Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the mppx library's handling of fee-payer transactions, where the length of the calldata was not being properly validated. This allowed a malicious user to append extra bytes (padding) to the calldata. Because the gas cost is calculated based on the size of the calldata, this padding would inflate the transaction's gas cost, forcing the fee-paying server to pay more than expected. The fix was implemented by introducing a new function, assertCanonicalSponsoredTransaction, which decodes and then re-encodes the calldata to ensure it is in a canonical format without any padding. This new validation was then integrated into the existing policy enforcement function assertTransactionPolicy. The test files were also updated to include checks for padded calldata in fillHostedFeePayerTransaction and prepareSponsoredTransaction, confirming that these functions were the entry points for the vulnerability.
assertTransactionPolicysrc/tempo/internal/fee-payer.ts
fillHostedFeePayerTransactionsrc/tempo/internal/fee-payer.ts
prepareSponsoredTransactionsrc/tempo/internal/fee-payer.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mppx | npm | < 0.8.1 | 0.8.2 |