Unrated severityNVD Advisory· Published Nov 9, 2026
pympp: Gas Draining with padding
CVE-2026-63634
Description
pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1.
Affected products
1Patches
Vulnerability mechanics
References
3- github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0mitrex_refsource_MISC
- github.com/tempoxyz/pympp/releases/tag/v0.9.1mitrex_refsource_MISC
- github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.