An unauthenticated remote client can exploit a resource allocation flaw in ZenHive mpp's Tempo FeePayerPolicy, allowing multiple concurrent sponsored payments to drain the fee‑payer wallet. The policy limits resource usage per individual transaction but does not account for aggregate exposure across concurrent requests, thereby allowing the sponsor wallet to be depleted by several concurrent transactions. This vulnerability, classified as CWE‑770, can lead to loss of funds and denial of service for legitimate payers once the sponsor wallet is empty.

The issue impacts ZenHive mpp versions starting from 0.2.0 up to, but not including, 0.12.0. Only the mpp library is affected; the vulnerability is tied to its Tempo.FeePayerPolicy component and the reserve_hash_atomic/2 mechanism that prevents duplicate broadcasts of the same signed transaction but not distinct sponsored transactions with different expiring nonces.

The CVSS score of 8.3 indicates high severity, but no EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalogue. An attacker would need network access to the mpp service, the ability to send sponsored payment transactions, and the capacity to issue them concurrently to fully drain the sponsor wallet. Successful exploitation would compromise confidentiality and integrity of the sponsor wallet and cause availability disruption for all legitimate payment users.