Executive brief
mppx is a library used to handle fee-payer transactions in blockchain applications. When the server acts as the fee payer, a malicious client can append unnecessary padding bytes to transaction calldata, inflating actual gas costs to roughly 5x normal rates while bypassing the library's fee caps. This forces the server's fee-payer wallet to cover inflated transaction fees, dramatically increasing operational costs and eliminating profitability on low-cost transactions.
Technical details
The vulnerability is a gas-draining attack exploiting incomplete validation in mppx's FeePayerPolicy. While the policy enforces caps on gas_limit (≤2M) and max_fee_per_gas (≤100 Gwei), it does not validate calldata length. An attacker appends non-zero padding bytes to transaction calldata, which cost 16 gas each under Tempo's legacy pricing model, inflating actual gas consumption without exceeding the declared gas_limit or fee caps. The attack requires the server to act as fee payer and co-sign the transaction; a proof-of-concept demonstrates achieving ~5x fee inflation within a 16 KB max_header_length constraint. The root cause is that intrinsic calldata gas cost is not accounted for in the FeePayerPolicy validation logic.
Affected products
- mppx mppx 0.6.27
Timeline
- 2026-09-22: disclosed: GHSA advisory published