A critical vulnerability in ZenHive mpp allows unauthenticated remote attackers to perform unauthorized financial resource consumption by inflating gas costs during sponsored payment processing.

The flaw exists in the MPP.Methods.Tempo.FeePayerPolicy.measure/3 function, which fails to inspect the aa_authorization_list field of client-signed envelopes. This oversight allows an unauthenticated remote attacker to attach unauthorized account delegations, causing the fee-payer to cover excessive intrinsic gas costs.

Successful exploitation of this vulnerability results in direct financial loss for the service provider acting as a transaction sponsor. By forcing the sponsor to pay for inflated gas costs and persistent account delegations, an attacker can rapidly deplete operational budgets and potentially manipulate account states, leading to significant service disruption and unauthorized resource usage. The CVSS score of 8.3 reflects the high impact on integrity and availability of financial resources.

Immediate Action: Update ZenHive mpp to version 0.16.1 or later to implement proper validation of the aa_authorization_list field.

Proactive Monitoring: Monitor transaction logs for anomalous gas consumption patterns or unexpected spikes in sponsored payment costs that may indicate exploitation attempts.

Compensating Controls: Implement stricter rate limiting on sponsored payment requests and audit the configuration of fee-payer policies to ensure all fields of the client-signed envelope are properly inspected.

Public Exploit Available: No

This vulnerability presents a significant financial risk to any organization utilizing ZenHive mpp for sponsored payments. Administrators must prioritize updating to version 0.16.1 immediately to prevent attackers from leveraging this oversight to force the sponsorship of unauthorized account delegations and inflated gas fees. Failure to patch will leave the infrastructure susceptible to direct financial abuse.