CVE-2026-73829: ZenHive MPP Race Condition Vulnerability

CVE-2026-73829 Overview

CVE-2026-73829 is a Time-of-check Time-of-use (TOCTOU) race condition [CWE-367] in the ZenHive mpp library. The flaw resides in the MPP.Methods.Tempo.verify/2 function, which validates on-chain payment hashes before granting access to paid resources. An unauthenticated remote client can submit concurrent requests carrying the same settled payment hash and receive multiple valid receipts. The vulnerability affects mpp versions from 0.2.0 before 0.6.1.

Critical Impact
Attackers can redeem a single confirmed blockchain payment for multiple paid-resource accesses, undermining the economic integrity of services relying on mpp for payment verification.

Affected Products

ZenHive mpp versions 0.2.0 through 0.6.0
Deployments configured with a stateful dedup store using the type="hash" credential path
Services relying on MPP.Methods.Tempo.verify/2 for on-chain payment replay protection

Discovery Timeline

2026-08-19 - CVE-2026-73829 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73829

Vulnerability Analysis

The vulnerability stems from a non-atomic check-then-mark sequence in the hash-credential path of MPP.Methods.Tempo.verify/2. The function calls check_hash_unused/2 to read the deduplication store, then performs an eth_getTransactionReceipt round trip to verify the payment on chain, and only afterward invokes mark_hash_used/2 to persist the mark. This window between check and mark allows concurrent requests to observe the same unused state.

Concurrent requests presenting the same settled payment hash all pass the read step before any writer commits the used marker. Each request is then issued a valid receipt, allowing an attacker to multiply the value of a single on-chain payment. Exploitation requires a stateful dedup store to be configured; the default nil store offers no replay protection regardless of the race.

Root Cause

The store exposes an atomic check_and_mark/2 primitive that is correctly used by the type="transaction" credential path. The type="hash" path instead calls plain get and put operations, even when the configured store implements the atomic primitive. This inconsistency is the root cause of the TOCTOU condition.

Attack Vector

An unauthenticated remote attacker submits multiple parallel requests to the paid-resource endpoint, each carrying the same confirmed on-chain payment hash. Because the network attack vector requires no privileges or user interaction, exploitation scales trivially with concurrency. Success depends on request timing falling within the window between check_hash_unused/2 and mark_hash_used/2.

text

            {:ok, receipt} <- rpc_fetch_receipt(hash, rpc_url, rpc_options(config)),
            :ok <- check_receipt_status(receipt),
            {:ok, _transfer} <- find_matching_transfer(receipt, charge, memo),
-           :ok <- mark_hash_used(store, hash) do
+           :ok <- commit_hash_used(store, hash) do
         {:ok, Receipt.new(method: "tempo", reference: hash, external_id: charge.external_id)}
       end
     end

Source: GitHub Commit Details. The patch replaces the non-atomic mark_hash_used/2 call with commit_hash_used/2, which routes through the store's atomic commit primitive.

Detection Methods for CVE-2026-73829

Indicators of Compromise

Multiple successful receipt issuances referencing the same on-chain transaction hash within a short time window.
Repeated eth_getTransactionReceipt RPC calls for identical hashes originating from the same or coordinated client sources.
Discrepancies between the count of issued tempo receipts and unique settled payments recorded on chain.

Detection Strategies

Instrument MPP.Methods.Tempo.verify/2 with correlation logging that ties each issued receipt to its payment hash and request timestamp.
Alert when concurrent verification requests for the same hash exceed one within a bounded interval.
Reconcile issued receipts against unique on-chain transaction hashes on a scheduled basis to identify replay artifacts.

Monitoring Recommendations

Monitor application logs for burst patterns of identical hash credential submissions arriving in parallel.
Track RPC provider metrics for duplicate receipt lookups keyed on the same transaction hash.
Audit dedup store contents to confirm each settled hash is marked used exactly once.

How to Mitigate CVE-2026-73829

Immediate Actions Required

Upgrade mpp to version 0.6.1 or later, which routes the hash credential path through the atomic commit primitive.
Inventory all services embedding mpp and confirm the configured dedup store implements check_and_mark/2.
Review recent receipt issuance logs to identify any duplicate redemptions against a single on-chain payment.

Patch Information

The fix is committed in ZenHive/mpp commit 46c5b0e and documented in the GitHub Security Advisory GHSA-w8j7-7qc3-5f24. The patch replaces mark_hash_used/2 with commit_hash_used/2 in lib/mpp/methods/tempo.ex, ensuring the deduplication step uses the store's atomic primitive. See the CNA ERLef advisory and OSV record EEF-CVE-2026-73829 for coordinated disclosure metadata.

Workarounds

Serialize verification requests per payment hash at the application or reverse-proxy layer until the upgrade is deployed.
Configure a dedup store backed by a datastore supporting atomic conditional writes and gate type="hash" submissions behind an application-level lock.
Temporarily disable the type="hash" credential path and require the type="transaction" path, which already uses the atomic primitive.

bash

# Upgrade mpp to the patched release in mix.exs
# {:mpp, "~> 0.6.1"}
mix deps.update mpp
mix deps.get
mix compile