Executive brief
Nimiq Blockchain is a Rust-based implementation of the Nimiq cryptocurrency protocol. A vulnerability in how the system validates block times allows malicious participants to submit blocks with timestamps set far into the future. This can be exploited to manipulate the network's reward system, leading to the unauthorized creation of new currency and undermining the integrity of the blockchain's economic model.
Technical details
The nimiq-blockchain library lacks a wall-clock upper bound check during block timestamp validation. While it ensures timestamps are greater than or equal to the parent block, it does not verify them against the current real-world time. A malicious validator can produce blocks with arbitrary future timestamps, which directly impacts reward calculations in 'blockchain/src/reward.rs' via 'Policy::supply_at()' and 'batch_delay()'. This allows for the inflation of the monetary supply beyond the protocol's defined emission schedule. The vulnerability is present in versions up to and including 1.3.0.
Affected products
- Nimiq nimiq-blockchain <= 1.3.0
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory