ZenHive mpp CVE-2026-59694

Exploitation requires the mpp server to be deployed as fee payer (fee_payer: true), invoking MPP.Tempo.Transaction.cosign_fee_payer/3 to sponsor gas for Tempo transactions on affected versions 0.2.0 through 0.5.x. No authentication is required (PR:N) and the attacker is an ordinary remote client submitting a valid transferWithMemo transaction whose 0x76 AASigned envelope carries a large EIP-2930 access list (up to 137 entries within Bandit's 10,000-byte per-header-field limit). Limiting factors: the flaw is inert on deployments not acting as fee payer, has no effect on confidentiality or on the executed transfer itself, and its harm is economic and cumulative - a single transaction only costs the sponsor a multiple of one fee, so meaningful damage requires sustained repeated abuse.

This is a credible but bounded financial-abuse risk rather than a system-compromise flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L) correctly reflects network reachability, no privileges, and no confidentiality impact; the AT:P (attack requirement) captures the key precondition that the server must be running as fee payer. EPSS and KEV data were not provided, and no POC or active-exploitation signal is present, so this should be treated as no public exploit identified at time of analysis - targeted economic abuse, not mass exploitation. Note a modeling nuance to verify with the vendor: the real-world impact is financial/resource exhaustion (wallet draining), which maps more naturally to an availability/economic-DoS impact than to the integrity-high rating in the official CVSS 4.0 vector; the underlying transfer executes normally, so no data integrity is violated. Priority is high specifically for organizations running mpp as a gas sponsor on low-margin payments.

A server operator runs mpp as a fee payer to sponsor gas for user payments. A malicious client submits a legitimate transferWithMemo call but pads the EIP-2930 access list with 137 fabricated address entries; the server co-signs and broadcasts it, and the transfer succeeds while the fee-payer wallet pays about 380,087 gas instead of ~51,287 (7.4x) at 100 Gwei. Repeating this at scale steadily erodes the sponsor's margin and drains the wallet; no public POC is identified, but the advisory documents exact parameters.