CVE-2026-59252: ZenHive mpp Fee-Payer DoS Vulnerability

CVE-2026-59252 Overview

CVE-2026-59252 affects the ZenHive mpp Elixir library when configured with fee_payer: true. The MPP.Methods.Tempo payment method co-signs and broadcasts client-supplied EVM transactions without validating that the client-supplied gas_limit is sufficient for execution. An unauthenticated remote attacker can submit a signed transferWithMemo transaction with an intentionally insufficient gas_limit. The transaction runs out of gas and reverts on-chain, but the fee-payer wallet is still charged for the burned gas. Repeated abuse drains the fee-payer wallet, causing denial of service for legitimate clients. The flaw is tracked under [CWE-1284: Improper Validation of Specified Quantity in Input].

Critical Impact
Unauthenticated attackers can drain the server's fee-payer wallet at near-zero cost, preventing sponsorship of gas for legitimate payment requests.

Affected Products

ZenHive mpp Elixir library versions 0.2.0 through 0.5.x
Deployments configured with fee_payer: true
Services using the MPP.Methods.Tempo payment method

Discovery Timeline

2026-07-17 - CVE-2026-59252 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-59252

Vulnerability Analysis

The vulnerability resides in the fee-payer path of the MPP.Methods.Tempo module. When fee_payer: true, the server co-signs a client-supplied EVM transaction and broadcasts it through rpc_broadcast_sync. The server never verifies that gas_limit is high enough to complete the intended call. An attacker crafts a signed transferWithMemo transaction with gas_limit set just below the amount required for successful execution. The Ethereum Virtual Machine (EVM) begins execution, exhausts gas, and reverts. The fee-payer wallet is still debited for the consumed gas, while the client pays nothing and receives no service. The issue impacts mpp from version 0.2.0 before 0.6.0.

Root Cause

The root cause is missing pre-broadcast validation of the client-supplied gas_limit against the actual gas required by the transaction. The optimistic path (wait_for_confirmation = false) is also affected. It invokes simulate_payment_call via eth_call, but the simulation omits the gas parameter and therefore cannot detect out-of-gas conditions before broadcast.

Attack Vector

The attack requires no authentication and can be executed by any remote client that can submit signed transactions to the server. The attacker repeatedly submits transactions with under-provisioned gas_limit values. Each reverted transaction burns fee-payer funds until the wallet is depleted. Legitimate payment requests are then rejected because the server can no longer sponsor gas.

text

-  "onchain_tempo": {:hex, :onchain_tempo, "0.6.0", ...},
+  "onchain_tempo": {:hex, :onchain_tempo, "0.7.0", ...},

Source: GitHub Commit Reference. The patch bumps onchain_tempo to 0.7.0 as part of adding fee-payer pre-broadcast simulation of co-signed Tempo transactions.

Detection Methods for CVE-2026-59252

Indicators of Compromise

Repeated on-chain transaction reverts with out of gas status from the fee-payer wallet address
Rapid decline in fee-payer wallet balance without corresponding successful transferWithMemo completions
Bursts of co-signed transactions from a small set of client identities with gas_limit values clustered just below required execution cost
Elevated rate of rpc_broadcast_sync calls followed by revert events

Detection Strategies

Correlate fee-payer wallet debits against successful vs. reverted transaction receipts and alert when revert ratio exceeds a baseline threshold
Instrument MPP.Methods.Tempo to log the client-supplied gas_limit, the estimated gas from eth_estimateGas, and the delta prior to broadcast
Monitor Ethereum node logs for repeated reverts sharing the same fee-payer signer

Monitoring Recommendations

Track fee-payer wallet balance and set alerts on abnormal burn rate
Aggregate revert events by client source IP or API key to identify abuse patterns
Ingest EVM RPC logs into a centralized analytics platform for longitudinal analysis of gas consumption anomalies

How to Mitigate CVE-2026-59252

Immediate Actions Required

Upgrade the mpp Elixir library to version 0.6.0 or later, which adds pre-broadcast gas simulation for co-signed Tempo transactions
If upgrade is not immediately possible, disable the fee_payer: true configuration until patched
Review fee-payer wallet transaction history for reverts and estimate financial impact

Patch Information

The fix is delivered in mpp version 0.6.0, which introduces pre-broadcast simulation of co-signed Tempo transactions to validate that the client-supplied gas_limit is sufficient. See the GitHub Security Advisory, the GitHub Commit Reference, and the OSV Vulnerability Report for details.

Workarounds

Set fee_payer: false and require clients to pay their own gas until upgrading
Introduce a request-level allowlist or authentication layer in front of the payment endpoint to limit unauthenticated submissions
Add application-level rate limiting on transferWithMemo submissions per client identity
Reject transactions whose gas_limit is below a locally computed eth_estimateGas value plus a safety margin

bash

# Update mpp to the patched version in mix.exs
# {:mpp, "~> 0.6.0"}
mix deps.update mpp
mix deps.get