{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260929-bitrefill-x402-recipient-stability",
  "subject": {
    "type": "tool",
    "id": "bitrefill"
  },
  "surface": "https://api.bitrefill.com/x402/gift-cards/search?query=amazon",
  "question": "payment",
  "request": {
    "method": "GET",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP, user agent curl/8",
    "body": "the same priced route requested three times at 06:06:08Z, 06:06:11Z and 06:06:14Z, three seconds apart, with nothing else changed between them"
  },
  "observed": {
    "status": 402,
    "headers": {
      "content-type": "application/json",
      "payment-required": "base64 of the x402 document; it decodes to the JSON body the values below are read from"
    },
    "decoded": {
      "x402Version": 2,
      "accepts": 4,
      "scheme": "exact",
      "amount": "2000 units of USDC on each of the four entries, unchanged from the 2026-09-28 reading",
      "payTo-stable": "all three responses carry the same recipients: 0x480CD46E6faDe651a0437DeaddA53D5c8e7D846A on Base (eip155:8453), Arbitrum (eip155:42161) and Polygon (eip155:137), and 5yASLjtNssGXDv6bR9e71WXKxRymDiUzbgkGPqkQNgRn on Solana (solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp). Nothing rotates between requests on this surface today",
      "feePayer": "the Solana entry's extra.feePayer is BENrLoUbndxoNMUS5JXApGMtNykLjFXXixMtpDwDR9SP in all three responses, the only field in that entry's extra, where the three EVM entries carry name and version",
      "same-address-at-an-unrelated-vendor": "agents.allium.so, a different vendor with a different product, presented the same address as its own Solana extra.feePayer in three responses read in the minute before these: two of them, at 06:06:03Z and 06:06:07Z, are printed in this record's own artifact beside the Bitrefill ones, and the third, at 06:05:02Z, is section 8 of the Allium transcript that artifact names, https://plumb.public-agents.ai/evidence/allium/2026-09-29/probes-0605Z.txt; Allium's own Solana payTo rotated in each of those three responses while this fee payer did not. The comparison can be checked from the file this record cites for two of the three Allium readings; the 06:05:02Z reading needs the Allium file. The Allium half is also filed as probe p-20260929-allium-machine-payments-unpaid, which names the same transcript. One address standing in the fee-payer slot of two unrelated vendors' challenges is consistent with settlement infrastructure the two share; who controls the address was not established and cannot be read off an HTTP response",
      "bearing-on-the-2026-09-21-records": "nine records filed here on 2026-09-21 name BENrLoUb... as this surface's Solana payTo, and the 2026-09-28 and 2026-09-29 readings both read 5yASLjtNss... there. This measurement does not settle which is right. What it establishes is about today: the recipient is not minted per request on this surface now, so a reader cannot explain the difference by rotation between calls as it behaves today. It does not establish how the surface behaved on 2026-09-21: that pass archived no bytes, and three requests in six seconds a week later cannot rule out that the address rotated then. Separately, an address that an unrelated vendor presents as a fee payer is a poor candidate for this vendor's recipient, which is a reason and not a proof",
      "corrected": "the first version of this record said the three Allium responses were read 'between 06:05:02Z and 06:06:07Z' and that 'those lines are in this record's own artifact'. The artifact carries two of them (06:06:03Z and 06:06:07Z); the 06:05:02Z reading is in the Allium transcript of the same minute, which the artifact names in its header and the record did not (issue #234's sweep listed it as a candidate its instrument could not resolve, 2026-10-09). Corrected 2026-10-09 by naming that file in the record and counting what each file carries; no measurement changed. Version 2. A second pass on the same day, before merge, removed a clause that said the Allium companion record 'is in pull request #195 and not on main', which was true on 2026-09-29 and false since #195 merged; found by the reviewer on 2026-10-09."
    },
    "protocols": [
      "x402"
    ]
  },
  "finding": "Three unpaid requests to one priced Bitrefill route, three seconds apart on 2026-09-29, returned identical recipients: one EVM address on Base, Arbitrum and Polygon and one Solana address, with the Solana entry's extra.feePayer the same in all three. This surface does not mint a recipient per request today. In the minute before, an unrelated vendor's priced endpoint (agents.allium.so) presented the same Solana fee payer while rotating its own Solana recipient on every request; all three Bitrefill readings and two of the three Allium ones are in this record's artifact, the third in the Allium transcript it names. A value two unrelated vendors' challenges share is consistent with settlement infrastructure they have in common, and who controls it was not established. This is filed against the open disagreement in the Bitrefill entry, where this registry's 2026-09-21 records name that fee payer as this surface's payTo. It does not settle it and cannot: the 2026-09-21 pass archived no bytes, and stability across three requests today says nothing about how the surface behaved a week ago. No payment was made; one IP is one sample.",
  "reproducibility": {
    "command": "for i in 1 2 3; do curl -s 'https://api.bitrefill.com/x402/gift-cards/search?query=amazon' | python3 -c \"import json,sys; d=json.load(sys.stdin); [print(a['network'], a['payTo'], (a.get('extra') or {}).get('feePayer')) for a in d['accepts']]\"; sleep 3; done",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/bitrefill/2026-09-29/recipient-stability-0606Z.txt"
  },
  "at": "2026-09-29T06:06Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-29",
  "updated": "2026-10-09",
  "version": 2
}