CVE-2026-63627: mppx Gas Draining Vulnerability Due to Padding

Background

mppx is an npm package that facilitates transaction processing in blockchain environments, specifically designed to handle fee payments efficiently. It allows users to set gas limits and fees for transactions. However, version 0.6.27 of mppx has a critical vulnerability that can be exploited by malicious clients to inflate transaction fees significantly.

Vulnerability Detail

The vulnerability arises from the way mppx validates calldata when the server acts as the fee payer. It utilizes viem's decodeFunctionData, which is lenient with trailing bytes. Although the FeePayerPolicy enforces limits on gas_limit (≤ 2M) and max_fee_per_gas (≤ 100 Gwei), it fails to check the length of calldata. This oversight allows attackers to append padding (e.g., 0x01 bytes) to transactions, inflating the gas used without exceeding the declared limits. Consequently, the server may end up paying approximately five times the normal transaction fee, leading to increased operational costs and potential profit loss on low-cost items.

npm install mppx@0.8.2

Workaround

As a temporary workaround, you can implement stricter validation on calldata length before processing transactions. This can be done by adding a check in your code to ensure that the length of calldata does not exceed a predefined limit. For example:

if (calldata.length > MAX_CALDATA_LENGTH) {
    throw new Error('Calldata length exceeds the maximum allowed limit.');
}

Conclusion

The mppx package version 0.6.27 has a vulnerability that allows for gas draining through padding in calldata. It is crucial to update to version 0.8.2 or later to mitigate this risk. Additionally, implementing stricter validation can serve as a temporary workaround. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for mppx →

FAQ