The vulnerability arises because MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs client-supplied base fields of the 0x76 AASigned envelope, including max_fee_per_gas and max_priority_fee_per_gas, without validating that these values are within reasonable limits. This allows an attacker to embed extremely high gas price values in the signed envelope. When the server co-signs and broadcasts the transaction, it pays the inflated gas fees from the fee-payer wallet. This can lead to complete depletion of the fee-payer wallet, disabling the server's ability to sponsor gas for legitimate transactions. The issue affects versions 0.2.0 through before 0.6.0 of ZenHive mpp.

An unauthenticated remote attacker can cause the server to pay arbitrarily high gas fees from its fee-payer wallet by submitting a single crafted transaction request. This can drain the wallet entirely, resulting in denial of service for legitimate payment requests that rely on the server sponsoring gas fees.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring the mpp Elixir library as a fee payer (fee_payer: true) or implement strict validation on max_fee_per_gas and max_priority_fee_per_gas fields before co-signing transactions to prevent acceptance of unreasonably high gas price values.