CVE-2026-63628: CWE-20: Improper Input Validation in wevm mppx
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
AI Analysis
Technical Summary
The vulnerability exists in the fee-payer cosigning path of mppx (a TypeScript interface for machine payments protocol) in versions before 0.8.2. Specifically, the code copied a client-supplied access_list from a FeePayerEnvelope without validating its length or contents. Since EIP-2930 access-list entries consume intrinsic gas even if the addresses are never used, an attacker can add fabricated entries to increase transaction fees paid by the server's fee_payer wallet. The demonstrated exploit used a 180-entry list that stayed within gas and header limits but increased fees by approximately 9.4 times. This flaw is addressed in version 0.8.2.
Potential Impact
An attacker can cause the server fee_payer wallet to pay significantly increased transaction fees by submitting a crafted access_list with fabricated address-only entries. This leads to unnecessary financial cost for the server. The vulnerability does not allow privilege escalation or code execution but results in a denial of economic service by inflating transaction costs.
Mitigation Recommendations
Upgrade to version 0.8.2 or later where the issue is fixed by validating the length and contents of the access_list. No other mitigation is required as the vulnerability is resolved in the official fix.
CVE-2026-63628: CWE-20: Improper Input Validation in wevm mppx
Description
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
CVSS v4.0
Score 6.9medium
Affected software
wevm
mppx
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the fee-payer cosigning path of mppx (a TypeScript interface for machine payments protocol) in versions before 0.8.2. Specifically, the code copied a client-supplied access_list from a FeePayerEnvelope without validating its length or contents. Since EIP-2930 access-list entries consume intrinsic gas even if the addresses are never used, an attacker can add fabricated entries to increase transaction fees paid by the server's fee_payer wallet. The demonstrated exploit used a 180-entry list that stayed within gas and header limits but increased fees by approximately 9.4 times. This flaw is addressed in version 0.8.2.
Potential Impact
An attacker can cause the server fee_payer wallet to pay significantly increased transaction fees by submitting a crafted access_list with fabricated address-only entries. This leads to unnecessary financial cost for the server. The vulnerability does not allow privilege escalation or code execution but results in a denial of economic service by inflating transaction costs.
Mitigation Recommendations
Upgrade to version 0.8.2 or later where the issue is fixed by validating the length and contents of the access_list. No other mitigation is required as the vulnerability is resolved in the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-17T14:11:15.482Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab2d808f7a7c54106a8a018
Added to database: 09/22/2026, 19:33:28 UTC
Last enriched: 09/22/2026, 19:48:42 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.