GHSA-727h-3vm5-qwq6: Input Validation
Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit (≤ 2 M) and maxfeepergas (≤ 100 Gwei) but does not check calldata length.
Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gaslimit and maxfeepergas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet.
Vulnerable code path: FeePayerPolicy in fee-payer.ts (mppx 0.6.27) enforces maxGas = 2000000 and maxFeePerGas = 100 Gwei but has no calldata.length bound. The policy check passes because the inflated gas comes from intrinsic calldata cost, not the declared gaslimit.
Note: In the experiment, a 16 KB maxheaderlength is enforced, which caps the maximum effective padding at roughly 5,500 bytes. The default padding in this PoC (5,500 bytes) is within that limit.
PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: bash unzip mppxtypescriptPoC.zip cd mppxtypescript docker build -t mppx-padding . docker run --rm mppx-padding There are more details in mppxtypescript/README.md
Impact A malicious client can force the server to pay ~5x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.
Please provide a way to share the PoC in .zip format to you. Thank you!
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/mppxto a version that resolves this vulnerability.Fixed in 0.8.2
Event History
Frequently Asked Questions
Which deployments are exposed to fee-draining transactions?
Deployments using mppx 0.6.27 are exposed when their server acts as the fee payer and uses the FeePayerPolicy path in fee-payer.ts. The issue depends on the server cosigning and broadcasting transactions whose calldata can include trailing bytes.
What does an attacker need to do to trigger the excess fee cost?
The attacker needs to provide calldata that passes viem's decodeFunctionData validation while containing appended non-zero trailing bytes, such as 0x01 padding. The declared gas_limit and max_fee_per_gas can remain within the policy caps because the extra cost comes from intrinsic calldata gas.
Is the potential drain bounded in the described test setup?
In the described experiment, a 16 KB max_header_length limits effective padding to roughly 5,500 bytes. At 16 gas per non-zero byte, padding increases actual gas use by 16 gas for each appended non-zero byte, although the stated header limit is specific to that experiment.