EEF-CVE-2026-59695
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
Details
## Summary
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.
When the mpp Elixir library is configured as fee payer (fee\_payer: true), MPP.Tempo.Transaction.cosign\_fee\_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max\_fee\_per\_gas and max\_priority\_fee\_per\_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective\_gas\_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.
This issue affects mpp: from 0.2.0 before 0.6.0.
## Configuration
The vulnerable code path is only reachable when the MPP.Methods.Tempo method is configured with fee\_payer: true (server-side gas sponsorship). Default deployments with fee\_payer: false are not affected, since the client pays for gas out of its own wallet.
Are you affected?
Enter the version of the package you're using.