The vulnerability in ZenHive mpp (versions 0.3.0 through before 0.6.3) involves the MPP.Methods.EVM.verify/2 function, which accepts a transaction hash as credential and validates a transfer based solely on token, recipient, and amount parameters. It does not bind the proof to the specific verification challenge nor maintain a record of prior use. The generic MPP.Plug deduplication store keys on challenge.id, which is regenerated for every 402 response, allowing reuse of a single historical transfer to satisfy multiple later charges. Since transfers are publicly visible on block explorers, an attacker can capture and replay these to bypass authentication and gain paid resources without authorization.

An unauthenticated remote attacker can bypass authentication controls by replaying a previously settled on-chain transfer transaction. This allows the attacker to obtain paid resources multiple times without making new payments, leading to unauthorized resource consumption and potential financial loss for the service provider.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional verification mechanisms that bind proofs to specific challenges and track prior use to prevent replay attacks. Monitoring for unusual repeated use of the same transaction hashes may help detect exploitation attempts.