The vulnerability in the mppx library allows a client to append non‑zero padding to fee‑sponsored calldata, which increases the intrinsic gas cost of the transaction without exceeding the declared gas_limit or max_fee_per_gas. The server fee_payer wallet calculates payment based on the inflated gas amount, resulting in fees that can be several times higher than the actual transaction cost. This flaw is an input‑validation issue (CWE‑20) in the FeePayerPolicy module where trailing bytes were not rejected when decoding function data, creating an economic attack vector that could significantly erode a validator’s or service operator’s funds.

The affected product is wevm’s mppx library. All releases prior to 0.8.2 are vulnerable. The patch in version 0.8.2 rejects trailing bytes during calldata processing, preventing the gas‑draining exploit.

With a CVSS score of 6.9 the vulnerability is moderate. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no widespread public exploitation yet. The attack vector is straightforward: any malicious client can send padded calldata. If a victim’s system automatically pays the fee, the attacker can increase costs dramatically, making this a tangible risk for organisations that trust unverified clients and rely on fee‑payers for transaction costs.