CVE-2026-82750: Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing.
When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/feepayerpolicy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aaauthorizationlist field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gaslimit ceiling. At the reporter's default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor's expense.
This issue affects mpp: from 0.2.0 before 0.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mppto a version that resolves this vulnerability.Fixed in 0.16.1 - Compensating control
Temporarily limit or block unauthenticated access to ZenHive mpp Tempo fee-payer sponsorship functionality to reduce the ability for clients to inflate the fee-payer's gas cost via improper quantity validation.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments that use mpp to sponsor Tempo payments are exposed if they run a version from 0.2.0 before 0.16.1. The issue is reachable by an unauthenticated remote client submitting a client-signed 0x76 envelope.
What must an attacker provide to increase sponsored costs?
The attacker can attach signed EIP-7702 delegations in the envelope's aa_authorization_list, using throwaway authority keys. Those entries are charged as intrinsic gas before the sponsored payment call executes, while the policy does not validate or bound that list.
Is the default configuration affected?
Yes. With the reporter's default of seven authorization-list entries, the sponsored cost increased from about 46,575 gas to about 1,884,087 gas, within the default gas_limit ceiling.
What is the impact beyond increased gas charges?
Each authorization entry applies a persistent set-code delegation. An attacker can therefore have the sponsor pay to upgrade the attacker's own accounts to delegated code of the attacker's choosing.