The vulnerability arises because MPP.Methods.Tempo.FeePayerPolicy enforces fee limits only on individual transactions without accounting for cumulative exposure from multiple concurrent sponsored transactions. The reserve_hash_atomic/2 function prevents duplicate broadcasts of the same transaction hash but does not prevent multiple distinct sponsored transactions with different expiring nonces. This allows an attacker to multiply the committed sponsor exposure by the number of concurrent transactions, bounded only by the default 900-second validity window during which transactions remain broadcastable and uncounted. This flaw enables an unauthenticated remote client to exhaust the fee-payer wallet, resulting in denial of service for legitimate payers.

An unauthenticated remote attacker can drain the fee-payer wallet by submitting multiple concurrent sponsored payment transactions, causing denial of service to legitimate payers once the wallet is empty. This impacts the availability of the payment service for legitimate users. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Users should monitor vendor communications for updates and consider limiting concurrent sponsored transactions if possible until a fix is available.