Executive brief
ZenHive's mpp is a payment processing system that sponsors transactions on behalf of clients to reduce their costs. A vulnerability allows unauthenticated attackers to manipulate sponsored payments so the fee-payer covers dramatically inflated gas costs (up to 40x higher) and unknowingly pays for unauthorized account upgrades. This could expose payment sponsors to substantial unexpected costs and loss of control over their accounts.
Technical details
The vulnerability is an improper input validation flaw in the fee_payer_policy.ex module. When validating 0x76 envelope transactions, the server bounds gas fields, fee budgets, and validity windows, but fails to validate the aa_authorization_list field. This list contains EIP-7702 account delegations that incur intrinsic gas charges before the payment executes. An unauthenticated remote client can attach arbitrary delegations from throwaway keys to force the sponsor to pay for them; at typical settings (7 entries), this inflates costs from ~46,575 gas to ~1.88M gas. Additionally, each delegation is applied as a persistent set-code operation, allowing the client to upgrade its own accounts at the sponsor's expense. The issue affects mpp versions 0.2.0 through 0.16.0; a patch is available in 0.16.1+.
Affected products
- ZenHive mpp 0.2.0 through 0.16.0
Timeline
- 2026-09-06: disclosed
- 0.16.1: patched: Fix available in version 0.16.1 and later