Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nimiq-blockchain | rust | <= 1.5.0 | 1.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is an off-by-one error in the nimiq-blockchain's validity store, which is responsible for preventing transaction replay attacks. The analysis of the patch commit a530b2434ebca6e3716f07c73079786fcc6f2e41 reveals the root cause. The core of the vulnerability lies in the ValidityStore::has_transaction function in blockchain/src/history/validity_store.rs. Before the patch, this function calculated the lookback period for replay protection using only the transaction_validity_window_blocks. However, the actual transaction validity period allowed by the protocol is longer, specifically transaction_validity_window_blocks + blocks_per_batch. This mismatch created a window where a transaction was no longer checked for replays by the validity store but was still considered valid for inclusion in a block. An attacker could exploit this gap to replay a transaction, causing it to be executed twice. The patch corrects this by extending the lookback period in ValidityStore::has_transaction to match the full protocol validity window, thus closing the replay vulnerability.
ValidityStore::has_transactionblockchain/src/history/validity_store.rs