Description
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
Published: 2026-04-09
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Monetary supply inflation via manipulated block timestamps
Action: Patch Immediately
AI Analysis

Impact

A missing upper bound on block timestamps allows a validator to set timestamps far into the future, which directly inflates the calculated monetary supply by skewing reward calculations. The flaw involves unchecked input handling and is identified as CWE‑1284.

Affected Systems

The vulnerability affects Nimiq’s Rust‑based blockchain implementation, specifically core‑rs‑albatross versions 1.3.0 and earlier. Newer releases that include a wall‑clock limit are not impacted.

Risk and Exploitability

With a CVSS score of 8.1 the severity is high; the Exploit Probability Score is not available. It is not listed in the CISA Known Exploited Vulnerabilities catalog. A validator that is permitted to produce blocks can create blocks with arbitrarily future timestamps, causing the network to mis‑calculate rewards and inflate supply. The attack path requires only the ability to craft blocks on the network and has no additional prerequisites.

Generated by OpenCVE AI on April 9, 2026 at 23:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Nimiq to a version that imposes an upper bound on block timestamps.
  • Verify that the updated version is running after the upgrade.
  • Initially monitor the blockchain for blocks with unusually distant future timestamps and flag or reject them until the upgrade is complete.

Generated by OpenCVE AI on April 9, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-49xc-52mp-cc9j nimiq-blockchain is missing a wall-clock upper bound on block timestamps
History

Fri, 24 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Nimiq nimiq Proof-of-stake
CPEs cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*
Vendors & Products Nimiq nimiq Proof-of-stake

Mon, 13 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Nimiq
Nimiq core-rs-albatross
Vendors & Products Nimiq
Nimiq core-rs-albatross

Thu, 09 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
Description nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
Title nimiq-blockchain is missing a wall-clock upper bound on block timestamps
Weaknesses CWE-1284
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Nimiq Core-rs-albatross Nimiq Proof-of-stake
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-13T15:38:14.634Z

Reserved: 2026-04-09T01:41:38.535Z

Link: CVE-2026-40093

cve-icon Vulnrichment

Updated: 2026-04-13T15:33:27.383Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T21:16:11.937

Modified: 2026-04-24T17:11:14.347

Link: CVE-2026-40093

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:29:19Z

Weaknesses