GHSA-vc34-39q2-m6q3

Suggest an improvement
Source
https://github.com/advisories/GHSA-vc34-39q2-m6q3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vc34-39q2-m6q3/GHSA-vc34-39q2-m6q3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vc34-39q2-m6q3
Aliases
Published
2026-04-22T19:18:55Z
Modified
2026-05-05T16:11:14Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
nimiq-account: Vesting insufficient funds error can panic
Details

Impact

VestingContract::can_change_balance returns AccountError::InsufficientFunds when new_balance < min_cap, but it constructs the error using balance: self.balance - min_cap. Coin::sub panics on underflow, so if an attacker can reach a state where min_cap > balance, the node crashes while trying to return an error.

The min_cap > balance precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding total_amount without validating total_amount <= transaction.value (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing.

Patches

The patch for this vulnerability is included as part of v1.3.0.

Workarounds

No known workarounds.

Database specific 
{
    "cwe_ids":  [
        "CWE-191"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-22T19:18:55Z",
    "nvd_published_at":  "2026-04-22T20:16:40Z",
    "severity":  "MODERATE"
}
References

Affected packages

crates.io / nimiq-account

Package

Name
nimiq-account
View open source insights on deps.dev
Purl
pkg:cargo/nimiq-account

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vc34-39q2-m6q3/GHSA-vc34-39q2-m6q3.json"