CVE-2026-63628
MediumCVSS 6.9Summary
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when unused, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list stayed within gas and size limits while increasing fees ~9.4x. Fixed in 0.8.2.
Risk Assessment
An attacker can cause the server to incur significantly higher transaction costs, potentially leading to financial losses and fund depletion.
Recommendation
Upgrade mppx to version 0.8.2 or later.
Other vulnerabilities in mppx
See all- CVE-2026-63627Medium
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding increasing intrinsic calldata gas while gas_limit and max_fee_per_gas stayed within policy caps, causing the server fee_payer wallet to pay substantially more than required. The tested 16 KB header limit bounded padding to ~5,500 bytes, producing ~5x normal fees. Fixed in 0.8.2.
- CVE-2026-34210High
mppx before version 0.4.11 did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential with the same spt token against a new challenge, and the server would accept the replayed PaymentIntent as a new payment without actually charging the customer. This allowed paying once and consuming unlimited resources.
- CVE-2026-34209High
mppx prior to version 0.4.11 contains a vulnerability in the tempo/session cooperative close handler. The close voucher amount validation uses "<" instead of "<=" against the on-chain settled amount. An attacker can submit a close voucher exactly equal to the settled amount, which is accepted without committing new funds, effectively closing the channel for free.
Original NVD description (English source)
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.