mpp vulnerabilities

A vulnerability in the ZenHive mpp library allows an unauthenticated remote attacker to drain the fee-payer wallet in a single request by specifying an arbitrarily high gas price. The library does not validate the max_fee_per_gas and max_priority_fee_per_gas fields before co-signing the transaction, causing the server's wallet to be charged inflated costs.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to inflate the fee-payer's gas cost by adding a large number of fabricated EIP-2930 access list entries. The server co-signs the transaction without validating the list length or contents, leading to a multiple increase in gas costs.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to drain the fee-payer wallet by submitting EVM transactions with a deliberately low gas limit. The server co-signs and broadcasts the transaction, which fails due to out-of-gas, but the fee-payer wallet is charged for the burned gas while the attacker pays nothing. This leads to denial of service for legitimate clients as the fee-payer wallet runs out of funds.