https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:55:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63628 <p>mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.</p> <p>mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63628 https://db.gcve.eu/vuln/ghsa-vc9j-9wph-qghj <p><strong>Affected:</strong> npm: mppx</p> <p>### Details When the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK&#39;s fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.</p> <p>Access list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.</p> <p>An attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.</p> <p>At the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC&#39;s `eth_call` simulation budget (verified empirically at 180 entries).</p> <p>### PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: ```bash unzip mppx_typescript_PoC.zip cd mppx_typescript docker build -t mppx-typescript-access-list . docker run --rm mppx-typescript-access-list ``` There are more details in `m…</p> <p><strong>Affected:</strong> npm: mppx</p> <p>### Details When the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK&#39;s fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.</p> <p>Access list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.</p> <p>An attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.</p> <p>At the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC&#39;s `eth_call` simulation budget (verified empirically at 180 entries).</p> <p>### PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: ```bash unzip mppx_typescript_PoC.zip cd mppx_typescript docker build -t mppx-typescript-access-list . docker run --rm mppx-typescript-access-list ``` There are more details in `m…</p> https://db.gcve.eu/vuln/ghsa-vc9j-9wph-qghj