GHSA-vc9j-9wph-qghj

Details

When the server acts as the fee_payer, mppx 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any access_list the client includes in the 0x78 FeePayerEnvelope without inspecting its length or contents.

Access list gas is charged intrinsically — before any opcode executes — regardless of whether the listed addresses are ever touched.

An attacker submits a valid transferWithMemo alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects access_list length. It cosigns and broadcasts a transaction that costs the fee-payer wallet N × 2,400 extra gas per request with no corresponding work performed on-chain.

At the default of 180 entries and 100 Gwei max_fee_per_gas, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a 9.4× multiplier — while staying within the FeePayerPolicy cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's eth_call simulation budget (verified empirically at 180 entries).

PoC

The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:

unzip mppx_typescript_PoC.zip
cd mppx_typescript
docker build -t mppx-typescript-access-list .
docker run --rm mppx-typescript-access-list

There are more details in mppx_typescript/README.md

Impact

A malicious client can force the server to pay ~9.4x the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.