A flaw in mppx’s session close handler accepts a close voucher whose amount equals the settled on‑chain amount. The code uses a less‑than comparison instead of a less‑than‑or‑equal comparison, which causes the voucher to be treated as valid and the channel to close without committing any additional funds. This permits an attacker to close or grief a channel at no cost, potentially causing financial loss to a counterparty and disrupting normal payment operations.

The wevm:mppx package, an interface for the machine payments protocol, is affected. All releases prior to version 0.4.11 contain the vulnerability and require an update to v0.4.11 or later.

The CVSS score of 7.5 highlights a high‑severity flaw, whereas the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Attackers must be able to submit a close voucher to the protocol, implying a remote or network‑based vector. Given the high impact and moderate severity, rapid remediation is recommended.