A public challenge.
A bounded finding.

Agreed scope

One operator-authorized, unpaid GET to a Node.js/TypeScript x402 endpoint on Base. No authenticated logs, payments or system changes.

Observed evidence

• The example endpoint returned HTTP 402.
• A parseable x402 v2 challenge declared an exact Base native-USDC option with a positive amount and a nonzero recipient.
• Bazaar metadata was not observed in this response.

A real report includes the observation time and a response fingerprint. This example has neither because no request was made.

Checks passed

The unpaid response demonstrated the expected status and a syntactically valid supported payment option. These checks do not prove that a payment can settle or that the declared recipient belongs to the operator.

Not checked or still unknown

• No payment, signature, transfer or production modification.
• No actual settlement, paid delivery, idempotency replay or marketplace-index lookup.
• The missing metadata does not establish why a resource is absent from a provider’s discovery index.

Recommended next step

Review the intended discovery registration with the provider. If middleware metadata needs a change, agree a separate repair scope, access permission and acceptance test first. If the provider confirms valid registration but indexing is absent, escalate the evidence upstream.

Acceptance test

Re-run the same authorized unpaid GET after an agreed change and inspect the challenge. Proving settlement or paid delivery requires a separate, explicitly authorized controlled transaction and reconciliation. This public diagnostic does not perform that transaction.

If the check cannot complete

The deliverable is an explicit blocker report stating that no root cause was established, which checks were not performed, and what supported input or provider help is needed. A scan error is not proof that the customer’s payment service is broken.