Mppx
Monthly
Improper validation of client-supplied transaction fields in the mppx fee-payer sponsorship path (src/tempo/internal/fee-payer.ts) allows an unauthenticated client to inflate the gas fees paid by a server's fee_payer wallet before version 0.8.2. Any deployment operating a hosted fee-payer/cosigning endpoint that accepts 0x78 FeePayerEnvelope submissions is affected; the attacker simply appends fabricated address-only EIP-2930 access-list entries whose intrinsic gas cost is charged to the sponsor, with a demonstrated 180-entry list raising the fee roughly 9.4x while remaining under the 500,000-gas policy cap, the 16 KB header limit, and the RPC simulation budget. Impact is limited to a bounded financial/availability drain on the sponsor wallet (no confidentiality, integrity, or code-execution impact), no public exploit code has been identified at time of analysis, and the issue is fixed in mppx 0.8.2.
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. Exploitation is unauthenticated and requires no user interaction, but impact is inherently bounded economic griefing: the demonstrated overpayment was limited to about 5x by the 16KB header ceiling (~5,500 padding bytes), and only operators who actually offer fee sponsorship are exposed. No public exploit code was identified at time of analysis and the issue is fixed in 0.8.2.
Improper validation of client-supplied transaction fields in the mppx fee-payer sponsorship path (src/tempo/internal/fee-payer.ts) allows an unauthenticated client to inflate the gas fees paid by a server's fee_payer wallet before version 0.8.2. Any deployment operating a hosted fee-payer/cosigning endpoint that accepts 0x78 FeePayerEnvelope submissions is affected; the attacker simply appends fabricated address-only EIP-2930 access-list entries whose intrinsic gas cost is charged to the sponsor, with a demonstrated 180-entry list raising the fee roughly 9.4x while remaining under the 500,000-gas policy cap, the 16 KB header limit, and the RPC simulation budget. Impact is limited to a bounded financial/availability drain on the sponsor wallet (no confidentiality, integrity, or code-execution impact), no public exploit code has been identified at time of analysis, and the issue is fixed in mppx 0.8.2.
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. Exploitation is unauthenticated and requires no user interaction, but impact is inherently bounded economic griefing: the demonstrated overpayment was limited to about 5x by the 16KB header ceiling (~5,500 padding bytes), and only operators who actually offer fee sponsorship are exposed. No public exploit code was identified at time of analysis and the issue is fixed in 0.8.2.