{"schema":"threatline.record/2","record":{"id":"GHSA-vj8p-hp9x-gh47","aliases":["CVE-2026-59252","EEF-CVE-2026-59252","GHSA-vj8p-hp9x-gh47"],"summary":"mpp vulnerable to Gas Draining with low gas limit","details":"## Vulnerability\nWhen the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `gas_limit` set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying.\n\nA `transferWithMemo` call on Tempo Moderato testnet requires **~51,299 gas** to complete successfully. By setting `gas_limit = 51,298`:\n\n1. The Tx gets cosigned and broadcast by the server.\n2. The Tx runs out of gas during EVM execution. All state reverts.\n3. The server's fee-payer wallet is charged for gas used.\n4. The client pays nothing and receives no resource.\n\n```bash\n# Run the PoC\nunzip mpp_elixir_low_gas_PoC.zip\ncd mpp_elixir_low_gas_PoC\ndocker build -t mpp-elixir-low-gas .\ndocker run --rm mpp-elixir-low-gas\n```\n\n**Zero-Cost DoS Attack:** Unlike gas draining with `access list` or `padding`, where the malicious client needs to complete a payment to drain the gas, this vulnerability allows malicious users to continuously drain the server's gas at virtually no financial cost (requiring only computing power). Therefore, an attacker can spawn *N* malicious clients to completely drain the funds from the server's wallet to perform a Denial of Service (DoS) attack. Once the server's wallet is empty, it has no more funds to pay the gas fees for upcoming requests from legitimate clients. \n\n```bash\n# Run the DoS PoC\nunzip mpp_elixir_low_gas_dos_PoC.zip\ncd mpp_elixir_low_gas_dos_PoC\ndocker build -t mpp-elixir-dos .\ndocker run --rm mpp-elixir-dos\n```\n\n**Vulnerable code path:** `broadcast_and_verify/7` in `mpp/methods/tempo.ex` (ZenHive/mpp 0.4.0).\nWhen `wait_for_confirmation = true` (the default), it calls `rpc_broadcast_sync` directly without any gas-adequacy check or simulation. The alternative `wait_for_confirmation = false` path does call `simulate_payment_call` via `eth_call`, but that simulation omits the `gas` parameter and therefore does not catch out-of-gas conditions.\n\n## Impact\nA malicious client can drain the server's wallet without any financial cost.","categories":["Libraries & packages"],"product":"mpp","vendor":"","ecosystem":"erlang","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47","source_modified_at":"2026-09-25T21:47:39Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"erlang","name":"mpp"},"range":">= 0.2.0, < 0.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vj8p-hp9x-gh47","source_modified_at":"2026-09-25T23:00:31.010937362Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"0.6.0"}]}],"versions":["0.2.0","0.3.0","0.3.1","0.3.2","0.4.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47","source_modified_at":"2026-09-25T21:47:39Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"erlang","name":"mpp"},"version":"0.6.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vj8p-hp9x-gh47","source_modified_at":"2026-09-25T23:00:31.010937362Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"mpp","ecosystem":"Hex","purl":"pkg:hex/mpp"},"version":"0.6.0"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-25T21:47:36Z","modified_at":"2026-09-25T23:00:31.010937362Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T21:47:39Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-vj8p-hp9x-gh47","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T23:00:31.010937362Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47","source":"GitHub Advisory Database"},{"url":"https://github.com/ZenHive/mpp/commit/d84e3e528db39654540c2035ea0fbdf7b950d3d1","source":"GitHub Advisory Database"},{"url":"https://github.com/ZenHive/mpp/releases/tag/v0.6.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T23:00:31.010937362Z","content_hash":"5155cdc1db0c775730c9c235b8004045204e43a0b8ec2412330cb382d16c46cc"}}