GHSA-VV77-66RF-PM86: GHSA-vv77-66rf-pm86: Gas Draining Vulnerability in mpp Multi-Party Payments Library

#security #cve #cybersecurity #ghsa

GHSA-vv77-66rf-pm86: Gas Draining Vulnerability in mpp Multi-Party Payments Library

Vulnerability ID: GHSA-VV77-66RF-PM86
CVSS Score: 8.8
Published: 2026-09-25

A critical-severity input validation vulnerability in the Elixir multi-party payment library mpp allows unauthenticated remote attackers to exhaust the transaction fee payer's wallet balance. By submitting a crafted Ethereum transaction envelope with artificially inflated gas parameters, an attacker can force the server to co-sign and commit to pay exorbitant fees, leading to severe financial loss and Denial of Service.

TL;DR

Unvalidated transaction gas parameters in the mpp library allow remote attackers to drain the server's wallet funds via sponsored transaction fee exploitation.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-20
Attack Vector: Network
CVSS Score: 8.8
Exploit Status: poc
KEV Status: Not listed

Affected Systems

Systems using mpp Elixir package for Ethereum sponsored/multi-party transactions
mpp: >= 0.2.0, < 0.6.0 (Fixed in: 0.6.0)

Code Analysis

Commit: 5d6338e

Implement FeePayerPolicy validation rules to bound client-supplied gas economics

Mitigation Strategies

Upgrade mpp to version 0.6.0 or higher.
Implement a strict FeePayerPolicy configuration.
Monitor fee payer wallet balances and set alerts for anomalous spending.
Rate-limit public transaction submission endpoints.

Remediation Steps:

Open mix.exs and change the dependency version of :mpp to ~> 0.6.0.
Run mix deps.get to fetch the updated dependency.
Define custom gas ceiling limits in the application configuration using the fee_payer_policy parameter.
Deploy the updated application to production environments.

References

Read the full report for GHSA-VV77-66RF-PM86 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community