Most recent entries from all

EUVD-2026-290885

2026-10-10T19:33:11.500838+00:00

EUVD-2026-290885

fkie_cve-2026-40093

2026-10-10T19:33:11.500876+00:00

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.

GHSA-49xc-52mp-cc9j — nimiq-blockchain is missing a wall-clock upper bound on block timestamps

2026-10-10T19:33:11.500914+00:00

Affected: crates.io: nimiq-blockchain

### Impact

Block timestamp validation enforces that `timestamp >= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule.

### Patches TBD

### Workarounds No know workarounds.