Executive brief
A flaw was discovered in the Nimiq blockchain software that allows an attacker to replay a previously processed transaction. This could result in a user being charged twice for the same payment while the recipient receives double the intended funds. The issue stems from a timing window where the system's built-in protection against duplicate transactions fails to recognize a repeat request.
Technical details
An off-by-one error exists in the Nimiq blockchain's validity store logic. The store treats a transaction as 'in window' using a strict inequality check against the block number, which conflicts with the protocol's Transaction::is_valid_at logic. By carefully selecting the validity_start_height, an attacker can exploit a contiguous window of blocks (approximately 10 minutes on MainNet) where the replay-protection check fails. This allows a single signed transaction to be included in two different blocks, resulting in the sender being debited twice and the recipient credited twice. The issue is fixed in version 1.5.1.
Affected products
- Nimiq nimiq-blockchain <= 1.5.0
Timeline
- 2026-08-11: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched