CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated remote clients to exploit the ZenHive mpp by executing multiple sponsored payment transactions concurrently, which can deplete the fee-payer wallet and deny service to legitimate users. This flaw arises from inadequate throttling mechanisms that fail to limit resource allocation across concurrent requests, leading to potential financial loss for users. Organizations utilizing affected versions of mpp (from 0.2.0 to before 0.12.0) should prioritize remediation to safeguard against service disruption and unauthorized fund depletion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings (max_gas, max_fee_per_gas, max_priority_fee_per_gas, the worst-case gas_limit * max_fee_per_gas <= max_total_fee budget cap, and a validity window) against one transaction at a time, and nothing accounts for exposure across concurrent requests. reserve_hash_atomic/2 is keyed on the transaction hash, so it prevents duplicate broadcast of the same signed transaction but not N distinct sponsored transactions carrying distinct expiring nonces. Committed sponsor exposure is therefore N times max_total_fee, bounded by nothing in the library, and the default 900 second validity window lets co-signed transactions stay broadcastable and uncounted for that entire period. This issue affects mpp: from 0.2.0 before 0.12.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)