HIGH 7.5 npm
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality
GHSA-mv9j-8jvg-j8mr · CVE-2026-34209
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
The tempo/session cooperative close handler validated the close voucher amount using < instead of <= against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.
Patches
Fixed in 0.4.11.
Workarounds
There are no workarounds available for this vulnerability.
References
- WEB https://github.com/wevm/mppx/security/advisories/GHSA-mv9j-8jvg-j8mr
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34209
- WEB https://github.com/wevm/mppx/commit/94088246ee18f21b5d6be40d9e7a464f5a280bfb
- PACKAGE https://github.com/wevm/mppx
- WEB https://github.com/wevm/mppx/releases/tag/mppx@0.4.11
Ready to move
Start Securing
Free, no credit card | First findings in minutes