Executive brief
ZenHive mpp is a blockchain payment library that allows sponsors to subsidize transaction fees for users. An unauthenticated attacker can exploit the lack of concurrent request limits to send many distinct sponsored transactions simultaneously, draining the sponsor's fee budget and blocking legitimate payments. Once the budget is empty, all sponsored transactions fail, denying service to authorized users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in the fee-payer policy enforcement of ZenHive mpp. The FeePayerPolicy.Methods.Tempo component enforces per-transaction limits (max_gas, max_fee_per_gas, max_priority_fee_per_gas, max_total_fee budget) but does not track exposure across concurrent requests. The reserve_hash_atomic/2 function uses transaction hash as a key, preventing only duplicate broadcast of the same signed transaction, not N distinct transactions with different nonces. An unauthenticated remote client can send many concurrent sponsored transactions, each within individual limits but collectively exceeding the sponsor's budget within the default 900-second validity window. An attacker can drain the fee-payer wallet and deny service to legitimate users. Fixed in version 0.12.0.
Affected products
- ZenHive mpp 0.2.0 before 0.12.0
Timeline
- 2026-08-19: disclosed