{"uuid": "6567e4f1-895f-4565-9dd5-5730c8c06460", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vj8p-hp9x-gh47", "type": "seen", "source": "https://gist.github.com/alon710/7677ed04750b8404bd2e33c234999538", "content": "# GHSA-VJ8P-HP9X-GH47: GHSA-vj8p-hp9x-gh47: Zero-Cost Fee-Payer Wallet Gas Draining in mpp Elixir Library\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/GHSA-VJ8P-HP9X-GH47\n\n## Summary\nA high-severity vulnerability exists in the Elixir library `mpp` (Multi-Party Payments) prior to version `0.6.0`. When acting as a sponsored transaction fee payer, the server co-signs and broadcasts user-provided transactions without verifying if the user-specified gas limit is sufficient. An attacker can submit transactions designed to run out of gas and revert. The transaction reversion ensures the attacker pays zero fees, while the sponsor's fee-payer wallet is fully billed for the wasted gas, resulting in a low-cost, high-impact Denial of Service (DoS) vector.\n\n## TL;DR\nAn unauthenticated attacker can submit transaction payloads with insufficient gas limits to the `mpp` fee-payer endpoint. This forces the sponsor's wallet to pay for failed execution costs while the attacker incurs zero financial cost, draining the host's wallet and causing a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS Score**: 8.8\n- **Impact**: Denial of Service (DoS) via Wallet Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- mpp Elixir library deployments configured as transaction fee-payer / sponsors\n- EVM-compatible Multi-Party Payment systems running on Tempo or related Account Abstraction protocols\n- **mpp**: >= 0.2.0, < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade the mpp package to version 0.6.0 or higher.\n- Ensure the connected JSON-RPC node supports the eth_simulateV1 endpoint.\n- Deploy rate-limiting at the API gateway layer to block rapid transaction submissions from individual clients.\n- Monitor fee-payer wallet balances and alert on unexpected revert rates.\n\n**Remediation Steps:**\n1. Open the mix.exs file in your Elixir project.\n2. Locate the :mpp dependency and update the version constraints to '~> 0.6.0'.\n3. Run 'mix deps.update mpp' to update dependencies and rewrite mix.lock.\n4. Verify the application logs to ensure no 'eth_simulateV1 unsupported' warnings are generated when submitting transactions.\n\n## References\n\n- [GHSA-vj8p-hp9x-gh47 Advisory on GitHub](https://github.com/advisories/GHSA-vj8p-hp9x-gh47)\n- [ZenHive/mpp Advisory Details](https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47)\n- [Fix Commit in GitHub Repository](https://github.com/ZenHive/mpp/commit/d84e3e528db39654540c2035ea0fbdf7b950d3d1)\n- [mpp v0.6.0 Release Tag](https://github.com/ZenHive/mpp/releases/tag/v0.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-VJ8P-HP9X-GH47) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T00:30:32.000000Z"}