E.Fu

**Name of the Vulnerable Software and Affected Versions** mpp versions 0.2.0 through 0.5.9 **Description** Improper validation of input quantities allows an unauthenticated remote client to drain the fee-payer wallet, leading to a denial of service for legitimate clients. When the library is configured with `fee payer: true`, the `MPP.Methods.Tempo` payment method co-signs and broadcasts client-supplied EVM transactions without verifying if the `gas limit` is sufficient. An attacker can submit a `transferWithMemo` transaction with a `gas limit` set just below the required amount. The server broadcasts this via `rpc broadcast sync`, and although the transaction reverts due to running out of gas, the fee-payer wallet is charged for the burned gas. Additionally, the optimistic path where `wait for confirmation = false` is affected because the `simulate payment call` function via `eth call` omits the gas parameter, failing to detect out-of-gas conditions. **Recommendations** Update mpp to version 0.6.0 or later. As a temporary mitigation, set `fee payer` to `false` in the `MPP.Methods.Tempo` configuration to disable server-side gas sponsorship.

**Name of the Vulnerable Software and Affected Versions** mpp versions 0.2.0 through 0.5.9 **Description** Improper validation of input quantity allows an unauthenticated remote client to significantly inflate the gas cost per payment for the fee-payer, reducing the sponsor's operating margin. When the library is configured as a fee payer, the `cosign fee payer/3` function re-signs client-supplied base fields of the 0x76 AASigned envelope without validating the length or contents of the EIP-2930 access list. EIP-2930 access list entries incur intrinsic gas costs regardless of whether the addresses are used. A malicious client can submit a `transferWithMemo` call with numerous fabricated access-list entries, causing the fee-payer wallet to pay a large multiple of the expected gas cost. This can lead to the gradual draining of the fee-payer wallet. **Recommendations** Update mpp to version 0.6.0 or later. As a temporary mitigation, set the `fee payer` configuration to `false` to disable server-side gas sponsorship.

**Name of the Vulnerable Software and Affected Versions** mpp versions 0.2.0 through 0.5.9 **Description** Improper validation of input quantities allows an unauthenticated remote client to drain the fee-payer wallet in a single request by specifying an arbitrarily high gas price. When the library is configured as a fee payer, the `cosign fee payer/3` function re-signs client-supplied base fields of the 0x76 AASigned envelope without validating that `max fee per gas` and `max priority fee per gas` are within reasonable bounds. A malicious client can embed excessively large values for these variables, causing the server to pay inflated per-gas rates from its own wallet. This can result in the complete depletion of the wallet, preventing the server from sponsoring gas for legitimate requests. This issue is only reachable when the `MPP.Methods.Tempo` method is configured with `fee payer: true`. **Recommendations** Update mpp to version 0.6.0 or later. As a temporary mitigation, set the `fee payer` configuration to `false` to disable server-side gas sponsorship.