nimiq-blockchain Package Vulnerability: Validity Store Off-by-One Error
- Severity
- HIGH
- Affected component
- nimiq-blockchain (cargo)
- Affected versions
- < 1.5.1 or <= 1.3.0 or <= 0.2.0 or < 1.5.0
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the nimiq-blockchain package. The issue is an off-by-one error in the validity store that could allow replay of signed transactions.
What happened
An off-by-one error has been identified in the nimiq-blockchain package's validity store. This error could potentially allow an attacker to replay the same signed transaction within a contiguous window of blocks. This could result in double debits and credits. The vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions of nimiq-blockchain are those less than 1.5.1, or less than or equal to 1.3.0, or less than or equal to 0.2.0, or less than 1.5.0. Users of these versions are advised to assess their exposure and prepare for an upgrade once a patched version is released.
What to do about it
- Review your project dependencies to identify if you are using an affected version of nimiq-blockchain.
- If you are using an affected version, prepare to upgrade to the patched version as soon as it is released.
- No official fix has been published yet. Monitor the provided sources for updates on the patched version.
- Consider implementing additional checks for transaction replays as a temporary measure until the patch is available.
- Communicate with your team and stakeholders about the potential risk and the planned mitigation steps.
How 0Day would have caught this
nimiq-blockchain is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using nimiq-blockchain version less than 1.5.1, or less than or equal to 1.3.0, or less than or equal to 0.2.0, or less than 1.5.0.
What should I do right now?
Review your dependencies and prepare to upgrade to the patched version once it is released. Monitor the sources for updates.
When will the patched version be available?
The release date for the patched version is not yet known. Continue to monitor the sources for updates.