The mpp Elixir 0.4.0 server, when acting as the fee payer, copies client-supplied EIP-2930 access lists directly into cosigned fee-payer transactions without validation. This allows an attacker to inflate transaction fees by including fabricated access list entries, causing the fee-payer to pay significantly higher gas costs without additional on-chain work. The attack can increase gas costs by approximately 7.4 times, severely impacting operational costs and profit margins for low-cost transactions.