pympp, a Python SDK for the Machine Payments Protocol, contains a flaw that allows developers to inflate gas usage by appending non‑zero padding bytes to calldata. The server, when configured to act as fee_payer, checks gas_limit and max_fee_per_gas but ignores calldata length. Because legacy gas pricing charges 16 gas per non‑zero byte, each added 0x01 byte increases the actual gas consumed while remaining within policy caps. The server signs and broadcasts the padded transaction, draining its fee‑payer wallet. The vulnerability is thus a financial loss that exploits the discrepancy between declared limits and real gas consumption.

All installations of tempoxyz’s pympp library older than version 0.9.1 are vulnerable. Users who use these SDK versions and run a server configured as fee_payer are exposed to the risk of under‑charging for gas and draining the wallet that is meant to pay transaction fees.

The CVSS score is 6.9, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious or compromised server that can instrument calldata padding before signing, or a client that deliberately sends padded calldata to a server set to run as fee_payer. Exploitation requires code‑level control over the server side of the SDK but does not need any privileged external network access. Once exploited, an attacker can recover monetary value equal to the over‑billed gas costs. The risk remains moderate to high for organizations running affected versions, with a clear mitigation path via patching.