CVE-2026-63628: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63628 is an improper input validation vulnerability in mppx, a TypeScript interface for the machine payments protocol (npm package by wevm). In versions prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied EIP-2930 access_list from a 0x78 FeePayerEnvelope without validating its length or contents, enabling a client to force the server's fee-payer wallet to pay inflated transaction fees. The vulnerability was disclosed on July 1, 2026, and fixed in mppx 0.8.2, released the same day. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-20 (Improper Input Validation): the prepareSponsoredTransaction and fillHostedFeePayerTransaction functions in src/tempo/internal/fee-payer.ts blindly copied the client-supplied access_list field into the cosigned fee-payer transaction without inspecting its length or contents. Under EIP-2930, access-list entries incur intrinsic gas charges (2,400 gas per address-only entry) before any opcode executes, regardless of whether the listed addresses are ever accessed on-chain. An unauthenticated attacker submits a valid transferWithMemo transaction alongside a fabricated access_list containing up to 180 address-only entries; the server validates calldata and gas parameters but never inspects the access list, then cosigns and broadcasts the inflated transaction. The demonstrated 180-entry payload stays within the 500,000 gas policy cap, the Node.js 16 KB header limit, and the Moderato RPC eth_call simulation budget, making it undetectable by existing policy checks (GitHub Advisory, Fix PR #602).

Successful exploitation allows any unauthenticated client to force the server-side fee_payer wallet to pay approximately 9.4× the normal transaction fee (~483,287 gas vs. the normal ~51,287 gas at 100 Gwei max_fee_per_gas), with no corresponding on-chain work performed. This directly drains the fee-payer wallet's funds, destroys profit margins on low-cost sponsored transactions, and can be repeated at scale to cause significant financial loss to service operators. There is no confidentiality or integrity impact; the vulnerability is limited to an availability/financial impact on the fee-payer wallet (GitHub Advisory).

A proof-of-concept (PoC) was included in the security advisory, provided as a Docker-based reproduction environment targeting the Tempo Moderate testnet. No exploit kits or in-the-wild exploitation have been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no privileges, and no user interaction, making it trivially automatable by any client with access to the fee-payer endpoint (GitHub Advisory, Feedly).

1. Identify a target: Locate a service running mppx versions prior to 0.8.2 that uses the fee-payer sponsorship feature (i.e., a server acting as fee_payer for client transactions on the Tempo network).
2. Craft a malicious FeePayerEnvelope: Construct a valid 0x78 FeePayerEnvelope containing a legitimate transferWithMemo call in the calls field, but append a fabricated EIP-2930 access_list with up to 180 address-only entries (empty storageKeys arrays) pointing to arbitrary or nonexistent addresses.
3. Submit the transaction: Send the crafted envelope to the fee-payer cosigning endpoint. The server validates calldata and gas parameters but does not inspect the access_list length or contents, so the request passes all policy checks.
4. Fee inflation occurs: The server cosigns and broadcasts the transaction. The 180 access-list entries add 180 × 2,400 = 432,000 extra intrinsic gas, inflating the fee from ~51,287 gas to ~483,287 gas (~9.4×) at the attacker's chosen max_fee_per_gas.
5. Repeat for maximum drain: Automate repeated submissions to continuously drain the fee-payer wallet, as each request remains within the 500,000 gas policy cap and other server-side limits (GitHub Advisory).

• Network: Repeated fee-payer cosigning requests containing access_list fields with many address-only entries (empty storageKeys); on-chain transactions from the fee-payer wallet with gas consumption significantly above the baseline (~51,287 gas) for standard transferWithMemo operations.
• Blockchain/On-chain: Fee-payer wallet transactions with intrinsic gas usage approaching 483,287 gas or higher for simple token transfers; unusual spikes in gas fees paid by the fee-payer wallet address.
• Logs: Server-side logs showing accepted fee-payer sponsorship requests with accessList entries present (prior to patching); rapid depletion of the fee-payer wallet balance without a corresponding increase in legitimate transaction volume (GitHub Advisory).

Upgrade mppx to version 0.8.2 or later, which introduces the assertCanonicalSponsoredTransaction validation function that rejects any sponsored transaction containing a non-empty access_list, non-canonical calldata, missing calls, or nonzero call values before cosigning (mppx Release, Fix PR #602). The fix enforces validation in the shared fee-payer policy gate before both local signing and hosted fee-payer requests. No configuration-based workaround is available for unpatched versions; immediate upgrade is the only remediation.

The vulnerability was reported by security researcher kai-kka and addressed by wevm maintainer brendanjryan, who merged the fix on July 1, 2026, the same day as disclosure. The advisory was published through GitHub Security Advisories (GHSA-vc9j-9wph-qghj). No significant broader media coverage or notable community commentary beyond the advisory and fix PR has been identified (GitHub Advisory, Fix PR #602).