TypeScript Interface Vulnerability in mppx Product by Wevm

CVE-2026-63628

What is CVE-2026-63628?

The mppx product, a TypeScript interface for machine payments protocol, has a vulnerability in the fee-payer cosigning path. Before version 0.8.2, it improperly handled the client-supplied access_list from a FeePayerEnvelope. This oversight allowed clients to insert unvalidated entries into the list, increasing transaction fees unnecessarily. EIP-2930 access-list entries incur gas costs even if not used, enabling an exploit where fake address-only entries could be added. This led to significant fee hikes, exemplified by a 180-entry list that raised costs by approximately 9.4 times. The issue was resolved in the 0.8.2 release.

References