Timestamp Manipulation Vulnerability in Nimiq's Rust Blockchain Implementation

CVE-2026-40093

What is CVE-2026-40093?

In the Nimiq blockchain's Rust implementation, the block timestamp validation incorrectly enforces timestamp constraints, allowing malicious validators to produce blocks with arbitrary future timestamps. This flaw compromises the integrity of reward calculations, potentially inflating the monetary supply by bypassing intended emission schedules. Proper bounds checking against the system clock is nonexistent, enabling exploitation that can impact the blockchain's economic model.

References