🔁

Replay / double-spend

Resend one legit payment verbatim to charge it twice.

Blocked before settlement409 · Replay

How the attack works

An attacker intercepts (or a retry bug re-sends) the same authorized payment with identical params, trying to settle it twice.

Why an agent can't stop it alone

Networks retransmit and agents retry; if the gateway has no memory of “this exact payment,” one authorization can settle multiple times and double-charge.

Which gate stops it

→ Replay & double-spend prevention (see all gates)

The replay / double-spend gate requires a one-time nonce per payment and remembers used ones; a repeated nonce is rejected. Resend the same payment verbatim and the second attempt is blocked.

Try it yourself

In the integrate page, send the same payment twice with the same nonce — the second is blocked with 409.

Reproduce in the Playground →Integrate your own agent