Logic Flaw in Nimiq Rust Implementation Affects Proof-of-Stake Protocol

CVE-2026-46539

What is CVE-2026-46539?

The Nimiq Proof-of-Stake protocol implemented in Rust contains a logic flaw that affects the BlockInclusionProof::is_block_proven function. This flaw allows an attacker to submit transaction inclusion proofs without proper cryptographic validation when the hop list returned by get_interlink_hops is empty. Specifically, this vulnerability occurs when the target block is situated at the election block immediately prior to the election head's epoch. Consequently, a malicious actor can successfully forge a MacroBlock header for this epoch position, leading it to be erroneously accepted as ‘proven’ in the system despite lacking any hash or signature verification. This critical issue has been addressed in version 1.4.0.

References