Staking Contract Vulnerability in Nimiq's Rust Implementation

CVE-2026-34068

What is CVE-2026-34068?

The Nimiq staking contract prior to version 1.3.0 allows for a security gap where the UpdateValidator transactions can ignore the required new_proof_of_knowledge. This omission bypasses the necessary proof-of-knowledge check that is pivotal in preventing BLS rogue-key attacks during public key aggregation. The result enables an attacker potential manipulation of validator voting keys and the creation of a misleading quorum-looking justification with a single signature. The vulnerability can be addressed by upgrading to version 1.3.0 or later, as this version includes a necessary patch.

References