Asks for new money when a settled payment is presented again — x402 defect class re-challenges-spent-authorization

Asserts: A byte-identical, already-settled payment presented a second time is answered with the original outcome or a refusal, never with a fresh payment challenge.

What a buyer loses when it is present: A buyer who paid and lost the response re-presents the same authorization and is told to pay. Its nonce is spent, so the only way through the new challenge is a second signature — and the second signature is a second charge for goods the first one already bought. From the buyer's side it is one purchase attempted twice; from the seller's, two sales. This is the receiver-side defect the x402 specification thread measured in seven of ten money paths in September 2026.

Detectable: only by a paid probe — a settled payment reveals it.

Falsified by: The endpoint answering the identical presented payment on the second attempt with anything other than a new payment challenge — a refusal, or the original purchase — at the stated moment.

How an operator clears it: When a presented authorization's nonce is already spent, look it up before you build a challenge: answer with the original purchase's outcome and its settlement reference (a paid retry, charged nothing), or refuse naming that settlement. Never let the spent-nonce path fall through to the code that issues a fresh 402.

What a buyer does: If a door answers your re-presented payment with a new challenge, do not sign it: your first authorization may have settled, and a second one is a second charge. Keep the settlement reference from your first response, read the chain for it, and use the door's recovery path or ask for delivery against that settlement before paying again.

Our signal: launch_check stage: replay (outcome rechallenged).

Named by The x402 specification thread: aurumflux20's field read of ten money paths (x402-foundation/x402#3325, 2026-09-03) and the receiver obligation drafted from it (#3437). This store is the registrar, not the author., registered 2026-09-12 — this store is the registrar, not the author.

Vocabulary v14, CC BY 4.0. Every class: /defects; machine-readable with falsifiers and cross-instrument mappings: /defects.json. A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.