GitHub Advisoryadvisory · crates.io

GHSA-vc34-39q2-m6q3 nimiq-account: Vesting insufficient funds error can panic

MEDIUM Published 2026-04-22 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-34064
Ecosystem
crates.io
Packages
nimiq-account
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-191
Reviewed
2026-04-22

Affected packages

• crates.io nimiq-account: <= 0.2.0 (no fix yet)

Description

Impact `VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance balance`, the node crashes while trying to return an error. The `min_cap > balance` precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding `total_amount` without validating `total_amount <= transaction.value` (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing. Patches The patch for this vulnerability is included as part of v1.3.0. Workarounds No known workarounds.

Related

Alias · CVE (1)

  • CVE-2026-34064 nimiq-account contains account primitives to be used in Nimiq's Rust implementation. vulnerability

Weakness · CWE (1)

  • CWE-191 Integer Underflow (Wrap or Wraparound) weakness

References