EEF-CVE-2026-73829

## Summary

Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses.

The `type="hash"` credential path in `MPP.Methods.Tempo.verify/2` guards against replay with a non-atomic check-then-mark sequence: `check_hash_unused/2` reads the dedup store, an `eth_getTransactionReceipt` round trip verifies the payment on chain, and only then does `mark_hash_used/2` write the mark. Concurrent requests carrying the same settled payment hash all pass the read before any of them writes, so each is issued a receipt. The store's atomic `check_and_mark/2` primitive is available and used by the `type="transaction"` path, but the hash path calls plain `get` and `put` even when the configured store implements it. Exploitation requires a dedup store to be configured; the default `nil` store is stateless and documented as offering no replay protection at all.

This issue affects mpp: from 0.2.0 before 0.6.1.

## Configurations

The race is only reachable when `MPP.Methods.Tempo` is configured with a dedup store (`"store"` in `method_config`). The default is `nil`, which runs the library statelessly and provides no application-level replay protection at all, a documented property rather than part of this issue.