Product
3 published CVES affecting hex mpp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Vulnerability When the server acts as the fee payer, mpp Elixir 0.4.0 (ZenHive/mpp) does not validate whether the gas_limit set by the client is enough before broadcasting. A malicious client can drain the server's gas without paying. A transferWithMemo call on Tempo Moderato tes...
Details When the server acts as the fee_payer, mpp Elixir 0.4.0 copies the client-supplied EIP-2930 access list verbatim into the cosigned fee-payer transaction. In cosign_fee_payer, the server re-signs the raw base_fields (index 5 of the 0x76 AASigned envelope) without inspectin...
Details When the server acts as the fee_payer, the mpp Elixir 0.4.0 does not validate gas_limit, max_fee_per_gas and max_priority_fee_per_gas before cosigning the client's fee-payer transaction. A malicious client embeds arbitrarily large max_fee_per_gas and max_priority_fee_per_...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.