The vulnerability in ZenHive mpp arises because the MPP.Tempo.Transaction.cosign_fee_payer/3 function re-signs client-supplied base fields of the 0x76 AASigned envelope, including the EIP-2930 access list, without validating its length or contents. Since EIP-2930 access list entries incur intrinsic gas costs regardless of execution, a malicious client can submit a valid transferWithMemo call with a large number of fabricated access-list entries. The server co-signs and broadcasts the transaction, resulting in the fee-payer paying a gas cost multiplied by up to 7.4 times the expected amount. This affects versions from 0.2.0 up to but not including 0.6.0.

An unauthenticated attacker can cause the fee-payer wallet to pay significantly inflated gas fees per transaction by submitting transactions with large fabricated access lists. This leads to a substantial increase in operating costs for the sponsor, potentially destroying the operating margin on low-cost payments and draining the fee-payer wallet over time. The intended transfer executes normally, so the attack is financially damaging without disrupting transaction functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or implement custom validation of access-list entries before co-signing transactions to prevent inflated gas costs. Monitor for updates from ZenHive regarding patches or official mitigations.