EUVD-2026-45160
GHSA-vp7w-82cm-hj3h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network request to a sponsor endpoint (PR:N, AV:N, AC:L) causes only availability loss via wallet drain (A:H); no data confidentiality or integrity impact, and scope stays within the vulnerable server.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of service for legitimate clients.
When the mpp Elixir library is configured as fee payer (fee_payer: true), the MPP.Methods.Tempo payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied gas_limit is sufficient to complete the intended call. A malicious client can submit a signed transferWithMemo transaction with gas_limit deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests.
The wait_for_confirmation = false (optimistic) path is also affected: it invokes simulate_payment_call via eth_call, but that simulation omits the gas parameter and therefore does not catch out-of-gas conditions.
This issue affects mpp: from 0.2.0 before 0.6.0.
AnalysisAI
Wallet-draining denial of service in ZenHive mpp (Elixir library) versions 0.2.0 through 0.5.x affects deployments configured as a Tempo fee payer (fee_payer: true), where the MPP.Methods.Tempo method co-signs and broadcasts a client-supplied EVM transaction without verifying the client's gas_limit is high enough to complete execution. An unauthenticated remote client can submit a signed transferWithMemo transaction with gas_limit set just below the required amount, causing an on-chain out-of-gas revert that still charges the sponsor's fee-payer wallet while the attacker pays nothing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The server must be deployed as a Tempo fee payer with fee_payer: true and using the MPP.Methods.Tempo payment method on mpp versions 0.2.0 through 0.5.x; the attacker submits a validly client-signed transferWithMemo (0x76 envelope) EVM transaction with gas_limit deliberately set just below the amount required for the call to complete, which the server co-signs and broadcasts via rpc_broadcast_sync (the optimistic wait_for_confirmation = false path is also affected because its eth_call simulation omits the gas parameter). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scores 8.2 (High) and is internally consistent with the description: network-reachable (AV:N), unauthenticated (PR:N), no user interaction (UI:N), a present attack requirement (AT:P - the server must be running as a Tempo fee payer and the attacker must tune gas_limit just below the execution threshold), and impact confined to availability (VA:H) with no confidentiality or integrity effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A server running mpp 0.2.0-0.5.x as a Tempo fee payer exposes its sponsored-payment endpoint to the network. An unauthenticated attacker crafts and signs a transferWithMemo (0x76) transaction with gas_limit set just below the amount needed to complete, submits it, and the server co-signs and broadcasts it; the transaction runs out of gas and reverts on-chain while the sponsor wallet is charged for the burned gas. … |
| Remediation | Upgrade mpp to 0.6.0 or later (Vendor-released patch: 0.6.0); the fix is in commit d84e3e528db39654540c2035ea0fbdf7b950d3d1, which adds pre-broadcast simulation of the full co-signed sponsored transaction via eth_simulateV1 on both the synchronous and optimistic paths so a transaction that would revert on-chain is rejected before the sponsor commits any gas, with graceful degradation if the node lacks eth_simulateV1 (JSON-RPC -32601) and fail-closed behavior on other RPC errors; note this release also advanced the onchain_tempo dependency to ~> 0.3 for the sender-recovery and simulate-request primitives. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ZenHive mpp deployments running versions 0.2.0 through 0.5.x configured with fee_payer: true and review wallet transaction history for suspicious fund drainage patterns or repeated low-gas submissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Economic resource exhaustion in the ZenHive mpp Elixir library (versions 0.2.0 through 0.5.x) lets an unauthenticated re
Fee-payer wallet draining in ZenHive mpp (Elixir) 0.2.0-0.5.x lets an unauthenticated remote client empty the sponsor's
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today