Executive brief
Nimiq is a blockchain protocol implemented in Rust. A logic error in how the system verifies block inclusion proofs allows an attacker to bypass security checks for specific types of blocks. This could allow a malicious actor to forge block headers and have them accepted as valid without the required cryptographic signatures, potentially compromising the integrity of transaction data.
Technical details
A logic flaw exists in the `BlockInclusionProof::is_block_proven` function within the `nimiq-primitives` crate. When the `get_interlink_hops` function returns an empty list—which occurs when a target block is at the election block position immediately preceding the election head's epoch—the verification function returns `true` without performing any cryptographic hash or signature checks. An attacker can exploit this by providing forged transaction inclusion proofs containing a fabricated MacroBlock header for that specific epoch position. The vulnerability is reachable over the network but requires high attack complexity to align the forged data with the specific epoch state. The issue is fixed in version 1.4.0.
Affected products
- Nimiq nimiq-primitives <= 1.3.0
Timeline
- 2026-04-22: patched: Fix merged in pull request 3705 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-799f-29jm-gr6c published
- 2026-06-10: disclosed: CVE-2026-46539 published to NVD