An integer overflow in Signum Node's BlockServiceImpl.applyBlock() permitted a miner to inflate block rewards arbitrarily by crafting blocks with a negative totalFeeCashBackNqt value. The bug existed before the 3.9.9 release and is tied to the SMART_FEES fee cash-back and burn accounting logic that lacked overflow protection. This flaw is classified as CWE-190, an integer overflow weakness that enables uncontrolled numeric manipulation.

The vulnerability affects the Signum Network's Signum Node software, specifically any deployment running a version older than 3.9.9. Users running the PoC+ consensus algorithm and the SMART_FEES hardfork prior to block ~1,029,000 are at risk.

With a CVSS score of 7.5, the vulnerability poses a moderate-to-high risk. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog, suggesting that there are currently no known widespread exploits. The attack vector is likely a malicious miner who can submit a crafted block; the miner must be able to influence the node's block validation logic. The integer overflow allows the attacker to inflate the block reward as desired once the faulty value is processed.