The vulnerability arises because the MPP.Methods.Tempo payment method co-signs and broadcasts client-supplied EVM transactions without validating that the gas_limit is sufficient for successful execution. Attackers can submit signed transferWithMemo transactions with gas_limit set just below the required amount, causing the transaction to revert during execution but still consuming gas fees from the fee-payer wallet. Additionally, the optimistic path (wait_for_confirmation = false) uses eth_call simulation that omits the gas parameter, failing to detect out-of-gas conditions. This flaw allows unauthenticated remote clients to drain the fee-payer wallet at near-zero cost, resulting in denial of service for legitimate users. The issue affects mpp versions from 0.2.0 before 0.6.0.

An attacker can cause the fee-payer wallet to be drained by repeatedly submitting transactions with insufficient gas limits that revert but still consume gas fees. This results in denial of service for legitimate clients who rely on the fee-payer wallet to sponsor gas fees for their transactions. The attacker incurs minimal cost while depleting the wallet, potentially disrupting normal service operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid configuring the mpp Elixir library as fee payer or implement additional validation of gas_limit before broadcasting transactions. Monitoring transaction gas usage and limiting fee-payer wallet exposure may help reduce risk.