Executive brief
mppx is a software library used to handle automated machine-to-machine payments. A flaw in how the system closes payment sessions allows an attacker to shut down a payment channel without providing the required funds. This can lead to financial discrepancies or 'griefing' attacks where legitimate payment channels are closed prematurely at no cost to the attacker.
Technical details
A logic error exists in the tempo/session cooperative close handler within the mppx library. The handler validated close voucher amounts using a strict 'less than' (<) comparison instead of 'less than or equal to' (<=) against the on-chain settled amount. This off-by-one logic flaw allows a remote attacker to submit a close voucher exactly equal to the settled amount. The system accepts this voucher as valid without requiring the commitment of new funds, enabling the attacker to close or 'grief' the payment channel for free. The issue is categorized as a form of authentication bypass via replay/logic manipulation (CWE-294) and has been patched in version 0.4.11.
Affected products
- wevm mppx < 0.4.11
Timeline
- 2026-03-26: patched: Version 0.4.11 released
- 2026-03-31: disclosed: CVE-2026-34209 published