Paid resource access via transaction replay

Authentication bypass in ZenHive mpp before 0.6.3 allows remote attackers to obtain paid resources by replaying a settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and treats any receipt with matching token, recipient, and amount or value as valid, without binding that proof to the current challenge or recording prior use. Unauthenticated reachability to a static-price route is sufficient, so a historical matching transfer visible on a public block explorer can satisfy later charges and grant repeated paid access.