x402's auth-capture scheme holds the money and leaves one address in charge of releasing it: the captureAuthorizer. Point that address at X402AssuredGate and escrow captures if — and only if — a six-layer proof shows your delivery happened on the other chain, bound to this exact payment. The payment never leaves Base. Only the evidence crosses.
PROPOSED specified against x402 v2 · reference model 21/21 · not yet deployed — status said plainly
No arbiter, no jury, no seller self-report. The gate captures when the proof shows the agreed event, on the agreed chain, inside the agreed window — and the event carries a correlator that binds it to this payment and no other. Without that binding, a gate can be pointed at someone else's transaction; the reference model's naive mode demonstrates exactly that failure, and the adversarial suite (0 of 9 attacks pay out) demonstrates the fix.
# the binding the delivery event must carry correlator = H("taifoon.x402.v1" ‖ nonce ‖ payTo ‖ chainId) # the gate's decision, whole capture ⇐ proof verifies against an anchored root ∧ event matches the agreed predicate ∧ event carries this correlator ∧ now ≤ captureDeadline reclaim ⇐ deadline passes with no such proof
| Limit | What it means for you |
|---|---|
| Events, not quality | The gate proves a transfer, fill, mint, swap or state change happened — bound to this payment, in this window. It cannot prove an answer was good. The scope is effects that land on a chain. |
| The provable window bounds the deadline | Each chain has its own window in which proofs are available. A captureDeadline shorter than the delivery chain's window is a payment that can never be captured — the client checks this before authorizing. |
| Anchor cadence, not recompute cadence | The superroot recomputes every 10 s; the gate can only use a root already anchored on Base. The anchor cadence is a separate, slower number — deadlines are set against it. |
| Liveness failure favours the buyer | If the evidence layer stalls, no capture happens and the buyer reclaims at the deadline. The provider carries that risk — deliberately, and stated up front. |
A Base Sepolia auth-capture escrow, a delivery on a second testnet, and capture firing off the proof — under three minutes, end to end. Being staged; this panel embeds it the day it runs. Until then nothing here pretends otherwise.
PROPOSED
DEEPER: THE FULL SPEC, FAILURE TABLE AND BUILD GATES LIVE IN THE COORDINATION PAPER · SEVEN SCENARIOS →