Nimiq — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/nimiq/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 24 Jan 2024 12:00:00 +0000Nimiq Node Panic due to Invalid BLS Keyhttps://feed.craftedsignal.io/briefs/2024-01-nimiq-panic/Wed, 24 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-nimiq-panic/An unauthenticated peer can crash a Nimiq node by sending a malformed election macro block containing an invalid BLS voting key, leading to a denial of service.A critical vulnerability exists in Nimiq’s core-rs-albatross library, specifically within the nimiq-primitives crate, affecting versions 0.2.0 and earlier. An attacker can exploit this vulnerability by sending a malicious election macro block to a Nimiq node. This block contains an invalid compressed BLS voting key. When the node attempts to process this block, specifically during the hashing of the election macro header and the validation of the validators set via Validators::voting_keys(), the validator.voting_key.uncompress().unwrap() function is triggered. Due to the invalid BLS key, this operation results in a panic, effectively crashing the Nimiq node and causing a denial-of-service condition. The vulnerability was patched in version 1.3.0 of the core-rs-albatross library.

Attack Chain

  1. Attacker identifies a vulnerable Nimiq node running a version of nimiq-primitives less than or equal to 0.2.0.
  2. Attacker crafts a malicious election macro block.
  3. The malicious block contains an invalid compressed BLS voting key within the validators set.
  4. The attacker sends the crafted block to the target Nimiq node via the peer-to-peer network.
  5. The Nimiq node receives the block and begins processing it.
  6. During the hashing of the election macro header, the validators set is processed.
  7. The Validators::voting_keys() function is called, which attempts to uncompress the BLS voting key.
  8. Due to the invalid compressed BLS key, the validator.voting_key.uncompress().unwrap() function panics, causing the node to crash and leading to a denial of service.

Impact

Successful exploitation of this vulnerability leads to a denial-of-service condition for the targeted Nimiq node. This can disrupt network operations, prevent legitimate transactions from being processed, and potentially impact the overall stability of the Nimiq network. The vulnerability allows any untrusted peer to trigger the crash.

Recommendation

  • Upgrade to version 1.3.0 or later of the core-rs-albatross library to patch CVE-2026-34065.
  • Implement rate limiting on incoming peer connections to mitigate the impact of malicious blocks being sent to the node.
]]>mediumadvisorydenial-of-servicenimiqblsNimiq Block Skip Block Quorum Bypass Vulnerabilityhttps://feed.craftedsignal.io/briefs/2024-01-nimiq-block-quorum-bypass/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-nimiq-block-quorum-bypass/A vulnerability exists in Nimiq Block's SkipBlockProof verification process, allowing attackers to bypass quorum checks by manipulating MultiSignature signers with out-of-range indices, potentially compromising blockchain integrity, and affecting rust/nimiq-block versions 0.2.0 and earlier.A critical vulnerability has been identified in the Nimiq Block’s SkipBlockProof::verify function within the rust-albatross core. This vulnerability stems from the way the quorum check is performed. The vulnerability lies in the ability to craft MultiSignature.signers that contain out-of-range indices spaced by 65536, inflating the len() calculation but colliding onto the same in-range u16 slot during aggregation due to truncation. The vulnerability affects rust/nimiq-block versions <= 0.2.0. Successful exploitation allows a malicious validator with significantly fewer than the required 2f+1 signer slots to pass skip block proof verification. This bypasses the intended security mechanisms, potentially undermining the blockchain’s consensus and integrity.

Attack Chain

  1. Attacker identifies a Nimiq Block instance running a vulnerable version (<= 0.2.0) of the rust/nimiq-block package.
  2. The attacker crafts a malicious MultiSignature.signers payload.
  3. The malicious payload contains out-of-range indices spaced by 65536. These indices are specifically designed to inflate the BitSet.len() calculation used in the quorum check.
  4. During verification within SkipBlockProof::verify, the usize indices are cast to u16 (slot as u16) for slot lookup.
  5. Due to the u16 truncation, the out-of-range indices collide onto the same in-range slot. This creates an artificial aggregation of signatures.
  6. The attacker multiplies a single BLS signature by a factor to match the inflated len() value.
  7. The manipulated SkipBlockProof passes the quorum check due to the inflated len() and signature aggregation.
  8. The malicious skip block is accepted, potentially leading to consensus manipulation or other attacks on the blockchain.

Impact

Successful exploitation of this vulnerability allows a malicious validator to bypass the standard quorum requirements for skip block proof verification. This means that a single compromised validator or a small group of colluding validators can inject fraudulent blocks into the blockchain, potentially leading to double-spending, denial-of-service, or other attacks that compromise the integrity and availability of the Nimiq blockchain. Given the severity of these potential outcomes, this vulnerability poses a critical risk to any system relying on affected versions of Nimiq Block.

Recommendation

  • Upgrade to rust/nimiq-block version 1.3.0 or later, which includes the fix for CVE-2026-33471.
  • Monitor network traffic for anomalies related to skip block submissions, focusing on unusually large MultiSignature.signers payloads with indices spaced by multiples of 65536. Create a network monitoring rule.
]]>mediumadvisoryblockchainquorum bypassnimiqrust