{"id":"GHSA-vj8p-hp9x-gh47","title":"mpp vulnerable to Gas Draining with low gas limit","summary":"mpp vulnerable to Gas Draining with low gas limit","severity":"high","cwe":["CWE-20"],"vendor":"mpp","product":"mpp","ecosystem":"erlang","affected":["mpp >= 0.2.0, < 0.6.0"],"patched":["mpp 0.6.0"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T21:47:39Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47","references":[{"url":"https://github.com/ZenHive/mpp/security/advisories/GHSA-vj8p-hp9x-gh47"},{"url":"https://github.com/ZenHive/mpp/commit/d84e3e528db39654540c2035ea0fbdf7b950d3d1"},{"url":"https://github.com/ZenHive/mpp/releases/tag/v0.6.0"},{"url":"https://github.com/advisories/GHSA-vj8p-hp9x-gh47"}],"tags":["ghsa","erlang"],"ingestedAt":"2026-09-25T22:20:31.565Z","slug":"GHSA-vj8p-hp9x-gh47","body":"## Overview\n\n## Vulnerability\nWhen the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `gas_limit` set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying.\n\nA `transferWithMemo` call on Tempo Moderato testnet requires **~51,299 gas** to complete successfully. By setting `gas_limit = 51,298`:\n\n1. The Tx gets cosigned and broadcast by the server.\n2. The Tx runs out of gas during EVM execution. All state reverts.\n3. The server's fee-payer wallet is charged for gas used.\n4. The client pays nothing and receives no resource.\n\n```bash\n# Run the PoC\nunzip mpp_elixir_low_gas_PoC.zip\ncd mpp_elixir_low_gas_PoC\ndocker build -t mpp-elixir-low-gas .\ndocker run --rm mpp-elixir-low-gas\n```\n\n**Zero-Cost DoS Attack:** Unlike gas draining with `access list` or `padding`, where the malicious client needs to complete a payment to drain the gas, this vulnerability allows malicious users to continuously drain the server's gas at virtually no financial cost (requiring only computing power). Therefore, an attacker can spawn *N* malicious clients to completely drain the funds from the server's wallet to perform a Denial of Service (DoS) attack. Once the server's wallet is empty, it has no more funds to pay the gas fees for upcoming requests from legitimate clients. \n\n```bash\n# Run the DoS PoC\nunzip mpp_elixir_low_gas_dos_PoC.zip\ncd mpp_elixir_low_gas_dos_PoC\ndocker build -t mpp-elixir-dos .\ndocker run --rm mpp-elixir-dos\n```\n\n**Vulnerable code path:** `broadcast_and_verify/7` in `mpp/methods/tempo.ex` (ZenHive/mpp 0.4.0).\nWhen `wait_for_confirmation = true` (the default), it calls `rpc_broadcast_sync` directly without any gas-adequacy check or simulation. The alternative `wait_for_confirmation = false` path does call `simulate_payment_call` via `eth_call`, but that simulation omits the `gas` parameter and therefore does not catch out-of-gas conditions.\n\n## Impact\nA malicious client can drain the server's wallet without any financial cost.\n\n## Affected packages\n\n- `mpp >= 0.2.0, < 0.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mpp 0.6.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}