{"id":"CVE-2026-63628","aliases":["GHSA-vc9j-9wph-qghj"],"url":"https://o3.security/vulnerability/CVE-2026-63628","summary":"mppx: Gas Draining with access list","details":"### Details\nWhen the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.\n\nAccess list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.\n\nAn attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.\n\nAt the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's `eth_call` simulation budget (verified empirically at 180 entries).\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mppx_typescript_PoC.zip\ncd mppx_typescript\ndocker build -t mppx-typescript-access-list .\ndocker run --rm mppx-typescript-access-list\n``` \nThere are more details in `mppx_typescript/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**9.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.","published":"2026-09-22T19:09:38.414Z","modified":"2026-10-21T02:58:56.461309585Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"mppx","fixedVersion":"0.8.2"}],"fix":{"url":"https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25","label":"wevm/mppx@24ddcca"},"references":[{"type":"WEB","url":"https://github.com/wevm/mppx/releases/tag/mppx@0.8.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63628.json"},{"type":"ADVISORY","url":"https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63628"},{"type":"FIX","url":"https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25"},{"type":"FIX","url":"https://github.com/wevm/mppx/pull/602"},{"type":"PACKAGE","url":"https://github.com/wevm/mppx"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:56.461309585Z"}}