The vulnerability resides in the fee‑payer cosigning component of mppx, where a supplied access_list in a 0x78 FeePayerEnvelope is copied without validation. The unchecked list lets a client introduce fabricated address‑only entries that consume EIP‑2930 intrinsic gas, thereby forcing the server fee_payer wallet to incur unnecessary transaction fees. This improper input validation (CWE‑20) can lead to financial loss for the server operator and can push the fee up to 9.4 times the normal amount without breaching the 500,000 gas policy cap or RPC simulation budget.

Wevm’s mppx package versions earlier than 0.8.2 are affected. Operators running any of these releases that expose the fee‑payer path to clients—for example through exposing the protocol interface—are vulnerable. The patch bundled in release 0.8.2 removes the unchecked copy and enforces valid access_list content.

The CVSS score of 6.9 reflects a moderate severity. EPSS is not reported, so current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. A client with control over the FeePayerEnvelope can trigger the flaw by submitting a crafted access_list; the server will then incur higher transaction fees. The attack is remote, relying on protocol interaction rather than local privilege or code execution.