Critical Nimiq Block Vulnerability: SkipBlockProof Bypass

The National Vulnerability Database (NVD) has detailed CVE-2026-33471, a critical vulnerability (CVSS 9.6) in nimiq-block, a component used in Nimiq’s Rust implementation. This flaw, present prior to version 1.3.0, allows a malicious validator to bypass SkipBlockProof::verify checks. The issue stems from how SkipBlockProof::verify computes its quorum using BitSet.len() and then casts usize indices to u16 for slot lookups.

An attacker can exploit this by crafting a SkipBlockProof where MultiSignature.signers contains out-of-range indices. These indices inflate the len() count but collide onto the same in-range u16 slot during aggregation due to the u16 cast. This effectively allows a malicious validator with significantly fewer than the required 2f+1 real signer slots to pass verification by multiplying a single BLS signature. The NVD notes that no workarounds are available, emphasizing the need for a direct patch.

For defenders, this is a severe integrity bypass. If you’re running Nimiq’s Rust implementation, particularly any system relying on nimiq-block for consensus or block validation, you are directly exposed. This isn’t just a theoretical bug; it represents a fundamental breakdown of trust in the validation process, potentially allowing unauthorized actors to manipulate block proofs. Patching to v1.3.0 or later is the only confirmed mitigation.