mppx: Gas Draining with access list

Details When the server acts as the feepayer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any accesslist the client includes in the 0x78 FeePayerEnvelope without inspecting its...

CVE-2026-63628

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...