Authentication Bypass via Static Memo in ZenHive mpp

Executive Summary

This vulnerability is an authentication bypass by capture-replay in ZenHive's mpp software. It allows an unauthenticated third party to exploit paid resources by replaying a transfer settled by another payer. The issue occurs when a static memo is configured in Tempo, which disables per-challenge attribution binding. Normally, transfers are bound to specific challenges via an attribution nonce, but static memos skip this binding, leaving only token, recipient, amount, and memo for verification. Since Tempo transfers are public and the static memo is echoed in responses, attackers can reuse historical transaction hashes to bypass authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if your ZenHive mpp deployment uses a static memo configuration in Tempo by inspecting method_config settings. Look for configurations where a fixed memo value is set instead of per-challenge attribution. Verify if the system is running affected versions (0.6.1 to before 0.6.4).

Commands to check: Review configuration files for static memo settings, check version with `mpp --version` or inspect package metadata. Monitor for unauthenticated 402 responses echoing static memos or unusual replay patterns in transaction logs.

Useful 0 Not Useful 0

Impact Analysis

If you use ZenHive mpp with a static memo configuration in versions 0.6.1 to 0.6.3, an attacker could replay your paid transfers to access resources without your consent. This could lead to unauthorized access to services, financial loss, or misuse of your paid resources. The impact is severe because the vulnerability allows unlimited replay attacks unless mitigated by removing the static memo or enabling a deduplication store.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to paid resources through replay attacks. GDPR requires strict data access controls and authentication, while HIPAA mandates secure handling of sensitive data. The authentication bypass undermines these requirements by allowing unauthorized parties to exploit legitimate transactions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to mpp version 0.6.4 or later to apply the patch that enforces deduplication store requirements for static memo configurations.

If upgrading is not immediately possible, remove static memo configurations from Tempo method_config or enable a deduplication store like MPP.Tempo.ConCacheStore to prevent replay attacks.

Useful 0 Not Useful 0