CVE-2026-63627: mppx TypeScript Fee Payer Vulnerability

CVE-2026-63627 Overview

CVE-2026-63627 affects mppx, a TypeScript interface for the machine payments protocol maintained by wevm. Versions prior to 0.8.2 contain an input validation flaw [CWE-20] in the FeePayerPolicy component located at src/tempo/internal/fee-payer.ts. The policy uses decodeFunctionData from viem to validate fee-sponsored calldata but fails to reject trailing bytes appended after the decoded ABI payload. An attacker can append nonzero padding to inflate intrinsic calldata gas while keeping gas_limit and max_fee_per_gas within policy caps, forcing the server fee_payer wallet to overpay.

Critical Impact
A network attacker with no authentication can cause the fee-payer wallet to pay approximately five times the normal transaction fee by submitting non-canonical calldata with trailing padding.

Affected Products

mppx versions prior to 0.8.2
FeePayerPolicy in src/tempo/internal/fee-payer.ts
Server deployments acting as fee sponsors on the machine payments protocol

Discovery Timeline

2026-09-22 - CVE-2026-63627 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63627

Vulnerability Analysis

The FeePayerPolicy in mppx is responsible for validating fee-sponsored transactions before the server signs and pays gas on behalf of a client. Validation relies on decodeFunctionData from viem, which parses ABI-encoded calldata into a function selector and typed arguments. The decoder ignores any bytes appearing after the expected ABI payload, so a malformed calldata blob still decodes successfully.

Because Ethereum-style networks charge intrinsic gas per calldata byte, an attacker can append arbitrary nonzero padding without changing the semantic call. The declared gas_limit and max_fee_per_gas values remain within server-configured caps, so the policy check passes. When the transaction executes, actual gas consumption scales with the padded calldata length, and the fee-payer wallet is billed accordingly.

The advisory reports that a tested 16 KB HTTP header limit bounded practical padding to roughly 5,500 bytes. That padding produced approximately five times the expected transaction fee, giving the vulnerability direct economic impact against fee-sponsor infrastructure.

Root Cause

The root cause is improper input validation [CWE-20]: decodeFunctionData does not enforce canonical encoding. mppx treated a successful decode as sufficient proof that calldata matched policy, without comparing the decoded payload against a re-encoded canonical form.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker submits a fee-sponsored request containing a valid function call plus trailing padding bytes. The policy accepts the request, the server signs it, and the fee-payer wallet funds the inflated gas cost on-chain.

typescript

// Patch excerpt from src/tempo/internal/fee-payer.ts (mppx@0.8.2)
 import { TxEnvelopeTempo } from 'ox/tempo'
 import type { Hex } from 'viem'
 import type { Account } from 'viem'
-import { decodeFunctionData, maxUint256, toHex } from 'viem'
+import { decodeFunctionData, encodeFunctionData, maxUint256, toHex } from 'viem'
 import { Abis, Addresses, Transaction } from 'viem/tempo'

 import * as TempoAddress_internal from './address.js'
// Source: https://github.com/wevm/mppx/commit/24ddcca719ae282977d8747309ed1275ea282b25

The fix imports encodeFunctionData so the policy can re-encode decoded arguments and reject any calldata that does not match its canonical form byte-for-byte.

Detection Methods for CVE-2026-63627

Indicators of Compromise

Fee-sponsored transactions where submitted calldata length exceeds the byte length of the canonical ABI encoding for the declared function
Unexpected spikes in fee_payer wallet gas expenditure that do not correspond to increased transaction volume
On-chain transactions from the fee-payer address whose intrinsic gas is disproportionate to the executed function logic

Detection Strategies

Compare inbound calldata against encodeFunctionData(abi, functionName, args) output and alert when lengths diverge
Instrument the FeePayerPolicy code path to log the ratio of declared gas_limit to expected intrinsic gas for the decoded function
Correlate HTTP request body sizes against the median size for each sponsored function selector and flag statistical outliers

Monitoring Recommendations

Track fee-payer wallet balance drain rate and alert on deviations from historical baselines
Ingest mppx server logs into a centralized data lake and query for repeated large-calldata submissions from the same client identity
Review GitHub Security Advisory GHSA-727h-3vm5-qwq6 for updated indicators

How to Mitigate CVE-2026-63627

Immediate Actions Required

Upgrade mppx to version 0.8.2 or later across all fee-sponsor deployments
Audit recent fee-payer wallet transactions for anomalous gas expenditure preceding the upgrade
Rotate or rate-limit API credentials for clients that submitted oversized calldata during the exposure window

Patch Information

The vendor released the fix in mppx@0.8.2 via Pull Request #602. The commit 24ddcca modifies FeePayerPolicy to re-encode decoded calldata with encodeFunctionData and reject non-canonical inputs. Full technical context is available in GitHub Security Advisory GHSA-727h-3vm5-qwq6.

Workarounds

Enforce a strict maximum calldata length per sponsored function selector at the reverse proxy or API gateway layer
Lower the HTTP header and body size limits fronting the mppx server to reduce the maximum possible padding
Cap the fee-payer wallet balance and implement per-client daily gas budgets until the upgrade is deployed

bash

# Upgrade mppx to the patched release
npm install mppx@0.8.2

# Verify installed version
npm ls mppx