GitHub Advisoryadvisory · crates.io

GHSA-49xc-52mp-cc9j nimiq-blockchain is missing a wall-clock upper bound on block timestamps

CRITICAL Published 2026-04-10 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-40093
Ecosystem
crates.io
Packages
nimiq-blockchain
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-1284, CWE-20
Reviewed
2026-04-10

Affected packages

• crates.io nimiq-blockchain: <= 1.3.0 (no fix yet)

Description

Impact Block timestamp validation enforces that `timestamp >= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule. Patches TBD Workarounds No know workarounds.

Related

Alias · CVE (1)

  • CVE-2026-40093 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. vulnerability

Weakness · CWE (2)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-20 Improper Input Validation weakness

References