wevm/mppx · Security
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
- GHSA ID
- GHSA-mv9j-8jvg-j8mr
- CVE ID
- CVE-2026-34209
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
Impact
The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.
Patches
Fixed in 0.4.11.
Workarounds
There are no workarounds available for this vulnerability.
CWEs
- CWE-294 · Authentication Bypass by Capture-replay
References
- https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr ↗
- https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb ↗
- https://github.com/wevm/mppx/releases/tag/[email protected] ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-34209 ↗
- https://github.com/advisories/GHSA-mv9j-8jvg-j8mr ↗