A vulnerability in the wevm mppx library allows unauthenticated remote attackers to trigger unnecessary transaction fees via improper input validation.

This vulnerability is an improper input validation flaw (CWE-20) located in the fee-payer cosigning path of the mppx library. An unauthenticated attacker can supply a malicious access list that forces the server fee-payer wallet to consume excessive intrinsic gas, resulting in significantly increased transaction costs.

The primary impact of this vulnerability is the financial loss associated with inflated transaction fees. Because the flaw allows for an increase in transaction costs by approximately 9.4 times, an attacker can rapidly drain the funds associated with the affected fee-payer wallet. While the CVSS score is 6.9 (Medium), the direct financial risk to organizations utilizing this library for machine payments necessitates prompt remediation to prevent unauthorized depletion of digital assets.

Immediate Action: Update the wevm mppx package to version 0.8.2 or later to include the necessary input validation checks.

Proactive Monitoring: Review transaction logs for anomalous gas consumption patterns or spikes in transaction fees associated with the fee-payer wallet.

Compensating Controls: Implement strict rate limiting or validation logic on the client-supplied access lists before they are processed by the fee-payer service.

Public Exploit Available: exploit_available (unknown)

Organizations utilizing the mppx library must prioritize updating to version 0.8.2 immediately. Given that this vulnerability directly impacts the financial integrity of the fee-payer wallet, delaying the patch exposes the organization to avoidable economic loss. Ensure that all downstream dependencies are updated and verify that the fix is correctly implemented in the production environment.