Author(s)
zynorr (GitHub: zynorr)
Point of contact: zynorlawes@gmail.com
Experiences and qualifications
Independent developer building payment-protocol tooling.
My most relevant public work is x402-Sentinel , a black-box conformance harness for x402 exact payments on Hedera. It includes 69 versioned checks, 54 adversarial fixtures with provenance, pinned specification revisions, JUnit/SARIF reporting, CI integration
This project provides a proven foundation for building specification-driven payment tests, adversarial fixtures, and reproducible regression reports.
This proposal is scoped as an independent black-box tool requiring no core repository changes or privileged infrastructure access.
Grant Description
This grant builds an independent production conformance and regression suite for x402.cow. fi CoW Protocol’s pay-per-quote API for bots and AI agents.
The service launched on October , with advertised payment options including USDC on Base, Ethereum, and BNB Chain, and COW on Base. The published price is $0.001 per quote. API documentation: x402.cow. fi
The underlying x402 batch-settlement scheme uses on-chain payment channels and cumulative off-chain vouchers. Incorrect deployment terms, inconsistent accounting responses, or broken recovery behavior can cause clients to misinterpret payment requirements, charges, or channel state.
CoW’s public documentation work, including PR #666, already covers SDK integration examples and local payment-policy validation. This proposal does not claim that no x402 testing exists. It targets independent verification of the deployed service, including actual paid-request behavior, accounting reconciliation, cross-option checks, and configuration drift.
The project will deliver:
-
Offline conformance engine: Validate payment challenges, advertised terms, receipts, accounting invariants, error handling, and documented recovery behavior against pinned x402 v2 and
batch-settlementspecification revisions. -
Fixture corpus: At least 40 fixtures with provenance, expected classifications, and documented rationales, covering valid, invalid, violating, and recoverable cases.
-
Live production verifier: Capture and validate payment requirements, compare observed terms against a reviewed baseline, execute a budget-capped Base USDC quote, and reconcile the response against applicable accounting and channel-state invariants.
-
Multi-option testing and CI: Extend live verification to at least three of the four advertised payment options. Add JSON, JUnit, and SARIF reports and publish scheduled deployment-verification reports.
-
Reproducible findings: Every confirmed violation will include the expected behavior, observed behavior, and a reproducible test case.
The implementation will use Node.js/TypeScript, @x402/evm pinned to version 2.26.0, viem, and GitHub Actions. The repository will be public under the Apache-2.0 license.
Live testing will use a dedicated test wallet, an explicit network/token allowlist, and a total direct test-spend cap of $25 across the project. No load testing, protocol modifications, or unauthorized probing are included.
Type of Grant
Milestone-based.
Milestones
| Milestone | Title | Due date | Funding request |
|---|---|---|---|
| 1 | Offline conformance engine and fixture corpus | 2 weeks after Snapshot approval | $2,000 |
| 2 | Live production verifier for Base USDC | 4 weeks after Snapshot approval | $3,000 |
| 3 | Multi-option testing, scheduled CI, and drift reports | 6 weeks after Snapshot approval | $3,000 |
| Total | $8,000 |
Specifics: Milestone 1
Build the public repository and pin the applicable x402 v2 and batch-settlement specification revisions.
Implement at least 30 executable checks across five families: payment challenge validation, terms consistency, receipt and cumulative-payment accounting, error and recovery behavior, and route/path semantics.
Create at least 40 fixtures with provenance, expected classifications, and documented rationales. Add JSON, JUnit, and SARIF reporting, a documented test command, and CI on every push.
Deliverable: Public repository, fixture corpus, specification-to-test mapping, and passing offline suite.
Acceptance criteria: At least 30 executable checks and 40 classified fixtures; reproducible local execution; successful CI.
Specifics: Milestone 2
Build a budget-capped live verifier against x402.cow.fi, starting with Base USDC.
Capture and validate the live payment challenge, including network, asset, receiver, price, and applicable channel terms. Compare these against a reviewed baseline.
Complete at least one paid end-to-end quote request and validate the response against applicable authorized-amount, actual-charge, cumulative-voucher, and channel-state invariants.
Exercise documented non-payment error and recovery paths. Publish a runbook for reconciling and withdrawing any remaining channel balance.
The total direct test-spend cap is $25 across all milestones, including paid requests, test deposits, and transaction costs.
Deliverable: Working Base USDC production verifier, first public report, and documented findings or verified results for the tested paths.
Acceptance criteria: A live challenge is captured and validated; one paid quote completes; accounting checks run against the returned data; spending controls are enforced; and the recovery procedure is documented.
Specifics: Milestone 3
Extend end-to-end production verification to at least three of the four advertised payment options, including Base USDC.
Add applicable authorization and recovery checks, finalize versioned deployment-term comparisons, and publish machine-readable drift reports.
Configure scheduled GitHub Actions runs and publish at least two consecutive weekly deployment-verification reports. Document test limitations, triaged findings, and reproduction steps.
Differences from a baseline will only be classified as confirmed violations when they contradict an authoritative requirement or reviewed expectation.
Deliverable: Multi-option production verifier, scheduled CI, public drift reports, and documented results.
Acceptance criteria: At least three payment options have been tested end to end; two consecutive weekly reports are published; and confirmed violations include reproducible test cases. If an advertised option becomes unavailable or cannot be safely tested, any substitute must be agreed with the reviewer and documented.
Length
Six weeks from successful Snapshot approval.
Each milestone requires reviewer acceptance before payment. Neither milestone completion nor payment depends on changes being merged into CoW Protocol’s core repositories.
Funding Request
$8,000 USD-equivalent, fixed and milestone-based.
-
Milestone 1: $2,000
-
Milestone 2: $3,000
-
Milestone 3: $3,000
Payment is requested in USDC or another stablecoin as directed by the Grants Committee, to the Ethereum Mainnet address below. No COW tokens are requested.
The $25 live-testing budget is included in the total and is not an additional expense.
Ethereum Mainnet Address
0x9D56b3867e080910FBE502791C4767fBf377EaD8
Terms and Conditions
By submitting this grant application, I acknowledge and agree to be bound by the CoW DAO Participation Agreement and the CoW DAO Grant Agreement Terms.
Please notify the Grantee of their reviewer and steward in the thread and, at the latest, upon successful approval of the Grant on Snapshot.