An unauthenticated remote attacker can exploit an input validation flaw in the mppx library to force excessive transaction fee payments from the server fee-payer wallet.

The vulnerability exists within the FeePayerPolicy logic, where the application uses decodeFunctionData to process calldata without rejecting trailing bytes. This allows an unauthenticated attacker to append nonzero padding, which increases intrinsic calldata gas and results in significantly higher transaction costs for the server.

The exploitation of this vulnerability leads to direct financial loss by forcing the server fee-payer wallet to pay substantially higher transaction fees than required. While the CVSS score of 6.9 indicates a medium severity, the impact is purely financial and can lead to rapid depletion of automated payment funds, potentially disrupting service operations.

Immediate Action: Update the wevm mppx package to version 0.8.2 or later to include the necessary input validation checks.

Proactive Monitoring: Monitor transaction fee patterns and gas consumption metrics for anomalies that deviate from standard operational baselines.

Compensating Controls: Implement strict rate limiting on incoming payment requests and define tighter gas limit policies to mitigate the financial impact of inflated calldata padding.

Public Exploit Available: No

Organizations utilizing the mppx library should prioritize upgrading to version 0.8.2 immediately to prevent unauthorized financial drain on their infrastructure. Given the potential for direct monetary impact, verify that all dependencies have been updated and monitor transaction logs for any unusual spikes in gas usage associated with fee-sponsored calls.