A resource allocation flaw in ZenHive mpp versions from 0.2.0 before 0.12.0 allows unauthenticated remote clients to drain the fee-payer wallet by sending multiple concurrent sponsored payment transactions. The system enforces fee limits per transaction but does not account for cumulative exposure across concurrent requests, enabling denial of service once the wallet is depleted.