CVE-2026-63627: mppx: Gas Draining with padding
Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit (≤ 2 M) and maxfeepergas (≤ 100 Gwei) but does not check calldata length.
Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gaslimit and maxfeepergas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet.
Vulnerable code path: FeePayerPolicy in fee-payer.ts (mppx 0.6.27) enforces maxGas = 2000000 and maxFeePerGas = 100 Gwei but has no calldata.length bound. The policy check passes because the inflated gas comes from intrinsic calldata cost, not the declared gaslimit.
Note: In the experiment, a 16 KB maxheaderlength is enforced, which caps the maximum effective padding at roughly 5,500 bytes. The default padding in this PoC (5,500 bytes) is within that limit.
PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: bash unzip mppxtypescriptPoC.zip cd mppxtypescript docker build -t mppx-padding . docker run --rm mppx-padding There are more details in mppxtypescript/README.md
Impact A malicious client can force the server to pay ~5x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.
Please provide a way to share the PoC in .zip format to you. Thank you!
Other sources
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gaslimit and maxfeepergas remained within policy caps, causing the server feepayer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/mppxto a version that resolves this vulnerability.Fixed in 0.8.2 - Upgrade
Upgrade
mppxto a version that resolves this vulnerability.Fixed in 0.8.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using mppx versions before 0.8.2 are affected when they use FeePayerPolicy to validate fee-sponsored calldata. The issue causes costs to be borne by the server fee_payer wallet.
What does an attacker need to do to trigger the excess fee payment?
The attacker needs to submit fee-sponsored calldata that passes FeePayerPolicy validation while containing appended nonzero trailing padding. The padding increases intrinsic calldata gas without causing the decoded transaction to exceed the policy's gas_limit or max_fee_per_gas caps.
How large can the demonstrated impact be?
With the tested 16 KB header limit, the demonstrated padding was bounded to about 5,500 bytes. This produced transaction fees of approximately five times the normal amount.
What should be done to remediate the issue?
Upgrade mppx to version 0.8.2, which fixes the trailing-byte validation issue in FeePayerPolicy.