According to CoinMeta, a study tested 15 major X402 payment service providers, including Coinbase, Thirdweb, PayAI, and Mogami. It was found that all the tested platforms violated at least one security rule, with a total of 49 rule violations and 31 different vulnerabilities involved. These service providers accounted for 99% of the X402 transaction volume and 98% of the payment amounts during the research period, but this does not mean that the same proportion of transactions had vulnerabilities. The risks identified in the study included obtaining goods or services for free, asset theft, service interruptions, and abuse of gas fees. Under restricted conditions, the researchers verified six attack pathways and found that the service providers did not actually transfer any assets. A total of six vulnerabilities were confirmed in Coinbase, PayAI, and Mogami; some of these have been fixed, while the rest are still being addressed. The scope of application of these fixes in the actual X402 infrastructure has not yet been clarified.