mpp vulnerable to Gas Draining with access list

Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...

GHSA-QPXH-FF8M-C62V mpp vulnerable to Gas Draining with access list

Details When the server acts as the feepayer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosignfeepayer, the server re-signs the raw basefields index 5 of the 0x76 AASigned envelope without inspecting the access list field...

mppx: Gas Draining with access list

Details When the server acts as the feepayer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any accesslist the client includes in the 0x78 FeePayerEnvelope without inspecting its...

CVE-2026-63628

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...

CVE-2026-63628 mppx: Gas Draining with access list

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...