19c3d3a0352b3a3b0edc7e"},"schema_version":"1.0"},"canonical_sha256":"5629cdd385adb02f245d8d410f60bac4d447a0d26839c7b75ba19ec813a6647e","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-01T01:03:29.761210Z","signature_b64":"dxnwTVDiFAuPWKJatjGMjx7MudlNY77LrJGvsSwjLqlHt5a/k2WW1ql4twtCmqTPph2Y/FLRdlOjIGNm6Jv6DQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5629cdd385adb02f245d8d410f60bac4d447a0d26839c7b75ba19ec813a6647e","last_reissued_at":"2026-06-01T01:03:29.760211Z","signature_status":"signed_v1","first_computed_at":"2026-06-01T01:03:29.760211Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.30998","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-01T01:03:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"O7+R8dwEXKDhe7dm5DwfZ5Kr8sLkw4oRQKBfUNAsaHucEczycGwn/99qG4WAkcDp6XcGYF/fN96bRwsKa3l+Cg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-02T16:32:23.785682Z"},"content_sha256":"b3f2fce007b90cfa0f4b12f8b0d8804d767dcc318600be5fa95a51d69f4577ee","schema_version":"1.0","event_id":"sha256:b3f2fce007b90cfa0f4b12f8b0d8804d767dcc318600be5fa95a51d69f4577ee"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:KYU43U4FVWYC6JC5RVAQ6YF2YT","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Free-Riding in the AI Economy: Demystifying Logic Flaws in x402-Enabled Payment Systems","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CE"],"primary_cat":"cs.CR","authors_text":"Cong Wang, Lei Wu, Shengchen Ling, Yajin Zhou, Yihang Huang, Yuan Chen","submitted_at":"2026-05-29T08:31:18Z","abstract_excerpt":"The agentic economy demands programmatic financial rails, positioning the x402 protocol as the de facto standard for machine-to-machine payments. However, bridging synchronous HTTP requests with asynchronous blockchain finality introduces profound state synchronization challenges. In this work, we perform the first comprehensive security analysis of the x402 ecosystem. By formalizing five Security Invariants, we reveal that current implementations fail to enforce transactional atomicity and cryptographic context binding, leading to systemic vulnerabilities. We identify a semantic gap in signat"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.30998","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.30998/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-01T01:03:29Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LLyTdAdRxmI8P/q4L1xignKemoBvgutPrUVuWcmGofhfAawcWildj8ZliNkGDeGGflW2T6Y3BJWFlbenAZN/DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-02T16:32:23.786063Z"},"content_sha256":"8b687a6e501b96ad200ad672d56f3e6d87340e117006c7b8a48bdde759963827","schema_version":"1.0","event_id":"sha256:8b687a6e501b96ad200ad672d56f3e6d87340e117006c7b8a48bdde759963827"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/bundle.json","state_url":"https://pith.science/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-02T16:32:23Z","links":{"resolver":"https://pith.science/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT","bundle":"https://pith.science/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/bundle.json","state":"https://pith.science/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KYU43U4FVWYC6JC5RVAQ6YF2YT/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:KYU43U4FVWYC6JC5RVAQ6YF2YT","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6d28c4990f92c9d44a35b55ba2bd56cbabbb69d6dc19c3d3a0352b3a3b0edc7e","cross_cats_sorted":["cs.CE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T08:31:18Z","title_canon_sha256":"a92c3d57d51e495b4c220bfcd0749dff9e83a0085cf72716b4c9cc5d1bed6f59"},"schema_version":"1.0","source":{"id":"2605.30998","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.30998","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"arxiv_version","alias_value":"2605.30998v1","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.30998","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_12","alias_value":"KYU43U4FVWYC","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_16","alias_value":"KYU43U4FVWYC6JC5","created_at":"2026-06-01T01:03:29Z"},{"alias_kind":"pith_short_8","alias_value":"KYU43U4F","created_at":"2026-06-01T01:03:29Z"}],"graph_snapshots":[{"event_id":"sha256:8b687a6e501b96ad200ad672d56f3e6d87340e117006c7b8a48bdde759963827","target":"graph","created_at":"2026-06-01T01:03:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.30998/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The agentic economy demands programmatic financial rails, positioning the x402 protocol as the de facto standard for machine-to-machine payments. However, bridging synchronous HTTP requests with asynchronous blockchain finality introduces profound state synchronization challenges. In this work, we perform the first comprehensive security analysis of the x402 ecosystem. By formalizing five Security Invariants, we reveal that current implementations fail to enforce transactional atomicity and cryptographic context binding, leading to systemic vulnerabilities. We identify a semantic gap in signat","authors_text":"Cong Wang, Lei Wu, Shengchen Ling, Yajin Zhou, Yihang Huang, Yuan Chen","cross_cats":["cs.CE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T08:31:18Z","title":"Free-Riding in the AI Economy: Demystifying Logic Flaws in x402-Enabled Payment Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.30998","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b3f2fce007b90cfa0f4b12f8b0d8804d767dcc318600be5fa95a51d69f4577ee","target":"record","created_at":"2026-06-01T01:03:29Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6d28c4990f92c9d44a35b55ba2bd56cbabbb69d6dc19c3d3a0352b3a3b0edc7e","cross_cats_sorted":["cs.CE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-29T08:31:18Z","title_canon_sha256":"a92c3d57d51e495b4c220bfcd0749dff9e83a0085cf72716b4c9cc5d1bed6f59"},"schema_version":"1.0","source":{"id":"2605.30998","kind":"arxiv","version":1}},"canonical_sha256":"5629cdd385adb02f245d8d410f60bac4d447a0d26839c7b75ba19ec813a6647e","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5629cdd385adb02f245d8d410f60bac4d447a0d26839c7b75ba19ec813a6647e","first_computed_at":"2026-06-01T01:03:29.760211Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-01T01:03:29.760211Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"dxnwTVDiFAuPWKJatjGMjx7MudlNY77LrJGvsSwjLqlHt5a/k2WW1ql4twtCmqTPph2Y/FLRdlOjIGNm6Jv6DQ==","signature_status":"signed_v1","signed_at":"2026-06-01T01:03:29.761210Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.30998","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b3f2fce007b90cfa0f4b12f8b0d8804d767dcc318600be5fa95a51d69f4577ee","sha256:8b687a6e501b96ad200ad672d56f3e6d87340e117006c7b8a48bdde759963827"],"state_sha256":"65f7d9ebeb56b510d7adcb249db95cdfec09eb9fc2200d4fa11648f9e19660f8"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lgO+QIAASelCZMYTen0kPmcAs/EgCDkwJXSKnFPwRgUUFJzP9uqlPSafuxIxOs107XZaa5R7LftosqwunSjJCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-02T16:32:23.787966Z","bundle_sha256":"4ebe6611bcc390fca57244cb2dd3ae586a8e5fe0ae5cff53164d6469dc00772b"}}