Executive brief
mppx is a TypeScript library that manages fee-payer transaction signing for blockchain transactions. An attacker can craft transactions with a bloated EIP-2930 access list that causes the fee-payer to pay 9.4× the normal transaction fee through intrinsic gas charges, with no corresponding on-chain work performed. This significantly increases operational costs and destroys profit margins on low-cost transactions.
Technical details
The vulnerability exists in mppx 0.6.27's fee-payer cosigning path, which accepts and copies the client-supplied EIP-2930 access list verbatim into the transaction without validating its length or contents. Access list gas is charged intrinsically before any opcode execution, regardless of whether the listed addresses are used. An attacker can submit a valid `transferWithMemo` call with a fabricated access list containing up to 180 dummy address-only entries, inflating the intrinsic gas cost from ~51,287 to ~483,287 gas (9.4× increase) while remaining within the 500K gas cap enforced by `FeePayerPolicy`. The server validates calldata and gas parameters but never inspects the access list, resulting in the cosigner broadcasting the inflated transaction.
Affected products
- mppx mppx 0.6.27
Timeline
- 2026-09-22: disclosed