Improper Input Validation in ZenHive mpp Affects Gas Cost Management

CVE-2026-82750

What is CVE-2026-82750?

The improper input validation in ZenHive's mpp allows unauthenticated remote clients to exploit fee-payer gas costs during sponsored payments. Through a vulnerability in the MPP.Methods.Tempo.FeePayerPolicy, clients can inflate the gas expenses significantly when delegating account control. The gas limit is breached by the inclusion of unauthorized delegations, leading to a dramatic increase in gas costs from approximately 46,575 to 1,884,087. This enables clients to make sponsors pay for actions they did not authorize, directly impacting the sponsor's financial liabilities during transaction processes.

References