GHSA-727H-3VM5-QWQ6
Vulnerability from github – Published: 2026-09-22 20:34 – Updated: 2026-09-22 20:34Details
When the server acts as the fee_payer, mppx 0.6.27 validates calldata using viem's decodeFunctionData, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length.
Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet.
Vulnerable code path: FeePayerPolicy in fee-payer.ts (mppx 0.6.27) enforces maxGas = 2_000_000 and maxFeePerGas = 100 Gwei but has no calldata.length bound. The policy check passes because the inflated gas comes from intrinsic calldata cost, not the declared gas_limit.
Note: In the experiment, a 16 KB max_header_length is enforced, which caps the maximum effective padding at roughly 5,500 bytes. The default padding in this PoC (5,500 bytes) is within that limit.
PoC
The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:
unzip mppx_typescript_PoC.zip
cd mppx_typescript
docker build -t mppx-padding .
docker run --rm mppx-padding
There are more details in mppx_typescript/README.md
Impact
A malicious client can force the server to pay ~5x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.
Please provide a way to share the PoC in .zip format to you. Thank you!
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 0.8.1"
},
"package": {
"ecosystem": "npm",
"name": "mppx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63627"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-22T20:34:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Details\nWhen the server acts as the fee_payer, `mppx` 0.6.27 validates calldata using viem\u0027s `decodeFunctionData`, which is lenient about trailing bytes. The `FeePayerPolicy` caps `gas_limit` (\u2264 2 M) and `max_fee_per_gas` (\u2264 100 Gwei) but does **not** check calldata length.\n\nTempo uses legacy calldata gas pricing: **16 gas per non-zero byte**. Appending `N` bytes of `0x01` padding inflates actual gas used by `N \u00d7 16` while keeping `gas_limit` and `max_fee_per_gas` within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet.\n\n**Vulnerable code path:** `FeePayerPolicy` in `fee-payer.ts` (mppx 0.6.27) enforces `maxGas = 2_000_000` and `maxFeePerGas = 100 Gwei` but has no `calldata.length` bound. The policy check passes because the inflated gas comes from intrinsic calldata cost, not the declared `gas_limit`.\n\n**Note:** In the experiment, a 16 KB `max_header_length` is enforced, which caps the maximum effective padding at roughly 5,500 bytes. The default padding in this PoC (5,500 bytes) is within that limit.\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mppx_typescript_PoC.zip\ncd mppx_typescript\ndocker build -t mppx-padding .\ndocker run --rm mppx-padding\n``` \nThere are more details in `mppx_typescript/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**5x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.\n\nPlease provide a way to share the PoC in .zip format to you. Thank you!",
"id": "GHSA-727h-3vm5-qwq6",
"modified": "2026-09-22T20:34:17Z",
"published": "2026-09-22T20:34:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wevm/mppx/security/advisories/GHSA-727h-3vm5-qwq6"
},
{
"type": "WEB",
"url": "https://github.com/wevm/mppx/pull/602"
},
{
"type": "WEB",
"url": "https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25"
},
{
"type": "PACKAGE",
"url": "https://github.com/wevm/mppx"
},
{
"type": "WEB",
"url": "https://github.com/wevm/mppx/releases/tag/mppx@0.8.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "mppx: Gas Draining with padding"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.