The vulnerability stems from improper validation of the max_fee_per_gas and max_priority_fee_per_gas parameters in the ZenHive mpp library. When the library is configured as a fee payer, it re-signs incoming transactions without checking that the gas ceilings are reasonable. A malicious client can embed arbitrarily large values for these fields; the server co-signs and broadcasts, billing itself at the inflated rates. This single request can exhaust the fee‑payer wallet, cutting off gas sponsorship for legitimate requests. The weakness is classified as CWE‑1284 and results in financial loss to the server operator.

Affected vendors: ZenHive. Product: mpp library. Affected versions are 0.2.0 up to but not including 0.6.0. Versions 0.6.0 and later contain the fix that forces validation of gas price ceilings.

The CVSS score is 8.3, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation under current data, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the attack requires only an unauthenticated request to a server configured as a fee payer, an attacker can drain the wallet with a single crafted transaction. The impact is loss of available funds and interruption of legitimate service. The low EPSS does not eliminate the risk in environments that expose the mpp library to the public; regular monitoring and prompt patching are prudent.