GitHub Advisoryadvisory · crates.io

GHSA-3763-qp59-59vf nimiq-blockchain: Validity store off by one error

HIGH Published 2026-08-12 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-46369
Ecosystem
crates.io
Packages
nimiq-blockchain
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-193, CWE-294
Reviewed
2026-08-12

Affected packages

• crates.io nimiq-blockchain: < 1.5.1 → fixed in 1.5.1

Description

Impact The validity store treats a transaction with stored `block_number = X` as "in window" only when `X > last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol's `Transaction::is_valid_at` accepts a transaction for inclusion in any block in `[validity_start_height - blocks_per_batch, validity_start_height + window - 1]`. By choosing `validity_start_height = X + blocks_per_batch` (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that `X + window < B < validity_start_height + window`, i.e., a contiguous window of `blocks_per_batch - 1` blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice. Patches https://github.com/nimiq/core-rs-albatross/pull/3772 Workarounds No known workarounds

Related

Alias · CVE (1)

  • CVE-2026-46369 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. vulnerability

Weakness · CWE (2)

  • CWE-193 Off-by-one Error weakness
  • CWE-294 Authentication Bypass by Capture-replay weakness

References