EUVD-2026-84806
GHSA-vc9j-9wph-qghj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated client of the sponsorship service (AV:N/AC:L/PR:N/UI:N); no confidentiality or integrity impact, only a bounded financial fee drain modeled as A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 3 npm packages depend on mppx (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 0.8.2.
DescriptionCVE.org
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
AnalysisAI
Improper validation of client-supplied transaction fields in the mppx fee-payer sponsorship path (src/tempo/internal/fee-payer.ts) allows an unauthenticated client to inflate the gas fees paid by a server's fee_payer wallet before version 0.8.2. Any deployment operating a hosted fee-payer/cosigning endpoint that accepts 0x78 FeePayerEnvelope submissions is affected; the attacker simply appends fabricated address-only EIP-2930 access-list entries whose intrinsic gas cost is charged to the sponsor, with a demonstrated 180-entry list raising the fee roughly 9.4x while remaining under the 500,000-gas policy cap, the 16 KB header limit, and the RPC simulation budget. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a server operating an mppx (<0.8.2) hosted fee-payer / sponsorship service that cosigns and pays gas for client-supplied transactions via the fillHostedFeePayerTransaction / prepareSponsoredTransaction path in src/tempo/internal/fee-payer.ts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate real-world risk that is correctly rated LOW-MEDIUM by the CVSS 4.0 base score of 6.9, though even that arguably overstates it because the only impact metric set is VA:L (VC:N/VI:N/VA:L) - there is no confidentiality or integrity impact, only a bounded financial/availability drain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to mppx 0.8.2 (https://github.com/wevm/mppx/releases/tag/mppx@0.8.2), which rejects client-supplied access lists, non-canonical/padded calldata, missing calls, and non-zero call values before any hosted fee-payer fill is requested, as implemented in https://github.com/wevm/mppx/pull/602 and https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25 under advisory GHSA-vc9j-9wph-qghj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today