CVE-2026-40093: nimiq-blockchain is missing a wall-clock upper bound on block timestamps
Impact Block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future.
Published Apr 10, 2026 · Updated Apr 14, 2026
Affected packages
nimiq-blockchain
- Ecosystem
- Rust (crates.io)
- Affected
- <= 1.3.0
- Fixed in
- No patched version yet
- Check
cargo tree -i nimiq-blockchain
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
Patches
TBD
Workarounds
No know workarounds.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology