{"id":"CVE-2026-63628","aliases":["CLSA-2026-1794314899","EUVD-2026-84806","GHSA-vc9j-9wph-qghj"],"status":"published","title":"mppx: Gas Draining with access list","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00487,"percentile":0.42445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-22T19:09:38Z","modified":"2026-11-10T19:46:06Z","fixes":[{"ecosystem":"npm","package":"mppx","fixed_in":["0.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mppx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"mppx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.31-tuxcare.0"},{"fixed":"0.6.31-tuxcare.1"}]}],"versions":["0.6.31"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"mppx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.2"}]}]}],"products":[{"vendor":"wevm","product":"mppx"}],"references":[{"url":"https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/wevm/mppx/pull/602","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/wevm/mppx/releases/tag/mppx@0.8.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-vc9j-9wph-qghj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63628.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63628","tags":["advisory"]},{"url":"https://github.com/wevm/mppx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63628","title":"mppx: Gas Draining with access list","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.","status":"published","published":"2026-09-22T19:09:38.414Z","modified":"2026-09-24T14:17:12.364Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-84806","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.","status":"published","published":"2026-09-22T19:09:38Z","modified":"2026-09-24T14:17:12Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:58.186745Z"}],"ghsa":[{"id":"GHSA-vc9j-9wph-qghj","title":"mppx: Gas Draining with access list","description":"### Details\nWhen the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.\n\nAccess list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.\n\nAn attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.\n\nAt the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's `eth_call` simulation budget (verified empirically at 180 entries).\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mppx_typescript_PoC.zip\ncd mppx_typescript\ndocker build -t mppx-typescript-access-list .\ndocker run --rm mppx-typescript-access-list\n``` \nThere are more details in `mppx_typescript/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**9.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.","status":"published","published":"2026-09-22T20:34:19Z","modified":"2026-09-22T20:34:21Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-63628","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.","status":"published","published":"2026-09-22T20:17:04.913Z","modified":"2026-09-24T15:17:26.803Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-63628","title":"mppx: Gas Draining with access list","description":"mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.","status":"published","published":"2026-09-22T19:09:38.414Z","modified":"2026-10-28T02:30:36.872295265Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"CLSA-2026-1794314899","title":"TuxCare security update for mppx (2 CVEs)","description":"TuxCare rebuilt mppx to address 2 CVEs. Fixed in 0.6.31-tuxcare.1.","status":"published","published":"2026-11-10T13:48:19Z","modified":"2026-11-10T19:46:06.6725539Z","updated_at":"2026-11-10T20:12:16.608797Z"},{"id":"GHSA-vc9j-9wph-qghj","title":"mppx: Gas Draining with access list","description":"### Details\nWhen the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.\n\nAccess list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.\n\nAn attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.\n\nAt the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's `eth_call` simulation budget (verified empirically at 180 entries).\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mppx_typescript_PoC.zip\ncd mppx_typescript\ndocker build -t mppx-typescript-access-list .\ndocker run --rm mppx-typescript-access-list\n``` \nThere are more details in `mppx_typescript/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**9.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.","status":"published","published":"2026-09-22T20:34:19Z","modified":"2026-09-22T21:00:10.495528816Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}