Listen to this Post
When the mpp Elixir library is configured as fee payer (fee_payer: true), the `MPP.Methods.Tempo` payment method co-signs and broadcasts a client-supplied EVM transaction without first validating that the client-supplied `gas_limit` is sufficient to complete the intended call. A malicious client can submit a signed `transferWithMemo` transaction with `gas_limit` deliberately set just below the amount required for successful execution. The server co-signs the transaction and broadcasts it via rpc_broadcast_sync. The transaction runs out of gas during EVM execution and reverts, but the fee-payer wallet is still charged for the burned gas while the client pays nothing and receives no resource. Repeated requests from one or more malicious clients drain the fee-payer wallet at near-zero cost to the attacker, ultimately preventing the server from sponsoring gas for legitimate payment requests. The `wait_for_confirmation = false` (optimistic) path is also affected: it invokes `simulate_payment_call` via eth_call, but that simulation omits the `gas` parameter and therefore does not catch out-of-gas conditions. This issue affects mpp from version 0.2.0 before 0.6.0. The vulnerable code path is `broadcast_and_verify/7` in mpp/methods/tempo.ex. A `transferWithMemo` call on Tempo Moderato testnet requires approximately 51,299 gas to complete successfully. By setting gas_limit = 51,298, the transaction gets cosigned and broadcast by the server, runs out of gas during EVM execution, all state reverts, the server’s fee-payer wallet is charged for gas used, and the client pays nothing and receives no resource. Unlike gas draining with access list or padding, where the malicious client needs to complete a payment to drain the gas, this vulnerability allows malicious users to continuously drain the server’s gas at virtually no financial cost, requiring only computing power. An attacker can spawn N malicious clients to completely drain the funds from the server’s wallet to perform a Denial of Service attack. Once the server’s wallet is empty, it has no more funds to pay the gas fees for upcoming requests from legitimate clients.
DailyCVE Form:
Platform: ZenHive mpp
Version: 0.2.0-0.5.x
Vulnerability: Missing gas validation
Severity: High
date: 2026-07-17
Prediction: Patch in 0.6.0
What Undercode Say:
Analytics
Run the PoC unzip mpp_elixir_low_gas_PoC.zip cd mpp_elixir_low_gas_PoC docker build -t mpp-elixir-low-gas . docker run --rm mpp-elixir-low-gas
Run the DoS PoC unzip mpp_elixir_low_gas_dos_PoC.zip cd mpp_elixir_low_gas_dos_PoC docker build -t mpp-elixir-dos . docker run --rm mpp-elixir-dos
Vulnerable code path broadcast_and_verify/7 in mpp/methods/tempo.ex (ZenHive/mpp 0.4.0) When wait_for_confirmation = true (default), calls rpc_broadcast_sync directly without any gas-adequacy check or simulation. The wait_for_confirmation = false path calls simulate_payment_call via eth_call, but omits the gas parameter.
Exploit: (Educational Purposes!)
Submit a signed `transferWithMemo` transaction with `gas_limit = 51,298` to a fee-payer-enabled Tempo Moderato endpoint. The server co-signs and broadcasts the transaction, which runs out of gas and reverts. The fee-payer wallet is charged for the burned gas. Repeat with multiple clients to drain the wallet at zero cost.
Protection:
Upgrade ZenHive mpp to version 0.6.0 or later where `gas_limit` validation has been added. If an upgrade is not immediately possible, disable the `fee_payer` feature by setting `fee_payer: false` or restrict its use to authenticated callers only. Configure network firewalls or API gateway rules to limit access to the mpp service, allowing only trusted clients to submit transaction requests.
Impact:
A malicious client can drain the server’s fee-payer wallet without any financial cost, causing a Denial of Service for legitimate clients who can no longer have their gas fees sponsored.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
