---
id: GHSA-qpxh-ff8m-c62v
title: mpp vulnerable to Gas Draining with access list
summary: mpp vulnerable to Gas Draining with access list
severity: medium
cwe:
  - CWE-20
vendor: mpp
product: mpp
ecosystem: erlang
affected:
  - 'mpp >= 0.2.0, < 0.6.0'
patched:
  - mpp 0.6.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T21:45:26Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-qpxh-ff8m-c62v'
references:
  - url: 'https://github.com/ZenHive/mpp/security/advisories/GHSA-qpxh-ff8m-c62v'
  - url: >-
      https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8
  - url: 'https://github.com/ZenHive/mpp/releases/tag/v0.6.0'
  - url: 'https://github.com/advisories/GHSA-qpxh-ff8m-c62v'
tags:
  - ghsa
  - erlang
ingestedAt: '2026-09-25T22:20:31.566Z'
---

## Overview

### Details
When the server acts as the fee_payer, `mpp` Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In `cosign_fee_payer`, the server re-signs the raw `base_fields` (index 5 of the 0x76 AASigned envelope) without inspecting the access list field, which is part of the signed payload.

Access list gas is charged **intrinsically** — before any opcode executes — regardless of whether the listed addresses are ever touched.

An attacker submits a valid `transferWithMemo` alongside fabricated address-only access list entries. The server validates calldata and amount but never inspects `access_list` length. It cosigns and broadcasts a transaction that costs the fee-payer wallet `N × 2,400` extra gas per request with no corresponding work performed on-chain.

At the default of 137 entries and 100 Gwei `max_fee_per_gas`, this inflates the fee-payer cost from the normal ~51,287 gas to ~380,087 gas — a **7.4× multiplier** — while staying within Bandit's default 10,000-byte per-header-field limit (verified empirically).

### PoC
The PoC is provided below. It is configured to reproduce the attack on Tempo Moderate testnet within a Docker environment. Download the PoC and run:
```bash
unzip mpp_elixir_PoC.zip
cd mpp_elixir
docker build -t mpp-elixir-access-list .
docker run --rm mpp-elixir-access-list
``` 
There are more details in `mpp_elixir/README.md`

### Impact
A malicious client can force the server to pay ~**7.4x** the normal transaction fee. This dramatically increases operational costs and completely destroys the profit margin on low-cost items.

## Affected packages

- `mpp >= 0.2.0, < 0.6.0`

## Remediation

Upgrade to a patched release:

- `mpp 0.6.0`