Intelligence
Join the waitlist
AEV-2026-0041

ZenHive mpp Tempo fee payer sponsor never checked the EIP 7702 authorization list it co signed (CVE-2026-82750)

ZenHive mpp's Tempo fee payer policy bounded a sponsored transaction's gas, fee, validity and access list before co signing it, but never inspected the same transaction's EIP 7702 authorization list. Each signed delegation entry is charged to the sponsor as intrinsic gas and persistently upgrades the client's own account to delegated, smart contract style code. The reporter's own reproduction, seven delegations, moved the cost from about 46,575 gas to about 1,884,087 gas, roughly forty times higher, entirely inside every field the policy did check.

AESS 6.9 mediumReproducedStatus: resolvedEvent: 4 September 2026Approval ControlsExecution AuthorityDelegated Authority

Affected

Organisation
ZenHive
Product
mpp, an Elixir implementation of the Machine Payment Protocol, EIP 7702 authorization list omission
Component
MPP.Methods.Tempo.FeePayerPolicy.measure and validate, the Tempo fee payer sponsorship policy
Versions
from 0.2.0 before 0.16.1
Configurations
A server operating the Tempo fee payer sponsorship path, an opt in deployment choice a server must have enabled for the vulnerability to apply; A client signed 0x76 transaction envelope carrying a non empty EIP 7702 authorization list alongside the fields the policy does check

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
A client submits a Tempo transaction for the server to sponsor, paying the client's own gas in exchange for the transaction meeting the server's fee payer policy
Agent
unknown
Delegating actor
unknown
Action
Attached a non empty EIP 7702 authorization list, up to the reporter's own tested seven entries, to the client signed transaction the sponsor's policy evaluated and then co signed
Target resource
The client's own account, upgraded to delegated, smart contract style code by each signed authorization list entry, and the sponsor's own gas budget
Environment
A server deployment of mpp with Tempo fee payer sponsorship enabled
Credentials used
unknown
Privileges available
Ordinary client side privileges sufficient to construct and sign a Tempo transaction
Authority presented
The sponsor's own policy decision that the transaction's gas, fee, validity window and access list fell inside its configured bounds
Authority required
A distinct, applicable grant covering whether the sponsor's co signature may also fund and authorize a persistent EIP 7702 account delegation, separate from the grant covering the payment itself
Applicable policy
MPP.Methods.Tempo.FeePayerPolicy.measure and validate, which the reporter's own advisory and this record's own direct read of the fix commit confirm evaluated gas, fee, validity and access list but not the authorization list before the fix
Approval mechanism
Automated policy check, not human review
Required approver
unknown
Independent approval
no
Action binding
The sponsor's own co signature covers the complete, unmutated transaction it signs, including the authorization list, whether or not its own policy evaluated that field
Sequence context
Policy evaluation and co signing occurred in one automated step, with no re-evaluation of the authorization list at any later point before broadcast

Impact

Consequence
material
Reach
single
Reversibility
unknown
Detectability
unknown
Propagation
potential
Recovery
Not established by anything available to this record. Whether a persistent EIP 7702 delegation created this way can be reset by the account owner submitting a further authorization to a null delegate is a general property of EIP 7702 this record does not treat as evidenced for this specific occurrence.

Evidence

Primary sources

Supporting sources

Reproduction status
Reported by the advisory's own author, kai-kka, as a reproduced gas cost measurement at a default of seven EIP 7702 delegation entries. This session independently fetched the GHSA advisory directly and independently fetched and read the fix commit directly, confirming the mechanism and the added checks, but did not itself reproduce the gas figures against a running mpp instance.
Evidence state
Reproduced

Known unknowns

  • Whether either vulnerability has been exploited outside the reporter's own disclosed reproduction. Nothing available to this record states active exploitation.
  • Whether a formal CVE Program or NVD record for CVE-2026-82750 states a field name of tempo_authorization_list or aa_authorization_list; independently corroborated search results state each name in a different secondary account, and direct fetch of cve.org and nvd.nist.gov was blocked in this session.
  • The exact CWE assignment on the formal CVE record: the GHSA advisory itself states CWE-20, while independently corroborated search results attribute CWE-1284 to the CVE record specifically.
  • Whether the delegated account's code can be reset by the account owner, and what happens to a delegation already relied upon by a further transaction before any reset.

Limitations

  • Direct fetch of the GHSA advisory and of the fix commit succeeded in this session; direct fetch of cve.org, nvd.nist.gov and several third party CVE aggregators did not, so the CVSS score, the CVE identifier's formal metadata and the exact CWE assignment rest on independently corroborated search results rather than a direct read of the CVE Program's own record.

Claim provenance