CVE-2026-63628: mppx TypeScript Fee Manipulation Vulnerability

CVE-2026-63628 Overview

CVE-2026-63628 affects mppx, a TypeScript interface for the machine payments protocol maintained by wevm. Versions prior to 0.8.2 contain an input validation flaw [CWE-20] in the fee-payer cosigning path located in src/tempo/internal/fee-payer.ts. The code copies a client-supplied access_list from a 0x78FeePayerEnvelope without validating its length or contents. An attacker can inject fabricated EIP-2930 access-list entries that consume intrinsic gas even when unused, forcing the server-side fee_payer wallet to pay inflated transaction fees. The issue is fixed in version 0.8.2.

Critical Impact

A demonstrated 180-entry access list stayed within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the transaction fee by approximately 9.4 times.

Affected Products

• mppx versions prior to 0.8.2
• The src/tempo/internal/fee-payer.ts fee-payer cosigning path
• Server-side deployments operating a fee_payer wallet for Tempo transactions

Discovery Timeline

• 2026-09-22 - CVE-2026-63628 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63628

Vulnerability Analysis

The flaw lives in the fee-payer cosigning path exposed by mppx. When the server receives a 0x78FeePayerEnvelope, it copies the client-supplied access_list directly into the transaction it cosigns. The server never checks the number of entries or verifies that the listed addresses are actually referenced by the transaction. Because EIP-2930 access-list entries incur intrinsic gas per address and per storage key, an attacker can pad the list with arbitrary address-only entries that inflate the intrinsic gas cost without affecting execution logic.

Root Cause

The root cause is missing input validation on an untrusted, client-controlled field. mppx treats the access_list inside the fee-payer envelope as canonical rather than adversarial. No maximum length, deduplication check, or address-usage validation is applied before the server signs and pays for the transaction.

Attack Vector

A remote client submits a FeePayerEnvelope containing a padded access_list with fabricated address-only entries. In the disclosed proof of concept, 180 entries remained within the 500,000 gas policy cap, the 16 KB header limit, and the RPC simulation budget while raising the fee by roughly 9.4x. The attacker never pays; the server's fee_payer wallet absorbs the inflated cost, creating a direct financial drain on the operator.

// Security patch in src/tempo/internal/fee-payer.ts
// fix: reject non-canonical fee-payer transactions (#602)
 import { TxEnvelopeTempo } from 'ox/tempo'
 import type { Hex } from 'viem'
 import type { Account } from 'viem'
-import { decodeFunctionData, maxUint256, toHex } from 'viem'
+import { decodeFunctionData, encodeFunctionData, maxUint256, toHex } from 'viem'
 import { Abis, Addresses, Transaction } from 'viem/tempo'

 import * as TempoAddress_internal from './address.js'

Source: GitHub Commit 24ddcca. The fix introduces encodeFunctionData so the server can re-encode the transaction canonically and reject envelopes whose access lists do not match the derived form.

Detection Methods for CVE-2026-63628

Indicators of Compromise

• Fee-payer transactions containing access_list entries with addresses that never appear in the transaction's execution trace.
• Sudden increases in average gas consumed per cosigned transaction from the fee_payer wallet.
• Repeated 0x78FeePayerEnvelope submissions from the same client identity with unusually long access lists.

Detection Strategies

• Compare the submitted access_list against the addresses and storage keys actually touched during RPC simulation and flag divergence.
• Alert on any envelope whose access list exceeds a small operational threshold (for example, more than a handful of entries).
• Correlate on-chain fee expenditure by the fee_payer wallet with the count of cosigned transactions to detect cost-per-transaction drift.

Monitoring Recommendations

• Log every FeePayerEnvelope received, including the length of access_list and the resulting intrinsic gas estimate.
• Track daily fee spend from the fee_payer wallet and alert on statistical anomalies.
• Monitor the mppx dependency version across deployed services to confirm all instances run 0.8.2 or later.

How to Mitigate CVE-2026-63628

Immediate Actions Required

• Upgrade mppx to version 0.8.2 in every service that operates a fee-payer wallet.
• Rotate or throttle any fee_payer wallet suspected of processing padded access lists.
• Review recent transaction history for unexplained fee inflation attributable to oversized access lists.

Patch Information

The fix ships in mppx@0.8.2 via pull request #602. The server now re-encodes the transaction canonically using encodeFunctionData and rejects fee-payer envelopes whose access_list is non-canonical. See the GitHub Security Advisory GHSA-vc9j-9wph-qghj, the GitHub Pull Request #602, and the mppx 0.8.2 Release Notes.

Workarounds

• If upgrading immediately is not possible, add server-side validation that strips or rejects any client-supplied access_list entries.
• Lower the maximum allowed intrinsic gas for cosigned transactions to bound worst-case fee exposure.
• Enforce per-client rate limits and fee ceilings on the fee_payer wallet.

# Upgrade mppx to the patched release
npm install mppx@0.8.2

# Verify installed version
npm ls mppx