---
title: "The recipient changed under a door that otherwise stayed the same — x402 defect class payto-moved"
description: "The recipient changed under a door that otherwise stayed the same (payto-moved), an x402 defect class: The payTo a door presents for a given network is the one it presented the last time it was observed, or the change was announced where the door's buyers read before the door presented it. Detectable by an unpaid probe. A buyer whose client trusts the door on its history pays a wallet that history never covered. Every structural check still passes — the challenge is well-formed, the amount atomic, the address payable — so a one-off preflight reads the door as ready at the exact moment it is most worth not paying. Visible only to something that looked twice."
canonical: "https://scvd.store/defects/payto-moved"
url: "https://scvd.store/defects/payto-moved"
term_code: "payto-moved"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# The recipient changed under a door that otherwise stayed the same

`payto-moved` — an x402 defect class.

**Asserts:** The payTo a door presents for a given network is the one it presented the last time it was observed, or the change was announced where the door's buyers read before the door presented it.

**Costs:** A buyer whose client trusts the door on its history pays a wallet that history never covered. Every structural check still passes — the challenge is well-formed, the amount atomic, the address payable — so a one-off preflight reads the door as ready at the exact moment it is most worth not paying. Visible only to something that looked twice.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** Two signed rows from the same watch, bracketing the claimed change, whose challenge_bytes decode to the same (network, payTo) set; or a dated notice of the rotation, published where the door's buyers read, that predates the first row showing it.

**How an operator clears it:** Rotate deliberately: publish the new payTo and its date where your buyers read — your llms.txt, your directory listings, a signed offer under a key they already hold — BEFORE the door presents it, and keep the old address listed as retired. A silent move is indistinguishable from a hijack to anyone watching, because from outside it is the same observation.

**What a buyer does:** Before paying a door you have paid before, compare the payTo against the one you last saw for that network; if it moved and no dated notice explains it where the door's buyers read, treat the door as unverified today, whatever the preflight says about its shape.

**Our signal:** `standing_watch summary: payto_changes, derived at read time from the signed rows' challenge_bytes`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.