7 matches found
mppx: Gas Draining with padding
Details When the server acts as the feepayer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit ≤ 2 M and maxfeepergas ≤ 100 Gwei but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 ga...
CVE-2026-63628
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...
CVE-2026-63627
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...
EUVD-2026-84806
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...
CVE-2026-63628
The mppx TypeScript interface for the machine payments protocol is vulnerable to a gas draining attack in versions prior to 0.8.2 . The flaw exists in the fee-payer cosigning path located in src/tempo/internal/fee-payer.ts, where the software copies a client-supplied access_list from a 0x78 FeePa...
CVE-2026-63628 mppx: Gas Draining with access list
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied accesslist from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume...
CVE-2026-63627 mppx: Gas Draining with padding
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...