{"schema":"threatline.record/2","record":{"id":"GHSA-qpxh-ff8m-c62v","aliases":["CVE-2026-59694","EEF-CVE-2026-59694","GHSA-qpxh-ff8m-c62v"],"summary":"mpp vulnerable to Gas Draining with access list","details":"### Details\nWhen the server acts as the fee_payer, `mpp` Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In `cosign_fee_payer`, the server re-signs the raw `base_fields` (index 5 of the 0x76 AASigned envelope) without inspecting the access list field, which is part of the signed payload.\n\nAccess list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.\n\nAn attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and amount but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.\n\nAt the default of 137 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~380,087 gas — a **7.4× multiplier** — while staying within Bandit's default 10,000-byte per-header-field limit (verified empirically).\n\n### PoC\nThe PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:\n```bash\nunzip mpp_elixir_PoC.zip\ncd mpp_elixir\ndocker build -t mpp-elixir-access-list .\ndocker run --rm mpp-elixir-access-list\n``` \nThere are more details in `mpp_elixir/README.md`\n\n### Impact\nA malicious client can force the server to pay ~**7.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.","categories":["Libraries & packages"],"product":"mpp","vendor":"","ecosystem":"erlang","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-qpxh-ff8m-c62v","source_modified_at":"2026-09-25T21:45:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"erlang","name":"mpp"},"range":">= 0.2.0, < 0.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qpxh-ff8m-c62v","source_modified_at":"2026-09-25T23:00:31.297255816Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"0.6.0"}]}],"versions":["0.2.0","0.3.0","0.3.1","0.3.2","0.4.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-qpxh-ff8m-c62v","source_modified_at":"2026-09-25T21:45:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"erlang","name":"mpp"},"version":"0.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-qpxh-ff8m-c62v","source_modified_at":"2026-09-25T23:00:31.297255816Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"version":"0.6.0"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-25T21:45:16Z","modified_at":"2026-09-25T23:00:31.297255816Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-qpxh-ff8m-c62v","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T21:45:26Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-qpxh-ff8m-c62v","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-09-25T23:00:31.297255816Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-qpxh-ff8m-c62v","source":"GitHub Advisory Database"},{"url":"https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8","source":"GitHub Advisory Database"},{"url":"https://github.com/ZenHive/mpp/releases/tag/v0.6.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-qpxh-ff8m-c62v","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T23:00:31.297255816Z","content_hash":"472dba1eba220eaf281b971c22fe2115097a02cf1847175ccc286b1b41b23ce4"}}