x402: base-sepolia advertises wrong EIP-712 domain name "USD Coin" (on-chain is "USDC")
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- go
- Domain
- api, blockchain, payments
Research direction
Start in internal/x402/chains.go at the Base Sepolia EIP3009Name entry and trace its use through the 402 extra fields. Compare the value with the vendored coinbase/x402/go registry in mechanisms/evm/constants.go, then add the regression coverage requested for the resolved EIP-712 domain and 402 extra.name. Done means Base Sepolia advertises "USDC" while other chain values remain correct.
Written by the indexing model from the issue text.
Description
Found during an x402 buyer/seller compatibility audit (paid-MCP obol sell mcp ⇄ external buyer).
Summary
internal/x402/chains.go advertises the EIP-712 domain name "USD Coin" for Base Sepolia (eip155:84532), but the on-chain USDC contract's EIP-712 domain name is "USDC". The obol sell http 402 challenge surfaces this wrong name in extra.name, so any payer that signs TransferWithAuthorization against the advertised domain produces a signature the facilitator rejects.
Evidence
internal/x402/chains.go:74—ChainBaseSepolia.EIP3009Name = "USD Coin"; flows into the 402extra.name(chains.go:237EIP712Name = c.EIP3009Name,chains.go:326"name": asset.EIP712Name).- On-chain ground truth (
eth_call name()on0x036CbD53842c5426634e7929541eC2318f3dCF7e, Base Sepolia): returns"USDC", version"2". Base mainnet0x833589…2913returns"USD Coin"— the split is real per-contract. - The vendored
coinbase/x402/goregistry agrees with the chain:eip155:84532 → "USDC",eip155:8453 → "USD Coin"(mechanisms/evm/constants.go).
Why it has not surfaced
obol's own buyer (internal/embed/skills/buy-x402/scripts/buy.py) deliberately ignores the seller-advertised extra.name (treats it as a human-readable display string) and signs from its own authoritative per-chain domain table (USDC_EIP712_DOMAIN, base-sepolia → ("USDC","2")). So internal sell http ⇄ buy.py flows on Base Sepolia pass and mask the bug. A spec-conformant external buyer that trusts extra.name will fail every paid request on Base Sepolia.
Fix
- Set
ChainBaseSepolia.EIP3009Name = "USDC". - Add a regression test asserting the resolved Base Sepolia EIP-712 domain name is
"USDC"(and that the 402extra.namematches). - Audit the other testnet entries (
polygon-amoy,avalanche-fuji,arbitrum-sepolia) against each testnet USDC contract's on-chainname()— they currently all hardcode"USD Coin".
- Dominant language
- Go
- Stars
- 11
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ObolNetwork/obol-stack
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
ObolNetwork/obol-stack#829 ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 72/100
ObolNetwork/obol-stack#828 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
ObolNetwork/obol-stack#821 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
ObolNetwork/obol-stack#807 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 68/100
ObolNetwork/obol-stack#804 ·
All issues in ObolNetwork/obol-stack
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·