Listen to this Post
CVE-2026-59695 is a high-severity vulnerability in the ZenHive mpp Elixir library, affecting versions from 0.2.0 before 0.6.0. When the library is configured to act as a fee payer (fee_payer: true), the function `MPP.Tempo.Transaction.cosign_fee_payer/3` located in `lib/mpp/tempo/transaction.ex` (around lines 229–262) re-signs and broadcasts a client-supplied 0x76 AASigned envelope. The function fails to validate the client-provided gas_limit, max_fee_per_gas, and `max_priority_fee_per_gas` fields before cosigning the transaction. A malicious client can embed arbitrarily large values for `max_fee_per_gas` and `max_priority_fee_per_gas` in the signed envelope. The server then cosigns and broadcasts the transaction, and the `effective_gas_price` charged against the fee-payer wallet is derived from the attacker-supplied ceilings. Consequently, the server pays inflated per-gas rates from its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests, effectively causing a denial of service (DoS). The vulnerability maps to CWE-20 (Improper Input Validation) and ATT&CK T1499.004 (Unauthorized Resource Consumption). Related advisories include CVE-2026-59252 for missing `gas_limit` validation and CVE-2026-59694 for unbounded access lists, all affecting the same version range.
DailyCVE Form:
Platform: ZenHive mpp
Version: 0.4.0
Vulnerability: Gas Price Drain
Severity: High
date: 2026-07-17
Prediction: 2026-07-17
What Undercode Say:
unzip mpp_elixir_PoC.zip
cd mpp_elixir
docker build -t mpp-elixir-gasdrain .
docker run –rm mpp-elixir-gasdrain
Exploit: (Educational Purposes!)
The PoC is configured to reproduce the attack on the Tempo Moderate testnet within a Docker environment. The exploit sends a signed transaction with inflated `max_fee_per_gas` and `max_priority_fee_per_gas` values to the server. The server cosigns and broadcasts the transaction, draining its own fee-payer wallet. The following commands reproduce the proof-of-concept:
`unzip mpp_elixir_PoC.zip`
`cd mpp_elixir`
`docker build -t mpp-elixir-gasdrain .`
`docker run –rm mpp-elixir-gasdrain`
More details are available in `mpp_elixir/README.md`.
Protection: from this CVE
Upgrade the ZenHive mpp library to version 0.6.0 or later, where validation for gas pricing parameters has been added. Implement strict bounds checking for `max_fee_per_gas` and `max_priority_fee_per_gas` before accepting client-signed transactions. Apply rate limiting and monitor for unusual gas pricing patterns to prevent rapid depletion of fee-payer balances.
Impact:
By draining the server’s wallet, an attacker causes direct financial loss to the organization. If the server’s funds are drained completely, legitimate clients will have their requests fail, as the server can no longer fund future transactions, effectively creating a Denial of Service (DoS) attack.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
