{"id":"GHSA-vc34-39q2-m6q3","summary":"nimiq-account: Vesting insufficient funds error can panic","details":"### Impact\n`VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance \u003c min_cap`, but it constructs the error using `balance: self.balance - min_cap`. `Coin::sub` panics on underflow, so if an attacker can reach a state where `min_cap \u003e balance`, the node crashes while trying to return an error.\n\nThe `min_cap \u003e balance` precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding `total_amount` without validating `total_amount \u003c= transaction.value` (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing.\n\n### Patches\n[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/commit/4d01946f0b3d6c6e31786f91cdfb3eb902908da0) is included as part of [v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0).\n\n### Workarounds\nNo known workarounds.","aliases":["CVE-2026-34064"],"modified":"2026-05-05T16:11:14.359484Z","published":"2026-04-22T19:18:55Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-22T19:18:55Z","nvd_published_at":"2026-04-22T20:16:40Z","cwe_ids":["CWE-191"]},"references":[{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vc34-39q2-m6q3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34064"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/pull/3658"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/commit/4d01946f0b3d6c6e31786f91cdfb3eb902908da0"},{"type":"PACKAGE","url":"https://github.com/nimiq/core-rs-albatross"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0"}],"affected":[{"package":{"name":"nimiq-account","ecosystem":"crates.io","purl":"pkg:cargo/nimiq-account"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-vc34-39q2-m6q3/GHSA-vc34-39q2-m6q3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}