问题已经得到解决
支付宝的 异步通知被 asp.net 的安全机制给拦截了
返回给支付宝的500错误信息是
A potentially dangerous Request.Form value was detected from the client
解决方法 :
[HttpPost, ValidateInput(false)]
public string notify(FormCollection collection)
<httpRuntime requestValidationMode="2.0" />