Nimiq Blockchain Transaction Replay Vulnerability

The Nimiq blockchain, specifically the nimiq-blockchain crate (version 1.5.0 and earlier), is susceptible to a transaction replay vulnerability (CVE-2026-46369) due to an off-by-one error in its validity store logic. The software incorrectly evaluates whether a transaction is within the validity window by using strict inequality, which contradicts the protocol's Transaction::is_valid_at definition. By crafting a specific validity_start_height, an attacker can bypass the intended replay protection mechanisms for a duration of approximately 10 minutes (59 blocks on MainNet). This mismatch allows an attacker to submit the same signed transaction multiple times, resulting in a double-spend where the sender is debited and the recipient is credited more than once. This issue represents a significant integrity risk to the ledger state and funds.

Impact

Successful exploitation leads to double-spending, where the attacker is able to execute a single transaction multiple times. This results in the erroneous debiting of sender accounts and unauthorized crediting of recipient accounts, undermining the integrity of the blockchain ledger and causing financial loss to users. The vulnerability affects all deployments running version 1.5.0 or older of the nimiq-blockchain Rust implementation.

Recommendation

Update the nimiq-blockchain crate to the version provided in the vendor patch (pull request 3772) immediately to remediate the validity check logic error. As no effective workarounds exist for this protocol-level flaw, nodes should prioritize upgrading to ensure compliance with the correct transaction validity window implementation.