CVE-2026-63628: mppx: Gas Draining with access list
Details When the server acts as the feepayer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any accesslist the client includes in the 0x78 FeePayerEnvelope without inspecting its length or contents.
Access list gas is charged intrinsically — before any opcode executes — regardless of whether the listed addresses are ever touched.
An attacker submits a valid transferWithMemo alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects accesslist length. It cosigns and broadcasts a transaction that costs the fee-payer wallet N × 2,400 extra gas per request with no corresponding work performed on-chain.
At the default of 180 entries and 100 Gwei maxfeepergas, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a 9.4× multiplier — while staying within the FeePayerPolicy cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's ethcall simulation budget (verified empirically at 180 entries).
PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: bash unzip mppxtypescriptPoC.zip cd mppxtypescript docker build -t mppx-typescript-access-list . docker run --rm mppx-typescript-access-list There are more details in mppxtypescript/README.md
Impact A malicious client can force the server to pay ~9.4x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.
Other sources
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server feepayer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/mppxto a version that resolves this vulnerability.Fixed in 0.8.2 - Upgrade
Upgrade
mppx TypeScript SDKto a version that resolves this vulnerability.Fixed in 0.8.2
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using mppx versions prior to 0.8.2 are affected when they use the fee-payer cosigning path for 0x78 FeePayerEnvelope transactions that accept a client-supplied access list.
What does an attacker need to do to increase the fee payer's costs?
An attacker needs to submit a FeePayerEnvelope with fabricated address-only access-list entries. The vulnerable cosigning path copies that list without validating its length or contents, causing the fee-payer wallet to cover the additional intrinsic gas.
How significant can the added cost be?
The demonstrated 180-entry access list stayed within the stated 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the transaction fee by about 9.4 times. Upgrade to mppx 0.8.2 to obtain the fix.