CyberRota Analysis
AI-GeneratedZenHive mpp is vulnerable to improper validation of input, allowing unauthenticated remote clients to significantly inflate the gas costs incurred by the fee-payer during sponsored payments. By exploiting this flaw, attackers can force sponsors to pay for excessive gas fees associated with arbitrary EIP-7702 account delegations, potentially raising costs from approximately 46,575 gas to over 1.8 million gas per transaction. Organizations using affected versions of ZenHive mpp (from 0.2.0 to before 0.16.1) should prioritize patching this vulnerability to mitigate financial exposure and prevent unauthorized account upgrades.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aa_authorization_list field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gas_limit ceiling. At the reporter's default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor's expense. This issue affects mpp: from 0.2.0 before 0.16.1.