The wevm mppx library contains a critical authentication bypass vulnerability that allows unauthenticated attackers to manipulate payment channels, posing a significant financial risk.

The vulnerability exists in the tempo/session cooperative close handler, which uses an incorrect comparison operator when validating close voucher amounts. This flaw allows an unauthenticated attacker to submit a voucher equal to the on-chain settled amount, effectively closing or griefing payment channels without committing additional funds.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation allows an attacker to disrupt financial operations or drain resources by closing channels for free, leading to potential financial loss and service degradation. Given that the protocol manages machine payments, this flaw directly impacts the integrity of automated financial transactions.

Immediate Action: Update the mppx library to version 0.4.11 or later to implement the corrected validation logic.

Proactive Monitoring: Review application logs for unusual channel closure requests or discrepancies in payment voucher validations.

Compensating Controls: Implement strict rate limiting on payment channel operations to detect and block potential automated exploitation attempts.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant risk to the integrity of payment processing within the mppx framework. Organizations utilizing this library should prioritize the update to version 0.4.11 immediately. Failure to apply this patch leaves financial channels vulnerable to manipulation by any network-accessible actor.