In mpp Elixir versions >=0.2.0 and <0.6.0, when the server acts as the fee payer, it copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The server re-signs the transaction without inspecting the access list field, which is part of the signed payload. Since access list gas is charged intrinsically before opcode execution regardless of usage, an attacker can submit a valid transferWithMemo transaction with fabricated access list entries. This causes the fee-payer wallet to incur extra gas costs (2,400 gas per fabricated entry) without corresponding on-chain work. At default settings (137 entries, 100 Gwei max_fee_per_gas), this inflates gas costs from ~51,287 to ~380,087 gas, a 7.4× increase. A proof of concept is available and demonstrates the attack on the Tempo Moderate testnet.

A malicious client can force the fee-payer server to pay approximately 7.4 times the normal transaction fee by exploiting the unchecked inclusion of fabricated access list entries. This significantly increases operational costs and can eliminate profit margins on low-cost transactions. There is no indication of direct compromise or data loss, but the financial impact on the fee-payer is substantial.

A patch is available for this vulnerability. Users should apply the official fix to ensure the server properly validates or sanitizes client-supplied access lists before cosigning fee-payer transactions. Until patched, the server remains vulnerable to inflated gas costs via crafted access lists.