ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34064

nimiq-account contains account primitives to be used in Nimiq's Rust implementation.

Published Apr 22, 2026 · updated Jun 17, 2026 · nimiq nimiq proof-of-stake

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, returns when , but it constructs the error using . panics on underflow, so if an attacker can reach a state where , the node crashes while trying to return an error. The precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding without validating (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, returns when , but it constructs the error using . panics on underflow, so if an attacker can reach a state where , the node crashes while trying to return an error. The precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding without va

  2. Jun 17, 2026 · NIST NVD

    Updated

    nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, returns when , but it constructs the error using . panics on underflow, so if an attacker can reach a state where , the node crashes while trying to return an error. The precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding without va

Affected

  • cpe nimiq/nimiq proof-of-stakeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-34064

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-34064

    nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, returns when , but it constructs the error using `balance: self.balance - mi

    nvd.nist.gov

References