{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/zenhive/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zenhive:mpp:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mpp (\u003e= 0.2.0, \u003c 0.6.0)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","blockchain","elixir","vulnerability"],"_cs_type":"advisory","_cs_vendors":["ZenHive"],"content_html":"\u003cp\u003eThe mpp Elixir package (ZenHive/mpp), specifically versions 0.2.0 through 0.5.x, contains a critical vulnerability in its transaction broadcasting mechanism. When the server acts as the designated fee payer for client-initiated operations, it fails to validate whether the \u003ccode\u003egas_limit\u003c/code\u003e provided by the client is sufficient to complete the transaction execution on the blockchain.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by crafting a transaction with a \u003ccode\u003egas_limit\u003c/code\u003e slightly lower than the required threshold for a successful operation. The server cosigns and broadcasts the transaction, which subsequently fails during execution due to out-of-gas conditions. Despite the transaction failure and the resulting state revert, the server's fee-payer wallet is still charged for the consumed gas. Because the attacker does not pay for this execution, they can automate this process across multiple clients to drain the server's funds, effectively performing a denial-of-service attack that prevents legitimate users from processing transactions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker initializes a client instance capable of interacting with the mpp service.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a target contract method that requires a known amount of gas (e.g., \u003ccode\u003etransferWithMemo\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker constructs a transaction payload with a \u003ccode\u003egas_limit\u003c/code\u003e set just below the threshold required for successful execution.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the malicious transaction payload to the mpp server, requesting the server to act as the fee-payer.\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003ebroadcast_and_verify/7\u003c/code\u003e in \u003ccode\u003empp/methods/tempo.ex\u003c/code\u003e, failing to perform a simulation or a minimum gas validation check before broadcasting.\u003c/li\u003e\n\u003cli\u003eThe transaction is broadcast to the network; the EVM execution consumes the available gas and reverts.\u003c/li\u003e\n\u003cli\u003eThe network charges the server's fee-payer wallet for the gas consumed during the failed execution.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats these steps to systematically deplete the server's wallet funds to achieve a permanent DoS state.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the financial depletion of the server's wallet, causing a complete denial-of-service for all legitimate users relying on that wallet to pay for transaction fees. The attack is highly impactful because it requires only compute resources from the attacker to initiate, rather than requiring the attacker to deposit their own funds, making it a zero-cost DoS vector against infrastructure providers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for development and infrastructure teams using mpp:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the mpp package to version 0.6.0 or later to ensure proper gas limit validation before transaction broadcasting.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003ebroadcast_and_verify/7\u003c/code\u003e logic to ensure that \u003ccode\u003ewait_for_confirmation = true\u003c/code\u003e paths perform a pre-flight gas simulation using a robust, parameter-aware \u003ccode\u003eeth_call\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement server-side rate limiting on transaction requests to prevent the rapid-fire submission of intentionally failing transactions from the same source.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for a high frequency of failed transactions originating from the same client ID or source IP, which may indicate an attempt to trigger this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-26T02:07:06Z","date_published":"2026-09-26T02:07:06Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mpp-gas-draining/","summary":"The mpp Elixir package fails to validate client-supplied gas limits before broadcasting transactions as a fee-payer, allowing attackers to drain the server's wallet through repeated out-of-gas transaction failures.","title":"ZenHive mpp Package Gas Draining and DoS Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-mpp-gas-draining/"}],"language":"en","title":"CraftedSignal Threat Feed - ZenHive","version":"https://jsonfeed.org/version/1.1"}