The vulnerability is caused by improper validation of the EIP‑2930 access list length inside the ZenHive mpp library when the fee_payer configuration is enabled. An unauthenticated remote client can construct a transaction that contains an arbitrarily long and largely fabricated access list. The server blindly re‑signs the supplied envelope and broadcasts it. The gas costs for the transaction are calculated before any on‑chain code runs, therefore the fee‑payer wallet is forced to pay a large amount of gas for no additional on‑chain work, resulting in a direct financial loss for the sponsor.

ZenHive mpp versions from 0.2.0 up to, but not including, 0.6.0 are affected. Administrators who run an mpp deployment with fee_payer:true should verify whether their version falls in this range and upgrade if possible. The vulnerability does not affect deployments that have disabled the fee_payer feature or use a later version of the library.

The flaw has a CVSS score of 8.3. Its EPSS score is less than 1 %, indicating that while the vulnerability is high‑severity, real‑world exploitation is currently unlikely and not currently reported. It is not listed in the CISA KEV catalog. The attack vector requires the attacker to submit a transaction; no authentication or privileged access is needed. The impact is purely financial: each abused transaction inflates gas costs, erodes operating margins, and can deplete a fee‑payer wallet over time. Based on the description, it is inferred that the attacker can exploit this from any remote network.