GHSA-vc9j-9wph-qghj

### Details When the server acts as the fee_payer, `mppx` 0.6.27 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. The TypeScript SDK's fee-payer cosigning path accepts any `access_list` the client includes in the 0x78 `FeePayerEnvelope` without inspecting its length or contents.

Access list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.

An attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and gas parameters but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.

At the default of 180 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~483,287 gas — a **9.4× multiplier** — while staying within the `FeePayerPolicy` cap of 500K gas, the Node.js 16 KB header limit, and the Moderato RPC's `eth_call` simulation budget (verified empirically at 180 entries).

### PoC The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run: ```bash unzip mppx_typescript_PoC.zip cd mppx_typescript docker build -t mppx-typescript-access-list . docker run --rm mppx-typescript-access-list ``` There are more details in `mppx_typescript/README.md`

### Impact A malicious client can force the server to pay ~**9.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.