Executive brief
ZenHive mpp is an Elixir library used for processing blockchain payments. A vulnerability exists where the library fails to validate certain transaction data when configured to pay for user transaction fees. An attacker can exploit this to force the service provider to pay significantly higher transaction fees than necessary, potentially draining the provider's digital wallet and destroying their operating margins.
Technical details
The vulnerability exists in the `MPP.Tempo.Transaction.cosign_fee_payer/3` function when `fee_payer` is set to true. The library re-signs client-supplied base fields of the 0x76 AASigned envelope verbatim, including the EIP-2930 access list, without validating its length or content. Because access list entries incur intrinsic gas costs charged before execution, an attacker can include a large number of fabricated entries. This results in the fee-payer wallet paying a large multiple of the expected gas cost (up to 7.4x in tested scenarios) for transactions that perform no additional on-chain work. The issue is fixed in version 0.6.0.
Affected products
- ZenHive mpp from 0.2.0 before 0.6.0
Timeline
- 2026-06-24: advisory: GitHub Security Advisory GHSA-qpxh-ff8m-c62v published
- 2026-07-17: disclosed: CVE-2026-59694 published to NVD