x402 Signs the Money, Not the URL. I Checked 18 Fields.
An engineer discovered that the x402 payment protocol's payer signature does not cover the URL, allowing the resource field to be mutated without invalidating the signature. Testing 18 field mutations…