[Agricola] AGR-2026-088: Pull transactions are broadcast before payment validation

[mpp-agricola]

AGR-2026-088 — Pull transactions are broadcast before payment validation

Last observed by the head-to-head audit at 2026-08-31T09:17:02.596794Z.

Audited heads

Target	Repository	Commit	Conformance	Semantic review
typescript	wevm/mppx	f13f800fed4a	Complete	Reference
java	stripe/mpp-java	2fe0a4bcb503	Complete	Complete
go	tempoxyz/mpp-go	77370bdd45f7	Complete	Complete
python	tempoxyz/pympp	bafb31ad9bff	Complete	Complete
ruby	stripe/mpp-rb	72cf0dd7274f	Complete	Complete
rust	tempoxyz/mpp-rs	089cb96e05b9	Complete	Complete

Finding

• Fingerprint: semantic:tempo-charge/prebroadcast-transaction-validation
• Source: semantic
• Affected SDKs: java
• Clean SDKs: none
• Not reported by semantic review: go, python, ruby, rust
• Canonical reference: draft-tempo-charge-00 § Transaction Verification
• Severity: high
• Confidence: high

Evidence

SDK	Canonical evidence	SDK evidence	Suggested test
java	validateTransactionCredential — Deserializes the submitted Tempo transaction, requires a sender signature, matches its transfer calls against the challenge, and simulates or fee-payer-validates it before returning it for broadcast.	verifyTransaction — Calls sendRawTransaction before awaitReceipt performs any currency, recipient, sender, or amount validation.	Submit a validly signed Tempo transaction that transfers the wrong token or recipient as a type=transaction credential; assert that verification fails without invoking eth_sendRawTransaction.

java: For a transaction credential, the target immediately submits the signed transaction and only validates its eventual receipt logs afterward. Canonical mppx deserializes the transaction, verifies its signature and required transfer calls, and simulates it before broadcast. Consequently, the target can broadcast an unrelated or malformed signed transaction supplied as a payment credential even though it later rejects that transaction as payment.

Available /ag commands

Post a command as a new comment. Only configured maintainers can run these commands.

Command	What it does
/ag status	Reports the current state of linked remediation pull requests.

/ag fix is unavailable for java because the affected SDK is configured for notification-only automation.

[ygd58]

Same fingerprint/root cause as #113 (AGR-2026-037), same audited commit (2fe0a4bcb503), same verifyTransaction/sendRawTransaction code path. Already has an open fix: stripe/mpp-java#18 (by @burak33bb) — should close this once merged.