arXiv subjects

Shengchen Ling

Publications and source records attributed to Shengchen Ling.

3 recordsLinked to original sources

arXiv2026

How Agentic Is Agentic Commerce? A Population-Scale Measurement of x402 Adoption and Authenticity

AI agents are said to be forming an economy in which they pay, on their own, for the data, APIs, and compute they consume. x402, which settles a stablecoin payment on-chain for each purchase, is the most widely deployed protocol for this, and its hundreds of millions of settlements are read as proof that the economy has arrived. We show the count cannot be read as adoption: it is the one metric an interested party can manufacture almost for free, since the facilitator sponsors the gas and nothing on-chain marks who controls a payment. We give the first population-scale measurement of x402 on Base, supplemented with a coarser Solana census. Identifying settlements from their on-chain event and resolving the true payer through the meta-transaction layer, we sort each by what its trace can prove via a payment graph. Over a 280-day window Base carries 136{,}708{,}672 settlements worth \$44{,}121{,}383.81, concentrated on every axis we measure (payer, recipient, and value Gini all above 0.98), yet 21.20\% are fictitious and 63.78\% internal settlement within a linked cluster. What is genuinely independent is bounded: it lies between the \$187{,}861.35 that demonstrably reaches a nameable service and the \$20{,}258{,}746.09 (45.92\% of value) not provably manufactured. Finally, we resolve the count's manufacturable component, a coherent operator-driven economy, star-shaped, machine-timed, and gas-subsidized. Settlement count measures manufacturability, not adoption.

cs.CR↗

arXiv2026

Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments

The x402 protocol has crossed from prototype to infrastructure for the agentic web, driving 130 million all-time transactions and embedded in Google Cloud, Cloudflare, and Stripe. Yet bridging synchronous HTTP requests with asynchronous blockchain finality creates state-synchronization challenges, and x402's security has so far been examined only in piecemeal vendor disclosures. It is moreover not one artefact but a stack of an HTTP semantic, per-chain schemes, and a long tail of SDK and deployment choices whose required guarantees prior work has not established. We perform a systematic security analysis organized around five invariants grounded in specifications, literature, and vendor expectations, resolving every violation to the responsible layer. We identify four flaw classes: cross-resource substitution, duplicate-settlement race (independently corroborated by subsequent third-party reports), allowance overdraft, and denial of settlement. Against official SDKs and a production deployment, these reach resource-leakage ratios up to 100%. For pay-per-token scheme we prove a structural limit: no output-only pricing can be both fair to honest users and bounded against inflation of the hidden "thinking" tokens, the price of fairness being a $\sqrt{1+\Theta}$ manipulation gap. We propose per-flaw mitigations and a defense triple with provable guarantees, cutting per-call reasoning cost by 47% and inverting attacker leverage from 8.7$\times$ to 0.9$\times$ at only 2.8% overhead. All findings have been disclosed.

cs.CR↗

arXiv2025

SoK: Stablecoin Designs, Risks, and the Stablecoin LEGO

Stablecoins have become significant assets in modern finance, with a market capitalization exceeding USD 246 billion (May 2025). Yet, despite their systemic importance, a comprehensive and risk-oriented understanding of crucial aspects like their design trade-offs, security dynamics, and interdependent failure pathways often remains underdeveloped. This SoK confronts this gap through a large-scale analysis of 157 research studies, 95 active stablecoins, and 44 major security incidents. Our analysis establishes four pivotal insights: 1) stability is best understood not an inherent property but an emergent, fragile state reliant on the interplay between market confidence and continuous liquidity; 2) stablecoin designs demonstrate trade-offs in risk specialization instead of mitigation; 3) the widespread integration of yield mechanisms imposes a "dual mandate" that creates a systemic tension between the core mission of stability and the high-risk financial engineering required for competitive returns; and 4) major security incidents act as acute "evolutionary pressures", forging resilience by stress-testing designs and aggressively redefining the security frontier. We introduce the Stablecoin LEGO framework, a quantitative methodology mapping historical failures to current designs. Its application reveals that a lower assessed risk strongly correlates with integrating lessons from past incidents. We hope this provides a systematic foundation for building, evaluating, and regulating more resilient stablecoins.

cs.CR↗