MPP.Methods.EVM.verify/2 accepts a transaction hash as a credential and authenticates a client by matching only the token and amount or native value of the transaction, without binding the proof to a specific challenge or recording prior use. Because of this, an attacker can reuse a settled on‑chain transfer to satisfy any later on‑chain payment challenge and obtain paid resources repeatedly without paying. The flaw effectively allows unauthenticated remote clients to bypass payment verification entirely.

ZenHive mpp versions starting with 0.3.0 up to and including 0.6.2 are vulnerable. The product is the multi‑purpose payment protocol (mpp) released by ZenHive. Any installation of these versions that processes ERC‑20 or native token transfers via the EVM payment method is at risk.

The CVSS score is 8.7, classifying the issue as high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, yet the attack vector is remote and unauthenticated; an adversary only needs to obtain the transaction hash from a public block explorer. Once the hash is known, replaying the transaction against future challenges requires no additional privileges or credentials, making exploitation relatively straightforward.