Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.

When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.

The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions.

This issue affects mpp: from 0.2.0 before 0.6.0.
Published: 2026-07-17
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper validation of the gas_limit field in ZenHive mpp’s Tempo payment method allows a remote client to supply a signed EVM transaction with a gas limit below what is necessary for successful execution. The server co-signs and broadcasts the transaction; it runs out of gas during execution and reverts, but the fee‑payer wallet is still charged for the burned gas. The attacker pays nothing and receives no resource, while the fee‑payer wallet gradually drained. Repeated requests can exhaust the wallet, causing the server to be unable to sponsor gas for legitimate payment requests. This vulnerability is a CWE-1284 type weakness involving improper validation of specified quantity in input.

Affected Systems

The vulnerability affects the ZenHive mpp Elixir library when the fee_payer option is enabled. It applies to all releases from version 0.2.0 up to, but excluding, 0.6.0. The flaw is present in the MPP.Methods.Tempo component of the library.

Risk and Exploitability

With a CVSS score of 8.2 the issue is considered high severity, yet the EPSS score of less than 1% indicates a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated remote attacker sending a signed transferWithMemo transaction with a deliberately low gas_limit to the mpp service, requiring only network access. Repeating this action drains the fee‑payer wallet and denies service to legitimate clients.

Generated by OpenCVE AI on August 1, 2026 at 08:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ZenHive mpp to version 0.6.0 or later, where gas_limit validation has been added.
  • If an upgrade is not immediately possible, disable the fee_payer feature by setting fee_payer: false or restrict its use to authenticated callers only.
  • Configure network firewalls or API gateway rules to limit access to the mpp service, allowing only trusted clients to submit transaction requests.

Generated by OpenCVE AI on August 1, 2026 at 08:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Zenhive
Zenhive mpp
Vendors & Products Zenhive
Zenhive mpp

Fri, 17 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Description Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients. When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests. The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions. This issue affects mpp: from 0.2.0 before 0.6.0.
Title Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
First Time appeared Zenhive
Zenhive mpp
Weaknesses CWE-1284
CPEs cpe:2.3:a:ZenHive:mpp:*:*:*:*:*:*:*:*
Vendors & Products Zenhive
Zenhive mpp
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Zenhive Mpp
Zenhive Mpp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-18T04:12:42.459Z

Reserved: 2026-07-04T04:24:03.653Z

Link: CVE-2026-59252

cve-icon Vulnrichment

Updated: 2026-07-17T12:20:25.349Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T08:30:03Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input