Executive brief
ZenHive mpp is a payment processing library used to handle signed transaction submissions and prevent duplicate payments. An attacker can submit the same signed transaction twice by manipulating recovery-ID encodings (v=27 vs v=0), bypassing the duplicate-submission gate in the Tempo component. Depending on how the node responds, this can result in duplicate valid payment receipts for a single on-chain transaction, leading to potential double-payment or billing fraud.
Technical details
The vulnerability exists in mpp.Methods.Tempo's reserve_hash_atomic/2 function, which keys deduplication by the raw transaction hex rather than a canonical form. The transaction deserializer accepts both ECDSA recovery-id encodings (v=27 and v=0), allowing a single signed transaction to be submitted twice with different recovery IDs, creating two distinct reserve keys that both pass the deduplication gate and reach the broadcast path. The credential replay store is deliberately carved out for Tempo, leaving only this reserve as the gate. A post-broadcast mark writes the canonical hash that the raw-keyed reserve never reads, so nodes may return duplicate Payment-Receipts for already-known transactions or trigger nonce-reuse rejections depending on node implementation.
Affected products
- ZenHive mpp 0.2.0 before 0.16.2
Timeline
- 2026-09-16: disclosed: CVE-2026-88255 published