VestingContract::can_change_balance incorrectly builds an InsufficientFunds error by subtracting min_cap from balance, which can underflow when the vesting contract’s minimum cap exceeds the current account balance. This causes the underlying Coin::sub operation to panic, aborting the node during mempool admission or block validation. The failure manifests as a denial‑of‑service: fully functional Nimiq nodes crash, taking them offline until restarted.

Affects Nimiq’s Rust‑based core, specifically the nimiq‑account module. All releases before v1.3.0 are susceptible. Version 1.3.0 and later contain the fix.

CVSS score 5.3 indicates moderate severity, and the EPSS is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the panic by creating a vesting contract with total amount greater than the transaction value, and then broadcasting a transaction that invokes can_change_balance, which is reachable remotely through normal network operations. While no exploit code is publicly known, the conditions are straightforward enough that an attacker could craft a custom transaction, making the risk moderate but significant for nodes that accept unfiltered contracts.